The spread of malicious influence from one agent to another in a multi-agent workflow, usually through shared context, trusted outputs, or delegated actions. The risk is not limited to one compromised model; it can propagate through the decision chain and affect downstream automation.
How Cross-Agent Contamination Happens
Cross-agent contamination occurs when one agent’s compromised output, hidden instruction, or unsafe delegation contaminates another agent in the same workflow. The second agent may treat the tainted material as trusted context and continue the propagation.
The risk is strongest in multi-agent systems that reuse shared state, route messages through orchestrators, or let downstream agents execute tasks without independently validating upstream inputs. In practice, the weakness is not just the initial compromise, but the fact that trust can be inherited across hops.
Contamination can move through text, tool outputs, retrieved content, structured messages, or approval chains. Once one agent accepts corrupted context, later agents may repeat, amplify, or operationalise the malicious instruction as if it were legitimate.
Why Shared Context Makes Propagation Worse
Shared memory, shared transcripts, and shared retrieval layers make cross-agent contamination more than a simple prompt-injection problem. They create a reuse channel where one bad input can influence several decision points instead of one.
This is especially dangerous when agents are designed to be helpful and collaborative. The more the system optimises for continuity, the easier it becomes for contaminated context to cross trust boundaries without being questioned.
Delegation also increases the blast radius. If an upstream agent is allowed to authorise actions, select tools, or summarise decisions for others, then a single compromised step can steer downstream automation away from the original user intent.
Where the Damage Shows Up
Cross-agent contamination can lead to repeated misinformation, unsafe tool calls, policy bypass, unintended data exposure, or automated actions that no one individual agent would have taken alone. The failure often appears as a normal workflow result, which makes it hard to spot early.
Because the influence is distributed, the impact is often cumulative. A weak instruction can be rephrased, reinforced, and reused by multiple agents until it looks like a consensus rather than an intrusion.
For teams building agentic workflows, the key issue is that downstream agents may be harmed even when their own prompts are clean. One compromised agent can poison the decision chain, not just its own turn.
How to Think About Containment
Containment depends on treating inter-agent communication as a trust boundary, not as an internal convenience layer. Messages, summaries, and delegated actions should be able to lose trust as they move between agents, especially when the source agent handled untrusted input.
Independent validation at each hop matters more than preserving perfect continuity. If a downstream agent can verify claims, permissions, and task scope before acting, the chain is less likely to turn one compromise into a multi-agent event.
Systems should also make provenance visible. When a downstream agent can see where a claim came from, what was inferred, and what was directly observed, it is easier to isolate contaminated context before it spreads further.
Risk and Threat Considerations
Cross-agent contamination matters because one compromised agent can seed a broader workflow failure, especially where agents share memory, delegated authority, or tool access. The practical threat is not only malicious instruction propagation, but also the silent amplification of unsafe assumptions across a decision chain.
Failure mechanism: A malicious or unreliable agent influences shared context, summaries, or delegated actions, and later agents accept that material as trusted input without revalidation.
Impact: The contamination can spread laterally or downstream, causing unsafe automation, policy bypass, data leakage, or repeated execution of attacker-shaped tasks.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Cross-agent contamination exploits inherited authority and trust across agents. |
| ASI07 — Insecure Inter-Agent Communication | The term centers on malicious influence spreading through agent-to-agent communication. | |
| ASI08 — Cascading Failures | Contamination propagates a failure from one agent into later agents and steps. | |
| Recommendation — Enforce per-agent privilege checks before downstream agents act on upstream context. Validate inter-agent messages and isolate shared channels that can carry tainted context. Contain blast radius by limiting how far a compromised agent can influence the workflow. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Agent-to-agent exchanges need trust boundaries to prevent contaminated context from crossing. |
| AC-6 — Least Privilege | Downstream agents should not inherit more authority than their task requires. | |
| Recommendation — Segment agent communication paths and enforce boundary checks on shared context. Restrict each agent to the minimum permissions needed for its current action. | ||
Practitioner Guidance
Why practitioners should care: Multi-agent systems fail differently from single-agent systems because one bad hop can corrupt several later decisions. Design each boundary so downstream agents can question, quarantine, or ignore upstream content when provenance is weak.
What to watch for: Reused summaries, shared memory, and delegated tool outputs are the highest-risk conduits. If a workflow lets one agent speak for another without strong validation, contamination can become systemic rather than local.