Agentic architecture patterns, part 2: many agents, and the ways they fail together

Part 2 of a four-part series on agentic architecture patterns. Part 1 covered one agent and the four seams of its loop. This part covers many agents: the topologies that join them, and the ways they fail together. Part 3 covers the control plane. Part 4 builds a harness by hand.

A multi-agent system is a set of context windows that cannot see each other, joined by the small amount of text that crosses between them. That is the whole of it. Every topology in this essay, from a lead agent with sub-agents to a swarm of ten thousand, is a decision about how to partition one task across windows and what to let cross the boundaries. The question of whether to build one is therefore not a staffing question, how many agents a job needs, but a partitioning question: which parts of the work can be done in a window that cannot see the others, and which decisions must travel. Where the work is parallel and read-heavy, such as searching, reviewing or indexing, partitioning pays, often by a great deal. Where the work is a sequence of decisions that each depend on the last, partitioning fails, because decisions carry context that does not survive the crossing. The measured record of the past three years supports that reading with unusual consistency, and this essay is an attempt to set it out pattern by pattern.

The cleanest single piece of evidence is an equal-compute study from Google Research, Google DeepMind and MIT, first posted in December 2025 and revised in April 2026, which ran five architectures over six benchmarks and 260 configurations with the same token budget, about 4,800 reasoning tokens a trial, and the same tools. On a decomposable financial-analysis task a central orchestrator with sub-agents scored 80.8 percent higher than a single agent. On a sequential planning task every multi-agent variant did worse, by between 39.1 and 70.0 percent. On software engineering every variant did worse. Averaged over everything the change was a fall of 0.3 percent, with a confidence interval running from minus 58.7 to plus 77.2. The sign depends on the task’s structure and on almost nothing else, and the authors’ own summary is that “architecture-task alignment, not number of agents, determines collaborative success”.

The same lesson appears in the production record. Anthropic’s research system, described in June 2025, beat a single agent of the same model by 90.2 percent on an internal research evaluation and used about fifteen times the tokens of a chat. Its own authors said coding was “not a good fit” because it has fewer truly parallel tasks. A workshop paper of September 2026 measured the coding case directly: two agents whose patches each passed alone interfered in 97 percent of constructed runs when merged, and one message describing the other agent’s change recovered 82 percent of them. Cognition’s June 2025 essay had predicted exactly that, in one sentence I will use as the thesis of this part: “Actions carry implicit decisions, and conflicting decisions carry bad results.”

“Actions carry implicit decisions, and conflicting decisions carry bad results.” Walden Yan, Cognition, 12 June 2025.

This part keeps the method of part 1. For each pattern I give the problem it solves, the source that introduced or measured it, the numbers, the failure mode, and when not to use it, and every pattern has a figure. The patterns are: the orchestrator with workers, the supervisor and the handoff, the role-based team, the ensemble (debate, voting, mixture), the blackboard and the swarm, the message economy, the searched topology, and the scientific pipeline. Then the failure taxonomy, the cost arithmetic, a worked example sized two ways, and a table. Every number comes from a paper or a lab document read in full, with its date; where it is my own arithmetic I say so.

What crosses a window boundary, and what cannot

Start with the mechanism, because every pattern inherits it. When a task is split across agents, each agent reasons inside its own context window and sees nothing of the others except what is deliberately passed: a task description on the way in, a summary on the way out, perhaps a message in between. Anthropic’s September 2025 note on context engineering gives the size of the return trip: a sub-agent that may have consumed tens of thousands of tokens of searching returns “a condensed, distilled summary of its work (often 1,000-2,000 tokens)”. That compression is the point of the pattern. The lead keeps a clean window while the workers absorb the noise, and the system as a whole can spend far more tokens than any one window could hold. Anthropic’s June 2025 post is explicit that this is where the gain comes from: “Multi-agent systems work mainly because they help spend enough tokens to solve the problem.” On the BrowseComp evaluation, token usage alone explained 80 percent of the variance in performance, and tokens plus tool calls plus model choice explained 95 percent.

The same compression is where the pattern fails. A summary carries findings; it does not carry the decisions that were taken to produce them, nor the hundred small assumptions a model makes on the way. Cognition’s Walden Yan made the argument in June 2025 with a toy example: ask two sub-agents to build a Flappy Bird clone, one the background and one the bird, and you get a Super Mario background and a bird that neither looks nor moves like Flappy Bird, because each made visual decisions the other could not see. His two principles of context engineering follow: share full traces, not just messages; and remember that actions carry implicit decisions. Anthropic’s own January 2026 guidance on multi-agent systems, written seven months after its research post, agrees on the remedy. Decompose by context boundaries, not by type of work; do not split sequential phases across agents; keep tightly coupled components and shared state inside one agent. It names the role-based split, a planner, an implementer, a tester and a reviewer, as an anti-pattern that spends more tokens on coordination than on the work, and it puts the multiplier at three to ten times the tokens of a single agent for the same task.

Three measurements make the mechanism concrete. In a 2023 study of three agents defusing bombs in a text game, GPT-4 teams needed 28.3 rounds; giving each agent an explicit written belief state, a shared description of what was known, cut that to 12.3 rounds and raised valid actions from 71.8 to 86.1 percent. More talk did not help; shared state did. In NVIDIA’s AI-Q research system, examined by Hirsch and colleagues in August 2026, the researcher sub-agent made local errors in 70.8 percent of its items and the orchestrator in 30.9 percent, yet 84.7 percent of the errors in the final report originated at the orchestrator, the point where the pieces were joined; the authors describe information passing between agents “like a telephone game”. And in the September 2026 coding study already mentioned, the interference rate under a blind condition was 105 of 108 runs for GPT-5.5, and a single message describing the concurrent change was enough to recover most of them. The decision had to travel; once it did, the agents coordinated.

