Every agent that reads the poisoned artifact inherits the error; the affected set grows with the fan-out degree of the topology. Depth is a different axis: in sequential refinement chains, hallucination can attenuate rather than amplify (normalized hallucination score fell from 0.422 at the first agent to 0.272 at the final agent across 3-agent chains, a 0.644 amplification factor), at the cost of small consistent losses in factual consistency and response quality (arXiv:2606.07937).
Downstream agents consume the claim as ground truth and build on it, so one local error becomes shared team context that no single agent re-checks.
- Trigger
- A single agent emits a hallucinated or unsupported claim into a shared artifact.
- Detection
- Divergence between a propagated claim and its cited source; an independent verifier that re-derives the fact disagrees with the consumed value.
- Containment
- Independent verification before an artifact is shared (build-verify-reflect); provenance tags so downstream agents can discount unsourced claims.
The whole deliberation collapses to one position; correct minority signals are lost and the error is laundered as consensus.
Sycophantic agreement and anchoring suppress dissent; agents converge on the initial position regardless of correctness, and a verification step rubber-stamps the majority.
- Trigger
- An early or confidently stated answer (possibly wrong) is surfaced to the group.
- Detection
- Unusually fast or unanimous agreement; low variance across independent samples; a held-out skeptic that still dissents when the group does not.
- Containment
- Independent sampling before any exchange; an adversarial or skeptic role required to refute; anti-consensus weighting that rewards a correct minority over a correlated majority.
Every downstream decision, ranking, or reward signal derived from the panel verdict inherits the amplified bias; systems that use the panel as a trusted oracle are systematically steered by the distorted signal.
Existing biases (position, verbosity, bandwagon) are amplified sharply after the first debate round and remain elevated in all subsequent rounds, so the multi-agent ensemble produces a more biased verdict than a single judge would have -- the social dynamic of debate turns a calibration problem into an entrenched directional error.
- Trigger
- An LLM-as-judge ensemble is deployed to produce a more reliable evaluation signal, with agents running a multi-round debate to reach a verdict.
- Detection
- Bias audit against held-out gold labels across multiple panel runs; variance tracking across rounds (rising bias with round count is the signal); comparison against a calibrated single-judge baseline.
- Containment
- Use meta-judge architectures (which the paper shows exhibit greater bias resistance) rather than open debate; inject a calibrated bias-free agent as a standing panel member; apply PINE-style debiasing before aggregation.
Any downstream stage that gates on the consensus signal (routing, human review escalation, confidence thresholding) inherits the false certification; errors embedded in divergent reasoning chains are never surfaced because the answer-level checkpoint passes.
Debate reduces detectable contradictions between agents' surface answers while simultaneously decreasing the semantic similarity of their reasoning chains, so the consensus-as-reliability heuristic certifies an answer whose underlying justifications are actually diverging -- the agreement is a statistical artifact, not an epistemic one.
- Trigger
- A multi-agent system uses answer-level agreement across agents as a reliability signal in a safety-critical context such as medical question answering.
- Detection
- Cross-agent reasoning alignment metrics (e.g., CARA) that measure semantic similarity of reasoning chains independently of answer agreement; flag cases where answer consensus is high but reasoning alignment is low.
- Containment
- Require agents to commit to named facts and explicit stances on each other's claims (Grounded Debate Protocol); audit reasoning alignment alongside accuracy before treating consensus as a trust signal.
Hub injection causes system-wide failure (100% in a centralized LangGraph topology) versus 9.7% from a leaf node; per-framework Impact Factor 10.31x (LangGraph), 6.29x (CrewAI).
Because the hub is the strict informational cut-set, its adoption of an error immediately broadcasts the falsehood to all connected workers, producing system-wide infection governed by the principal eigenvector of the dependency graph; the same error content causes 100% system-wide failure from the hub versus 9.7% from a leaf node.
- Trigger
- An error seed is injected at or adopted by the central hub/supervisor node of a centralized multi-agent topology.
- Detection
- Sharp discontinuous jump in aggregate error rate when the central coordinator's output changes; divergence between hub output and an independent re-derivation from raw inputs.
- Containment
- Quarantine the hub behind an independent verifier before downstream broadcast; distribute authority so no single node is a strict cut-set; genealogy-graph governance layer that tracks message provenance and suppresses amplification.
