Collaboration & delivery Published 17 August 2026 · Evidence current to August 2026 # The handoff, and where the work actually gets lost Issue 01 found that risk, not capability, stops organizations scaling AI employees. Issue 02 took that barrier apart. This issue measures the thing both were circling: work does not fail inside an agent. It fails in the space between one worker and the next. Three seams in one delegated task Human You the brief 41.8% of failures Agent Team lead the delegation 36.9% of failures Agent Specialist the approval 21.3% of failures Human You again Four workers, three transfers. Benchmarks score the boxes. Almost every documented failure happens on the lines — and the lines are the part no vendor instruments. Shares are the failure-category distribution from a 1,600-trace corpus, mapped onto the seam each category describes. ## Six numbers Each traced to a dated source 36.9% of multi-agent failures are inter-agent misalignment — communication breakdown, context lost at handoff, conflicting output. MAST · 1,600+ traces 79% of production breakdowns trace to specification and coordination, not to defects in the model. MAST synthesis · 2026 17× / 4.4× error amplification in an uncoordinated agent team, against a centralised team with a validation gate. Reported from MAST data · 2026 4 hops is where agent-to-agent chains start failing disproportionately. Each hop is a lossy compression of the task. Anthropic internal · reported 2026 97% of non-human identities already carry excessive privilege. Every hop multiplies the access it hands on. Cloud Security Alliance · Mar 2026 20 / 60 escalation rate, in percent: above 20 the agent is miscalibrated, near 60 the review queue has eaten the automation. Production analysis · Apr 2026 Nobody measures a human employee alone. We measure the brief they were given, whether the person receiving their output could act on it, how long they waited on an approval, and how much of the work came back. The unit of performance is the transfer, not the worker. Agent evaluation inverted this: benchmarks score one model on one task in isolation, then the results get used to predict the behaviour of a team. 01 ## The model is not what broke The largest empirical study of multi-agent failure to date annotated more than 1,600 execution traces across seven production frameworks and built a taxonomy from them: fourteen distinct failure modes, six expert annotators, inter-annotator agreement of 0.88. It is the closest thing the field has to a post-mortem archive. The finding that should reorganise how platforms are built is the distribution. Roughly four in five failures sit in specification and coordination. Model competence — the thing every procurement conversation is about — is not the dominant term. Upgrading the model addresses the smallest category. Rewriting the brief and the handoff addresses the other two. Fig 01 Where multi-agent failures actually sit Share of annotated failures by category · 14 modes · 7 frameworks 41.8% 36.9% 21.3% Specification & system design — task misread, roles ambiguous or duplicated, decomposition wrong, no termination condition Inter-agent misalignment — communication breakdown, context lost in transfer, conflicting output, format mismatch Task verification — no output check, absent validation, work accepted without anyone establishing it was done Shares vary a few points between the paper and independent replications on other trace sets — one graph-agent study reports 44.2 / 32.3 on its own trajectories. The ordering is stable across every reported set: specification first, coordination second, verification third. Within specification, step repetition (15.7%) and failure to recognise task completion (12.4%) are the two largest single modes. Sources: Cemri et al., Why Do Multi-Agent LLM Systems Fail? , NeurIPS 2025 (MAST, MAST-Data, n>1,600 traces, κ=0.88) · per-mode prevalence via arXiv:2601.17915 , Appendix C.1 · category-share synthesis reported by Augment Code , Jun 2026. 02 ## Depth is the cheapest thing to get wrong Adding a tier to an org chart feels free. It is not. Every hop re-states the task in the sender's words and the receiver acts on the re-statement, so each transfer is a lossy compression of the original intent. Anthropic's internal work puts the practical ceiling at four: beyond four agent-to-agent handoffs, tasks fail at disproportionately high rates. Topology decides how fast the loss compounds. Reported from the same trace corpus, an uncoordinated team amplifies an early error by up to seventeen times; a centralised team that forces work through a validation bottleneck holds amplification near four and a half. The bottleneck everyone designs around is the thing doing the work. Fig 02 The delegation ladder Each rung restates the task. The bar is intent surviving the transfer, not a measured completion rate. Human → agent The brief, as