Odingard Security blog

Transitive Taint Propagation: Containing Poisoned Writes in Shared Agent State

andre.byrd@odingard.com (Andre Byrd) — Sun, 04 Oct 2026 09:14:22 GMT

Multi-agent AI systems increasingly coordinate through shared state: a common memory, blackboard, or retrieval store that many agents read from and write to. That design makes agents more capable. It also creates a security problem most stacks do not address: if one write is poisoned, honest agents can read it, act on it in good faith, and write new records that carry the poison forward. By the time anyone notices, the damage has spread through the field.

This post explains transitive taint propagation (TTP), a primitive for tracing and containing that spread, and summarizes what our measurements show so far. It draws on two preprints published on Zenodo. Both are preprints and have not been peer reviewed.

Key findings

Across three model families (Claude Haiku 4.5, Claude Sonnet 4.5, and Gemini 2.5 Flash), a read-relevance gate raised blast-radius precision from 80% to 100% in the same threshold band.
Across six agent topologies, precision reached 100% in every one. The recall cost varied by workload and is reported per topology.
Ground truth cannot be assumed. Under-declared dependencies were about 0% in five topologies and 50% in one (plan-execute).
Two instrumentation fixes closed specific gaps: cross-session recall rose from 33% to 100%, and plan-execute precision rose from 46.2% to 88.5%.

The Unverified-Writer Gap

Shared-state systems usually answer two questions well. Authentication tells you who wrote a record. Concurrency control tells you when writes happen and in what order. Neither tells you whether a write is trustworthy before it becomes shared reality, and neither traces what happened downstream once a write turns out to be bad.

We call this the unverified-writer gap. Trust in a shared field is transitive. An honest agent can read a poisoned record and produce a derived record of its own, under its own valid identity. Every access check passes. The poison has now been laundered through an agent you trust.

This is the same pattern that makes indirect prompt injection dangerous for single agents, scaled up to a whole system. One injected record can become many.

How Transitive Taint Propagation Works

TTP does three things.

Record dependencies at write time. When an agent writes to shared state, the system records which earlier records the write depended on. Those links form a trust-dependency graph.
Compute the blast radius on detection. When a record is later identified as poisoned, the system walks the graph forward to find every downstream write that depended on it, directly or through a chain of other writes.
Contain the tainted subgraph. Those records are quarantined. The rest of the field keeps running, and nothing has to be re-verified from scratch.

The key design choice is recording provenance at write time. Trying to reconstruct dependencies after an incident is slow and unreliable. Recording them as writes happen makes containment a graph traversal.

The first paper specifies the model, the propagation rule, and the containment operation. It argues for three properties a correct implementation needs: containment soundness (everything that depended on the poison is caught), bounded over-containment (it does not quarantine far more than necessary), and tractability at scale. It also states plainly what remains to be proven formally and shown empirically.

What We Measured

The empirical companion tested TTP on real, instrumented agent traces rather than only a synthetic oracle. The question it set out to answer was generalization: does the approach hold beyond one model and one agent layout?

It holds across model families

The method depends on a premise: when an agent reads a record and then writes, the write actually derives from what it read. That premise held in all three model families tested. Adding a read-relevance gate, which filters out reads that did not actually influence a write, lifted blast-radius precision from 80% to 100%. The same threshold band worked for every family.

It holds across topologies, with a recall cost

Across six agent topologies, the gate reached 100% precision in each. Recall did not always reach 100%. The losses fell where the paper's two published boundaries predict: dependencies carried across sessions, and information that is paraphrased so heavily it no longer matches. Each cost is reported per workload rather than averaged away.

Ground truth has to be measured

The method relies on agents' recorded dependencies being complete. In five of six topologies, under-declaration was about 0%. In the plan-execute topology it was 50%. That is the most important practical lesson in the study: you cannot assume your dependency records are complete. You have to measure them for each workload.

Two gaps were closed with better instrumentation

An observable carry channel recovered a cross-session dependency edge, raising recall on a no-re-read handoff from 33% to 100%.
Logging inputs at the retrieval layer, instead of relying on what agents self-report, raised measured precision on plan-execute from 46.2% to 88.5%.

Why This Matters for Security Teams

Most agent security today focuses on a single agent and a single action: should this tool call be allowed? That is necessary. It does not answer what happens after a bad write gets into shared memory and other agents start building on it.

TTP gives incident response a concrete answer to three questions: what did this poisoned record touch, what can we safely keep running, and how do we prove the scope of the incident to an auditor? Because dependencies are recorded as writes happen, the answer is a graph query, not a forensic reconstruction.

It also changes how you instrument agents. The results show that dependency records are only as good as the place you capture them. Self-reported provenance can miss half the edges in some topologies. Capturing inputs at the retrieval layer is more reliable.

Limits and Open Questions

Both papers are preprints and have not been peer reviewed.
Formal proofs of the containment properties are stated as open work, not completed.
Recall drops under cross-session carry and heavy paraphrase unless extra instrumentation is added.
Correct containment can itself be turned into an attack, by steering poison so that containment disables large amounts of legitimate state. Our later work on containment denial-of-service examines that problem directly.