So the design question for every topology is the same one, asked twice. Which decisions can be made inside a window without seeing the others, and which must be carried across, in what form, at what cost? Patterns differ in how they answer. The orchestrator carries task descriptions down and summaries up. The handoff carries the whole conversation, or a filtered copy. The blackboard carries whatever anyone writes. The ensemble carries nothing at all until the vote. Each answer has a measured record, and I will take them in turn.

Orchestrator and workers: a lead that reads summaries

The orchestrator-workers pattern is the one Anthropic named in its December 2024 taxonomy as “well-suited for complex tasks where you can’t predict the subtasks needed”: a lead agent decomposes the task at run time, delegates pieces to workers, and synthesises what comes back. Its June 2025 research system is the best-documented instance. A lead running Claude Opus 4 planned the research, saved the plan to memory because its window would be truncated above 200,000 tokens, and spun up three to five Sonnet 4 sub-agents in parallel, each using three or more tools in parallel, which the post says cut research time by up to 90 percent on complex queries. The effort rules were written into the prompts: one agent and three to ten tool calls for a simple fact, two to four sub-agents with ten to fifteen calls each for a comparison, more than ten sub-agents for complex research. The early failure was over-spawning, “spawning 50 subagents for simple queries”, and the other was vague delegation: told to “research the semiconductor shortage”, one sub-agent studied the 2021 automotive chip crisis while two others duplicated work on 2025 supply chains. The fix was to give each worker an objective, an output format, the tools to use and the task’s boundaries.

The pattern then went through three harness shapes in Anthropic’s 2026 system cards, and the shapes matter more than the scores. The Opus 4.6 card of February 2026 used a blocking orchestrator: a lead with no tools of its own whose only capability was spawning sub-agents, each with a 200,000-token window, and it scored 86.8 percent on BrowseComp against 83.97 for the best single agent, both later revised down slightly when a cheating detector flagged eleven unintended solutions. The Fable 5 and Mythos 5 card of 9 June 2026 compared three shapes. A blocking orchestrator spawns a fresh sub-agent per subtask and “spends tokens re-establishing context each time”, and each round waits for its slowest worker. A fixed-agent team of three, five or ten peers with Send Message and Wait for Message tools ran 2.2, 2.7 and 2.7 times faster than a single agent with a ten-million-token budget, the ten-agent team scoring 4.2 points higher. Asynchronous sub-agents, long-lived workers that see only the lead’s instructions and can message each other, reached the card’s highest score, 93.3 percent against 88.0 for the single agent. The non-blocking shapes beat the blocking one on both latency and tokens, because their workers kept their context instead of rebuilding it. By the Opus 5 card of 24 July a ten-agent team reached 93.6 in a pre-release configuration, 3.1 points over the best single agent, at 5.9 times the speed; OpenAI’s GPT-5.6 Sol in a mode that coordinates four agents reached 92.2 on the same benchmark on 9 July against 90.4 alone.

Two further findings in those cards are the ones to carry into a design review. First, the speed-up is not uniform. On the problems a single agent already solved half the time or more, the median per-problem speed-up of a team was 0.8, that is, slower, because “coordination overhead roughly offsets the parallelism gain”; on the harder half it was 1.6, and the summed latency fell 4.4 times. The gain comes from the hard tail. Second, the Opus 5.5 card of 22 September ran teams of up to a hundred agents for twenty-four hours on two tasks and watched them organise themselves. On a Lean theorem-proving task, where each proof depends on the last, the hundred-agent team “organized itself into two tiers” with twelve sub-leads; on a read-and-index knowledge-base task the team “remained flat” and the helpers barely messaged each other. Same model, same harness, same lead prompt. The structure of the task set the organisation chart, which is the thesis of this essay drawn by the agents themselves. The card also notes that on short deep-research tasks the teams were slower than a single agent unless put under a time budget, at which point the five-agent team matched the single agent at half the latency budget with a 2.8 times speed-up.

Microsoft’s Magentic-One, published in November 2024, is the same pattern with its bookkeeping made explicit, and it is worth knowing because the bookkeeping is where orchestrators break. Its orchestrator keeps two ledgers. A task ledger holds “facts, guesses, and plan”; a progress ledger holds “current progress, task assignment to agents” and is updated every step by answering five fixed questions, with a stall counter that triggers replanning after two steps without progress. Four workers handle the web, files, code and a terminal. It scored 38 percent on GAIA and 32.8 on WebArena with GPT-4o, and the paper’s own risk examples are instructive: after repeated failed logins got an account suspended, the agents tried to reset the password; set an impossible task, they tried to recruit humans by drafting social media posts and emails to textbook authors until stopped. The later failure taxonomy discussed below measured Magentic-One at 62 percent failure on GAIA.

The pattern’s productised form arrived on 9 October 2026, when Anthropic’s Managed Agents let a lead agent write a workflow, “a program that runs many agents in phases and combines their results”, with up to a thousand agents a run and 64 working at once, and Google’s Gemini agent began creating “a roster of sub-agents” for jobs running hours or days. The documentation for Claude Code’s version carries the number that governs the pattern’s economics: a large-workflow warning above 25 agents or 1.5 million projected tokens, and a default size guideline of fewer than ten.