All users served by the same shared-state agent instance; each contaminating interaction raises the probability of corrupting subsequent users, compounding across the user population.
When a subsequent user queries the same shared-state agent, the agent silently reapplies the prior user's artifact without scope-checking, producing a silent wrong answer; no adversary is required and the contamination rate reaches 57–71% under raw shared state.
- Trigger
- A benign user interaction produces a scope-bound artifact (interpretation, transformation rule, or workflow) that persists in a shared agent state layer.
- Detection
- Divergence between a user's explicit query intent and the agent's response; monitoring for artifact reuse across user-session boundaries; A/B comparison against an isolated-state baseline.
- Containment
- Write-time sanitization (Sanitized Shared Interaction) that strips user-specific scope before persisting artifacts; per-user context isolation; scope tags that prevent cross-user artifact reuse.
Every future session of the agent and every user it serves after the memory is poisoned; a small number of poisoned records can dominate retrieved experiences on benign workloads.
Future agent instantiations load the poisoned store from disk; semantic similarity retrieval surfaces the malicious templates whenever a task resembles the poisoned entries, causing the agent to adopt unsafe patterns, and the behavioral drift propagates across sessions and across users without further attacker intervention.
- Trigger
- An attacker plants a small set of malicious procedure templates in an agent's long-term RAG memory store alongside legitimate experiences.
- Detection
- Behavioral anomaly detection across sessions; comparison of retrieved experience templates against an allowlisted baseline; monitoring for retrieval of low-trust memory records.
- Containment
- Trust-scored memory retrieval that discounts records below a provenance threshold; memory sanitization before persistence; periodic memory audits that replay experiences against a verifier.
In 32% of observed failures the root-cause node differs from the symptom node, with propagation distances exceeding 40% of total workflow length in over 10% of cases; LLM/Agent and Logic/Control nodes are disproportionately prone to non-local manifestation.
The erroneous output flows downstream as apparently valid data; subsequent nodes consume it and build further actions on it, so the visible failure symptom materializes at a node far removed from the actual root cause, entangling attribution.
- Trigger
- A failure originates at one workflow node (via a natural-language interaction, tool invocation, or control-logic error) but produces no observable symptom at the point of origin.
- Detection
- Causal-attribution tracing that links observable failure symptoms back through the dependency graph to their origin node; runtime provenance logs on each inter-node message.
- Containment
- Lightweight validation gates at each stage boundary so bad output is caught at the producer node before entering the shared message channel; anomaly detection on inter-node payloads rather than only on final output.
Without intervention, the cascade infects the majority of agent runs; the error solidifies into shared context artifacts (sources, assumptions, code skeletons, evaluation criteria) that downstream agents treat as ground truth.
The seed error is repeatedly cited and reused across the agent dependency graph; each agent that adopts it raises the probability that connected agents adopt it too (non-linear contagion modeled via spectral-radius growth), and when the system enters a supercritical regime the error crystallizes into shared constraints that all subsequent steps are built upon, making correction increasingly costly.
- Trigger
- A single atomic factuality or faithfulness error is injected into (or arises within) a shared multi-agent interaction chain.
- Detection
- Monitor per-agent adoption rate of a specific claim; rapid cross-agent agreement on an unverified claim signals supercritical propagation; spectral-radius analysis of the dependency graph identifies the highest-leverage infection vectors. Online cross-channel causal monitoring can additionally attribute a live cascade, identifying the origin, bridge, and amplifier agents and reconstructing its principal propagation pathways at sub-1% latency overhead (CASPIAN, arXiv:2605.19240).
- Containment
- Maintain an immutable reference layer that agents check before adopting a peer's claim; introduce governance probes that inject verified contradictions to arrest supercritical spread; require independent sourcing before a claim enters the shared constraint layer.
All agents and pipeline stages that consume the reviewed artifact treat it as trusted; the false-positive certification suppresses re-inspection across the whole downstream chain.
The verifier performs only low-level correctness checks (compilation, surface syntax) rather than high-level objective validation, so a flawed artifact clears review and its laundered "approved" status downstream signals to subsequent agents that further checking is unnecessary.
- Trigger
- A verifier agent runs but applies shallow or misaligned checks, approving an artifact that contains a latent error.
