When one AI agent hands work to another, and that one to a third, the instructions do not stay intact. They drift, the way a sentence mutates as it passes down a line of whispering children. A heise+ analysis argues that this telephone-game effect is not a curiosity but a structural risk in agentic systems now being deployed in production.
In a single model call a human can read the prompt and see the answer. In a chain of agents, each hop summarises, re-interprets and re-prioritises. Small misunderstandings compound rather than cancel: a constraint dropped at step two is gone by step five, a caveat attached to an instruction quietly disappears, and a narrow task can widen as it is restated. By the end, the original intent — and the provenance of a decision — may no longer be recoverable from the final output at all.
The consequences range from the merely annoying to the serious. A report can drift off-brief and nobody can say where. More troubling, an agent told to read a web page may act on instructions embedded in that page, a form of indirect prompt injection, and then pass the poisoned instruction onward to agents holding broader permissions than the one that was attacked.
The analysis points to mitigations that mirror decades of distributed-systems practice rather than anything exotic: keep instructions structured instead of passing free-text summaries between agents, verify at each hop rather than trusting the paraphrase, scope every agent's permissions to the minimum it needs, and log each hand-off so that a final action can be traced back to the intent that authorised it.
The uncomfortable part is that the failure is quiet. Nothing crashes and no exception is raised; the chain produces something plausible that is simply not what was asked for. Systems that treat an agent's summary as ground truth inherit exactly that silence.