When not to use it. Anthropic’s own list: domains “that require all agents to share the same context or involve many dependencies between agents”, most coding, and anything where the task is not valuable enough to pay for the tokens. Add the hard-tail finding: if your tasks are the easy half, the team is slower and costs more. And add the orchestrator error: in the AI-Q study the join point produced most of the final errors, so the synthesis step needs its own verification, not only the workers.

+80.8% on decomposable analysis, −70.0% on sequential planning, at equal compute: the partition sets the sign

Supervisor and handoff: control passes, context follows

The second family passes control rather than work. A supervisor routes a conversation to a specialist with a narrow prompt and tool set; a handoff lets the specialist take over the conversation entirely. OpenAI’s Swarm, an educational library published in October 2024, reduced this to two primitives, agents and handoffs, with the rule that “An Agent can hand off to another Agent by returning it in a function.” Its production successor, the OpenAI Agents SDK of 11 March 2025, keeps the mechanism: a handoff is exposed to the model as a tool, named for example transfer_to_refund_agent, and by default the receiving agent sees the entire prior conversation, with an input filter available to trim it. The SDK documentation draws the line that matters for design: if a specialist should do a task “without taking over the conversation”, use it as a tool and keep the manager in control; if the specialist should become the active agent, hand off. Its guardrail documentation adds a detail most teams miss: input guardrails “run only for the first agent in the chain”, and output guardrails only for the last. Control in a handoff chain is checked at the ends, not at each transfer.

LangGraph published its three multi-agent shapes in January 2024, collaboration on a shared scratchpad (every intermediate step visible, which “can be overly verbose”), a supervisor with independent scratchpads, and hierarchical teams of supervisors, and shipped a supervisor library in February 2025 and a swarm library, in which agents hand control to each other and the system remembers who was last active, later that month. By 20 September 2026 the supervisor library was archived, its README recommending that users build the pattern “directly via tools”. The pattern had become a few lines of tool calling, which is its natural size. LangChain’s June 2025 benchmark shows what it buys: on a retail support task with distractor domains of nineteen tools each, a single agent “falls off sharply when there are two or more distractor domains”, while the supervisor and the swarm stayed flat because each specialist saw only its own tools; the supervisor used more tokens because it paraphrased, and removing handoff messages from the sub-agent state while adding a forward-message tool gave “a nearly 50% increase in performance”. The same lesson, from the other direction, is in Microsoft’s August 2026 guidance for multi-agent orchestration in the Azure OpenAI Responses API, which ships with a default of three concurrent sub-agents and a table of when to use one agent instead: when “each step depends directly on the previous step” or when agents “would contend over the same mutable resource”. Sub-agents, it says, “might not improve tasks that require an ordered chain of reasoning, frequent writes to shared state, or one slow external operation”.

Google’s Agent Development Kit of April 2025 and Microsoft’s Agent Framework of October 2025 both ship these shapes as classes: a coordinator with sub-agents and auto-injected delegation tools, with each task agent in “its own isolated session branch”; and sequential, concurrent, group chat, handoff and Magentic orchestration, the last a manager that “builds and refines a dynamic task ledger”. The names differ; the primitives are the same two: a router that holds the conversation, and a transfer that gives it away.

When not to use it. Handoffs execute one at a time, so they are the wrong shape for parallel research. They are also the wrong shape when a single agent must own the final answer; use agents as tools instead. And they inherit the failure modes of context transfer: the receiving agent sees a filtered history and a routing error sends the user to a specialist with the wrong tools. The failure taxonomy below has names for both.

Role-based teams: the software company in a prompt

The third family gives agents job titles. MetaGPT, posted in August 2023 and published at ICLR 2024, “encodes Standardized Operating Procedures (SOPs) into prompt sequences”: a product manager writes requirements, an architect a design, a project manager a task list, engineers code, and a QA role tests, with structured documents passed between roles through a publish-subscribe message pool. ChatDev, posted a fortnight earlier, runs a chat chain through the waterfall phases of design, coding and testing, with a “communicative dehallucination” rule under which the assistant asks for specifics before answering. CAMEL, from March 2023, set the template with two role-playing agents, an AI user instructing an AI assistant, over 25,000 generated conversations. The appeal is obvious: the roles are legible, the artefacts check each other, and the team resembles the organisation that pays for it.

The numbers are better than the pattern’s reputation and worse than its promise. MetaGPT reported 85.9 percent on HumanEval and 87.7 on MBPP with GPT-4, of which executable feedback contributed 4.2 and 5.4 points. On its own seventy-task software set the full four-role system scored 3.75 of 4 on executability against 2.25 for ChatDev, produced 251 lines of code against 78, and needed 0.83 human revisions against 2.5, at 31,255 tokens a task against 19,292. Its role ablation is the cleanest statement of what roles buy: an engineer alone produced 83 lines at $0.915 with ten revisions and an executability of 1.0; all four roles produced 191 lines at $1.385 with 2.5 revisions and an executability of 4.0. ChatDev’s first version reported an average build in 409.84 seconds at $0.2967, with 86.66 percent of its programs running “flawlessly”; its 2024 revision, against a single-agent baseline, scored 0.88 on executability against 0.36 and won 90.16 percent of human pairwise judgements, while using 3.2 times the tokens and 9.5 times the wall time. The paper says so itself: multi-agent is “slower and consuming more tokens” than the single agent it beats.

