Shared State Poisoning in Multi-Agent Systems: Blackboards, Handoffs, and Session Smuggling

Shared state poisoning is SSA descriptive wording for a security-relevant change to state that more than one agent, session, or component reads as trusted: a blackboard entry, an agent-to-agent (A2A) message payload, a shared memory record, or a handoff artifact one agent writes for another to consume. The defining cause is adversarial. Accidental cross-contamination with no adversary is a separate problem, covered below.

What it is

The defining object is any state artifact more than one agent or session treats as authoritative rather than as private working memory. The defining cause is an attacker who controls or compromises one participant, message, or contributor to the shared object and uses that position to write content a different agent will later trust without independently re-verifying it. The defining consequence is that a second agent's context, memory, plan, or authorized action changes because it read the poisoned shared object, not because it was itself directly compromised. This differs from single-agent poisoning mainly in reach: a poisoned private context affects one agent's own later decisions, while a poisoned shared object can affect every reader of a blackboard, vector store, or handoff queue.

What it is not

Ordinary private context or session-only memory no other agent reads, covered by compromised summaries and context compaction unless it is itself shared or handed off.
Accidental cross-user or cross-session contamination with no adversary. The 2026 paper *No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents* (arXiv 2604.01350) reports contamination rates of 57 to 71 percent under raw shared-state conditions from ordinary reuse of prior users' information, with text-level sanitization insufficient against executable artifacts that silently produce wrong results (arXiv 2604.01350). That outcome belongs to behavioral state decay, not to this working term, unless an adversary caused, induced, or exploited the specific event.
Model-weight attacks, training-data poisoning, and product-specific exploit procedures or reproducible payloads.

In scope

Deliberate writes to blackboards, shared vector memory, message buses, or handoff payloads intended for other agents or sessions.
Compromise of one agent or channel used as a pivot to influence state another agent trusts.
Stateful multi-turn exchanges where hidden instructions are inserted between legitimate agent-to-agent turns.
Propagation of a poisoned shared object into new sessions, agents, or durable storage.
Defensive controls for provenance, isolation, verification, containment, and recovery of shared state.

Target state and trust boundaries

The target state is whatever object sits at the coordination layer between agents: a blackboard record, an A2A message, a shared tool-result cache, or a memory store multiple agents read and write. The relevant trust boundary sits around the shared object itself, not around any single agent: which writers are authorized, which readers treat the object as ground truth, and whether a reader can distinguish an authoritative peer's output from relayed or attacker-influenced content. Multi-agent architectures often extend implicit trust across this boundary by default, since the protocol was designed for cooperation rather than adversarial input, so a compromised or spoofed participant inherits the trust given to any legitimate one.

Preconditions and impact

Three conditions are usually present: an adversary needs a position that can write to or influence shared state (a compromised agent, a spoofed participant, a poisoned tool result copied into shared memory, or an injected mid-session exchange); the shared-state layer must accept that content without sufficient authentication or verification; and at least one other agent or session must read and act on the poisoned object without independently re-validating it.

Resulting effects include propagation of a false belief or altered goal to agents that never saw the original untrusted input, authority misuse where a downstream agent executes an action it would not have authorized on direct evidence, and cascading contamination where a shared store keeps re-serving the poisoned record to new sessions.

Persistence

A poisoned message in a single handoff can affect one downstream turn. A poisoned blackboard or shared memory entry can affect every subsequent reader until corrected, making persistence a property of the shared store's own lifecycle rather than any one agent's session length.

What the research establishes

Palo Alto Networks Unit 42 documented agent session smuggling, an attack against stateful A2A communication, on 2025-10-31. A malicious or compromised remote agent uses an already-established cross-agent session to inject covert instructions between otherwise legitimate requests and responses, so the exchange looks unremarkable while the victim agent's operative state is altered. The researchers demonstrated exfiltration of system configuration, tool schemas, and conversation history, plus unauthorized tool invocations such as trades the user never approved. Proposed mitigations include out-of-band confirmation for sensitive actions, checks that a remote agent's instructions stay aligned with original user intent, cryptographically signed agent identity cards, and exposing inter-agent activity to users rather than hiding it in the orchestration layer (Unit 42, Agent Session Smuggling Attack in A2A Systems).

More broadly, the research agenda *Open Challenges in Multi-Agent Security* (arXiv 2505.02077, v2, 2026-04-29) frames this as a network problem: effects like privacy breaches, disinformation, and data poisoning can spread across interacting agents, and free-form inter-agent protocols create room for coordinated attacks harder to observe than single-agent misbehavior (arXiv 2505.02077). This article does not reproduce the session-smuggling technique or any coordinated-attack construction; it treats both as evidence that shared coordination state is a distinct target.

Detection: observable signs

A shared object changes without a corresponding authorized write from a recognized participant.
An agent treats another agent's relayed content as ground truth rather than an observation needing independent verification.
Multiple agents repeat the same unsupported claim shortly after reading one shared artifact.
A downstream agent executes a tool call that does not match the intent of the original, human-visible request.
Session logs show extra inter-agent exchanges with no corresponding user-visible turn.

