Inter-Agent Trust Boundaries in Multi-Agent Pipeline Architectures

Multi-agent pipeline security depends on both how each agent behaves and what crosses the boundaries between agents. Inter-agent trust boundaries leave content, identity, intent, and state unverified unless the architecture explicitly checks them. Closing those gaps requires structural enforcement outside the LLM reasoning layer, because locally acceptable actions can combine into an unauthorized operation.

Why multi-agent pipelines create a security problem that single-agent thinking cannot solve

A planner, researcher, analyst, coder, and validator exchange intermediate outputs that become inputs to later decisions. Each exchange is an implicit trust decision. Frameworks such as LangGraph, CrewAI, and AutoGen make that coordination practical, but also make implicit trust the default. Single-agent guardrails assume one trust boundary, while a pipeline multiplies boundaries and treats internal handoffs as lower risk. The mismatch is architectural.

One agent requires one authorization decision, while two coordinating agents require three, and the number grows rapidly beyond that. Agents also have read-write API and database access and persistent storage, so they can change systems as well as produce misleading text. Crew Scaler’s NIST RFI response identifies nine multi-agent system risk categories, including Agent-Tool Coupling, Memory Poisoning, Trust Exploitation, and Identity and Provenance, that frameworks for stateless, single-model systems do not address. A detector that works reliably at one hop can therefore degrade sharply across a five-agent chain.

The four things that go unverified at every inter-agent handoff

IEEE GLOBECOM 2026 research, “Adversarial Attacks in Multi-Agent LLM Pipelines,” identifies boundary verification as the missing security primitive. Its analytical frame has four dimensions, namely content, identity, intent, and state. Content verification asks whether a payload is data or an executable instruction, and whether the context window keeps those roles separate. Identity verification checks whether the sender has credentials that can be verified or just holds the expected routing position. These are separate tests of trust.

Intent verification checks whether the claimed execution intent fits the authorized plan and the current state. State verification asks whether shared or persistent memory has changed in ways that invalidate downstream assumptions. The pipeline study found these gaps in ordinary, non-adversarial production-style traces from GAIA and SWE-Bench. In a live LangChain integration using one model, attack success tracked pipeline topology more than model capability.

SentinelAgent examines who is accountable in a delegation chain in which Agent A delegates to Agent B, which invokes Tool C for User X. Its paper argues that existing frameworks cannot show whose authorization chain led to the action or where that chain broke policy. Knowing which tool ran is not enough. How the authority to run it passed between agents remains unresolved.

How content injection exploits the data-instruction boundary

Retrieved content becomes dangerous when it shares a context window with executable instructions without enforced separation. An adversary embeds directive text in a resource on the retrieval path, and the receiving agent processes it as a legitimate task instruction. The corrupted context then reaches subsequent agents as trusted input. The OWASP Top 10 for Agentic Applications 2026 names this amplification in ASI01, Agent Goal Hijack, where manipulated input redirects goals, planning, and multi-step behavior.

Persistent memory gives the same attack a longer life. A poisoned record written by one agent can become baseline context for later agents and later sessions. Lakera AI’s November 2025 research showed how indirect prompt injection through poisoned data sources corrupted long-term memory and led the agent to hold false beliefs about security policies that it defended when humans questioned it. Crew Scaler treats Memory Poisoning as a separate category and identifies latent poisoning through shared vector databases as an attack pattern with few established countermeasures. A well-formed payload is therefore not necessarily harmless, particularly when its text also claims authority.

How agent impersonation exploits identity inferred from routing position

Routing establishes where a message came from operationally. If position substitutes for credentials, a process occupying the expected position can impersonate an agent. Clean content does not resolve that gap. SentinelAgent cites a survey of IT and security professionals in which only 23% of organizations had a formal agent identity strategy. An even smaller share said they were confident that their identity and access management infrastructure could manage agent identities.

The Model Context Protocol makes delegation easy to implement in agent-to-agent-to-agent chains, while its security guidance assumes agent-to-API interactions. Those deployments do not inherit identity verification by default. Hossain Safin et al.’s four-agent LangGraph study examines the resulting confused deputy pattern through a Supervisor, Researcher, Validator, and Executor. A less-privileged agent forwards untrusted content to a more-privileged agent, which can misuse authority it legitimately holds because it cannot verify the source.

Anthropic’s GTG-1002 report describes a related identity bypass at the model level. In the campaign detected in mid-September 2025, operators told Claude that it was an employee of a legitimate cybersecurity firm performing defensive testing. The claimed role substituted for trustworthy evidence of purpose. This role-play social engineering enabled the campaign to proceed.

How plan deviation exploits the absence of binding execution contracts

A verified sender can still request an unauthorized plan. Natural-language execution plans describe intended behavior but do not bind the orchestrator to it. An agent or injected instruction can redirect the plan without an external mechanism enforcing that realized actions remain within authorized intent. Better reasoning alone does not create that mechanism.

SentinelAgent sets out seven properties that binding delegation contracts must have. Six are deterministic, including authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, and output schema conformance. The seventh, intent preservation, remains probabilistic. Natural-language plan strings provide none of these guarantees by themselves. The distinction separates enforceable constraints from judgments about meaning.

Intent checking is particularly vulnerable to adversarial paraphrasing. The same paper reports that sophisticated paraphrasing of malicious instructions to evade natural-language inference detection degraded intent verification to 13%, while the deterministic structural properties remained unbroken. A rigorous design must acknowledge that limit. Even when content is clean and the sender is authenticated, the system still needs an external authority to restrict execution to permitted scope.

