The False Assumption
At some point, someone building an agentic framework made a quiet assumption: if an agent produced it, the next agent can trust it. That assumption is now running inside every major agentic platform. It wasn’t announced. It wasn’t debated. It just shipped, and it’s still there.
Ask any agentic framework vendor about prompt injection and grab a coffee, because you’re going to be there a while. Governance platforms aren’t much better; everyone’s racing to claim the best constraint layer, the tightest policy engine, the most robust guardrails. And honestly? That work matters. But it’s all pointed at the same place. The front door. Who’s knocking, what are they carrying, should we let them in.
Nobody’s talking about what happens once they’re inside.
The security community isn’t completely silent on this. OWASP named it explicitly in their 2026 Top 10 for Agentic Applications: ASI07, Insecure Inter-Agent Communication. The official definition says exchanges between coordinating agents lack proper authentication, integrity verification, or policy constraints. Named, catalogued, assigned a number. The industry knows it exists.
And the industry is still trying to fix it with the wrong tools, because most people building the response fundamentally misunderstand the architecture of an agentic handoff.
When an agent finishes its job and passes context to the next one, something interesting happens. The receiving agent doesn’t question it. Doesn’t verify it. Just picks it up and keeps going, like it was always supposed to. And maybe that feels fine. But at some point it’s worth asking: who decided that? Because I don’t think anyone actually did. It just became the default.
That’s not your governance platform failing you. That’s the framework itself.
The Architecture Has No Checkpoint
So here’s a fun question. When one agent finishes its work and hands off to the next one, where exactly does that handoff happen? Like, physically, architecturally: where is the moment?
Most systems that pass information have edges, the boundaries where one thing stops and another begins. An API call has a sender and a receiver. A webhook fires and lands somewhere. An event queue has a message with a beginning and an end. Those boundaries are useful. That’s where you can intercept something, inspect it, decide if it should keep moving. The gap is the whole point.
Agent-to-agent handoffs don’t have that. Think of a shared Google Doc. One person stops typing, the other keeps reading. There’s no envelope. No moment of transfer. Just one continuous thing that keeps going. That’s closer to how most agentic frameworks pass context between nodes, one agent writes, the next picks up, and the stream never really breaks.
Which, to be fair, is why these systems feel fast and coherent. The continuous stream is a feature.
It’s also why there’s no place to put a checkpoint. Not because nobody thought to add one. Because the architecture genuinely doesn’t have room. Seams exist inside individual frameworks. What does not exist is a consistent enforcement surface that works across all of them. You can’t configure your way out of it. The architecture has to change.
The Blast Radius
LangChain. AutoGen. CrewAI. OpenAI. Anthropic. Pick your framework. They’re all impressive pieces of work: the orchestration, the routing, the ability to chain complex workflows together.
But go look for the part where one agent decides whether to trust another consistently, across every boundary, regardless of which framework or provider is on either side. Some frameworks have intervention points. AutoGen has handlers that can inspect and modify messages between agents. That work is real. But it is framework-specific, internally enforced, and does not extend to the boundaries between heterogeneous systems.
The moment two agents from different frameworks or providers need to talk to each other, that coverage stops.
And this isn’t me picking on specific vendors. That’s the point. This is an industry-wide assumption that got baked in so early nobody thought to write it down. The frameworks were built to answer “how do agents work together” and they answered that really well. Nobody asked “should agents automatically trust each other”, so that question just got skipped.
Researchers have tested this. A 2025 paper from the University of Calabria tested 18 state-of-the-art LLMs and found that 100% of them could be compromised through inter-agent trust exploitation. Not some. All of them. Including the ones that successfully resisted direct prompt injection. The models that passed the front door test failed completely once they were inside.
The vulnerability isn’t in the models. It is in the handoff.
Consequences of a Gap Nobody Closed
OpenAI’s own FAQ for Dots says this about prompt injection, one of the known ways malicious content can hijack an agent mid-task:
“These protections help reduce the risk of malicious instructions causing an unwanted action, but they do not eliminate it.”
That’s a direct quote. But sit with that sentence for a second. This is an always-on agent running across your email, your calendar, your Slack, your connected apps. Proactively in the background while you’re in a meeting or asleep.
OpenAI’s answer to governance is auto-review, custom rules, and safety monitoring. That’s real work. But all of it lives inside their stack. Their rules, their infrastructure, their enforcement. You can watch it. You can’t govern it.
The trust gap that every open source framework quietly shipped as a default didn’t stay in developer tools. It just landed in millions of consumer and enterprise accounts, running continuously, connected to basically everything.
That’s a different conversation than the one the industry has been having.
The Necessary Foundation
Here’s where it gets interesting. Because buried inside a small number of enterprise agentic deployments is an architectural pattern that actually creates the seam the industry is missing.
