Field Note #5: When agents trust the handoff
Three agents worked one after another on a policy review. A hidden instruction in one file traveled down the chain. The same setup, run with controls on, stopped it.
WHAT HAPPENED
The first agent read a policy file in a shared folder and wrote a short team note. A second agent reviewed the note. A third turned it into the summary. At each step, the agent worked from the note it was handed, not the original files.
HOW THE HANDOFF BROKE AND WHAT STOPPED IT
– The setup. The three agents ran one after another. Each passed its work to the next as trusted input.
– What broke. One policy file contained a hidden instruction to open a file outside the assigned folder. With no limit on what it could read, the first agent opened that file.
– How it spread. That outside file’s contents went into the team note. Both later agents worked from the note. The injected text shaped the final summary. No agent flagged the problem.
– What stopped it. In the governed run, the first agent could open files in one folder only. The outside read was refused. The note recorded that the read was blocked, so no false content reached the later agents.
ONE ROOT
Each agent worked from the handed note as trusted. That’s how one bad input at the top reached both agents below it. The control that mattered limited which files the first agent could open.
THREE QUESTIONS TO ASK
– Who authorized this chain of agents to act?
– Who is accountable for what the chain produces?
– Could you prove what each agent read and passed on?
Govern the whole chain, not each agent alone. The control belongs on the first agent. If it can’t open anything outside its folder, the bad input doesn’t reach the agents below it.
Earlier notes covered a single governed agent. This one covers more than one agent working together.
#AgenticAI #AIGovernance #CISO #AISecurity
First comment (posted after publishing): Based on an ongoing research series on AI agent security governance.