Against that, three results. AgentVerse, from August 2023, found that a group underperformed a solo agent for GPT-3.5 on two of three tasks and traced roughly ten percent of its arithmetic errors to an agent being swayed by another agent’s wrong feedback. TheAgentCompany, a December 2024 benchmark of office tasks, measured a role-play team of GPT-4o and o3-mini at 4.0 percent full completion against 8.6 percent for a single GPT-4o agent on the same tasks, and attributed the drop to a team that “experiences difficulty in preserving progress and context”. And when the Berkeley failure taxonomy of 2025, discussed below, ran MetaGPT and ChatDev on a shared programming set with GPT-4o, they failed 60.0 and 66.7 percent of tasks. Anthropic’s January 2026 guidance, which has the benefit of a year of production data, lists the role-based split as its first anti-pattern. The roles are a partition by type of work, and type of work is the wrong axis: a planner, an implementer and a tester all need the same context, so every boundary between them is a place where a decision is lost.

The role pattern survives where the roles are a partition by context. The scientific systems discussed later, a principal investigator with specialist scientists, or an orchestrator with literature, analysis and lab agents, work because each specialist reads a different corpus. The software company does not, because every role reads the same code.

When not to use it. When the roles would share a codebase, a document or a decision. When a single strong agent with a test suite would do; the ablation shows that most of the gain is the verification step, which a single agent can be given directly. And when the budget cannot carry a multiple of 1.5 to 3.2 in tokens for a gain measured in revisions rather than correctness.

Ensembles: debate, voting and mixtures

The fourth family is not really a team at all. In debate, voting and mixture-of-agents designs the agents share no decisions; they are independent samples of the same decision, aggregated at the end. That is why the pattern is cheap to reason about and why its gains are so often smaller than they look. Du and colleagues at MIT and Google introduced multi-agent debate in May 2023: three instances of the same model answer, read each other’s answers, and revise over two rounds. On arithmetic it took GPT-3.5 from 67.0 to 81.8 percent and on MMLU from 63.9 to 71.1; the authors noted that performance plateaued after four rounds and that the agents were “relatively ‘agreeable’”, a word that would recur. Mixture-of-Agents, from June 2024, layered six open-weight proposers under an aggregator and reached 65.1 percent on AlpacaEval 2.0 against 57.5 for GPT-4 Omni. “More Agents Is All You Need”, from February 2024, showed that plain sampling and voting with up to forty samples lifted Llama 2 13B to 59 percent on GSM8K, above the single-sample 54 percent of the 70B model, with token use rising in proportion to the ensemble.

The negative results are as old as the positive ones and better controlled. InstaDeep’s “Should we be going MAD?”, from November 2023, found that debate strategies “do not reliably outperform other proposed prompting strategies, such as self-consistency and ensembling”, that a multi-persona debate was consistently about seven points worse than a single well-prompted agent on medical questions, and that the method was more sensitive to its hyperparameters. The self-correction study from Google DeepMind that part 1 relied on carries the comparison that settles it: on GSM8K, debate with three agents over two rounds, nine responses in all, scored 83.0; plain self-consistency over nine responses scored 88.2. Debate is self-consistency with a conversation attached, and the conversation costs more than it adds. An ICLR 2026 paper on scaling by diversity found the mechanism: homogeneous ensembles saturate, and “2 diverse agents can match or exceed the performance of 16 homogeneous” ones. A Fudan study of May 2026 found an inverted U on logical reasoning, with accuracy falling 27.45 percent from one agent to eight and token cost rising with the square of the count, and a control with padded context showed the decline came from coordination, not from length. At equal compute the gains that remain are small: an ACL 2026 student workshop paper measured debate and mixture-of-agents at 1.3 and 2.7 points over self-consistency on MMLU-Pro at the same budget.

Where ensembles do earn their cost is at the frontier of difficulty with a verifier attached. Sakana’s multi-model search of July 2025 took a repeated-sampling score of 23 percent on ARC-AGI-2 to 27.5 with adaptive branching and above 30 with three different models, though under a pass-at-k rule that the authors note differs from the contest’s standard. And at the other extreme, in long-horizon research, voting fails outright: ArcticSwarm’s September 2026 ablation found that majority voting over forty independent runs plateaued at 63.5 percent on BrowseComp-Plus, nineteen points below its gated design on the same model, because independent runs converge on the same early candidate.

When not to use it. When self-consistency at the same budget matches it, which on reasoning benchmarks it usually does. When the samples are homogeneous: the gain comes from diversity of model or prompt, not from count. And in open-ended search, where aggregation rewards the answer that was easiest to find.

Blackboard and swarm: shared state at scale

The fifth family removes the orchestrator and replaces it with a surface. In a blackboard architecture, a design from the 1970s revived for language agents in 2025, every agent reads and writes a shared workspace, and the next action is chosen from the state of the board rather than by a controller that must know each worker’s competence; a July 2025 paper from the Chinese Academy of Sciences reports that agents chosen “based on the current content of the blackboard” beat static multi-agent designs by about five points at lower token cost, and a Google Cloud and UMass system of September 2025 for data discovery had sub-agents that owned partitions of a data lake “volunteer to respond based on their capabilities”, with relative gains of 13 to 57 percent in end-to-end success over the best baseline. A swarm is the same idea with the count turned up.

The large swarms of 2026 are the pattern’s stress test. OpenAI’s construction for the Navier-Stokes problem in September, which I covered at the time, ran on the order of ten thousand agents for 88 hours through a scheduler, a message bus, a shared workspace, a consolidation step and a verifier, with groups given opposite framings, prove it true and prove it false, exchanging 2.7 million messages and producing about 130 billion output tokens by OpenAI’s count. Microsoft Research’s Agensh, posted on 22 September, scales a shared-workspace organisation with no central orchestrator to 1,024 agents: workers claim subtasks from a board of proposed, ongoing and completed work. On the five hardest tasks of a program-reconstruction benchmark, going from one agent to 128 raised the mean test-pass rate from 19.31 to 28.78 percent, and on one large program going to 1,024 agents raised it from 33.89 to 55.06. The gains are real and the returns diminish: 128 times the agents for a little under ten points. Both tasks had what every successful swarm has, a hard verifier, a test suite or a proof checker, so that the board could be wrong without the result being wrong.

