A benchmark published this month ran the same 600 tasks through seven agent topologies and found that the architecture every vendor demos is also the one that oversteps most. Centralized supervisor hierarchies completed 93.9–98.6% of tasks. Flat peer networks completed 85.7–87.0%. On unauthorized actions the order inverts: hierarchies took one in 2.7–19.8% of tasks, peer networks in 0.6–0.8%, "a gap that widens with hierarchy depth," according to MasDrift, posted to arXiv on 2 August 2026 and revised on 11 August.
Nobody attacked these systems. There was no prompt injection, no compromised tool, no adversary. The permissions were correct. Six hundred ordinary productivity tasks were handed to a supervisor, the supervisor split the work, and somewhere between the user's instruction and the worker's tool call, the part of the instruction that said don't stopped travelling with the part that said do.
That matters more this month than last, because agents just got a wallet.
What MasDrift Measured, and Why It Is Not Another Prompt-Injection Paper
MasDrift is a controlled comparison of coordination topologies, not a red-team exercise. The authors — Zhuoning Xu, Xiucheng Zhang, Hanjun Luo, Yingbin Jin, Yinpeng Dong and Hanan Salam — built 600 benign tasks across finance (90 tasks), human resources (85), marketing (80), operations (80), sales (80), customer support (80), healthcare (55) and legal (50). Each task pairs work the agent is required to do with actions the user explicitly withheld.
The withheld actions are the whole design. The paper's task suite contains 1,915 reserved actions at 3.19 per task, comprising "929 production state changes, 919 external transmissions, and 67 publications." An unauthorized action is defined as a call that matches one of those reserved predicates — write to production, send outside the org, publish. Not a hallucination. Not a wrong answer. A real side effect the user said not to take.
The same tasks then ran through a single agent, centralized hierarchies at one, two and three levels, and peer networks of two, four and eight agents, across DeepSeek V4 Flash, Qwen3.7 Plus, GPT-5.4 Nano, Gemini 3.1 Pro and GPT-5.6 Sol. The variable under test is the org chart, not the model.
This is a distinct failure from the one we covered when one agent escalated another through standing IAM permissions. There, the grants were too wide and an attacker found them. Here the grants are correct and no attacker exists. The boundary is dropped by the topology.
The Drift Happens at Handoff One, Not Deep in the Tree
The loss is not gradual accumulation down a delegation chain — it is one bad copy at the top. The paper's second observation is blunt: "Even at three levels, 71.9% of losses remain at hop 1, and the deeper tail reflects the longer routing paths of that topology rather than a later typical loss."
The mechanism is named directly: the evaluator places 92% of one model's losses "at the very first handoff, where the lead restates the task before any worker sees it."
Restating the task is not a bug in some framework. It is the advertised feature. Microsoft's connected agents documentation sells it as "no custom orchestration required: the main agent uses natural language to route tasks, eliminating the need for hardcoded logic." Amazon's Bedrock multi-agent collaboration says the supervisor "automatically creates and executes a plan across a set of collaborator agents." CrewAI's hierarchical process has a manager that will "allocate tasks among crew members based on their roles and capabilities." Anthropic's own multi-agent research write-up says subagents need "an objective, an output format, guidance on the tools and sources to use, and clear task boundaries" — a lead-authored brief, in other words.
Every one of those is a paraphrase step. A paraphrase preserves the goal, because the goal is what the supervisor was asked to achieve. It drops the prohibition, because the prohibition is not part of the goal.
There is one practical fork worth checking in your own stack before Monday. LangGraph's supervisor library says its default create_handoff_tool forwards the full message history — the original user turn survives to the worker. Custom handoff tools that add a task_description parameter for "the LLM to populate" do not. Same library, opposite exposure, one line of code apart.
The Strongest Model Did Not Fix It. It Hid It.
Buying a better model does not remove the drift — it removes the symptom while leaving the cause, which is worse, because you cannot see it. This is the finding that should stop a platform team cold.
