Don't Raise Trust When Crossing Between Agents

A subagent's summary, shared memory, and teammates' messages stay untrusted data. Otherwise prompt injection gets a new path through "our own" agent. A multi-agent topology widens the attack surface: one worker reads an external page, a second trusts its summary, a third has a write tool. If the host considers an internal message safe just because of the sender id, an external instruction can pass through the whole chain.

Anthropic separately describes multi-agent trust escalation: a subagent can isolate untrusted content, but its output can wrongly receive a higher trust level. The OWASP multi-agent threat guide notes additional attack surfaces of coordinating autonomous components.

To build a trust boundary on a specific chain, use the lab.

The minimal defense is made of several rules: mark the source and trust class of each field; don't carry instructions from retrieved content into system policy; pass structured facts with references to raw evidence; re-authorize every action at the tool boundary; limit persistent memory and check it on load; don't give the reviewer trust above the verifiable sources.

Trust class is data, not the sender. A message doesn't become safe because it came from "our own" agent. What makes it safe is the origin of the content and a re-check at the rights boundary.

Trust boundaries are set. So all of this can be explained and debugged, decisions, calls, and boundaries must be traced.