AI Security Atlas › All entries › Multi-Agent & Memory Trust
Cascading Multi-Agent Failure
One agent's bad output, compromise, or error propagates through delegations and shared state, amplifying across the system.
Open in the interactive atlas →Impact
A single fault becomes a system-wide incident, with each agent faithfully acting on bad input.
Why this severity
Impact High × Likelihood Medium = High
Impact high: a single fault becomes system-wide. Likelihood medium: a self-replicating prompt worm spread between GenAI systems in a research demonstration.
Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Medium: Publicly demonstrated against real products or in peer-reviewed research, or seen in the wild only with a prior foothold such as stolen credentials.
Method: OWASP Risk Rating Methodology
Evidence
- Demonstration: Morris II Worm: RAG-Based Attack (MITRE ATLAS case study AML.CS0024, 2024)
Related
Exploits
- No Isolation Between Agents Vulnerability · High severity
Follows from
- Persistent Memory Poisoning Threat · Critical severity
- Inter-Agent Impersonation Threat · Medium severity
Mitigated by
- Blast-Radius Isolation & Circuit Breakers Guardrail · Fixes high risks
Remediation
- Validate inputs between agents as untrusted data.
- Isolate credentials and resources per agent.
- Add circuit breakers that stop fan-out on error spikes.
How to verify
- Inject a faulty agent in staging and measure blast radius.
- Confirm breakers trip before downstream agents act on bad output.
Framework mapping
OWASP Top 10 for Agentic Applications 2026
- ASI08:2026 Cascading Failures
OWASP Top 10 for LLM Applications 2025
- LLM06:2025 Excessive Agency
MITRE ATLAS
- AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
NIST AI RMF 1.0
- MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate AI systems
- MEASURE 2.6 AI system is evaluated regularly for safety risks