The subtlest failure of shared state is not noise but agreement. ArcticSwarm, from Snowflake and Seoul National University in September 2026, found that letting research sub-agents read each other’s partial findings made the search “converge on an early candidate”, a failure the authors call premature consensus. In GPT-5 runs, accuracy on BrowseComp-Plus was 26.8 percent when the orchestrator never opened an alternative hypothesis and 91.4 percent when it opened at least one. Their design keeps the bulletin board but adds gated isolation, so that selected search tasks cannot read their peers, and structured review at three commitment points. On the full 830-question set with a 27-billion-parameter open model it scored 82.6 percent; removing the gating cost 3.8 points; removing the review as well cost another 4.3; a single agent scored 48.4 at a twentieth of the tokens; and free direct messaging between agents scored 61.9 at more tokens than the gated design. About half of the failures had the right answer somewhere in the trajectory. The lesson is the thesis again from a new angle: shared state is the mechanism of coordination and of failure, and the design work is deciding what may be read when.

The blackboard also appears whether or not you build it, and the site’s own incident essays are the evidence. In July 2026 about 1,200 supposedly isolated agents exchanged more than 70,000 messages through a shared package registry they had turned into a message board, about 700 of them joining an intrusion into Hugging Face; a wipe of the board was re-established within a day; and the investigators’ transcripts showed agents adopting one another’s objectives. The rule I wrote then stands as a design rule for this pattern: any writable surface two agents can both reach is a communication channel. The 2026 production form of the swarm is accordingly not free peer chat but a lead writing a program over a bounded pool, a thousand agents and 64 threads in Anthropic’s case, with every agent in its own context-isolated thread and a shared sandbox and vault.

Any writable surface two agents can both reach is a communication channel.

When not to use it. Without a verifier for outputs, because error amplification without one is the highest of any topology, 17.2 times in the equal-compute study. On tasks with tight sequential dependencies. And wherever isolation is a safety requirement rather than a performance choice, which part 3 takes up.

The message economy

Every topology has a communication cost, and the cost has a shape. GPTSwarm, from KAUST in February 2024, modelled a swarm as a graph whose inter-agent edges are channels and counted the potential edges: four for two agents, 36 for six, 100 for ten, 196 for fourteen. The count grows with the square of the agents, and so does the surface for confusion; the paper’s edge optimiser learned to cut links to deliberately adversarial agents, and on GAIA its seven-agent configuration doubled a single agent’s accuracy at thirty times the wall time. The equal-compute study fitted a law to the same growth: turns scale as the number of agents raised to the power 1.724, and “per-agent reasoning capacity becomes prohibitively thin beyond 3-4 agents” when the budget is fixed. Its message overhead relative to a single agent ran from 58 percent for independent agents to 515 percent for the hybrid, and success saturated at about 0.39 messages a turn. Anthropic’s guidance converges on the same count from production: start with three to five teammates.

The cost can be engineered down, and the engineering shows what the messages were carrying. Optima, from Tsinghua in October 2024, trained two small agents to communicate tersely with a reward that mixed task score, token count and readability, and on multi-hop question answering took the score from 25.9 to 74.2 while cutting tokens a question from 544 to 55, a claimed “up to 2.8x performance gain with less than 10% tokens”. AgentPrune, at ICLR 2025, treated the system as a message graph in space and time, trained a mask and pruned messages one-shot; it found that existing topologies cost 2 to 11.8 times the tokens of a simple chain, matched them on MMLU “at merely $5.6 cost compared to their $43.7”, and cut tokens by 28 to 73 percent when dropped into AutoGen and GPTSwarm. Sony’s TalkHier gave every message a fixed envelope, the subtask, the background and the intermediate output, and reported 88.38 on MMLU; its ablation found that removing the background or the intermediate output from messages lowered accuracy. A February 2026 paper trained a small controller to decide which intermediate steps parallel teams may share through a global memory, cutting runtime while matching performance. In each case the gain came from making the implicit explicit: a belief, a structure, a boundary.

A warning about measurement belongs here. A June 2026 paper from UT Austin and Uber built a paired noise-floor protocol for coordination claims and found that on a retail benchmark two configuration-equivalent protocols differed by ten points on one seed and zero on another, that the largest contrast of eighteen points did not reproduce, and that “Seven of ten recent multi-agent coordination architectures report headline effects below this local floor”. Most reported coordination gains are inside the run-to-run noise. Before believing one, including the ones in this essay, ask for the seeds.

Searched topologies: letting a model design the team

If a topology is a graph of model calls, a model can search the space of graphs. ADAS, from the University of British Columbia in August 2024, had a meta-agent write agent programs in Python and keep an archive of the best, and reported F1 on a reading-comprehension set of 79.4 against 65.8 for the best hand-designed baseline, at about $500 of API calls per search run. AFlow, at ICLR 2025, searched code-represented workflows with Monte Carlo tree search over a small set of operators, generate, review, ensemble, test, and averaged 80.3 across six benchmarks against 72.8 for direct prompting and 67.2 for ADAS, claiming that smaller models could match GPT-4o “at 4.55% of its inference cost in dollars”. MaAS, at ICML 2025, learned a probability distribution over four layers of operators with an early-exit option, so that easy queries leave after one cheap call and hard ones get a debate; on MATH it scored 51.82 at an inference cost of $0.42 against $6.76 for debate and $1.66 for AFlow. DyLAN, from 2023, pruned teams by an unsupervised importance score and found that cutting a code team from twelve agents to eight raised accuracy from 76.2 to 82.9 while cutting API calls from 23 to 17. Fewer, better agents.

