Many agent pipelines share infrastructure: a vector database used by multiple retrieval agents, a shared LLM API endpoint, a common tool server, a central state store. When a shared dependency fails, every agent that depends on it fails simultaneously — creating a blast radius proportional to the number of sharing agents.

The deeper the dependency, the wider the failure: A failure in a tool used by one specialized agent is contained. A failure in the shared state store used by the orchestrator, all sub-agents, and the monitoring system produces a simultaneous outage of the entire pipeline — including the monitoring that would detect and respond to the outage.

Why agents don't naturally isolate shared dependencies: Agent orchestration frameworks encourage composition — building complex pipelines from shared components. The same property that makes a shared vector database efficient (one update visible to all agents) makes it a single point of failure: one corruption visible to all agents. The efficiency and the fragility come from the same architectural decision.

Cascading shutdown: In many pipelines, when an agent detects that its dependency is unavailable, it marks itself unavailable. The agents that depend on it detect that, and mark themselves unavailable. The cascade of "dependency unavailable" signals propagates upward, shutting down the entire pipeline from the bottom up.

An attacker deliberately crafts the failure in the initial agent to produce specific downstream effects — using the cascade mechanism as an attack amplifier. Instead of attacking the terminal action-taking agent directly (which may have strong controls), the attacker targets a less-protected upstream agent and engineers an output that, after being processed by intermediate agents, produces the desired harmful action downstream.

Why this is harder to defend than a direct attack: Each intermediate agent's processing transforms the attacker's instructions, making attribution difficult. The final harmful action is taken by a legitimate, authorized agent — it appears to be operating normally. The attacker's fingerprints are several hops upstream, in an agent that may have weaker monitoring.

The stepping-stone pattern: Attack a data retrieval agent → craft output that instructs the analysis agent → analysis agent produces a recommendation that instructs the action agent → action agent takes the attacker-desired action. Three agents, all working correctly. One attacker who only touched the first.