A sequence of autonomous software entities handing work, context, or requests from one agent to another. Each hop can widen the trust boundary, weaken identity context, and create unreviewed access to systems or data if one link is unregistered or misconfigured.
Expanded Definition
An agent-to-agent chain is a handoff path where one autonomous software entity passes context, tasks, or execution authority to another. In NHI security, the risk is not the handoff itself but the accumulation of trust across each hop, especially when identity, purpose, or authorization is not revalidated.
Definitions vary across vendors, but the operational meaning is consistent: every agent in the sequence should be treated as a distinct NHI with its own identity, policy boundary, and secret exposure profile. That aligns with the governance direction in the NIST AI Risk Management Framework and the control thinking reflected in the OWASP Agentic AI Top 10.
An experienced operator recognises that the chain can be valid and still unsafe if one agent inherits too much context, too many secrets, or too broad a tool grant. The most common misapplication is assuming the upstream agent’s approval automatically legitimises every downstream action, which occurs when handoff tokens, RBAC, or JIT controls are reused without fresh verification.
Examples and Use Cases
Implementing agent-to-agent chaining rigorously often introduces latency and policy overhead, requiring organisations to weigh orchestration speed against stronger verification at every transfer point.
- A support agent escalates a billing dispute to a refund agent, but only after reissuing a scoped token and stripping customer secrets from the shared context.
- An engineering agent delegates test execution to a deployment agent while preserving only the minimum task metadata, not the full repository access chain.
- A security triage agent forwards a suspicious prompt to a containment agent, referencing the patterns discussed in the OWASP NHI Top 10 and the MITRE ATLAS adversarial AI threat matrix.
- An AI coding assistant hands a change request to a review agent, but the review agent must authenticate independently rather than trust inherited session state.
- A procurement workflow routes an approval task through multiple agents, similar to the failure patterns described in the AI LLM hijack breach, where chained trust can be abused.
In well-designed systems, each transfer is logged, policy checked, and identity rebound before the next agent can act.
Why It Matters in NHI Security
Agent-to-agent chains matter because they create hidden privilege expansion. If one agent is compromised, misconfigured, or over-permissioned, every downstream hop can inherit that weakness and turn a small trust error into broad exposure across systems, data, and tool access. That is why chain governance belongs alongside secrets management, PAM, RBAC, and Zero Trust Architecture, not after incident response.
NHIMG research shows why this matters operationally: the average estimated time to remediate a leaked secret is 27 days, even though 75% of organisations report strong confidence in their secrets management. That gap becomes more dangerous when secrets or context are passed from one agent to another without strict scoping, especially under the conditions highlighted in the OWASP NHI Top 10 and the NIST AI Risk Management Framework.
Chains also amplify the impact of compromised agent keys, echoed in NHIMG reporting such as the Moltbook AI agent keys breach. Organisations typically encounter the consequence only after an unexpected action, unauthorized data access, or a cross-agent abuse path is discovered, at which point agent-to-agent chain control becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Agent handoffs expand secret and identity exposure across NHI boundaries. |
| OWASP Agentic AI Top 10 | A1 | Agent chaining can amplify prompt and tool abuse across orchestrated workflows. |
| NIST AI RMF | AI risk management requires mapping and monitoring risks across agent interactions. |
Document chain risks, monitor transfers, and maintain human oversight for high-impact actions.