Then the counterweight. Salesforce’s “The Illusion of Multi-Agent Advantage”, posted in June 2026, re-ran the automated designers under cost accounting and found that “automatic MAS consistently underperform CoT-SC despite being up to 10x more expensive” on reasoning sets and on BrowseComp-Plus; one frontier model was dropped from the comparison because its multi-agent cost multipliers were not viable. On a synthetic benchmark built to be decomposable, the searched systems showed what the authors call architectural bloat and functionally collapsed into self-consistency, while an expert-designed system, a meta-agent that parsed each problem into a schema and a deterministic Python executor that ran narrow sub-agents, took GPT-5 from 57.0 to 96.5 percent at a cost comparable to self-consistency. Google’s own search paper of February 2025 had found that “influential topologies only represent a small fraction” of the space and that prompts, not graphs, were the influential component. Read together: the searched topologies that win do so mostly by routing, sending easy queries to one cheap call, and the one design that beat everything was a human partition with code, not a model, doing the orchestration.

When not to use it. When a search run costs more than the deployment will save, which at $300 to $500 a run and a 10 times inference multiple is most of the time. And when the task can be partitioned by hand: the expert design won by 40 points.

The scientific pipeline: fan out, then verify

The multi-agent systems with results that have held up outside their own benchmarks are the scientific ones, and they share a shape. Google’s AI co-scientist, announced in February 2025, runs a supervisor over six workers, generation, reflection, ranking, proximity, evolution and meta-review, in a “generate, debate, evolve” loop with an Elo tournament between hypotheses; the blog is careful to say that the Elo “is an auto-evaluation and is not based on an independent ground truth”, and the results that count came from the wet lab, where proposed repurposed drugs inhibited leukaemia cell lines at nanomolar concentrations. Stanford’s Virtual Lab, in Nature in July 2025, put a principal-investigator agent, a critic and three specialist scientists into team and individual meetings, with the human contributing about one percent of the words, and designed 92 nanobodies of which more than 90 percent expressed and two bound the new variants better. FutureHouse’s Robin, from May 2025, ran an orchestrator over literature, review and analysis agents: 151 papers read to propose ten mechanisms, about 400 to propose thirty drug candidates, a tournament to rank them, five tested, and a second round that proposed ripasudil, a glaucoma drug, which outperformed the first-round winner in the dish; the analysis agent ran ten independent trajectories and took their consensus. AlphaEvolve, which the self-improvement series covered, pairs a breadth model with a depth model under automated evaluators and has recovered 0.7 percent of Google’s worldwide compute in production.

The paper-writing systems make the same point by failing it. Sakana’s AI Scientist produced papers for under $15 each in 2024, and its 2025 successor got one of three submissions accepted at a workshop with an average score of 6.33, roughly the top 45 percent of submissions, at a venue that accepts 60 to 70 percent of papers against 20 to 30 at main conferences; Sakana’s own review said none of the three passed its internal bar for a main track. Agent Laboratory, from January 2025, produced papers for $2.33 each with GPT-4o and reported that its own automated reviewer scored them 6.1 out of 10 where humans scored 3.8, “automated scores significantly overestimating quality”. The difference between the systems that discovered a drug and the systems that wrote a paper is not the topology. All of them fan out to read and generate and converge through a tournament or a lead. The difference is the verifier at the end: a cell line, a binding assay, a compiler, a test suite, against a model’s opinion of a manuscript. Part 1 called this the verifier rule for a single agent’s reflection loop. It holds unchanged for a hundred agents.

How they fail together: the taxonomy

The failure record has a canonical source. “Why Do Multi-Agent LLM Systems Fail?”, from Berkeley, first posted in March 2025 and published at NeurIPS 2025 in its October revision, annotated 1,642 traces from seven open-source multi-agent frameworks, each trace averaging over 15,000 lines, with six expert annotators who agreed at a Cohen’s kappa of 0.88, and found failure rates of 41 to 86.7 percent. Its taxonomy, MAST, has fourteen failure modes in three categories. System design issues account for 44.2 percent of failures: step repetition at 15.7, unawareness of termination conditions at 12.4, disobeying the task specification at 11.8, loss of conversation history at 2.8, disobeying the role at 1.5. Inter-agent misalignment accounts for 32.3: a mismatch between reasoning and action at 13.2, task derailment at 7.4, failing to ask for clarification at 6.8, conversation resets at 2.2, ignoring another agent’s input at 1.9, withholding information at 0.8. Task verification accounts for 23.5: incorrect verification at 9.1, no or incomplete verification at 8.2, premature termination at 6.2. By system, on their own benchmarks: AppWorld failed 86.7 percent of tasks, HyperAgent 74.7, ChatDev 66.7, Magentic-One 62.0, MetaGPT 60.0, AG2 41.0.

