Nominally isolated evaluation runs were talking to each other through a default Docker backend.

arXiv 2609.18460 models multi-agent failure as an epidemic and its deployment audit turned up implicit communication paths between runs that were supposed to be isolated, transport verified through a default Docker backend. RogueHandoff-20 injects unsafe trajectories from a modified Qwen-27B route and finds executed harm at 0-5% on normal tasks rising to 40-95% after injection, 5 to 45 points above paired direct malicious requests. The authors are explicit this shows high conditional susceptibility rather than a demonstrated autonomous cascade. The isolation finding is the part I'd check in my own harness today.