Inter-Agent Context Propagation

Inter-agent context propagation occurs when an orchestrated AI system is configured to pass one synthetic subject’s output into another synthetic subject’s context. This may occur through inter-agent messages, delegated task records, summaries, shared memory, generated work products, workflow state, tool outputs, or orchestration-layer handoffs.

This configuration creates an elevated exposure condition because model-visible context can move across agents, roles, tools, and trust boundaries. A receiving synthetic subject may rely on inherited context without knowing its original source, trust level, or integrity.

The primary risk is unvalidated context transfer. Content first processed by a low-trust or attacker-influenced synthetic subject may be reformatted, summarized, copied, or embedded into another agent’s task context. As the context moves through the system, its original provenance may become less visible while its ability to influence downstream behavior increases.

A related risk is capability amplification through delegation. A synthetic subject with limited access may pass inherited context to a tool-equipped worker, privileged agent, or downstream workflow with greater operational reach. The downstream synthetic subject may then act on that context as if it came from the orchestrator, an approved task record, or another trusted system component.

Investigators should review the agent graph, context-sharing configuration, delegation paths, inter-agent message formats, shared memory stores, task handoff records, summarization steps, tool-output routing, provenance tags, and trust-boundary controls. Particular attention should be given to context copied between agents, missing source attribution, inherited instructions, repeated unusual text appearing across agents, and downstream actions that trace back to propagated context rather than an approved operator objective.

Investigative Relevance

Inter-agent context propagation is relevant because context-sharing is a design decision that defines how synthetic subjects influence each other. In an orchestrated system, the risk is not only what an individual agent can access, but what context it can pass to other agents with different permissions, tools, or responsibilities.

This sub-section is especially relevant where agents summarize each other’s work, pass task instructions, share memory, consume generated records, exchange tool outputs, or delegate actions to tool-equipped workers without enforcing provenance, trust-level separation, and integrity checks.