written 1 hop Leader restates for a specialist 2 hops Constraints start dropping out 3 hops Nobody holds the whole goal 4+ hops Disproportionate failure 17× error amplification, uncoordinated team 4.4× with a central validation gate 4 hops before failure rates break trend The bars are illustrative of a documented direction, not measured survival rates — no public dataset reports intent retention per hop, which is precisely the gap Figure 06 is built to close. The 17× / 4.4× figures and the four-hop ceiling are reported values. Sources: amplification figures reported from MAST data in arXiv:2604.22136 §2.5 · four-hop ceiling, Anthropic internal research as reported in Agent-to-Human Handoff Patterns , Apr 2026 · delegation-pattern guidance, Tomašev et al., Intelligent AI Delegation , Google DeepMind, 2026. 03 ## A handoff is a transfer of state, not a message The single most useful reframing in the current literature: a handoff is not a transfer of conversation, it is a transfer of working state. Systems that treat it as a message consistently fail. Passing the transcript is not passing the task — it passes everything except the parts that mattered. Two failure shapes recur. Context bleed : the sender's history contaminates the receiver's reasoning, so a planning agent's artifacts confuse an execution agent that needed only the decision. Context drift : state that has gone stale keeps being treated as current, and the orchestrator carries on under pre-handoff assumptions after a human already resolved the thing differently. Fig 03 What has to travel with the task Six fields. A handoff missing any one of them is a message, not a transfer. Goal The outcome in the requester's terms, not the sender's summary of it. Scope What is explicitly out of bounds. Absent boundaries produce actions nobody authorised. Evidence, with freshness Claims tied to what was inspected and when — a revision, a version, a timestamp — so they can be invalidated. Invariants The properties that must still hold afterwards. If they never reach the reviewer, the reviewer cannot establish them. Authority Which credentials and actions are granted for this task, scoped down rather than inherited whole. Done condition How the receiver knows to stop. Failure to recognise completion is one of the largest single modes in the taxonomy. The six fields are our consolidation of requirements stated separately across the handoff-protocol literature and the MAST failure modes. Evidence freshness matters at different rates: a documentation summary stays useful for hours, a permission check before a destructive operation deserves a much shorter validity, a health check from before a deployment should not authorise anything after it. Sources: Agent-to-Human Handoff Patterns , Apr 2026 (state-transfer framing, context bleed and drift) · AI Agent Handoff Protocols , Aug 2026 (what must travel, expansion discipline) · evidence-freshness and invariant argument, Why Multi-Agent Systems Fail at Handoffs , Aug 2026. 04 ## The human seam is the slow one Agents are measured in seconds and approvals in working hours. Every gate converts a machine-speed process into a human-speed one, which means the throughput of an AI workforce is set by the availability of its reviewers, not by the latency of its models. Teams discover this as "the agent is slow". Escalation rate is the diagnostic, and it has a usable band. Production deployments target roughly 70–80% handled autonomously against 20–30% escalated. Above 20% the agent is miscalibrated or under-trained. Approaching 60%, the reviewer queue has grown large enough to defeat the purpose of the automation — and the escalated bucket is exactly the expensive one: compliance-sensitive actions, high-value transactions, cases outside the training distribution. Fig 04 Escalation rate, and the band that works Share of tasks handed back to a human, on a single 0–100% axis 20% 60% 0% 25% 50% 75% 100% 20–30% — the target band. The agent handles the routine majority, humans take the costly remainder. Above 20% — read as miscalibration or under-training, not as caution. Near 60% — the review queue has consumed the automation. Below the band is its own warning: nothing is escalating. A rate under the band is not a success signal. It is the Issue 02 finding restated: an agent that escalates nothing is either well-calibrated or unable to recognise the cases it should be escalating, and the rate alone cannot distinguish them. Sources: escalation bands and the 70–80 / 20–30 split, Agent-to-Human Handoff Patterns , Apr 2026 · calibration reading cross-checked against Passi & Singh, The Oversight Fallacy , Data & Society, Jul 2026, discussed in Issue 02 . 