title: Cascading Failure Detection in Agent Pipelines
id: ATR-2026-00052
rule_version: 1
status: experimental
description: |
  Detects cascading failure patterns in automated agent pipelines where
  a false signal, error, or compromised output propagates through
  multiple stages with escalating impact. Covers auto-approval chains,
  error propagation without human checkpoints, automated rollback
  triggers from unverified sources, and pipeline stages that amplify
  incorrect signals. These patterns exploit the "trust the previous
  stage" assumption in multi-step agent workflows.
  Note: This rule detects textual descriptions of cascading failure patterns, not live cascading failures. Structural cascade prevention requires behavioral monitoring.
author: ATR Community
date: 2026/03/09
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: high
references:
  owasp_llm:
    - LLM06:2025
    - LLM05:2025
  owasp_agentic:
    - ASI08:2026
  mitre_atlas:
    - AML.T0053 - AI Agent Tool Invocation
    - AML.T0046 - Spamming AI System with Chaff Data
compliance:
  eu_ai_act:
    - article: '14'
      context: Cascading failures propagating across agent pipelines make human intervention increasingly difficult as the failure scope widens; early detection provides evidence supporting Article 14's requirement for effective human override capability.
      strength: primary
    - article: '15'
      context: Article 15 accuracy and robustness requirements demand that high-risk AI systems handle failure propagation gracefully; this rule provides the monitoring signal required to contain cascading events.
      strength: secondary
    - article: '9'
      context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Cascading Failure Detection in Agent Pipelines).
      strength: secondary
  nist_ai_rmf:
    - subcategory: GV.1.2
      context: Cascading failures exploit the absence of defined human-in-the-loop checkpoints in agent pipeline accountability structures; GV.1.2 requires that these roles and checkpoints are defined and enforced before automated pipelines propagate errors.
      strength: primary
    - subcategory: MG.3.2
      context: Multi-stage pipeline failures are AI incidents requiring predefined response processes; MG.3.2 mandates that cascading failure response procedures exist so that failure scope can be contained before all downstream agents are affected.
      strength: secondary
    - subcategory: MG.2.3
      context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Cascading Failure Detection in Agent Pipelines) so the risk can be treated.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Cascading Failure Detection in Agent Pipelines).
      strength: secondary
  iso_42001:
    - clause: '6.2'
      context: ISO 42001 clause 6.2 risk treatment activities must cover cascading failure scenarios in multi-agent pipelines; this rule detects the propagation patterns and auto-approval chains that trigger uncontrolled cascade events.
      strength: primary
    - clause: '8.1'
      context: Clause 8.1 operational controls require that AI pipeline stages execute with appropriate verification gates; detection of blind upstream trust and automated destructive triggers enforces the human checkpoint requirements in pipeline design.
      strength: secondary
tags:
  category: excessive-autonomy
  subcategory: cascading-failure
  scan_target: mcp
  confidence: medium
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)auto[_-]?approv(?:ed|ing|al).{0,30}(?:without|no|skipping)\s+(?:human|manual|review|check|verification|validation)
      description: Automated approval bypassing human review checkpoint
    - field: content
      operator: regex
      value: (?i)(?:propagat(?:ed|ing)|forward(?:ed|ing)|pass(?:ed|ing))\s+(?:error|failure|exception|fault)\s+(?:to|through|downstream|to\s+next\s+(?:stage|step|agent))
      description: Error propagating downstream through pipeline stages
    - field: content
      operator: regex
      value: (?i)(?:stage|step|phase)\s+\d+\s+(?:failed|error|timed\s+out).*(?:stage|step|phase)\s+\d+\s+(?:also|subsequently|then)\s+(?:failed|errored)
      description: Multiple pipeline stages failing in sequence
    - field: content
      operator: regex
      value: (?i)(?:trusting|accepting|using)\s+(?:previous|upstream|prior)\s+(?:stage|step|agent)\s+(?:output|result|response)\s+(?:without|no)\s+(?:validation|verification|check)
      description: Stage consuming upstream output without validation
    - field: content
      operator: regex
      value: (?i)(?:rollback|revert|undo|destroy|delete|terminate)\s+(?:all|everything|entire|production|live).{0,40}(?:based\s+on|triggered\s+by|due\s+to)\s+(?:automated|agent|AI|pipeline)
      description: Destructive action triggered by automated pipeline signal
    - field: content
      operator: regex
      value: (?i)(?:amplif(?:ied|ying)|escalat(?:ed|ing)|magnif(?:ied|ying))\s+(?:the\s+)?(?:error|issue|problem|signal|impact|damage)\s+(?:across|through|to)\s+(?:multiple|all|downstream)
      description: Error amplification across multiple pipeline stages
    - field: content
      operator: regex
      value: (?i)(?:no\s+(?:human|manual)\s+(?:in|checkpoint|review|gate|approval)\s+(?:the|this)?\s*(?:loop|pipeline|chain|workflow)|(?:fully|completely)\s+automated\s+(?:pipeline|workflow|chain)\s+(?:with|including)\s+(?:destructive|production|critical))
      description: Fully automated pipeline with no human-in-the-loop for critical actions
    - field: content
      operator: regex
      value: (?i)(?:blind(?:ly)?|unconditional(?:ly)?|automatic(?:ally)?)\s+(?:executing|running|applying|deploying).{0,60}(?:previous|upstream|AI|agent|automated)(?:\s+(?:AI|agent|system|model))?
      description: Blind execution of upstream agent recommendations
    - field: content
      operator: regex
      value: (?i)(?!(?:post[- ]?(?:incident|mortem)|review|analysis|report|last\s+(?:week|month|time)|caused\s+by|root\s+cause|lessons?\s+learned|investigation|retrospective).{0,80})(?:chain\s+reaction|domino\s+(?:effect|failure)|failure\s+cascade|cascading\s+(?:error|failure|shutdown|rollback))(?!.{0,80}(?:was\s+caused\s+by|root\s+cause|post[- ]?(?:incident|mortem)|lessons?\s+learned|last\s+(?:week|month|time)))
      description: Explicit cascading failure terminology (excludes retrospective analysis context)
    - field: content
      operator: regex
      value: (?i)(?:retry|fallback)\s+(?:triggered|activated|initiated)\s+(?:automatically|by\s+(?:previous|upstream)).*(?:retry|fallback)\s+(?:triggered|activated|initiated)
      description: Cascading retry/fallback loops across stages
    - field: content
      operator: regex
      value: (?i)(?:all|every)\s+\d+\s+(?:downstream|dependent|connected)\s+(?:agents?|services?|stages?|steps?)\s+(?:affected|impacted|failed|halted)
      description: Multiple downstream components affected by single failure
  condition: any
  false_positives:
    - Legitimate pipeline monitoring reporting multi-stage errors for debugging
    - Chaos engineering or fault injection testing in controlled environments
    - Post-incident analysis discussing cascading failure root causes
    - Circuit breaker implementations that intentionally detect cascade patterns
response:
  actions:
    - alert
    - snapshot
  auto_response_threshold: high
  message_template: |
    [ATR-2026-052] HIGH: Cascading failure pattern detected in agent
    pipeline. Signal propagating through multiple stages without human
    checkpoint. Pattern: {matched_pattern}. Pipeline paused for review.
    Session: {session_id}. Verify upstream signal integrity.
confidence: 81
wild_validated: 2026/04/08
wild_samples: 53577