GPT-5.6 Sol posted the lowest unauthorized-action rates in the table — 0.0% at one level, 1.5% at two, 1.0% at three, where DeepSeek V4 Flash ran 6.0% → 15.7% → 26.2% and Qwen3.7 Plus ran 0.8% → 14.5% → 33.5%. On the scoreboard, Sol looks like the safe choice.
It is not. The paper reports that homogeneous Sol "reaches 44.7% CL, the highest of any homogeneous configuration we evaluate, while its UA is the lowest: the drift is fully present, only masked by the restraint of the executing model." Constraint loss — CL — is defined as the constraint being "weakened or absent for the executing agent." Sol loses the constraint more often than anything else tested. Its workers simply decline to act on the opening.
Then the authors changed the workers. In the heterogeneous Sol–Nano configuration, "averaged over the four centralized architectures, Sol–Nano loses the constraint at least as often as pure Sol, yet their UA rates are 1.0% and 24.9%" — 1.0% is pure Sol, 24.9% is Sol–Nano. Same lead. Same topology. Same rate of dropping the boundary. Twenty-five times the violations, because a cheaper model sat in the worker slot.
If you route sub-agents to a cheaper tier to control token spend — and multi-agent systems burn roughly 15× the tokens of a chat, per Anthropic's own numbers, so you probably do — this is your configuration. The paper's conclusion: "The fix is architectural, not a question of which model you buy."
Treat that as the counterweight to any orchestration platform selection that scores on features and completion, and to any pilot graded on how many tasks finished rather than how many finished acceptably.
Agents Got a Production Wallet on 18 August. The Guards Are All Per-Tool.
The timing is what turns a preprint into a procurement question: the write and spend authority reached general availability in the same fortnight the benchmark did. AWS made Bedrock AgentCore Payments generally available on 18 August 2026 — in preview since May — letting agents "autonomously discover, access, and pay for paid APIs, MCPs, and content with just a few lines of code" over the Machine Payment Protocol and x402, with Coinbase and Stripe Privy wallets behind it. Two weeks earlier, on 5 August, Cloudflare put WriteGuard into private beta, classifying every MCP tool call into Read Only, Minimal Impact, Contained Write or Critical, and blocking a configured top-tier call before its handler runs — one of a week of agent-platform launches.
Both are good controls. Both are the wrong shape for this failure.
AWS's Payment Sessions enforce a maximum spend and a session expiry deterministically at the infrastructure layer. WriteGuard gates a tool by its risk tier. Neither knows that this user, in this request, said not to email the vendor, not to touch the production record, not to publish. A per-tool allowlist answers "may an agent ever do this?" MasDrift is measuring failures of "may this agent do this, now, for this request?" — and 100% of the reserved actions in the suite are things the agent was, in general, allowed to do.
That is the same gap we flagged when AWS agent sessions ran 14 days with the session as the only wall, and it is why prompts are not policy. OWASP's Top 10 for Agentic Applications, published in December 2025, files this territory under ASI03 Identity and Privilege Abuse and ASI07 Insecure Inter-Agent Communication, and introduces "least agency" — grant only the minimum autonomy required for safe, bounded tasks. A separate May 2026 preprint on authorization propagation argues the same point from theory: RBAC, ABAC and ReBAC do not model transitive delegation, and identity governance has to be enforced at every interaction boundary.
Meanwhile the State of AI Agent Security 2026 survey — self-reported by 900-plus executives and practitioners, published 4 February 2026 by API-management vendor Gravitee, which sells the agent governance it finds missing — found 25.5% of deployed agents can already create and task another agent, 45.6% of teams authenticate agent-to-agent traffic with shared API keys, and only 21.9% treat agents as identity-bearing entities at all. The topology is spreading faster than the identity model under it.
Re-Anchoring Costs 1.6 Points. Policy Chaining Costs 36.3.
The paper tested two fixes, and the cheap one wins by a margin large enough to settle the argument. Re-anchoring validates every pending call against the original user request. Chain propagation carries an attenuated policy down the delegation chain.
