The most common cause. An agent encounters unexpected input — a malformed API response, an empty dataset, a timeout that produces a partial result — and produces incorrect output as a result. No attacker involved. The pipeline simply wasn't designed to detect and isolate the bad output before propagating it.

Examples: External API returns partial data during a high-traffic period. Upstream agent's underlying model hallucinates a data field. An agent processes input from a source that changed its schema without notice.

A spike in demand, a slow external dependency, or memory pressure causes one agent to become a bottleneck. Requests queue up. Timeouts propagate. Downstream agents that depend on the bottlenecked agent either receive stale data, no data, or trigger their own overload as they retry.

The thundering herd variant: All downstream agents detect the failure simultaneously, retry simultaneously, and the combined retry load overwhelms the recovering agent — extending the outage far beyond the original cause.

An attacker who can control one agent's output — through prompt injection, a compromised data source, or a supply-chain attack on a tool the agent uses — can craft output that is specifically designed to cause harmful behavior in downstream agents. This converts a single-agent compromise into a pipeline-wide attack.

Why this is more dangerous than direct attack: Each downstream agent is a legitimate, trusted component executing its designed function. Defenders see authorized actions being taken by authorized agents. The attacker's instructions are laundered through multiple legitimate steps before producing visible harm — making attribution and detection much harder than a direct attack on the terminal agent.

Note on scope: The cascade mechanism is the vulnerability here. The initial compromise of the upstream agent is covered by other entries in the top 10. AG08 focuses on what happens after a failure originates — regardless of how it started.