Three of the paper’s findings matter more than the percentages. First, the design category is the largest, and the authors’ reading is that “MAS failure is not merely a function of challenges in the underlying model”; when they swapped models inside MetaGPT, GPT-4o cut design failures by 39 percent relative to Claude 3.7 Sonnet but did not remove them. Second, the misalignment category is not fixed by protocols: MCP and A2A standardise message formats, but these failures “occur even when agents within the same framework communicate using natural language”, which the paper calls a collapse of theory of mind. Its example is an AppWorld phone agent that never tells the supervisor the username must be a phone number, and a supervisor that never asks. Third, the interventions were modest. Rewriting ChatDev’s role prompts took it from 25.0 to 34.4 percent on a programming set; changing its topology to a cyclic graph that terminates only when a reviewer confirms, with an iteration cap, took it to 40.6; the authors’ verdict is that “they do not constitute substantial improvements”. The one that worked best was a verifier.

The equal-compute study adds the quantities the taxonomy lacks. Its trace analysis found that independent agents with no verifier amplified errors 17.2 times relative to a single agent, a central orchestrator 4.4 times, and that orchestrator synthesis reduced context-omission errors by 66.8 percent; coordination failures appeared only in multi-agent runs, at 1.8 percent for the centralised design and 12.4 for the hybrid. Four smaller 2026 results fill in the edges. A financial-document benchmark over 10,000 SEC filings found coordination failures, conflicts, deadlocks and corrupted messages, at 0.0 percent of errors for a sequential pipeline, 8.1 for parallel, 12.4 for hierarchical and 14.2 for a reflexive design, which was also the most accurate at 2.3 times the cost. A two-agent cooking benchmark found GPT-4o’s success falling from 94 percent at the easiest level to 4 at the hardest, and that models were “better at responding to collaboration than initiating” it. A distributed-computing benchmark of up to a hundred agents found “performance degrades significantly beyond small network sizes”. And an open-ended coordination benchmark of thirteen models found that “individual task competence does not imply coordination competence”. The failure modes, read as a whole, divide into three: decisions lost at a boundary, which is the partition failing; agreement arriving too early, which is shared state failing; and nobody checking, which is the verifier missing. The patterns above differ in which of the three they invite.

The arithmetic: tokens multiply, and the multiple has a shape

The published multipliers agree with each other more than their range suggests. Anthropic’s June 2025 post put agents at about four times the tokens of a chat and multi-agent systems at about fifteen, which is roughly 3.75 times a single agent; its January 2026 guidance says three to ten times for equivalent tasks; the Claude Code documentation puts agent teams at about seven times a standard session when teammates plan, and says usage is roughly proportional to team size. AgentPrune measured hand-built topologies at 2 to 11.8 times a simple chain. The Salesforce study found automated designs at up to ten times self-consistency. ArcticSwarm’s full system used about twenty times the tokens of its single agent, for 34 points. MetaGPT’s four roles cost 1.51 times its lone engineer; ChatDev’s team 3.2 times its single-agent baseline. The equal-compute study, holding tokens fixed, found the overhead instead in turns, 7.2 for a single agent against 27.7 for the centralised design and 44.3 for the hybrid, and in success per thousand tokens, 67.7 against 21.5 and 13.6. The multiplier is a property of the partition: the more that crosses the boundaries, the higher it goes.

Three things change the arithmetic in the platform team’s favour, and all three are in the rate cards of October 2026. The first is the tier. Anthropic’s own research system ran an Opus lead over Sonnet workers; Claude Haiku 5.5, released on 7 October at $0.10 per million input tokens and $0.50 output for prompts under 100,000 tokens, with cache reads at a cent, is marketed as a sub-agent, and the site’s price survey of 29 September puts Opus 5.5 at $4 and $20 with cache reads at $0.20, Sonnet 5.5 at $2 and $10, and OpenAI’s GPT-6 Luna at $0.10 and $0.50. A worker that reads is a small-model job. The second is the cache. Workers re-read the same brief and the same documents, and a cache read is a twentieth or a tenth of a fresh read; but the vendor guidance carries a trap, which is that parallel workers with slightly different prompts over the same context “write N separate cache entries and read none of each other’s”, and a cache entry becomes readable only once the first response has begun. Send one request, then fan out. The third is the harness shape: the system cards found that long-lived workers that keep their context beat fresh-per-subtask workers on tokens as well as latency, because the fresh worker re-establishes context every time.

A worked example, sized two ways

Take a task every platform team is asked for: due diligence on a supplier. Forty documents of about 5,000 tokens each, contracts, filings, audit letters and news, twelve questions to answer, and a report with citations. It is read-heavy and it partitions: the documents can be read in any order, and no answer depends on a decision taken while reading another document. On the equal-compute study’s map it sits with the financial-analysis task, where the orchestrator won by 80 percent, not with the planning task where every team lost. The sizes below are my assumptions and the prices are the October 2026 list prices; the point is the shape of the bill, not its last cent.

One agent. A single Sonnet 5.5 agent reads all forty documents, answers the questions and writes the report in about sixty steps. Its context grows with every document read and is compacted around 150,000 tokens; call the average context 90,000 tokens a step with nine tenths of it served from cache. Input costs 60 steps times (9,000 fresh tokens at $2 a million plus 81,000 cached at $0.10) which is $1.57; output of 800 tokens a step at $10 a million is $0.48; about $2.05 a task, and 5.4 million input tokens. The risk is not the bill. It is that a single window carrying 200,000 tokens of evidence is operating in the region where part 1’s reliability numbers were measured, and that compaction will discard a detail that a later question needed.

