A cascading failure — ASI08 in the OWASP Top 10 for Agentic Applications 2026 — is a single agent's error amplified through an orchestrated system until the damage is systemic: a wrong classification becomes an escalation, the escalation triggers automation, the automation disrupts a pipeline whose monitoring agent escalates again. The defining property is amplification. The initial fault is often trivial; the trust structure between agents is what turns it into an incident.
This risk needs no attacker. Multi-agent systems inherit the failure dynamics of distributed systems — cascades, retry storms, feedback loops — and add a new accelerant: stages that consume each other's content as trusted truth, at machine speed, with real-world side effects. This post covers the cascade mechanics and the containment architecture. It is one spoke of the complete OWASP Agentic AI Top 10 guide.
The three cascade mechanics
1. Error propagation: wrong data, trusted onward. Agent A produces an incorrect output — a hallucinated fact, a mislabeled severity, a wrong entity match. Agent B consumes it as ground truth and acts. By the third hop the original error has been laundered into "system knowledge": summarized, recorded, propagated into agent memory, and used to justify actions in systems that never saw the original claim. The multi-agent version of garbage-in-garbage-out has a crucial difference: each stage adds authority to the garbage, because downstream consumers see it arriving from a trusted internal peer rather than from the untrusted source that originated it.
2. Feedback loops: agents re-triggering each other. Agent A's action creates a condition that activates agent B, whose response creates a condition that re-activates A. A monitoring agent flags an anomaly; a remediation agent restarts a service; the restart produces anomalous metrics; the monitoring agent flags harder. Humans in the loop dampen such cycles naturally — they get suspicious the third time the same alert fires. Agents, without explicit loop detection, escalate them at machine speed.
3. Resource storms: retries and fan-out multiplying consumption. A failing downstream dependency meets naive retry logic across a fleet of agents, each retry spawning model calls, tool calls, and sometimes sub-agents. Fan-out orchestration multiplies this: one stuck task re-dispatched to five specialists is five times the burn, recursively. The financial expression of this mechanic is the runaway-spend threat model; the operational expression is your downstream systems experiencing what is functionally a self-inflicted denial of service.
An attacker, of course, can induce any of these deliberately — a goal-hijacked agent seeded with subtly wrong outputs, or a poisoned input crafted to trigger a known feedback pair. The controls are the same either way, which is why ASI08 is worth engineering against even if you believe your agents will never be targeted.
Why cascades are a governance failure, not a model failure
The instinctive response to cascade risk is "make the agents more accurate." Accuracy helps, but it misdiagnoses the problem: cascades are caused by unbounded trust between stages, not by any single stage's error rate. A system where every agent is 99% accurate but every output is trusted absolutely will cascade; a system with mediocre agents but validated boundaries and bounded blast radii will not. The engineering target is the structure, and the structure is enforceable at the control plane — the same runtime enforcement layer that governs identity and content.
The containment architecture
Circuit breakers between stages
Every inter-agent connection carries thresholds — error rates, output anomaly scores, invocation frequency — beyond which the connection suspends rather than retries. Breakers convert "stage B is misbehaving" from a propagating condition into a contained one, and they are the shared primitive with A2A security: the same connection-level machinery that suspends a malicious peer suspends a malfunctioning one. Include backoff with jitter and retry ceilings per connection, so transient downstream failure produces bounded, decaying load rather than a synchronized storm.
Validation at stage boundaries
End-to-end trust is the cascade's fuel; boundary validation is its firebreak. Downstream agents verify upstream claims that carry consequences: schema and range checks structurally, source-verification for claims that gate sensitive actions ("re-check the severity against the raw signal before paging"), and guardrail inspection of inter-agent content in-band. Boundary validation also restores provenance — recording which stage asserted what, so an error discovered at hop four can be traced to and purged from every hop, rather than persisting as anonymous system knowledge in the audit record.
Budgets, rate limits, and concurrency caps per scope
Resource governance is cascade containment with a price tag. Per-agent and per-workflow budget caps with reservation-based enforcement put a hard ceiling on what any loop can consume before it stops; rate limits bound how fast a feedback pair can cycle; concurrency caps bound fan-out amplification. Scope layering matters: an agent-level cap catches the local loop, the workflow cap catches the distributed one, and the organization ceiling is the backstop that guarantees the worst case is an incident, not a quarter-defining invoice.
Loop detection
Feedback cycles deserve explicit detection, not just rate limiting: correlation of recurring trigger patterns (the same alert-remediate-alert signature within a window), hop-count or causation-chain limits on task lineage — a task whose ancestry chain exceeds a depth threshold gets escalated to a human rather than re-dispatched — and dampening rules that require novel evidence before re-triggering a previously-fired pathway.
Independent kill paths
When containment thresholds trip, operators need to stop parts of the system without stopping all of it, and without needing the root cause first: suspend one agent, pause one workflow, sever one connection — each independently, each immediately, each without cooperation from the possibly-compromised runtime. That tiered containment model is the kill-switch architecture, and cascades are its most common non-adversarial trigger.
Testing: cascade drills
Distributed-systems teams learned that failure modes you have not rehearsed are failure modes you do not actually handle. The agentic equivalent: inject a wrong-but-plausible output at one stage in staging and watch whether boundaries catch it or propagate it; stall a downstream dependency and measure the retry surface; kill one agent mid-workflow and verify the workflow degrades rather than deadlocks or storms. The measure of ASI08 readiness is not the absence of failures — it is the observed blast radius of one.
Common questions
What is a cascading failure in a multi-agent system? OWASP ASI08: a single agent's error — wrong output, bad action, or failure — amplified through the trust relationships of an orchestrated system, via error propagation, feedback loops, or resource storms, until the damage is systemic rather than local.
Do cascading failures require an attacker? No. Unbounded trust between stages lets a system attack itself with ordinary errors; that is what makes ASI08 distinct. An attacker simply makes the cascade deliberate — seeding a wrong output or triggering a known feedback pair — which is why the containment controls double as security controls.
What is the single most important containment control? Circuit breakers on inter-agent connections, because they convert misbehavior from a propagating condition into a contained one regardless of cause. Budgets and concurrency caps are the close second: they guarantee a hard ceiling on the worst case even when detection fails entirely.
How is this different from ordinary distributed-systems resilience? The mechanics overlap (retries, backoff, breakers all apply), but agents add a channel conventional services lack: stages consume each other's content as reasoning input, so errors gain authority as they propagate, and manipulated content can steer downstream behavior. That is why boundary validation and in-band content inspection join the classic resilience toolkit.
How do we test for cascade risk before production? Run cascade drills: inject plausible-but-wrong outputs at one stage, stall dependencies, kill agents mid-workflow — and measure blast radius against expectations. If a single injected error reaches three systems unvalidated, you have measured your ASI08 exposure precisely.