When agents call agents, one agent's output is another's untrusted input, and a single injected instruction can propagate across the whole graph with accumulated privileges. The strong answer treats every inter-agent edge as a trust boundary and bounds privilege per agent, not per system.
Updated Aug 2026 · Grounded in real Forward Deployed Engineer interview loops and written to a senior-engineer editorial bar.
When agents call agents, one agent's output is another's untrusted input, and a single injected instruction can propagate across the whole graph with accumulated privileges. The strong answer treats every inter-agent edge as a trust boundary and bounds privilege per agent, not per system.
The trap is treating the multi-agent system as one trusted unit, because the dangerous property is exactly that agents trust each other's output by default, so an injection in one propagates with the union of privileges along the call path. The senior move is per-agent least privilege plus treating inter-agent messages as untrusted content, which contains the blast radius to one agent's scope. Watch for the candidate who gives a single orchestrator a god token that every sub-agent effectively borrows, which collapses all the boundaries at once.
No comments yet — be the first to share your approach.
