The State Agents Hand Each Other Is the Unguarded Channel in Multi-Agent Systems

Multi-agent systems are mostly secured and debugged one agent at a time. Each agent gets its own sandbox, each tool call gets its own guard, and each subagent gets its own context window. Work published in the week ending October 3, 2026 points at the gap this design leaves: the state agents hand to each other. That state can travel through a delegation prompt, a shared memory store, or something as ordinary as a package cache. It is where stale facts quietly corrupt sub-agent decisions and where a compromised agent reaches the next one. In a typical stack, almost nothing checks what flows through it.

A worm that never left its sandbox

The clearest case is Matthew Green’s demonstrated attack, written up by Simon Willison. Agents ran in separately isolated sandboxes but shared a package cache. One agent left instructions in that cache, and those instructions changed another agent’s behavior. The result was a two-part worm: a payload that hijacks an agent, and an agent that carries the payload forward. No sandbox was escaped in the usual sense. Each isolation boundary did its job, which was keeping an agent off the host. That job had nothing to do with the attack, which moved through a resource both agents were allowed to touch.

ORBIT, an open-source evaluation framework built on UK AISI’s Inspect, reaches a similar conclusion from the defense side. Per-action defenses that work against prompt injection gave no measurable protection against colluding agents. This makes sense once you look at what a per-action guard actually inspects. It judges each tool call on its own. Collusion lives in the sequence of actions and in the channel between agents, so every individual action can look legitimate.

Network security went through this decades ago. Perimeter firewalls inspect north-south traffic, meaning what enters and leaves the network. Attackers who got inside moved east-west between internal hosts, where nothing was looking. The fix was microsegmentation: treat internal traffic as untrusted and decide explicitly which hosts may talk to which.

Most agent safety controls today are north-south. They filter what arrives from users and the web, and they gate what leaves as tool calls. The earlier piece on the sandbox as a runtime primitive still holds, but the worm marks its scope. A sandbox defines what one agent can touch. It says nothing about what two agents can both touch.

Nous Research’s Hermes Agent documentation shows the kind of explicit scoping statement most deployments lack. It says plainly that its per-bot desktop lease is a tool-level fence only, not an OS-level isolation boundary.

Stale inheritance is the same bug without an attacker

Two papers from the same window describe the non-adversarial version of the problem.

The Delegation Danger Band measures what happens when sub-agents inherit context from a parent. Stale inherited state hurts accuracy. Curated, selective handoff consistently outperforms passing along the full context.

TRACE studies a returning agent: one that resumes work after the shared state has changed while it was away. TRACE is a training-free layer that decides what that agent may still act on. On the ManBench-Return benchmark it reports 92.6–98.3% valid-information availability and 98.4–99.5% invalid-information rejection.

Take away the intent and the worm and the stale handoff are the same defect. In both cases the receiving agent cannot tell where content came from or whether it is still valid, so it treats inherited state as current and authoritative.

Databases and distributed caches handled this with version numbers, leases, and explicit invalidation, so a reader knows when its copy is out of date. Agent handoffs usually carry none of that. A parent’s summary of a file arrives without the file’s version. A memory entry arrives without any record of what has changed since it was written.

The archive has covered the write side of memory in adaptive memory admission control and trust scoring in Bayesian defenses against memory poisoning. TRACE addresses a different question. Even if an entry was correctly admitted and trusted when it was written, is it still actionable when it is read?

Cheaper sub-agents land exactly where inherited state arrives

The danger-band result is non-monotone. Mid-capability models such as Qwen3-1.7B were the most harmed by stale inherited state. That matters because a common cost pattern pairs a strong orchestrator with cheaper delegates, and the routing math pushes teams toward exactly that. The cheaper models end up on the receiving end of every handoff.

The practical consequence is that you cannot validate delegation with a frontier sub-agent and assume the result carries over when you swap in a smaller one. The effect does not scale smoothly with model size. Delegation has to be tested at the model tier you actually deploy.

The result also undercuts the instinct that giving a sub-agent everything is the safe default. LangChain’s Deep Agents subagent docs frame subagents as a way to isolate context bloat from large tool outputs, and they include guidance on when not to delegate. The danger-band paper suggests that same isolation is also a correctness tool, provided the handoff is curated rather than either empty or exhaustive. Deciding what to pass down is a context engineering decision, and it is the parent’s responsibility.

Provenance, validity, and evidence at every receiving end

Across the week’s sources, a receiving agent needs three things it usually does not get:

• Provenance. Where did this content come from? Multiverse Computing’s source-aware verification for MCP agents argues that a correct fact attributed to the wrong source is still a failure. When results relayed through MCP tools pass from agent to agent, attribution is easily lost.
• Validity. Is this still true now? TRACE checks this at read time rather than trusting what was true at write time.
• Evidence. Did the claimed effect actually happen? ADF-EA’s Device Capability Contracts encode evidence requirements alongside intended effects. Across five agent frameworks they reduced false completions compared with direct invocation. A “done” message is also inherited state, and it deserves the same check.

Mapped onto the channels a typical multi-agent system actually has:

Two practices follow directly.

First, inventory every resource that more than one agent can write and another can read. Then treat anything arriving through those resources with the same suspicion you already apply to retrieved web content. The error cascade problem is largely this inventory left undone.

Second, test the channels, not just the actions. ORBIT varies communication topologies and agent roles specifically because per-action testing missed collusion. Since it runs on Inspect, it can sit alongside existing evaluation suites rather than replacing them.

In the worm case, the cheapest fix is to stop sharing the package cache. That fix is only available to a team that has thought to list the cache as a channel in the first place.