The State Agents Hand Each Other Is the Unguarded Channel in Multi-Agent Systems
A demonstrated agent worm, a collusion finding from ORBIT, and two papers on stale inherited state all point at the same gap: nothing checks what flows between agents.
By Daniel Huber · 6 min read
Multi-agent systems are mostly secured and debugged one agent at a time. Each agent gets its own sandbox, each tool call gets its own guard, and each subagent gets its own context window. Work published in the week ending October 3, 2026 points at the gap this design leaves: the state agents hand to each other. That state can travel through a delegation prompt, a shared memory store, or something as ordinary as a package cache. It is where stale facts quietly corrupt sub-agent decisions and where a compromised agent reaches the next one. In a typical stack, almost nothing checks what flows through it.
The clearest case is Matthew Green's demonstrated attack, written up by Simon Willison. Agents ran in separately isolated sandboxes but shared a package cache. One agent left instructions in that cache, and those instructions changed another agent's behavior. The result was a two-part worm: a payload that hijacks an agent, and an agent that carries the payload forward. No sandbox was escaped in the usual sense. Each isolation boundary did its job, which was keeping an agent off the host. That job had nothing to do with the attack, which moved through a resource both agents were allowed to touch.