CAIN-42 invariant · E24

NET-I021: agent compromise cannot automatically compromise every peer

Held · CAIN-42 Evolution 24 -- Governed Agentic Internet Fabric

Last reviewed 2026-10-01

held   niche Attacks, threats & containment

What this rule means

CAIN-42 must always satisfy: agent compromise cannot automatically compromise every peer. It is one of 298 invariants checked for CAIN-42 Evolution 24 -- Governed Agentic Internet Fabric. An invariant is a rule the system may never break, whatever an agent or attacker does; the test suite tries to break it across many scenarios and records the result.

Recorded detail

{
 "A_AND_C_CONTINUE_WHERE_SAFE": true,
 "NETWORK_DID_NOT_COLLAPSE": true
}

Verify it in your browser

Your browser downloads the bundle's SHA256SUMS manifest and the file(s) behind this page, hashes them with SHA-256 locally (WebCrypto), and compares. A match shows the record you are reading is the published one; it does not by itself prove who published it (see the signed claims registry and the bundle verifier for that).

Check it yourself

Browse the raw bundle · SHA-256 manifest

Related rules

• NET-I020: quarantined agent cannot regain authority without reattestation
• NET-I022: incident propagation must preserve unrelated trust domains
• NET-I023: quarantine cannot erase evidence
• NET-I024: recovery cannot erase incident history
• NET-I048: a forged discovery advertisement is refused
• NET-I063: the evidence log is hash-chained and tamper-evident
• NET-Q-active: quarantine state ACTIVE never raises authority
• NET-Q-restricted: quarantine state RESTRICTED never raises authority

← NET-I020 · all 298 · NET-I022 →