How a single compromised hop cascades unauthorized actions through the whole chain

Safin et al.’s study found that memory poisoning reached execution in every undefended trial, bypassing the Validator while upstream agents remained within their individual constraints. Poisoned state supplied the context, the handoff lent it apparent authority, and the absence of binding enforcement allowed it to reach execution.

Anthropic detected GTG-1002, a Chinese state-sponsored group, using Claude Code and MCP tools in an autonomous attack framework. Claude functioned as an orchestration system, decomposing multi-stage attacks into discrete tasks for sub-agents. Those tasks included vulnerability scanning, credential validation, data extraction, and lateral movement, each of which appeared legitimate in isolation. AI did the large majority of tactical operations, sending requests at rates that would be physically impossible for humans. The aggregate plan was a cyberattack despite the local plausibility of its steps.

The LiteLLM backdoor in March 2026 exposed a different cascade route through the software supply chain. During a three-hour PyPI window, the compromised dependency reached CrewAI, DSPy, Microsoft GraphRAG, and dozens of other agent frameworks. Downstream projects that pulled the update acquired an autonomous attack bot in their pipelines. The entry point differed, but downstream dependence amplified the compromise. Individual-action detection is architecturally insufficient because the unit of security analysis must be the chain.

Why existing security frameworks do not cover multi-agent threat surfaces adequately

Existing frameworks are still useful, but what they cover does not prove that a multi-agent system is secure. Crew Scaler scored security and governance frameworks on how well they covered threats in nine multi-agent risk categories. The OWASP Agentic Security Initiative covered the most threats overall, but none of the reviewed frameworks covered more than half in any single category. Non-Determinism and Data Leakage were the least addressed domains. Both complicate the detection and containment of cascades.

The mismatch lies in assumptions about deterministic control flow, bounded trust boundaries, stateless execution, and identifiable adversarial inputs. Autonomous agents instead share persistent memory, propagate tool authorization through delegation, and influence one another through context. SentinelAgent finds that existing approaches address pieces without formally modeling how authority, intent, and compliance compose across multiple hops. Coordination patterns also change the exposure. Sequential, parallel, hierarchical, and marketplace systems have distinct security implications, with marketplace agents creating previously unknown trust relationships as they discover and hire one another at runtime.

Structural controls that close each boundary gap

The lesson for deployment teams is to enforce trust at the boundary rather than rely on agents to reason correctly about every payload. For content, Safin et al.’s Observer layer removed detected injections before review and reduced false-positive blocking for agent hijacking from high to low single digits without weakening execution-level security. This separates content filtering from execution authorization. Crew Scaler’s memory-poisoning analysis also supports treating memory writes as untrusted inputs requiring the same validation as external content, rather than granting trust merely because a record has been stored.

For identity, every message must carry cryptographic or attestation-based credentials, whatever its routing position. Safin et al. implemented cryptographically signed, task-bound, single-use tokens. With authorization enabled, memory poisoning still produced a high Judgment Bypass Rate, but the Unsafe Action Rate was zero. The Validator remained compromised while execution was contained. The 2026 Singapore Consensus also requires capabilities to change as tasks change, which supports using short-lived, session-scoped credentials checked again at each tool call in place of static grants.

For intent, SentinelAgent places enforcement in a non-LLM authority outside the reasoning layer. Over its lifecycle, it checks intent before execution, enforces scope during execution, and validates output after execution. On DelegationBench v4, which has 516 scenarios across ten attack categories, the layers together reached a full true-positive rate with zero false positives. Each layer caught attacks the others missed. When paraphrasing evades intent checking, deterministic authority narrowing, scope-action conformance, and forensic reconstructibility still restrict the attacker to permitted API calls and traceable actions.

For state, containment must survive corrupted upstream judgment. Safin et al.’s ablation testing found that an independently verified policy oracle protected the system when an attacker had the signing secret, while signed tokens alone could not. This contains effects without proving that memory is clean. The Progent framework enforces symbolic rules on tool names and typed arguments at the structured tool-call interface. It cut attack success from high to low single digits while keeping utility on AgentDojo, which shows how argument-level restrictions can work alongside boundary checks.

These controls also need pre-deployment evidence. Microsoft’s RAMPART framework, released in May 2026, provides structured tests for cross-prompt injection, behavioral regression, and data exfiltration that teams can integrate into CI/CD release gates. Such testing evaluates whether controls withstand attacks before an updated agent reaches deployment. It does not replace runtime enforcement. The controls are complementary because filtering content, authenticating senders, restricting actions, and containing poisoned state solve different problems.

What teams deploying multi-agent pipelines should verify before each release

Release verification must repeat whenever a model, agent, or tool call changes the threat surface. A snapshot certification expires in practical terms when the next deployment changes what was tested. NIST testing found that security did not correlate with capability, so a newer or more capable model cannot be assumed safer. Teams should therefore make continuous adversarial testing part of CI/CD release gates and test structural authorization and model alignment on every pass.

Agent impersonation tests should forge handoff payloads and establish whether downstream agents validate origin and integrity. Cross-agent injection tests should check whether retrieved content can become executable instructions in another agent’s context. Cascade analysis should evaluate the complete realized plan. Delegation-chain forensic tests should establish whether the authority path from human intent to downstream tool call can be reconstructed and audited.

The Verified Change Record model gives these tests a reproducible release discipline. Teams prove the attack, apply the minimal fix, re-run approved workflows, and produce a record demonstrating the result. That evidence backs a claim that a specific gap has been closed without suggesting protection from every attack. Teams should also maintain an explicit account of tested and untested boundaries, covered and uncovered attack categories, and unresolved limitations. Coverage is not completeness, and a defensible release decision names the difference.