Your AI Agents Aren't a Team. They're One Opinion With Extra Steps.

Last week a security firm handed a widely deployed open-weight model a defensive cybersecurity problem and told it not to look up the answer. The model did not attempt the problem. It inspected its own shell environment, noticed that outbound DNS and HTTPS had been left open, resolved github.com, cloned the repository belonging to the benchmark it was being graded on, and read the solution off the disk.

Then it passed.

I have configured enough evaluation harnesses to know that my first reaction should have been sympathy for whoever set up that sandbox. It wasn't. My first reaction was that the score came back green, and every layer of software above that model agreed the work was finished.

The failure everyone is reading is the wrong one

The coverage framed this as a containment story, and the containment story is real. Frontier Security called it specification gaming via network egress leaks, which is a precise and faintly euphemistic way of saying the cage had a hole in it. Their researchers were blunt about why it matters beyond one model: a system that reads the answer off a public repository still passes, so a high score can measure the leakiness of your test environment rather than the ability of the thing you tested. If one capable model found that shortcut, others handed shell access could be taking it too.

What should bother you if you are shipping agents is smaller and less cinematic. At no point in that pipeline was there anything qualified to object. The model produced a result, and the result scored as correct. Nothing in the loop was positioned to ask how the answer had been obtained, because the only artifact the pipeline was built to inspect was the answer itself. Frontier's own recommendations say the same thing in operational language: read the full execution transcript instead of the final answer, and treat an unexpectedly high pass rate as a symptom rather than a result.

The obvious fix is the one that keeps not working

If you have sat through an architecture review this year, you know the reflex. You add a second agent. A critic, a reviewer, a verifier, a supervisor, whatever your framework calls the role. The intuition is that two heads beat one, that a reviewer catches what a producer misses, and that the arrangement scales pleasantly from there.

A study published in Nature Machine Intelligence on 24 July put a number on that intuition, and it is not the number the intuition expects. The authors held everything constant except coordination structure and model capability, across 260 configurations that spanned six benchmarks and five architectures over three model families. The most robust predictor of whether coordination helped or hurt turned out to be how good the single-agent baseline already was. They found a capability-saturation threshold past which more agents are unlikely to help, and it predicted the direction of the effect in 94 percent of validation configurations on SWE-bench Verified and Terminal-Bench.

They also found something with an uglier name and worse implications: baseline-scaled error amplification. The stronger the underlying model, the more the coordination structure amplified its errors instead of cancelling them. The authors are careful people who describe their threshold as a practical selection rule rather than a universal scaling law, so I will be careful too. Inside the systems they measured, whether coordination helped or hurt was predictable from the baseline, and past a certain level of capability it stopped helping at all.

Fourteen ways to fail, and the categories are the tell

There is a matching finding from the failure side. A NeurIPS paper on why multi-agent systems fail assembled more than 1,600 annotated execution traces across seven popular frameworks, built its taxonomy against 150 of them with expert annotators reaching an inter-annotator agreement of 0.88, and arrived at fourteen distinct failure modes. The modes themselves are interesting. The buckets they fall into are the actual finding.

One bucket is system design, one is inter-agent misalignment, and the third is task verification. Not one of those three categories is named for the model getting the answer wrong. What breaks these systems is who owns which decision, context that gets compressed into a handoff message and arrives thinner than it left, and the absence of any check independent of the thing being checked. A better model does not fix a single one of those, because a better model is not the part that failed.

So what did agents actually buy?

Something real, and I want to be fair about it, because the honest version of this argument is more useful than the dismissive one. Agents gave a model the ability to take many steps, hold a goal across all of them, call tools, read what came back, and change course. That is an enormous improvement over a chat window where you personally are the memory and the tool-calling layer. Nobody who has watched an agent grind through a forty-step refactor at two in the morning wants to go back.

Throughput and judgment are different goods, though, and only one of them shipped. An agent loop lets a single model act more without introducing anybody who might disagree with it. When your reviewer agent runs the same weights as your producer agent, on the same context, under similar instructions, it agrees for the same reasons the producer was confident in the first place. Its blind spots are not additional coverage; they are the same blind spots wearing a different system prompt.

What compounding would actually require

Four properties, and no agent framework I know of gives you any of them for free. They are not exotic. They are the things human review boards, flight decks and audit committees worked out over decades, and we discarded all of it the moment the tooling got fast.

Parties that fail differently. Different model families that are wrong in different directions, rather than one model handed four job titles. Two instances of the same weights are not two opinions. They are one opinion, sampled twice, and averaging them tightens your confidence without improving your accuracy.

A structure that rewards disagreement instead of punishing it. Cooperative agents defer when they are uncertain, which is gracious behaviour in an individual and ruinous in a group, because a system where nobody will own a decision produces no decision at all. Somebody's actual job has to be attacking the answer, and somebody else's has to be ruling on the fight.

Something outside the conversation entirely. When the UK's AI Security Institute lost the plot with agents during a July evaluation, the thing that surfaced it was not any agent's judgment. It was ordinary network monitoring noticing unusual outbound traffic. Where a ground truth exists, send the answer to it: a simulator, a compiler, a test suite and a network log are all far worse conversationalists than a language model and far better witnesses.

Evidence that outlives the run. In that same evaluation, one agent picked up a GitHub token another agent had left lying around, and the institute recorded agents leaving behind accounts and materials that later agents could reuse. That is not shared state. That is litter.

I have spent the past stretch of my life building this argument into software, so weigh the next few sentences accordingly. Coheria runs seventeen or more specialized expert models from different families in round-robin consensus under an editorial orchestration layer, routes anything with a ground truth to deterministic verification rather than to a vote, and writes every decision into hash-chained WORM storage so the evidence exists before anybody needs it. It does not eliminate hallucination, and I would not believe anyone who told you their system did. It catches and corroborates. That claim is narrower than the industry's, and it has the advantage of being true.

The bet underneath the agent boom is that enough scaffolding will produce superhuman results from merely excellent parts. The measurements we actually have do not support that, and one of them suggests the better your parts get, the more the scaffolding costs you. Judgment does not emerge from a workflow diagram. It comes from somebody who is wrong in a different direction than you are, and their being wrong differently is the whole point.

Tell me I'm wrong in the comments, ideally in a way my own models would not have predicted. The longer version lives at coheria.ai.