05 ## Every hop hands on more access than it needs Delegation is an access-control event that most platforms record as a coordination event. The Cloud Security Alliance's March 2026 analysis is blunt about the compounding: each agent handoff multiplies access, and with 97% of non-human identities already carrying excessive privilege, the risk grows at every hop rather than staying flat. Two disclosed vulnerabilities show what the seam looks like when it is attacked rather than merely mismanaged. In agent session smuggling , a sub-agent embeds a silent instruction inside an otherwise routine response and the parent executes it with no prompt and no visibility. In cross-agent privilege escalation , one agent rewrites another's configuration mid-task, which can start a self-reinforcing control loop. The delegation chain is the lateral-movement path. It is also the feature you are selling. The defences named are unglamorous and specific: permissions scoped per task rather than inherited whole, and cryptographic lineage so a receiver can establish who actually authorised the work it is holding. Neither is a model improvement. Both belong to the handoff. Sources: Control the Chain, Secure the System , Cloud Security Alliance, 25 Mar 2026 (97% figure, session smuggling Nov 2025, cross-agent privilege escalation Sept 2025) · formal treatment of accountability propagation across a delegation chain, Safe Bilevel Delegation , 2026. 06 ## Rework is the number that tells the truth Completion rate flatters everyone. It counts a task as done when the agent stopped, which is not the same as the work being usable. Rework rate — how often output has to be redone — is harder to game, and it splits cleanly into two causes that need opposite fixes. The delegation-gap literature makes the throughput consequence concrete. When a person cannot fully hand a task over, they stay inside the loop: prompt, read, correct, re-prompt, accept the partial output, finish the rest themselves. The agent accelerates the typing and frees nobody. A February 2026 study of 4,500 engineers across 150 enterprises found teams without structured delegation primitives ran 23% higher bug density and spent 12% more time in code review — more output, more inspection, no net gain. Fig 05 Attributing rework One question, asked of every redone task. The answer picks the fix. Instruction fault The agent did what it was told and what it was told was wrong. Scope was open, the goal was a summary of a goal, the done condition was implicit. Fix the handoff, not the model Execution fault The brief was sound and the work still came back. Tool use failed, the agent looped, or it stopped before the condition it was given. Fix capability, tooling or routing This is an instrument, not a result. The taxonomy predicts the split lands heavily on the instruction side — specification is the largest failure category in every reported trace set — but we are not publishing a ratio we have not measured. Ours follows in the next issue. Sources: throughput argument and the McKinsey February 2026 engineering study (n=4,500 across 150 enterprises), The Delegation Gap , May 2026 · failure-mode attribution, Microsoft AI Red Team agent failure taxonomy, 2025, updated 2026. 07 ## The handoff audit Five measures, computable from agent logs most teams already keep. None requires a benchmark, a new vendor, or our platform. If you run agents in production you can produce these numbers this week, and they will tell you more about your deployment than any model comparison will. Where a threshold is published we cite it. Where it is not, the column says so rather than inventing one. Fig 06 Five measures of a seam Run these against your own traces Measure How to compute it Reference point Handoff success by direction Split every transfer into human→agent, agent→agent, agent→human. For each, the share where the receiver acted without asking for more. Report the three separately; an average hides the broken one. No published baseline. Compare your own directions against each other. Completion by depth Tag each task with the number of agent-to-agent hops it travelled, then plot completion against depth. The curve's knee is your real delegation limit. Expect degradation by 4 hops. Escalation rate Share of tasks returned to a human. Track it per role, not per deployment — one badly scoped employee can carry the whole number. Band 20–30%. Above 20% miscalibrated; near 60% self-defeating. Time to unblock Wall-clock time from an approval being requested to it being answered. Take the median and the 90th percentile; the tail is where work actually dies. No published baseline. Compare against your agents' task latency. Rework, attributed Share of completed work redone, split into instruction fault and execution fault per Figure 05. The split is the finding; the total is only a headline. Specification dominates in every published trace set. Two of the five have no external baseline. That is not a gap in the instrument, it is the state of the field: handoff success and approval latency are not reported by anyone at scale, which is