Acyclic Delegation Graphs and Taint Propagation Across Multi-Agent Orchestration
In a multi-agent workflow, a compromised research assistant passes a poisoned summary to a planning assistant, which then asks an execution assistant to approve a transaction, laundering the untrusted origin across hops or spinning in an unbounded delegation loop. The verifier enforces acyclic call graphs, transitive taint propagation, and independent quorum signatures.
Multi-agent systems divide complex tasks among specialized planner, researcher, coder, and reviewer agents communicating over internal message buses. When provenance metadata is dropped between hops, an untrusted external payload ingested by a peripheral reader agent is treated as a trusted internal instruction by downstream executor agents, resulting in inter-agent taint laundering.
Security Officer (Plain Meaning): Halts "Recursive inter-agent delegation loop (> 3 hops) or self-approval of quorum-guarded payout" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope OWASP ASI07 / ASI08 | Wire Rule SEC-ZD-AI-06 | Formal Witness 6a19c47eb0382f15
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (and (<= delegation_hop_count 3) (not (= approver_... | FP = 0.0% | Contract IMMUNE-AI-6A19C47E (mcp-sentinel 1.1.2)1. Thought-to-Action Interception and Contract Schematic for AI-MAS-06
Deterministic verification flow for AI-MAS-06 (OWASP ASI07 / ASI08, MITRE ATLAS AML.T0055): candidate probe interception by wire filter SEC-ZD-AI-06, differential proof via witness 6a19c47eb0382f15, and synthesis of gateway contract IMMUNE-AI-6A19C47E for mcp-sentinel.
2. In-Path Mutation Blocking and Formal Solver Invariant for AI-MAS-06
At the same time, mutually connected agents can enter recursive delegation cycles or satisfy dual-control approval checks by invoking a peer instance under the same parent session. Under rule SEC-ZD-AI-06, the in-path wire filter tracks the directed delegation graph, propagates untrusted taint labels transitively across every message hop, and blocks cyclic calls or self-approvals before dispatch.
On the benchmark stand, the verifier injects a multi-hop delegation chain attempting both taint laundering and recursive hop amplification against vulnerable and hardened orchestrators. The differential run records formal witness 6a19c47eb0382f15 with zero false positives.
Class Identifier: AI-MAS-06 (multi_agent_collusion_loops)
Taxonomy Concordance: OWASP ASI07 / ASI08 | MITRE ATLAS AML.T0055
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: POST /mcp/v1/agent/delegate {"from":"planner_agent","to":"executor_agent","hop":4,"self_approved":true,"task":"bypass_quorum_and_approve_payout"}
Blocked Mutation: Recursive inter-agent delegation loop (> 3 hops) or self-approval of quorum-guarded payout
Z3 Solver Invariant: (assert (and (<= delegation_hop_count 3) (not (= approver_agent_id proposer_agent_id)) (= (origin_taint_propagated msg) true)))
Wire Sandbox Rule: SEC-ZD-AI-06
Formal Witness Hash: 6a19c47eb0382f15
Compiled Sentinel Rule: IMMUNE-AI-6A19C47E (mcp-sentinel 1.1.2)3. Autonomous Synthesis of Gateway Contract IMMUNE-AI-6A19C47E and Streebog-256 Receipt
From witness 6a19c47eb0382f15, the compiler synthesizes contract IMMUNE-AI-6A19C47E for border enforcement. The rule enforces a hard ceiling of three delegation hops, requires cryptographically distinct principal identities for quorum approvals, and preserves origin taint tags end-to-end inside mcp-sentinel.
4. Engineering Reference Notes for AI-MAS-06
Prevention of taint laundering when one assistant summarizes data for another
Provenance tags are monotonic across message boundaries: any summary or plan produced by an agent that read untrusted input inherits the untrusted label automatically.
Stopping recursive ping-pong loops between planner and critic agents
Every inter-agent message carries a monotonically increasing hop counter and a cycle-detection set of visited agent identifiers, halting execution immediately when a cycle or hop bound is reached.