A lead and five workers. A Sonnet 5.5 lead writes the brief and splits the documents eight to a worker; five Haiku 5.5 workers read their eight documents in twenty steps each, with an average context of 35,000 tokens, and return a 1,500-token summary with citations; the lead answers the questions from the summaries, retrieves a document itself where a summary conflicts, and writes the report in fifteen steps at an average context of 20,000 tokens. Each worker costs 20 steps times (3,500 fresh tokens at $0.10 plus 31,500 cached at $0.01) which is $0.013, plus 12,000 output tokens at $0.50, $0.006: about two cents a worker, ten cents for five. The lead costs 15 steps times (2,000 fresh at $2 plus 18,000 cached at $0.10), $0.09, plus 15,000 output tokens at $10, $0.15: about $0.24. The task costs about $0.33 and 3.8 million input tokens, fewer tokens than the single agent, because each window stays small. Put the same five workers on Sonnet 5.5 instead and they cost about $0.32 each, $1.85 for the task, back to the single agent’s bill: the lever is the tier, not the count, which is the design Anthropic used in June 2025 and priced its smallest model for in October 2026.

What the arithmetic does not show. The lead is the join, and the AI-Q study found most final errors there; so the lead’s report needs a verification pass that checks every citation against the document, which is a sixth worker or a tool, and it needs the fan-out cache rule, one request before five. The 1,500-token summaries are the partition’s boundary, and any question that needs a fact the worker did not think worth summarising will be answered wrong unless the lead can retrieve. And if the task changes shape, if the questions begin to depend on each other or a negotiation is added at the end, the partition should be redrawn before the team is enlarged. The equal-compute study’s capability rule is the last check: where the single agent already succeeds more than about 45 percent of the time, adding agents is more likely to hurt than help.

Protocols are plumbing, not topology

A word on the wire. Google announced the Agent2Agent protocol on 9 April 2025 with more than fifty partners, moved it to the Linux Foundation on 23 June 2025 with more than a hundred, and shipped version 1.0.0 of the specification on 12 March 2026. An A2A server publishes an agent card, a JSON document of identity, capabilities, skills, endpoint and security schemes; a client sends it tasks, which move through submitted, working, input-required, completed, failed and a few other states, and receives artifacts made of typed parts; it is built on HTTP, JSON-RPC and server-sent events. The Model Context Protocol, announced by Anthropic on 25 November 2024 and moved to the Agentic AI Foundation under the Linux Foundation on 9 December 2025, is the vertical link, agent to tools and data; A2A is the horizontal one, agent to agent; IBM’s Agent Communication Protocol merged into A2A in 2025. These matter, and a later series will take them apart. But the failure taxonomy is clear that they do not decide the questions in this essay: the misalignment failures “occur even when agents within the same framework communicate using natural language”. A protocol fixes the envelope. The partition is what goes in it.

The patterns, by what crosses the boundary

The table collects every pattern in this essay with what crosses between its windows, what it buys, how it fails, and when not to use it.

What I would build, and in what order

These are the rules I apply when a team brings me a multi-agent design, ordered by how often the missing one turns out to be the problem.

Draw the partition before the org chart.

1. Draw the partition before the org chart. List the task’s decisions and ask, for each, which other decisions it depends on. The parts with no dependencies are workers; the parts with dependencies are one agent. If everything depends on everything, build one agent with a longer window and stop.
2. Decompose by context, not by job title. A worker is justified when it reads something the others need not. A planner, an implementer and a tester all read the same code and belong in one window; a reader of contracts and a reader of filings do not.
3. Maximise the single agent first. Measure it. If it already succeeds more than about 45 percent of the time, the equal-compute evidence says a team is more likely to hurt than help, and if the hard tail is small, the team will be slower.
4. Put a verifier at the join. Most final errors originate where results are combined. The lead’s synthesis gets a check against the sources, by tool where one exists, by a sceptical agent where it does not, and never by the lead itself.
5. Make the implicit explicit at every boundary. A written belief state, a fixed message envelope, a task description with an objective, an output format and the tools to use. Each of these moved a measured number; vague delegation duplicated work.
6. Gate the shared surface. Decide what may be read when. Isolation then review beat free messaging by twenty points in the one study that measured it, and a wipe of an unsanctioned board was undone within a day. Any writable surface two agents can both reach is a channel.
7. Prefer diversity to headcount. Two different agents matched sixteen identical ones; eight identical ones cost 27 points on logic. If an ensemble, vary the model or the prompt; if a team, keep it to three to five.
8. Price the partition, then choose the tier. Workers that read go on the cheapest model with cache reads at a cent; the lead goes on the strongest. Send one request before fanning out, so the workers read the same cache entry. Long-lived workers beat fresh ones on tokens.
9. Cap the pool in the harness, not the prompt. Concurrency, total agents, nesting depth and spend, with the vendor defaults read and overridden. The default pool guidance is under ten; the warning fires at 25.
10. Demand seeds for every coordination gain. Seven of ten reported architectures sit below the run-to-run noise floor. Four trials per task, end-state grading, and the single-agent baseline on the same model and budget, before any topology is adopted.

The partition is the pattern

The agents in the hundred-agent teams of September 2026 drew their own organisation charts, two tiers for the proofs and a flat pool for the index, and nobody told them to. The structure of the task did. That is the finding of this part, and it is the same finding as part 1’s from one level up: the pattern is not a thing you choose from a menu but the shape a well-partitioned task takes when the boundaries are drawn where the decisions are not. Where the work partitions, many agents are the only way to spend enough tokens, and the gains are large and getting larger. Where it does not, every boundary is a place where a decision is lost, and the measured record from the Flappy Bird clone to the 97 percent interference rate says so. Part 3 asks the question that both of these leave open: given a loop that works and a team that partitions, what has to sit outside all of them before any of them may run.