Useful telemetry includes sender identity and authentication status, the full inter-agent exchange rather than just the visible summary, write provenance for shared memory, and a mapping from each downstream action back to the read that authorized it.

Defenses, containment, and recovery

The table below is SSA editorial guidance. It is neither a standard requirement nor a measured effectiveness ranking.

| Control | Transition it interrupts | Applicability | Residual risk and verification | | --- | --- | --- | --- | | Signed agent identity and message authentication | Unverified or spoofed writer to shared state | A2A and multi-agent protocols | A compromised legitimate agent still holds a valid signature; pair with content checks. | | Context-intent grounding | Injected instructions surviving as an operative goal | Stateful multi-turn exchanges | Fooled by patient, incremental drift; test multi-turn, low-salience injections. | | Least-privilege per-agent authorization | Poisoned shared object becoming an unauthorized action | Tool-using multi-agent systems | Limits blast radius but not the belief; exercise deny paths with a poisoned-state scenario. | | Full inter-agent exchange logging | Hidden exchanges invisible to human oversight | Orchestration layers that hide sub-turns | Helps only if reviewed; alert on exchange counts deviating from user-visible turns. | | Quarantine and re-derivation | One poisoned object serving new readers | Persistent shared memory or blackboards | Cached copies may already be distributed; track readers and force re-fetch. |

Prevention should authenticate writers and keep sensitive actions behind independent, non-model authorization. Detection should log the full inter-agent exchange, not only what a human sees, and compare downstream actions against originating intent. Containment should quarantine the suspect object and identify every reader before deletion. Recovery should restore shared state from a verified source, revalidate actions taken while the object was live, and keep high-impact actions disabled until invariants pass.

Boundaries with similar concepts

Memory poisoning targets state one agent reads for itself; this working term targets state built for more than one reader, so a durable memory record qualifies once another agent or session reads it as trusted. A compromised summary becomes a shared-state poisoning case once it is handed off or written to a shared store, but stays within that article's narrower scope if session-only. Contamination with no adversary stays a reliability property, not this working term — the same causal test applies: look for a party that caused, induced, or exploited the write.

Mapping to standards and research

| Source | Source-owned term or item | Relationship to this article | | --- | --- | --- | | Unit 42 (2025-10-31) | Agent Session Smuggling | Documented named attack on stateful A2A sessions; direct evidence for this entry path. | | arXiv 2505.02077 (v2, 2026-04-29) | Multi-agent security, network-effect propagation | Framing for why shared coordination state is a distinct target. | | arXiv 2604.01350 (2026-04-01) | Unintentional cross-user contamination | Boundary evidence that degradation can occur without an adversary. | | OWASP Agentic Top 10 2026 | `ASI06 Memory & Context Poisoning`; `ASI07 Insecure Inter-Agent Communication` | Broader risk categories for poisoned state and unsafe agent channels. | | MITRE ATLAS v2026.06 | `AML.T0080`; `AML.T0080.001 Thread` | Attacker-behavior classification for context poisoning via a shared thread. | | Agent State Attack | Shared state poisoning | SSA descriptive phrase, not attributed to the sources above. |

Related terms

Agent state attack: the SSA Working Term this article's scope sits under.
Compromised summaries and context compaction: the state surface this article extends to shared readers.
OWASP and MITRE ATLAS crosswalk: the broader framework mapping.
Behavioral state decay: the non-adversarial boundary for cross-session contamination.

FAQ

Is "shared state poisoning" a standard term?

No. It is SSA descriptive wording built on OWASP's `ASI06` and `ASI07` categories, MITRE ATLAS's `AML.T0080` family, and the documented agent session smuggling attack. None of those sources use this exact phrase.

Does this require a multi-agent framework to apply?

It requires more than one reader of the same state object: multi-agent frameworks, agent-to-agent protocols, or simpler patterns such as one agent's output written to a store a second session later reads.

Is agent session smuggling the only relevant attack?

No. It is one documented example used here as evidence that this entry path is real and has been demonstrated against production-style A2A communication. Any write path into shared state that another agent trusts falls in scope.

Sources

Verification and change history

Standards and versions referenced: OWASP Top 10 for Agentic Applications, Version 2026 (December 2025); MITRE ATLAS, data release v2026.06 (2026-06-30); arXiv 2505.02077, v2 (2026-04-29); arXiv 2604.01350 (2026-04-01).

Last verified: 2026-08-07. The Unit 42 publication date and technique description were read from the source article; the arXiv titles and dates from their abstract pages; the OWASP and MITRE identifiers were reused from this site's previously verified crosswalk entries.

Change history: 2026-08-07, initial defensive draft. Not scheduled for publication.

Working-term label: **Mixed provenance.** "Agent Session Smuggling" is a Unit 42 research/industry term. `ASI06`, `ASI07`, and `AML.T0080` are Standard Terms owned by OWASP and MITRE. "Shared state poisoning" is SSA descriptive wording, not a standard term.