A Poisoned Validator Agent Can Stay Compromised at 100% and Still Produce 0% Unsafe Actions

arXiv 2609.17648·medium signalXBlueskyLinkedInCopy link

arXiv 2609.17648 (15 Sep 2026) studies attack propagation through a four-agent LangGraph pipeline of Supervisor, Researcher, Validator and Executor, testing shared-memory poisoning and indirect prompt injection via a forged approval in a retrieved document. Across three seeds and 60 labeled tasks, memory poisoning reached execution in every undefended trial; adding task-bound signed tokens and a separately verified policy oracle left the Judgment Bypass Rate at 100% while the Unsafe Action Rate fell to 0%. The design lesson is that containment belongs in an independent authorization layer rather than in the reviewing agent's judgment, which the paper's new JBR metric exists to make visible.