MuleSoft calls it the Omni Gateway. The idea is simple: instead of each agent in a graph calling its LLM provider directly, every LLM call routes through a central model proxy first. Every node. Every provider. Every call. The proxy is the hub. The agents are the spokes. Agent Fabric is built around this pattern natively — the proxy isn’t added on top, it’s the foundation.
It’s a governance play, obviously, but also something structurally more important. For the first time, there’s an actual moment between the agent and the model. A place where something can be inspected before it moves forward. The seam the framework was never built to have.
The hub exists, and Agent Fabric is already routing traffic this way across enterprise deployments, handling cost control, rate limiting, and provider-level policy enforcement at the proxy layer. It’s the most complete implementation of this pattern I’ve seen in production.
And the reason I’m writing about it is what becomes possible from here.
The Semantic Blind Spot
The hub-and-spoke proxy can validate a lot of things. HTTP structure. Auth headers. Schema conformance. Cost thresholds. Useful, but it stops at the surface.
What it can’t do today is look inside the message and understand what it means.
When Node 1 finishes and passes context to Node 2, that handoff is a conversation object. Most frameworks represent conversation objects with three role tags: system, user, or assistant; though providers handle the system role differently at the API level. Those tags are not decoration. The receiving model uses them to determine authority and intent. Which instructions to obey. Whose words carry weight. Inject content into the wrong role position or tamper with the sequence, and the model’s behavior changes in ways the proxy cannot catch. The proxy can inspect the envelope. It cannot tell whether the role assignments inside it are legitimate.
No proxy does this consistently, across all frameworks, across all providers, in one enforceable place. No policy engine checks whether the role sequence is coherent, whether it conforms to the target provider’s spec, or whether the conversation that arrived is actually the conversation that was sent. The proxy sees a well-formed HTTP request and waves it through. What’s inside is invisible to it.
That’s the gap inside the gap. The industry found the seam. Nobody’s built the policy that understands what passes through it.
Call it what you want. Semantic validation. Message sequence governance. LLM structural observability. The name doesn’t matter. The capability doesn’t exist yet — and in a world where agents are chaining across real systems and touching real data, the absence of it is doing a lot of quiet damage that nobody is measuring because nobody has built the instrument to measure it with.
The Architectural Mandate
The seam is the model proxy, the point where every LLM call can be intercepted before it reaches the provider. MuleSoft’s Omni Gateway is built on that seam. It handles routing, policy enforcement, rate limiting, and auth across providers before a single token gets forwarded. That part of the problem has an answer.
What does not have a full answer yet is what sits at that seam reading the conversation object before forwarding it. Not schema validation, which already exists and already misses this entirely. Something that reads the role sequence and asks whether it makes sense. Whether it ends where this provider expects. Whether either provider would accept it cleanly, or surface the error too late to stop it.
When something fails that check, rejection needs to be a designed outcome with a handler, not an exception that breaks the graph or lets bad context accumulate downstream. The seam exists to make that possible. That validator does not exist consistently, across frameworks, in one enforceable place yet.
So here is the question to bring to every framework and gateway evaluation. The question stops being where we can intercept all the messages. It becomes: how do we preserve and enforce trust semantics when context moves between independently implemented agents and models? That requires an enforcement surface that works across all of them, consistent, provider-agnostic, sitting at every boundary regardless of what’s on either side. Agent Fabric is built on exactly that surface.
Agentic systems are already in production. The trust gap is not theoretical. Every deployment running without conversation-level validation is running on an assumption that the context it receives is coherent, untampered, and correctly structured. That assumption has never been verified. Start asking whether it should be.
If the architecture in this article is relevant to what you are building or evaluating, these are worth reading:
- MuleSoft Agent Fabric Overview — How Salesforce uses Agent Fabric internally to unify agents behind a single broker: How Salesforce Tames Agent Sprawl with Agent Fabric.
- Omni Gateway — One gateway, 140+ LLMs, included in existing MuleSoft subscriptions: Any Model, One Gateway.
- Agent Fabric Product Overview — What the control plane covers: Registry, MCP Bridge, AI Gateway, governance, cost optimization.
- Getting Started with Agent Networks — Official MuleSoft documentation for deploying an agent network, including gateway setup and deployment targets.
- — the industry risk framework referenced in this article, including ASI07 on insecure inter-agent communication: genai.owasp.org
Sources: Lupinacci et al., “The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise,” arXiv:2507.06850 (2025) · Bappy et al., “Adversarial Attacks in Multi-Agent LLM Pipelines,” arXiv:2608.00718 (2026) · Cai et al., “When Child Inherits: Structural Trust Boundary Violations through Memory Inheritance,” arXiv:2605.08460 (2026) · Paul & Nandy, “Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems,” arXiv:2609.22949 (2026) · OpenAI, “Dots Privacy, Security, and Safety FAQs,” help.openai.com/en/articles/20001529, OWASP Gen AI Security Project, “OWASP Top 10 for Agentic Applications,” ASI07: Insecure Inter-Agent Communication (2026) · https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
