Agentic systems are only as safe as their weakest link

Models that reject false claims from peer agents can accept identical fabrications when they arrive as delegated tool results. Preserving source evidence prevents both the initial manipulation and its propagation through the system.

This essay summarizes the findings of our full paper.

While the world has only just begun to get used to talking to language models as we would other humans, LMs are rapidly becoming “comfortable” talking to each other. The rise of LM communication, what is commonly referred to as agent-to-agent communication (A2A), is realized not only in the corporate landscape but also inside the architecture of agentic systems themselves.

Modern systems increasingly chain models together. An orchestrator model delegates subtasks to sub-agents, models critique and verify one another, and each agent’s output becomes the next one’s input.

With this evolution in agent architecture, a potential risk arises: in the same way a human can be swayed by the conversations they have, A2A interaction leaves a concerning possibility of manipulation. Systems are only as safe as their weakest link. AI safety research must therefore identify where those weak links may exist.

A controlled test of agent-to-agent manipulation

To explore these weak links, we designed a controlled evaluation of A2A manipulation in which one agent attempts to convince another of a false “fact.”

First, a subject agent reads a passage containing a fictional “fact” and answers a question about it correctly. We then introduce an attacker agent that attempts to convince the subject to adopt the wrong answer.

We measure harmful revisions: cases in which the subject abandons its correct answer for the specific wrong answer advocated by the attacker.

We ran a series of escalating stress tests, moving from static A2A messages to live adaptive dialogue and fabricated evidence delivered through a delegated sub-agent. We then tested whether corruption propagates through a worker–aggregator pipeline and whether a verifier can stop it.

Across these experiments, manipulation depended on three factors: the target model, its access to evidence, and the delivery channel.

Manipulability depends more on the target than the attacker

In a 14-model directed influence map, manipulability was primarily a property of the subject model rather than the attacker. Subject model resistance explains 88% of pairwise variance while attacker strength explains only 2%.

Evidence determines whether models hold their ground

Subject resistance, however, was not a fixed trait of the underlying model; it depended on the second factor, access to evidence.

With the source passage retained in context, capable models never revised under static false claims. With the source removed but the model’s own rationale retained, they largely withstand harmful revisions. Only when both the source and rationale were removed did capable models revise on 99–100% of trials.

Adaptive persuasion defeats rationale-only defenses

These initial experiments used a static attack. To test whether the subject agents can withstand a stronger attacker, we had a live persuader read and rebut the subject’s reasoning.

This raised harmful revision from 12% to 99% for GPT-4o-mini and from 2% to 56% for Claude Haiku 4.5. An equally long neutral challenge produced almost no revision. We conclude therefore that the failure comes from the attacker’s adaptation, not the added conversation length.

The delivery channel changes what models accept

Frontier models resisted even the live attacker, suggesting that capable models were relatively robust to peer-to-peer manipulation in this setting.

To test whether the same holds true when agents interact within an increasingly common system structure, we hold the false content fixed and vary only the channel through which it arrives.

This produced our central result.

Claude Opus 4.6 and Claude Sonnet 4.6 reject a retriever’s fabricated source on every trial when it is presented as a peer message, yet accept the identical fabrication on 92.8% and 58.9% of trials when the same retriever agent returns it as a delegated sub-agent tool result (with the passage still in their context).

For these models, content rejected as a peer’s claim is accepted as a tool’s observation. GPT-5.4 shows no such asymmetry.

Corruption propagates through the system

The failure did not remain contained.

In a worker–aggregator pipeline, a single corrupted worker caused a downstream aggregator that resisted direct attack to answer incorrectly on 98% of trials.

Verification works when it restores evidence

The mechanism behind the failure also points to its solution.

A verifier that re-supplied the source passage eliminated both the direct attack and the pipeline cascade, reducing error to 0% for every subject model tested. A verifier that merely asserted the correct answer was inconsistent, leaving GPT-4o-mini as high as 54%.

From model safety to system safety

These results demonstrate that a model’s robustness to false information depends on the evidence it receives and the channel through which it arrives. Even frontier models that reject false peer claims can accept the same fabrication as a delegated tool result. Once one agent is corrupted, the failure can propagate to agents that resist direct attack.

A robust model alone is therefore insufficient to secure the system around it.

Each of these failures traces to a common cause, the loss of contact with evidence, which is also what makes them preventable. A verifier that restores the source eliminates both the attack and its propagation, whereas one that merely asserts the correct answer does not. The effective defense is not more model calls, but preserved evidence provenance.

These experiments use controlled, binary, fictional-fact tasks rather than open-world deployments. The strongest channel asymmetry was also model-dependent, appearing in Claude Opus 4.6 and Sonnet 4.6 but not GPT-5.4. Our results isolate a specific safety-relevant mechanism; they do not imply that every agentic system will fail in the same way.

Safety evaluations have largely focused on whether individual models resist misdirection. As systems scale into networks of delegating agents, however, our findings suggest that the relevant unit of safety shifts from individual models to the boundaries between them.

A multi-agent system is only as safe as its weakest link, and that link is the boundary at which evidence is lost.