Cross-Agent Coordination

Cross-agent coordination is the exchange of instructions, context, or work between multiple AI agents through an orchestrator or shared state. It becomes a security concern when a malicious instruction moves from one agent to another through a path that appears legitimate on both sides.

Expanded Definition

Cross-agent coordination describes how multiple AI agents exchange tasks, context, and outputs through an orchestrator, a message bus, or shared state. In NHI security, the key issue is not simply collaboration, but whether one agent can inherit trust from another and pass along instructions that should have been constrained. That makes the coordination path part of the attack surface, especially when agents can call tools, retrieve secrets, or act on behalf of a human or workload identity.

Definitions vary across vendors because some platforms treat coordination as a workflow feature, while others treat it as a governance boundary. NIST’s NIST AI Risk Management Framework is useful here because it emphasises controllable, traceable AI behaviour rather than assuming agent outputs are inherently trustworthy. In practice, coordination is safest when every transfer is explicit, validated, and logged, and when agents do not inherit broader privileges simply because they belong to the same system. The most common misapplication is assuming the orchestrator automatically sanitises inter-agent messages, which occurs when teams trust the routing layer but do not inspect payloads, context windows, or tool permissions.

Examples and Use Cases

Implementing cross-agent coordination rigorously often introduces latency and governance overhead, requiring organisations to weigh agent autonomy against the cost of tighter validation and logging.

• An intake agent summarises a support ticket, but a downstream remediation agent only receives the minimum context needed to open a change request, not the original user instructions.
• A coding agent hands off build results to a security review agent, with each message signed and checked so that unsafe instructions do not travel with the code artifacts.
• A procurement assistant agent forwards vendor details to a finance agent, while the orchestrator blocks any request to retrieve tokens or secrets that were embedded in the upstream conversation.
• An incident-response workflow uses shared state to coordinate evidence collection, but access to that state is partitioned so one compromised agent cannot rewrite another agent’s findings.
• Researchers studying agentic abuse cases such as the Gemini AI Breach – Google Calendar Prompt Injection and the OWASP Agentic AI Top 10 use cross-agent trust boundaries to show how one compromised step can influence later actions.

Coordination patterns also appear in tool-using ecosystems, including cases highlighted in OWASP NHI Top 10, where agent handoffs create opportunities for instruction smuggling across otherwise legitimate workflows.

Why It Matters in NHI Security

Cross-agent coordination becomes an NHI problem the moment agents begin relaying privileged context, because the weakness is often not the agent itself but the identity and authority attached to its handoff. NHIs outnumber human identities by 25x to 50x in modern enterprises, and NHIMG reports that 97% of NHIs carry excessive privileges, which means a compromised agent path can magnify impact quickly. This is especially relevant when agents share service accounts, API keys, or workflow tokens across boundaries that were never designed for adversarial input.

The security failure mode is usually lateral movement disguised as normal collaboration. If one agent accepts an injected instruction and forwards it, the next agent may execute it because the message appears to come from an approved system peer. That is why CSA MAESTRO agentic AI threat modeling framework and the MITRE ATLAS adversarial AI threat matrix are valuable complements to NHI governance: both encourage modelling trust transitions, not just standalone components. Organisations typically encounter the full operational cost only after an agent-to-agent handoff triggers data exposure, unauthorised tool use, or destructive actions, at which point cross-agent coordination becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• AI Agent Authentication
• Where does cross-environment agent discovery fit in an IAM programme?
• Who is accountable when a cross-door agent attack slips through separate controls?
• Cross-Agent Lineage