AG08 describes the vulnerability that exists between agents — the absence of isolation boundaries, output validation, circuit breakers, and graceful degradation that allows a failure in one agent to propagate through to every dependent component.

It doesn't matter how the failure started. The question AG08 asks is: once a failure occurs in agent A, does the system architecture prevent that failure from reaching agents B, C, and D? If not, the system has an AG08 vulnerability — regardless of what caused A to fail.

AG08 applies equally to accidental failures (bad data), environmental failures (overload), and adversarial triggers (compromised input). All three produce the same cascading propagation pattern when the architecture lacks isolation.

Not: The initial compromise of an agent. How an individual agent gets manipulated, tricked, or exploited is covered elsewhere in the top 10. AG08 begins at the moment a failure is present in an agent's output and asks: what happens next?

Not: A single agent producing bad output and being the only harm. If an agent fails and the failure is contained — detected, logged, and the pipeline stops or falls back — that is AG08 mitigated, even if the agent's individual behavior was a problem.

Not: Software bugs within a single agent. A coding error in an individual agent's logic is a standard software quality issue. AG08 is the architectural pattern that allows such bugs (or external failures) to propagate beyond the agent where they originate.

Not: A specific harm type. AG08 is a propagation mechanism. The harms it produces — wrong actions, resource exhaustion, unauthorized operations — are downstream consequences of the missing isolation architecture.