---
title: 'ASI08: Cascading Failures'
description: OWASP Agentic Top 10 reference for cascading failure vulnerabilities where single agent failures propagate through multi-agent systems
---

# 08 Cascading Failures

Identifier: ASI08:2026
Category: Resilience

## Description

Agentic cascading failures occur when a single fault (hallucination, malicious input, corrupted
tool, or poisoned memory) propagates across autonomous agents, compounding into system-wide harm.
Because agents plan, persist, and delegate autonomously, a single error can bypass stepwise human
checks and persist in a saved state.
As agents form emergent links to new tools or peers, these latent faults chain into privileged
operations that compromise confidentiality, integrity, and availability.

Cascading failures describes the propagation and amplification of an initial fault, not the
initial vulnerability itself, across agents, tools, and workflows, turning a single error into
system-wide impact.

Observable symptoms include rapid fan-out where one faulty decision triggers many downstream
agents, cross-domain or tenant spread beyond the original context, oscillating retries or
feedback loops between agents, and downstream queue storms or repeated identical intents.

## Risk

* System-wide harm from propagation of a single fault across autonomous agents and workflows.
* Compromised confidentiality, integrity, and availability through latent fault chains reaching
  privileged operations.
* Automated execution of unsafe steps without validation due to planner-executor coupling.
* Persistent error propagation through corrupted long-term memory that influences new plans and
  delegations.
* Governance drift from weakened human oversight after repeated success leading to unchecked
  configuration changes.
* Feedback-loop amplification where agents relying on each other's outputs magnify initial errors.
* Catastrophic defensive actions from propagation of hallucinated or injected false alerts across
  multi-agent systems.

## Vulnerability checklist

* A hallucinating or compromised planner emits unsafe steps that the executor automatically
  performs without validation.
* Poisoned long-term goals or state entries continue influencing new plans and delegations after
  the original source is removed.
* A single corrupted update can cause peer agents to act on false alerts or reboot instructions
  across regions.
* One agent's misuse of an integration or elevated credential leads downstream agents to repeat
  unsafe actions.
* A poisoned or faulty release pushed by an orchestrator propagates automatically to all
  connected agents.
* Human oversight weakens after repeated success and bulk approvals propagate unchecked
  configuration drift.
* Two or more agents rely on each other's outputs, creating a self-reinforcing loop that
  magnifies initial errors.

## Prevention controls

1. Design systems with zero-trust fault tolerance that assumes availability failure of agentic
   function components and external sources.
2. Sandbox agents with least privilege, network segmentation, scoped APIs, and mutual auth to
   contain failure propagation.
3. Issue short-lived, task-scoped credentials for each agent run and validate every high-impact
   tool invocation against a policy-as-code rule before executing it.
4. Separate planning and execution via an external policy engine to prevent corrupt planning from
   triggering harmful actions.
5. Implement checkpoints, governance agents, or human review for high-risk actions before agent
   outputs are propagated downstream.
6. Implement blast-radius guardrails such as quotas, progress caps, and circuit breakers between
   planner and executor.
7. Re-run recorded agent actions in an isolated clone to test whether sequences trigger cascading
   failures. Gate policy expansion on replay tests passing predefined blast-radius caps.

## Example attack scenarios

### Scenario A — Financial trading cascade

Prompt injection poisons a market analysis agent, inflating risk limits.
Position and execution agents auto-trade larger positions while compliance stays blind to
within-parameter activity.

### Scenario B — Healthcare protocol propagation

Supply chain tampering corrupts drug data. Treatment auto-adjusts protocols, and care
coordination spreads them network-wide without human review.

### Scenario C — Cloud orchestration breakdown

Poisoning in resource planning adds unauthorized permissions.
Security applies them, and deployment provisions backdoored, costly infrastructure without
per-change approval.

### Scenario D — Auto-remediation feedback loop

A remediation agent suppresses alerts to meet latency SLAs.
A planning agent interprets fewer alerts as success and widens automation, compounding blind
spots across regions.

### Scenario E — Agentic cyber defense hallucination

Propagation of a hallucinated imminent attack is propagated in underlying multi-agent systems,
causing unnecessary but catastrophic defensive actions such as shutdowns, denials, and network
disconnects.

## Detection guidance

* Detect fast-spreading commands across agent networks and throttle or pause on anomalies.
* Track decisions against baselines and alignment and flag gradual degradation.
* Monitor for rapid fan-out where one faulty decision triggers many downstream agents in a short
  time.
* Detect cross-domain or tenant spread of faults beyond the original context.
* Identify oscillating retries or feedback loops between agents and downstream queue storms.
* Record all inter-agent messages, policy decisions, and execution outcomes in tamper-evident,
  time-stamped logs bound to cryptographic agent identities.

## Remediation

* Deploy circuit breakers between planner and executor to halt cascading propagation.
* Isolate affected agents with least privilege and network segmentation to contain failure spread.
* Roll back corrupted persistent memory and state entries using version-controlled snapshots.
* Revoke task-scoped credentials for compromised agent runs and re-validate all downstream
  actions.
* Restore human oversight checkpoints for any governance drift identified during the cascade.
* Maintain lineage metadata for every propagated action to support forensic traceability and
  rollback validation.

---

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0
(<https://creativecommons.org/licenses/by-sa/4.0/>).
Modifications: Restructured into agent-consumable reference format with added
detection and remediation guidance.