As agents delegate to other agents, a new failure mode appears: a single bad output — an error, a hallucination, a compromised decision — is consumed by the next agent as trusted input, and the problem compounds down the chain. By the time it surfaces, the damage can be several hops from its origin, and no single agent looks obviously at fault. In the OWASP Top 10 for Agentic Applications it is ASI08, Cascading Failures.
What a cascading failure is
In a multi-agent system, agents tend to trust one another’s output by default. One agent produces a result; the next treats it as ground truth and acts on it; its output feeds a third. When the first result was wrong — whether from a bug, a hallucination, or a prompt injection — the error does not stay put. It propagates, and often amplifies, as each agent builds on the last. Patient zero is frequently unremarkable; the damage is emergent, a property of the chain rather than any one link.
Why it is hard to investigate
- The damage is far from the cause. The harm appears several hops downstream, so the agent that surfaced it is rarely the one that started it.
- No single agent is clearly at fault. Each did its job on the input it was given — the failure is in the hand-offs, not the individuals.
- Trust is implicit. Agents accept each other’s output without challenge, so there is no rejection or error to flag at the boundary.
- The chain spans systems. Each agent logs separately, so the propagation path is fragmented across the very logs you need to join.
The investigation, step by step
1. Map the delegation chain
Establish which agents were involved, who delegated to whom, and in what order. The chain is the structure the whole investigation hangs on.
2. Fuse the chain onto one timeline
Order every agent’s actions across every system into a single sequence, so the hand-offs become visible as a connected path.
3. Find patient zero
Walk the chain back to the first agent whose output was wrong — the origin of the cascade, however unremarkable it looks in isolation.
4. Trace the propagation path
Follow the bad output forward, hop by hop, showing how it moved between agents and amplified at each step into the eventual damage.
5. Determine where it could have been caught
Identify the missing validation or trust boundary — the hand-off where a check would have stopped the cascade.
6. Establish total blast radius and report
Account for every agent, system, and action the cascade touched, and produce a defensible account that shows the path, not just the endpoint.
What to collect
| Source | What it tells you |
|---|---|
| Inter-agent message logs | What each agent passed to the next — the hand-offs themselves |
| Per-agent trace logs | How each agent acted on the input it received |
| Orchestration / delegation logs | The structure of the chain and who called whom |
| Tool-call logs per agent | The downstream actions each agent took |
| Identity logs | Which identity each agent acted under across the chain |
Common mistakes
- Investigating where the harm appeared. Focusing on the agent that surfaced the damage instead of walking back to the origin.
- Treating agents in isolation. Examining each one alone and never reconstructing the hand-offs that connect them.
- Assuming the loudest failure is the cause. Mistaking the largest downstream effect for patient zero.
- Ignoring the trust boundaries. Fixing the agents without addressing the unchallenged hand-offs that let the error spread.
Where Agent Autopsy fits
Agent Autopsy reconstructs a multi-agent incident as one connected story rather than a set of disconnected agent logs: it fuses the chain onto a single timeline, finds patient zero, and traces the propagation path forward to the damage — including where a cascade ends in data exfiltration or began with a poisoned memory. It is one application of AI agent forensics, and slots into the wider incident-response process. See how it works, or how it is validated.
Frequently asked questions
How do you find the origin of a multi-agent cascade?
By mapping the delegation chain, fusing every agent’s actions onto one timeline, and walking backward to the first agent whose output was wrong. Patient zero is often unremarkable on its own, which is why it is only findable once the whole chain is reconstructed as a connected path.
Why is no single agent at fault?
Because each agent did its job on the input it was handed. The failure lives in the hand-offs — one agent’s bad output trusted as another’s input — so the cascade is a property of the chain and its missing trust boundaries, not of any individual agent.
How is this different from a single-agent incident?
The cause and the damage are separated across agents, not just across time. Attribution and propagation dominate: the work is to reconstruct who passed what to whom, find where the error entered, and show how it amplified down the chain to the point the harm became visible.