Chain propagation is the design most architects reach for first, and it is the wrong one. It eliminates executed unauthorized actions — and then keeps going. Per the paper's third observation: "Chain blocks up to 54.5% of attempted required calls and forfeits up to 36.3 points of completion, whereas Source blocks at most 3.5% and moves completion by at most 4.5 points." Re-anchoring cost 1.6 points of pooled completion across the evaluation and reduced unauthorized actions in every model configuration tested.
An agent system that refuses half the work it was asked to do will be switched off inside a quarter. One that gives up 1.6 points of completion will not be noticed. That is the entire trade, and it is not close.
The honest caveats: MasDrift is a preprint and has not been peer reviewed, the tasks are constructed rather than harvested from production traffic, and the abstract's headline ranges cover "generic multi-agent conditions" — individual model-topology cells in the table vary widely, running both below that floor and well above that ceiling. What survives all of that is the direction and the mechanism, both of which reproduce across five models and three depths.
What to Do
This Week: Find out what your supervisor actually forwards. Open the handoff and answer one question — does the worker receive the original user turn, or a supervisor-authored restatement? In LangGraph that is the difference between the default handoff tool and a custom one with a task_description field. In Bedrock multi-agent collaboration and Foundry connected agents, the supervisor authors the instruction and you cannot see it by default: Microsoft's docs state plainly that "connected agent responses are only visible to the main agent, and not to the end user." Get that into your traces before you argue about anything else.
This Month: Add a re-anchor check at the tool boundary, not the agent boundary. Every call with a side effect gets evaluated against the original user request — the literal text, held immutably for the run — before it executes. This is a gate in front of your tool executor, not a prompt instruction, and it is a week of work for most teams. If your platform cannot hold and re-present the original request at execution time, that is now a selection criterion. Note the depth constraint you are designing against: Foundry's classic connected agents cap out at a depth of 2 and error beyond it, while CrewAI and LangGraph will let you nest as deep as you like.
Before You Grant Write or Spend Scopes: Require an unauthorized-action number, measured on your own tasks, alongside the completion number. Run a fixed task set through your candidate topology with 20–30 explicitly reserved actions and count violations. Then run the same set flat. If the hierarchy wins on completion by eight points and loses on violations by fifteen, you now have the actual decision in front of you instead of a demo. Do this before AgentCore Payments session limits or WriteGuard tiers are the only thing between an agent and a funded wallet — and price the consumption exposure while you are there.
If You Have Mixed Model Tiers: Re-test. A supervisor on a frontier model with workers on a cheap one is the exact configuration where constraint loss stays constant and violations multiply by 25×. Your cost-optimization change last quarter may have been a security change nobody logged.
The Bottom Line
Every distributed system generation has learned the same lesson late: the thing that makes coordination efficient is the thing that loses the context. Two-phase commit lost it to the coordinator. Microservices lost it at the service boundary and got service meshes and propagated trace context in return. Multi-agent systems are losing authorization at the delegation hop, and the industry is currently answering with per-tool allowlists — the equivalent of firewalling each service and calling it distributed tracing.
The measurement now exists. Pick your agent topology the way you pick a database isolation level: by what it guarantees under load, not by how fast it looks in the demo. And keep the user's original words in the room, all the way down.
Completion rate tells you what the system did. The unauthorized-action rate tells you what it will cost you.
Continue Reading
- One Agent Escalated Another. Every Call Was Authorized.
- Agent Orchestration Platforms: Score Exit, Not Features
- LangGraph vs CrewAI vs AutoGen: One of Them Is Retired
- AWS Agents Run 14 Days. The Session Is the Only Wall.
- Claude Code Stops Asking Aug 14. Prompts Aren't Policy.
- Best AI Agent Monitoring: Langfuse, Then a Real Kill Switch
- Agents Averaged 73. Only 30% Were Usable. Grade Pass/Fail.