Organizations may apply propagation tags to content exchanged between synthetic subjects so recipients can identify material that has already been processed or relayed.

A receiving synthetic subject should refuse to act on tagged content where doing so would repeat or extend the same instruction chain. The control is intended to interrupt agent-to-agent propagation, reinfection, and execution loops after the first hop.

This is a research-proposed containment measure for inter-agent messaging. Its deployment maturity and operational effectiveness should not be assumed without independent validation.

Sections

ID	Name	Description
IV003	Agent-to-Agent and Tool-Output Invocation	Agent-to-agent and tool-output invocation occurs when the output of one synthetic subject, tool, service, or agent becomes the triggering instruction for another synthetic subject. The effective instruction is propagated through an agent graph, tool chain, orchestration layer, or service-to-service workflow rather than being issued directly by a human operator. This invocation creates an elevated exposure condition because machine-generated output may be treated as trusted task context by the next synthetic subject. A tool result, worker-agent summary, delegated task, inter-agent message, service response, or generated record may carry instruction-bearing content that causes another synthetic subject to act. The primary risk is propagation without human review. A compromised, manipulated, or misaligned synthetic subject may produce output that recruits other agents, triggers tool-equipped workers, causes repeated actions, or spreads across a multi-agent system. The resulting behavior may resemble worm-like fan-out, synchronized drift, or cascading action across multiple agents. A related risk is provenance loss. If inter-agent messages and tool outputs are not signed, attributed, or tagged by trust level, investigators may be unable to determine which agent originated the instruction, which agents propagated it, and where the first unsafe action occurred. Investigators should review inter-agent messages, tool outputs, orchestration logs, delegation records, shared context, tool-call logs, agent identities, message provenance, and downstream actions across the agent graph. Particular attention should be given to instruction-bearing payloads, repeated payloads across agents, one-to-many fan-out, synchronized identical actions, and actions caused by peer output rather than an approved human instruction. Investigative Relevance Agent-to-agent and tool-output invocation is relevant because synthetic subject action may be triggered by another machine actor inside the workflow. The apparent local action may be only one step in a broader propagation chain. This section is especially relevant where orchestrators delegate to worker agents, agents exchange messages, tools return model-visible output, services generate task instructions, agents share context, or multi-agent systems operate without human review at each handoff.
AO006	Agentic Harm Propagation	Agentic harm propagation occurs when an adverse condition affecting one synthetic subject spreads to other synthetic subjects, tools, memory stores, sessions, workflows, or systems. The spread may occur through agent-to-agent messages, shared memory, tool outputs, orchestration handoffs, connector metadata, generated records, or workflow state. This adverse outcome creates organizational harm because the blast radius expands beyond the initial point of failure. A single poisoned input, unsafe output, false record, contaminated memory entry, or malicious connector may influence multiple synthetic subjects with different roles, permissions, tools, or data access. The primary harm is system-wide amplification. An instruction, false record, unsafe behavior, misleading output, or malicious tool result may replicate or reappear across the agent graph, causing repeated data exposure, unauthorized actions, misinformation, fraud, operational disruption, or trust degradation. A related harm is containment difficulty. By the time the adverse condition is detected, the original source may no longer be obvious. The same payload or false state may appear in summaries, task handoffs, memory entries, tool outputs, inter-agent messages, or downstream records, requiring investigators to reconstruct the propagation path across multiple logs and systems. Investigators should review inter-agent communications, shared memory, orchestration logs, tool outputs, Model Context Protocol (MCP) server records, connector changes, memory writes, task handoff records, non-human identity activity, and downstream actions. Particular attention should be given to repeated instruction patterns, anomalous agent-to-agent message volume, poisoned memory records, tool-definition changes, one-to-many fan-out, and synchronized behavior across multiple agents. Investigative Relevance Agentic harm propagation is relevant because synthetic subject harm may not remain isolated. Agentic systems are often designed to share context, delegate work, call tools, and reuse memory, which can allow a localized adverse condition to spread through legitimate coordination paths. This section is especially relevant where synthetic subjects operate in multi-agent systems, shared memory environments, MCP-connected tool ecosystems, orchestration frameworks, cross-agent workflows, or platforms where one agent’s output becomes another agent’s input.
CF011.003	Inter-Agent Context Propagation	Inter-agent context propagation occurs when an orchestrated AI system is configured to pass one synthetic subject’s output into another synthetic subject’s context. This may occur through inter-agent messages, delegated task records, summaries, shared memory, generated work products, workflow state, tool outputs, or orchestration-layer handoffs. This configuration creates an elevated exposure condition because model-visible context can move across agents, roles, tools, and trust boundaries. A receiving synthetic subject may rely on inherited context without knowing its original source, trust level, or integrity. The primary risk is unvalidated context transfer. Content first processed by a low-trust or attacker-influenced synthetic subject may be reformatted, summarized, copied, or embedded into another agent’s task context. As the context moves through the system, its original provenance may become less visible while its ability to influence downstream behavior increases. A related risk is capability amplification through delegation. A synthetic subject with limited access may pass inherited context to a tool-equipped worker, privileged agent, or downstream workflow with greater operational reach. The downstream synthetic subject may then act on that context as if it came from the orchestrator, an approved task record, or another trusted system component. Investigators should review the agent graph, context-sharing configuration, delegation paths, inter-agent message formats, shared memory stores, task handoff records, summarization steps, tool-output routing, provenance tags, and trust-boundary controls. Particular attention should be given to context copied between agents, missing source attribution, inherited instructions, repeated unusual text appearing across agents, and downstream actions that trace back to propagated context rather than an approved operator objective. Investigative Relevance Inter-agent context propagation is relevant because context-sharing is a design decision that defines how synthetic subjects influence each other. In an orchestrated system, the risk is not only what an individual agent can access, but what context it can pass to other agents with different permissions, tools, or responsibilities. This sub-section is especially relevant where agents summarize each other’s work, pass task instructions, share memory, consume generated records, exchange tool outputs, or delegate actions to tool-equipped workers without enforcing provenance, trust-level separation, and integrity checks.

preventions

Propagation Containment Tagging

Sections

Investigative Relevance

Investigative Relevance

Investigative Relevance