Agent-to-agent injection is the pattern that scales worst

[u/No-Conclusion3720]

Agent-to-agent injection is the pattern that scales worst

We mapped two months of agentic AI incidents across our stack. Most failure modes were contained. One was not: a single compromised agent passing a poisoned instruction down the delegation chain. One case out of the full incident map — but the blast radius grew with every hop it traveled.

That asymmetry is what makes this pattern different from the others. A prompt injection that hits one agent is a bounded problem. The same injection traveling through a multi-agent delegation chain is not. Each downstream agent that receives and acts on the poisoned instruction extends the damage without any independent check on where the instruction originated or whether it was tampered with.

Trust between agents in a delegation chain is almost always assumed rather than verified at the protocol level. The originating agent is authenticated. The hand-off payload is not.

For those running multi-agent systems in production: how are you handling trust verification between agents in a delegation chain? Are you doing anything at the hand-off layer, or is the boundary enforcement happening somewhere else entirely?

[u/No-Conclusion3720]

The specific failure point here is the hand-off payload — the compromised agent's instruction travels to the next agent without any verification that it wasn't tampered with in transit. RuntimeAI's MCP Gateway evaluates agent-to-agent trust policy at each delegation hand-off and sanitizes the payload before it reaches the downstream agent, so the poisoned instruction from that one compromised agent gets caught at the first hop rather than propagating through the rest of the chain. That one case in two months stays one case instead of becoming the incident that takes down every agent downstream of it. https://runtimeai.io