Read the Papers

Byrd, A. Transitive Taint Propagation for Shared Agent State: A Trust Primitive for the Verified Field. Zenodo preprint. doi:10.5281/zenodo.20786402
Byrd, A. Transitive Taint Propagation for Shared Agent State: Measured Generalization Across Models and Topologies, An Empirical Companion (v0.3). Zenodo preprint. doi:10.5281/zenodo.20838847

More of our work is listed on the Odingard research page. For how runtime enforcement fits alongside containment, see Cyber Security and AI: Enterprise Defense in 2026 and Cerberus.

Running multiple agents on shared memory? Request an AI agent security assessment.

Cyber Security and AI: Enterprise Defense in 2026

andre.byrd@odingard.com (Andre Byrd) — Sun, 04 Oct 2026 05:15:21 GMT

Artificial intelligence now sits on both sides of the security equation. Enterprises use it to detect and contain attacks faster, and they also deploy AI systems that create attack surfaces traditional controls were never built to see. In the World Economic Forum's Global Cybersecurity Outlook 2026, 94% of surveyed leaders said AI will be the most significant driver of change in cybersecurity this year, and 87% named AI-related vulnerabilities as the fastest-growing cyber risk.

That creates a dual mandate: use AI to strengthen defense, and secure the AI you deploy. This guide covers both, with a focus on the second, which is where most organizations are least prepared.

The Dual Nature of AI in Cybersecurity

Attackers use AI to automate reconnaissance, write convincing personalized phishing at scale, and adapt malware to evade signature-based detection. These attacks run at machine speed, which overwhelms teams that rely on manual triage.

Defenders use the same technology to establish behavioral baselines, correlate signals across millions of events, and trigger containment in seconds. The organizations that benefit most treat AI as an accelerator for an existing security program, not a replacement for one.

How AI Transforms Threat Detection and Response

AI-driven security delivers value in three areas:

Anomaly detection. User and entity behavior analytics (UEBA) and AI-enhanced EDR learn what normal looks like for users, devices, and workloads, then flag deviations such as off-hours access to sensitive databases or unusual data transfers.
Automated response. SOAR platforms connected to SIEM, identity, and endpoint tools can isolate a host, disable a compromised account, and preserve forensic evidence within seconds of detection.
Vulnerability prioritization. Correlating vulnerability data with threat intelligence and asset criticality focuses limited patching capacity on what attackers are most likely to exploit.

Securing AI Systems: Runtime Protection

AI applications and agents introduce risks that static testing cannot catch. An agent that can read data, call tools, and reach external services can be manipulated through its inputs. Prompt injection tops the OWASP Top 10 for LLM Applications for that reason.

The most dangerous pattern combines three conditions in one agent: privileged access to sensitive data or systems, exposure to untrusted input, and a path to send data out. When all three are present, a single injected instruction can turn a helpful agent into an exfiltration channel.

Runtime protection addresses this by monitoring what an AI system actually does in production: inspecting tool calls as they happen, enforcing policy before an action executes, and blocking unsafe actions in real time. Pre-deployment testing still matters, but it cannot anticipate every input an agent will see once it is live.

Beyond runtime, AI security covers the full lifecycle: training-data provenance to resist poisoning, model integrity verification, input validation, and adversarial robustness testing.

Governance and Shadow AI

Employees adopt AI assistants, coding tools, and automation agents faster than security teams can review them. Effective governance needs four things: an inventory of AI systems in use, policy controls on which tools are approved, continuous monitoring of AI behavior and data flows, and audit trails that document AI-driven decisions.

The WEF report shows progress here: the share of organizations with a process to assess the security of AI tools before deployment rose from 37% in 2025 to 64% in 2026. That still leaves roughly one in three without one.

Compliance for AI Deployments

Regulation is catching up. The EU AI Act sets risk-based obligations, with high-risk systems facing requirements for transparency, human oversight, and technical documentation. For the most serious violations, fines can reach €35 million or 7% of global annual turnover, whichever is higher. In the United States, many organizations use the voluntary NIST AI Risk Management Framework as their baseline.

Because AI systems change as data and prompts change, compliance cannot be a point-in-time exercise. Regulators increasingly expect continuous evidence: model versions, data lineage, configuration changes, and records of what the system did.

Choosing AI Security Tooling

When evaluating platforms, look at:

Coverage: whether the tool secures AI systems themselves, or only uses AI to improve traditional detection.
Enforcement point: whether it can block an unsafe action before it executes, or only alert afterward.
Integration: fit with your agent frameworks, SIEM, and identity stack.
Evidence: audit trails that hold up in a compliance review.
Total cost: licensing plus the staff time to tune and operate it.

How Odingard Security Helps

Odingard Security builds tools for the second half of the dual mandate: securing the AI agents you deploy.

Cerberus is an open-core runtime enforcement engine for AI agents. It inspects tool calls as they happen and blocks the privileged-access, untrusted-input, and exfiltration combination described above. It works with LangChain, OpenAI Agents, Vercel AI, and MCP-based agents.
ARGUS is an autonomous AI red team platform. It attacks your agents the way an adversary would, so you find exploitable paths before someone else does.

Want to know how exposed your agents are today? Request an AI agent security assessment.