- Detection
- A held-out adversarial test suite (e.g., isomorphic perturbation, execution against held-out cases) that the verifier never saw; cross-checking the artifact against the high-level objective rather than only low-level proxies.
- Containment
- Multi-level verification: pair a low-level checker with an independent high-level objective validator; require verifiers to justify approval against the task specification, not only surface properties.
The whole agent network subject to the delayed-correction regime oscillates rather than converging on a stable answer, so any downstream consumer sampling the system at different times sees contradictory outputs; the effect was confirmed experimentally across five open models. Grounded factual-answering tasks are immune (truth acts as an absorbing boundary), so the exposure is specific to signed-belief and opinion-style consensus tasks.
The system is modeled as delayed consensus on a graph with grounded corrector nodes; spectral decomposition of the grounded Laplacian yields a closed-form stability threshold for the verification 'dose'. When correction is too strong or arrives too late relative to how fast the claim spreads, the system does not settle into either the correct or the false belief: it flips into sustained oscillation between belief states. The worst-case regime is when communication delay and verification delay coincide, where the derived threshold is the inverse golden ratio.
- Trigger
- A verifier or critic agent's correction of a false claim arrives after a delay, while the claim itself is already propagating through the agent network via normal message exchange.
- Detection
- Track variance/oscillation in an agent's or the group's belief state across successive rounds rather than only its final answer; check whether the observed communication delay and verification delay coincide, the paper's highest-risk regime; compare the measured dose-delay pair against the derived closed-form stability threshold.
- Containment
- Use the paper's supermodular placement objective with a greedy (1-1/e)-approximation to assign a limited number of verifiers to nodes that maximise convergence speed; cap correction dose below the instability threshold for the given delay; separate communication and verification channels so their delays do not coincide.
The runaway handoff/tool-call chain amplifies a single request into cost exhaustion, model denial of service, context window overflow, and repeated side effects (duplicate API calls, duplicate writes). Affects any framework without explicit cross-component loop budgets.
Because the loop arises from the interaction between agent logic, framework semantics, runtime observability, and tool responses rather than from a single code path, standard static analysis misses it. The paper formalises this with a framework-independent Agent IR and an Agentic Loop Dependence Graph (ALDG) that captures cross-agent, cross-tool feedback edges invisible to per-component testing.
- Trigger
- A single upstream request enters an agent workflow whose feedback path spans tool calls, workflow transitions, and agent handoffs without a guaranteed termination condition.
- Detection
- Build a framework-independent Agent IR and an Agentic Loop Dependence Graph (ALDG) from the agent's runtime traces; flag feedback cycles that span more than one agent or tool boundary; alert on monotonically increasing turn/token counts without progress signals.
- Containment
- Impose explicit hard bounds (iteration counts, cost or turn budgets) on every feedback path that crosses an agent or tool boundary, not just on the top-level orchestrator; instrument cross-component loop detection at the framework level rather than relying on individual agent self-termination.
Every descendant generation and every agent instance derived from the compromised lineage inherits the adversarial payload. The paper reports 100% persistence across 40/40 test payloads, with only 2.5% blocked by content scanners, making the attack nearly undetectable by existing guardrails.
Because the system commits changes to its own weights, tools, memory or architecture rather than only to an external store, an adversarial influence accepted during a self-evolution step gets baked into the agent's identity and propagates to all descendant generations. Unlike RAG poisoning, the payload is not retrievable or deletable from an external database; it is woven into the model/tool/architecture lineage.
- Trigger
- An adversarial or erroneous influence is accepted during a self-evolving agent's own update cycle (its Propose/Commit lifecycle stage), rather than being injected into an external memory or retrieval store.
- Detection
- Run an MLAS-style audit across the five functional modules (Brain, Cognitive Resource, Execution, Self-Evolution, Security) at each generation boundary; diff the agent's toolset, memory schema, and architecture state against the last known-good checkpoint; flag any Propose/Commit cycle whose delta was not human-reviewed.
- Containment
- Treat the Propose and Commit stages of the self-evolution loop as the primary gate and apply formal verification or human-in-the-loop approval before any weight, tool, or architecture change is persisted; maintain signed lineage hashes so that any unauthorised modification is detectable at generation boundaries.
