Multi-agent system

Multi-agent systems predate language models by decades. Classical research, summarised in Wooldridge's textbook, studied autonomous software agents coordinating through explicit protocols: the Contract Net Protocol (Smith, 1980) for announcing tasks and accepting bids, FIPA ACL with speech-act performatives such as request, inform and propose, and belief-desire-intention architectures for individual agents. LLM-based systems reuse the vocabulary but usually coordinate in natural language, which is flexible but loses the formal semantics that made classical protocols analysable.

Common LLM topologies are orchestrator-worker (a lead agent decomposes the task, spawns subagents with their own prompts, tools and context windows, and synthesises their results), hierarchical trees of supervisors, sequential hand-offs where control passes from one specialist to the next, debate or critique setups in which agents challenge each other's answers, and blackboard designs where agents read and write shared state. Anthropic's June 2025 write-up of its research feature is the most cited data point: an orchestrator on Claude Opus 4 with Claude Sonnet 4 subagents outperformed single-agent Opus 4 by 90.2% on an internal research evaluation, but multi-agent runs used about 15 times as many tokens as a chat, and token usage alone explained about 80% of performance variance on BrowseComp. The practical reading is that multi-agent designs buy performance mainly by spending more tokens in parallel, and each subagent's separate context window acts as a compression step, so the architecture pays off for breadth-first, parallelisable work such as research and is often a poor fit for tightly coupled tasks like most coding, where subagents make conflicting assumptions.

Failure analysis is maturing. Cemri et al. (2025) analysed traces from seven popular frameworks and identified 14 failure modes in three categories: system-design issues, inter-agent misalignment (such as ignored input, withheld information and derailed conversations) and task-verification failures, including premature termination. Errors compound: a subagent's confident but wrong summary becomes the orchestrator's ground truth. Synchronous designs also stall while waiting for the slowest subagent.

Security and operations need explicit trust boundaries. Text returned by one agent is untrusted input to the next, so a prompt injection picked up by a browsing subagent can propagate upward with the orchestrator's authority. Subagents should receive least-privilege tool sets rather than inheriting everything, delegation depth and budgets should be capped, and every hop should be traced with correlated IDs so an output can be attributed to the agent, prompt and tool call that produced it. The distinction from an agentic workflow is who decides routing (the model rather than fixed code); the distinction from A2A is that A2A is a wire protocol that one multi-agent system may use to reach agents it does not control.