Can agents be tricked into delegating work in circles?

Much of the study, as the introduction frames it, applies known attack patterns such as prompt injection to web-based multi-agent systems and compares the result with the single-agent case. The Telephone Loop is different in kind. The abstract calls it "a novel MAS-specific Telephone Loop attack that exploits cross-agent delegation to create cyclical task loops." The reason it is MAS-specific is in the mechanism it names. Delegation is how a multi-agent system hands work from one agent to another, and a single-agent system has no such edge to bend into a circle. The other scenarios ask whether an old attack lands harder on a team. This one asks what a team makes possible that a lone agent never could.

That framing is the paper's, as far as the excerpt shows. What follows is the vault's reading, and it is limited. The excerpt does not say what harm the loop causes (wasted work, cost, denial of service, something else), what the adversary places on the page to start it, how many hops it takes, or how often it succeeds. It reports no result for this scenario. So the note holds a class, not an effect size, and any post using it should say the attack is named and described in one clause.

Two neighbors are worth holding. Why do autonomous LLM agents fail in predictable ways? records infinite loops that arise on their own from politeness patterns with no adversary; the Telephone Loop is the adversarial counterpart, a loop that is induced from outside. And Do internal agent hops in pipelines need security monitoring? counts the handoffs as an attack surface; the Telephone Loop uses the delegation handoff as the surface. Both links are the vault's, not the paper's.

Three later notes from other papers place it, again as the vault's reading. How do failures cross boundaries between multiple agents? defines the delegation mechanism by what it transfers, authority, and the excerpt does not say whether the loop involves any transfer, so whether it fits that verb is open. Under the four-way test in Does a multi-agent setting automatically signal a security effect?, a cycle of delegations exists only across agents, which makes it a candidate for the roles with no single-agent counterpart (composition, or a property that exists only between principals); nothing in the excerpt sorts it. And Can one compromised agent corrupt an entire multi-agent network? is the vault's other attack that needs the multi-agent structure to exist: a compromised peer's ordinary messages carry a bias downstream, on the message edge where this one uses the delegation edge.

The open design question is detection. A loop is a property of the sequence of delegations, not of any single message, which puts it in the family of Can individual components pass safety checks if the system still fails?: each individual handoff can look ordinary. Whether the paper's setup detects or bounds loops is not in the excerpt.