What Breaks When You Connect More Than One AI System

TL;DR

A single AI system is manageable: you know what data it touches and who reviews it. The moment you connect a second one, three failures appear that didn't exist before: not knowing who did what, permissions that creep in without anyone granting them, and hidden instructions arriving from outside that get executed as if they were commands. This article explains all three, and what to do before they reach production.

One AI system is easy to watch over. The second one isn't

When you have a single AI agent working on a process, security is almost common sense: you know what data it sees, what it can write, and who reviews what it does. If something goes wrong, there's only one place to look.

That's not where the problem starts. It starts the moment that agent begins talking to a second system: another agent, a CRM, an inbox, an external tool. At that point, there's no longer a single thing to watch — there's a chain. And a chain breaks where the links meet, not inside each individual link.

This is exactly what the OWASP Top 10 for LLM (Large Language Models, the models that power AI agents) describes — the industry's reference catalog of security risks in AI systems. And it points to three very specific failures that only show up once you start connecting AI systems to each other.

What is traceability, and why does it disappear when you connect systems?

The first failure is not knowing who did what. With a single agent, if something changes in your data, you know it was that agent. With two or three agents handing work to each other, a final action — say, an edited invoice or an email sent — can be the result of three separate decisions made by three separate systems, and none of them holds the full trail on its own.

Think of an office where every employee keeps their own notebook of who asked them for what. That works fine as long as everyone works alone. The moment they start passing tasks to each other without a shared log, something eventually goes wrong, and nobody can flip through their notebooks to work out who touched what first.

Traceability — the record of which system did which action, on which data, and in what order — isn't a technical nice-to-have. It's the difference between answering "what happened here?" on the spot and spending days piecing it back together by hand.

What are inherited permissions in chained AI agents?

The second failure is subtler. OWASP calls it excessive agency: when an AI agent is granted more capability than its specific task actually needs.

This happens a lot when connecting systems: for agent A to talk to system B, someone grants it access to B. But that access is rarely trimmed down to "only what's needed." It's faster to hand over the full set of keys than to cut a custom one. And every time a new connection is added, the agent quietly accumulates a bit more reach that nobody goes back to review.

It's like handing a new employee the exact same keyring the previous one had, without checking which doors they actually need to open. With one person and one keyring, nothing happens. With five people inheriting keyrings over the years, nobody remembers anymore which key opens which door, or who should even be holding it.

An agent with inherited permissions nobody has reviewed is exactly that: a keyring that has quietly grown without an audit.

What is prompt injection, and why does it change once systems are connected?

The third failure is the one OWASP ranks as the number one risk for AI applications: prompt injection. It happens when a hidden instruction inside a piece of content — an email, a document, a webpage — gets executed as if it were a legitimate command, instead of being treated as the plain text it actually is.

With a single agent reading only what you type to it, the risk is low. The problem grows once that agent starts reading content that comes from outside — a customer email, an attached document, a webpage — and that content flows, unfiltered, into a second system with its own permissions.

It's like an office runner carrying a folder from one department to another. If someone slips a note inside that folder saying "sign this and send it now," the second department may not be able to tell that note apart from the rest of the legitimate instructions arriving with the folder. The instruction came in hidden, and the system that received it had no way of knowing it came from outside.

The typical mistake: auditing each piece separately

The mistake we see most often is reviewing each system on its own — agent A is secure, system B is secure — and assuming the combination inherits that security. It doesn't. The security of a chain is measured at the points where it connects, not in each link on its own.

A simple way to check whether your business has this blind spot: could you sketch on a napkin exactly what happens when an email comes in, from the moment it arrives to the moment a system acts on it? If you can't trace that line without hesitating, that's your blind spot.

At Digital Transformations, we run a checklist based on the OWASP Top 10 for LLM on every agent before it goes into production — specifically checking these three points: who did what, what permissions it inherits, and what enters unfiltered from outside — with data hosted in the EU.

If you're building, or already running, several AI systems working together in your business, it's worth mapping this out before the chain grows any further. The Equipos Digitales (Digital Teams) guide explains how to set up a team of agents that scales without these blind spots, from the first node to the full picture: https://www.digitransformations.com/equipos-digitales

Shall we talk? https://www.digitransformations.com/equipos-digitales

Content developed with AI assistance and reviewed by the Digital Transformations editorial team