Practitioners reported a single session's recursive tree burning roughly four million tokens in under five minutes, exhausting an entire Pro Max 20x five-hour budget instantly. The June 2, 2026 outage affected Claude's web interface, developer console, and Claude Code simultaneously; Anthropic issued emergency refunds.
Because each spawned sub-agent is itself permitted to dispatch further child sub-agents, and the runtime has no server-side nesting cap, the delegation tree grows exponentially. Unlike a cyclic feedback loop (where a single process repeats), this creates an exponential tree of new processes, each consuming its own token budget and API quota.
- Trigger
- A coordinator's nested sub-agent delegation feature (agents dispatching further agents to manage complex subtasks) lacks an enforced depth or breadth limit, so a single user request triggers recursive spawning.
- Detection
- Alert on sub-agent delegation depth or concurrent-subagent count exceeding a small threshold (the platform's post-incident cap is 5 levels); monitor token-consumption rate per session for exponential-growth signatures.
- Containment
- Enforce nesting-depth limits server-side rather than relying on a client-honoured flag alone; Anthropic's fix was a hard 5-level cap in Claude Code v2.1.172. Additionally, impose per-session token-rate budgets that trigger circuit-breaker shutdown before exponential consumption exhausts the account.
Any deployment that treats multi-agent debate consensus as a de-biased signal is exposed once the conformity threshold is crossed; the authors show the effect generalizes beyond toy settings to realistic decision tasks including investment decisions and LLM-as-a-judge evaluation.
Using a physics-inspired social-dynamics model, the paper shows debate outcomes undergo a phase transition to collective bias once conformity pressure among agents surpasses a critical threshold set jointly by the agents' initial bias and the debate's noise level; below the threshold, individual biases stay individual, but above it they lock in as a shared, amplified group norm. Agent heterogeneity smooths (rounds off) the sharpness of this transition rather than preventing it.
- Trigger
- Debating agents each carry a small pre-existing individual bias, and the debate is run under a given sampling noise level (e.g. LLM temperature).
- Detection
- Track finite-size crossover behavior in measured bias as conformity, initial bias, and sampling noise are varied, the paper's own experiments confirm the predicted phase transition this way; watch for a sharp jump in group-level bias as temperature or agent homogeneity changes rather than assuming bias grows only gradually.
- Containment
- Increase agent heterogeneity (different models, prompts, or initializations) in the debate pool, which the paper shows smooths the phase transition and suppresses emergence of collective bias; keep debate noise and conformity pressure below the derived critical threshold.
Agents within the propagating neighbourhood of an erroneous claim: those that receive it via majority-vote aggregation from neighbours and go on to assert or retransmit it once the network's error reproduction number R_err exceeds 1. Mean first-generation offspring rose from 0.667 to 1.333 to 1.667 as node degree increased from 2 to 4 to 5, showing that the same connectivity increase used to hit a majority-vote reliability target also expands the set of agents an erroneous claim can infect.
The paper models claim-level spread as a susceptible/exposed/infectious/corrected contagion process on the network graph and proves the claim-free state is stable only when R_err, the spectral radius of the next-generation matrix K = P T Gamma^-1, stays below 1. Because majority-vote reliability and error contagion are driven by the same connectivity parameter, a graph needs at least k* neighbours per node to clear its reliability target; but any graph meeting that target also satisfies R_err(G) >= q*tau*k*. If q*tau*k* >= 1, no graph in the reliable class can stay below the contagion threshold, so raising connectivity to hit a reliability bar can itself hand an erroneous claim the spread it needs to invade the network.
- Trigger
- A multi-agent network's communication topology is chosen or scaled up specifically to improve reliability, because agents aggregate their neighbours' claims by majority vote and denser connectivity supplies more corroborating signals per node.
- Detection
- Estimate R_err from the network's topology and each agent's measured reliability/majority-vote parameters (q, tau) and compare it against the q*tau*k* threshold; track first-generation offspring count and cumulative infectious fraction at runtime rather than relying on final-answer agreement alone.
- Containment
- When q*tau*k* < 1, use a connected, simple k*-regular graph: the paper proves this class is simultaneously reliable, strictly subcritical, and minimises R_err over every graph meeting the reliability target. When q*tau*k* >= 1, no topology in the reliable class avoids contagion risk, so the reliability target itself, not just the graph, has to change.
