S-13Agent-to-Agent Trust

One agent’s output is another agent’s untrusted input — and internal provenance is not trust.

Key insight

Multi-agent systems quietly launder taint. Text an attacker wrote arrives at the privileged agent in a teammate’s voice, and “it came from our own agent” is exactly the reasoning that makes it dangerous.

Failure mode

Drawing the trust boundary only at the system’s edge. Inside a four-agent pipeline every handoff is an injection point, and the agent holding the write scope is usually the last one.

S-13Agent-to-Agent Trust

Elsewhere in the atlas