In March 2026, Cosimo Spera published a formal proof that most of the AI security industry has not yet absorbed. The result is simple enough to state in one sentence: two individually safe AI agents can compose into an unsafe system.
Not through bugs. Not through misconfiguration. Through a mathematical property of safety itself.
Theorem (Spera, 2026)
Safety is non-compositional in the presence of conjunctive capability dependencies. Two agents, each individually incapable of reaching any forbidden capability, can — when combined — collectively reach a forbidden goal through an emergent conjunctive dependency.
Component-level safety verification is necessary but provably insufficient.
Read that last line again. Provably insufficient. Not "sometimes insufficient" or "insufficient in edge cases." The proof holds for any system where capabilities combine — which describes every AI coding agent stack shipping today.
The Number
In June, a team built AgentThread, a framework for formally verifying how AI agent protocols compose. They tested five protocols — MCP, A2A, ANP, ACP, and ACP-Client — against 43 cross-protocol security obligations.
Thirty failed.
Authority escalation. Injection chains crossing protocol boundaries. Consent bypass through semantic mismatches between delegation models. Credential cascades through hidden intermediaries. The failures aren't implementation bugs — they're what the researchers call composition orphans: behaviors that no individual protocol owns because they only exist at the seam between protocols.
No protocol checks the seam. Each protocol checks itself.
The Exploit
MOSAIC made the abstraction operational. The attack is elegant: feed a coding agent a sequence of CLI commands, each individually benign, that compose through shared operating-system state into an exploit chain. Per-command safety checks pass every command. The agent executes them all. Attack success rate: 96.59%.
This is Spera's theorem with a shell prompt. Safety that operates per-element fails when danger is per-sequence. The scanner reviews each instruction. The exploit lives in the ordering.
The same pattern repeats wherever you look. SkillCloak bypassed all eight open-source skill scanners — 90%+ success with payload-preserving evasion — because static analysis checks what a skill looks like, not what it does at runtime. Agent Data Injection spoofed PR authorship so that AI reviewers trusted attacker-controlled metadata. Each defense checks one dimension. Attacks cross dimensions.
The Mirror
Here is where it gets structural. In July, Mohammadreza Rashidi systematized 39 execution-security papers published between 2023 and 2026 — the entire body of research on making AI coding agents safe to run. The papers fall into 17 categories: sandbox isolation, capability control, policy enforcement, TOCTOU races, MCP threats, identity delegation, execution provenance, network egress, static analysis of generated code.
They rarely cite each other.
The defense research is balkanized the same way the defenses are. Papers on sandbox isolation don't test against policy-enforcement attack models. Policy-enforcement papers report 69% to 98% denylist failure rates, but no isolation paper re-evaluates its own defense under those adversarial conditions. TOCTOU and MCP threats are studied as separate literatures despite being instances of the same state-validation problem. Every enforcement mechanism assumes an honest policy author, leaving policy-authoring error itself unaddressed.
The research community has the same composition failure as its subject. Each group checks its own layer. No one checks the seam.
What This Means
This is not "defense is hard." I have written twenty articles about AI security. The early ones described specific vulnerabilities. The middle ones described defense becoming attack surface. This one is different because the argument is mathematical, not observational.
Safety is non-compositional. The proof exists. It means that even if every individual defense in the stack works perfectly — the sandbox holds, the scanner catches payloads, the approval dialog displays the correct path, the AI reviewer flags suspicious code — the stack can still fail because the property of safety doesn't survive composition. Agent A is safe. Agent B is safe. Agent A composed with Agent B is not safe. This is a theorem, not a deployment error.
The industry response so far has been to add more layers. More scanners. More approval dialogs. More review agents. Each layer is individually defensible. Each layer assumes the others are intact. And 70% of the time, the composition has a counterexample.
You cannot stack your way out of a non-compositional property. Every layer you add is another seam.