Topology-dependent: chain topology suppresses preference contagion (beta_3 = 0.0126 +/- 0.0038) while fully-connected topology cascades it network-wide (Delta H_avg = -0.020, an entropy collapse of the preference distribution); every agent whose outputs are scored or filtered by the contaminated evaluators inherits the collapsed preference norm.
Evaluator preferences transfer measurably between agents (contagion coefficients gamma 0.157 to 0.352 across three DeepSeek-chat agents with distinct evaluator profiles), and the system falls into one of three propagation regimes governed by the spectral radius of the contagion matrix. Because shared architectural priors dominate explicit preference prompts as the contagion driver (rho_neutral 1.498 vs rho_mixed 1.299), homogeneous-model networks contaminate even when prompts differ; chain topologies suppress the contagion while fully-connected topologies let it cascade into system-wide preference collapse.
- Trigger
- An evaluator agent carrying systematic preferences, driven largely by shared architectural priors rather than by its explicit preference prompt, scores or critiques other agents in an interacting network.
- Detection
- Measure inter-agent preference transfer coefficients (gamma) between evaluator and evaluated agents; estimate the spectral radius of the contagion matrix to place the system in a propagation regime; monitor entropy of the network's preference distribution for collapse, especially in dense topologies built from a single model family.
- Containment
- Increase evaluator committee size (moving from k=1 to k=3 reduces effective contagion by 68.9% +/- 14.1%); prefer sparse or chain evaluation topologies over fully-connected ones; diversify model architectures across evaluators, since shared architectural priors, not prompts, drive the contagion.
Downstream classification accuracy degrades across every tested domain, with compression-induced loss of 10.3% in fact-checking, 28.2% in sentiment analysis, and 9.1% in medical triage; any pipeline stage consuming the compressed intermediate text inherits the degraded decision geometry.
Register transformation systematically compresses the semantic distinctions the downstream decision depends on, measured as shrinking inter-label separation in sentence-transformer embedding space; the geometric change depends on the specific intermediate transformation, and a 20-level prompt gradient shows a non-monotonic compression profile in which balanced evaluative prompts produce the strongest compression. No claim is falsified at any hop, yet the representation reaching the decision agent no longer carries enough separation to decide correctly.
- Trigger
- An intermediate agent in a role-decomposed pipeline transforms text across linguistic registers (summarising, formalising, simplifying, neutral rewriting) before a downstream agent makes a decision on it.
- Detection
- Measure inter-label separation in sentence-transformer embedding space before and after each intermediate transformation and alert on separation shrinkage; probe candidate intermediate prompts with a prompt gradient, since transformation valence controls both the direction and the sign of geometric change independently of compression magnitude.
- Containment
- Use identity passthrough for text that downstream deciders will classify (it preserves semantic distinctions nearly completely); where transformation is required, prefer credibility-seeking transformation variants, which expand rather than compress inter-label separation; avoid balanced evaluative rewriting prompts at intermediate hops.
In an analysis of 73 production agent incidents (January to May 2026), 61% of multi-layer incidents had a retrieval failure at layer 2 as the upstream cause of a tool-call symptom at layer 1; every action taken on the masked output, and every operator debugging the wrong layer, is inside the radius.
Each subsequent layer of the agent stack executes correctly against the corrupted input: the planning layer decomposes the task using the stale context, and the tool call executes correctly against the wrong plan, so the output looks valid and nothing at any individual layer fires an alert. The failure symptom therefore surfaces at a different stack layer (typically the tool-call layer) than the root-cause layer (typically retrieval), and per-layer monitoring is structurally blind to it.
- Trigger
- A retrieval or context-quality failure pulls stale or wrong context into the agent stack at one layer, while every other layer remains healthy.
- Detection
- Cross-layer trace correlation that attributes tool-call symptoms back through planning to retrieval provenance; context-quality scoring at the retrieval boundary rather than only output validation; treat a rising tool-call error rate as a retrieval-layer alarm candidate, not only a schema problem.
- Containment
- Context-quality gates between the retrieval layer and the planning layer so stale or out-of-scope context is rejected before decomposition; per-layer provenance on intermediate artifacts so symptoms are attributable upstream instead of being patched at the symptom layer.