why we are collecting them. 08 ## What this changes about how you buy If four in five failures are specification and coordination, then the evaluation criteria in most procurement processes are aimed at the smallest term. A demo shows one agent doing one task well. It cannot show you what happens at the third hop, or how long an approval sits, or whether the receiver got the invariants. Four questions worth asking any vendor, including us. What travels with a delegated task — can you see the goal, scope, evidence, invariants, authority and done condition, or just a message? How deep does delegation go , and is depth capped or unbounded? What does an approval cost in time , measured rather than described? Is authority scoped per hop or inherited whole? A platform that cannot answer these has not instrumented the place where its failures come from. The expansion discipline in the handoff-protocol literature is the same idea applied to rollout: widen exactly one dimension at a time — receiver role, data class, tool, action, channel, volume, delegation depth, operating window — because when several change together a regression cannot be attributed to any of them. Sources: expansion discipline and conformance testing, AI Agent Handoff Protocols , Aug 2026 · category shares as in Figure 01. 09 ## Methods, and what this issue cannot tell you Every figure comes from published work, dated and linked at the foot of its section. Where we have consolidated findings that appear separately across sources — the six handoff fields in Figure 03, the two-way rework attribution in Figure 05 — the section note says so. Figure 02's bars illustrate a documented direction and are not measured retention rates; the note under the figure states this rather than leaving the shape to imply precision it does not have. Three limits are worth naming. The trace corpora behind the taxonomy come from research and open-source frameworks, not from enterprise deployments, and enterprise coordination may fail differently. Reported production failure rates span 41% to nearly 87%, a range wide enough that the central estimate should be treated as a direction rather than a number. And the four-hop ceiling is reported from internal research we cannot independently inspect. We publish the instrument before we publish our own numbers. The next issue reports what it found on us. A later issue runs the audit in Figure 06 against our own delegation traces and approval records — the same five measures, on a company where agents do most of the work. Including the ones that look bad. ## References Nine sources · every figure in this issue traces to one of them - 01 Cemri, M. et al. Why Do Multi-Agent LLM Systems Fail? NeurIPS 2025. MAST taxonomy, MAST-Data, 1,600+ annotated traces across 7 frameworks, κ=0.88. arxiv.org/abs/2503.13657 Used in: Figure 01, sections 01, 06, 08 - 02 Per-mode failure prevalence, Appendix C.1 — step repetition 15.7%, unaware of termination conditions 12.4%, disobey task specification 11.8%. arxiv.org/pdf/2601.17915 Used in: Figure 01 note - 03 Sovereign Agentic Loops , 2026, §2.5 — error amplification of up to 17× in uncoordinated multi-agent systems against approximately 4.4× with a centralised validation bottleneck. arxiv.org/pdf/2604.22136 Used in: Figure 02, section 02 - 04 Agent-to-Human Handoff Patterns , Zylos Research, 3 Apr 2026 — four-hop ceiling from Anthropic internal research, escalation bands, the 70–80 / 20–30 split, context bleed and context drift. zylos.ai Used in: Figures 02 and 04, sections 02, 03, 04 - 05 Control the Chain, Secure the System: Fixing AI Agent Delegation , Cloud Security Alliance, 25 Mar 2026 — 97% of non-human identities carrying excessive privilege, agent session smuggling (Nov 2025), cross-agent privilege escalation (Sept 2025). cloudsecurityalliance.org Used in: section 05 - 06 AI Agent Handoff Protocols: What Must Travel With the Task , CellCog, Aug 2026 — handoff field requirements, one-dimension expansion discipline, conformance testing. cellcog.ai Used in: Figure 03, sections 03, 08 - 07 The Delegation Gap , Clarvia, May 2026 — McKinsey February 2026 study of 4,500 engineers across 150 enterprises: 23% higher bug density and 12% more time in code review without structured delegation primitives. clarvia.dev Used in: section 06 - 08 Category-share synthesis and the 41–86.7% reported range of production failure rates. augmentcode.com , Jun 2026 Used in: Figure 01, section 09 - 09 Safe Bilevel Delegation , 2026 — formal accountability propagation across a delegation chain; cites Tomašev et al., Intelligent AI Delegation , Google DeepMind, 2026. arxiv.org/pdf/2604.27358 Used in: sections 02, 05 Also referenced without carrying a figure: Passi & Singh, The Oversight Fallacy , Data & Society, Jul 2026, and the Microsoft AI Red Team agent failure taxonomy, 2025 revised 2026. Both are discussed at length in Issue 02 .