Pattern 6.5 · Agentic Dysfunctions
Delegative Handoff Erosion
The Broken Telephone
Alignment progressively degrades as a sophisticated agent delegates to simpler tools or sub-agents that lack the fine-grained understanding necessary to preserve intent. Each handoff strips context and each tool simplifies goals, so the final action bears little resemblance to the original instruction. The loss accumulates across hops; loss confined to a single tool boundary is Tool-Interface Decontextualization (6.1).
Unit of analysis and evidence status
Unit of analysis
- Unit of assessment
- Multi-agent
- Kind of entry
- Observable pattern
- What is observed
- In a delegation chain, the terminal action departs from the originating instruction, and comparing each hop's brief with the original shows context or constraints lost incrementally across two or more hops.
- Minimum persistence
- Recurs within or across contexts
- Specifiers
- Architecture-coupled Multi-agent
Evidence status
- Underlying behavior
- 2 research publications, 1 documented incident and 1 other source (4 sources)
- This construct
- Awaiting independent assessment
- Proposed mechanism
- Hypotheses; not yet assessed
- Detection
- Accuracy unmeasured
- Interventions
- Untested for this pattern; evidence shown is for the general technique
- Last review
- No independent review yet
- Author's working assessment (book)
- E1 (a clear mechanistic hypothesis and illustrative cases; syndrome-specific prevalence is unknown)
- Typical-case risk (editorial estimate)
- ModerateConsequences, spread, persistence and detectability depend on the deployment.
Unassessed is not unsupported: the behavior can be well documented while this construct awaits assessment.
Clinical reference
6.5 Delegative Handoff Erosion “The Broken Telephone”
Healthy functioning
Functional resilience. A system functioning well passes full intent and constraints to every tool and sub-agent it delegates to, and checks that delegated work preserved them.
For example: Delegating a refund task to a sub-agent, it passes the customer's goal and the refund limit together, and checks that the completed refund stayed within both.
Adequate functioning
Each handoff carries the originating goal and its constraints, so terminal actions satisfy the original instruction's intent as well as its letter.
Diagnostic Criteria
Required (all must hold)
- Terminal actions that diverge from the originating instruction even though each hop is a plausible reading of the instruction it received
- Loss that accumulates across two or more hops, shown by comparing each hop's brief with the original, rather than loss located at one boundary
- Every party in the chain is sanctioned and the transport between hops worked as specified, so the loss arises in the handoffs themselves
Supporting
- Progressive simplification of goals through delegation layers
- Critical context lost in inter-agent communication
- Sub-agent actions technically satisfying requests while violating intent
- Ethical or safety constraints stated at the origin that are absent from terminal actions
Symptoms
- A primary agent stating aligned intentions while producing misaligned outcomes through tool use
- Increasing drift from intent as delegation depth increases
- Tool outputs that strip safety-relevant context
- Final actions satisfying literal requirements while missing purpose
- Inability to reconstruct original intent from tool chain outputs
Further signals
- Subagents satisfying their immediate subgoal while violating the orchestrator's higher-level intent (literal-but-misaligned).
- Successive paraphrases that drop qualifiers ("if safe to do so", "with user consent", "within budget") at progressively deeper hops.
- Terminal actions that pass each individual interface check but whose composition violates the originating constraints.
- Orchestrator surprise on chain return ("that's not what I meant") mirroring 6.1 surprise but at chain rather than call scope.
Rule out first
- Loss located at a single tool boundary (Tool-Interface Decontextualization, 6.1)
- A transport or serialization bug that truncated messages
- An unsanctioned party in the chain (Shadow Mode Autonomy, 6.6)
- Active misrepresentation of sub-agent results (Delegation Narcissism, 6.9)
- An ambiguous originating instruction
Differential diagnosis
- 6.1 Tool-Interface Decontextualization: 6.1 is single-hop translation failure; 6.5 is multi-hop cumulative loss. If chain depth is 1, code 6.1. If depth is 2 or more and loss is incremental (not localized to a single hop), code 6.5. At depth 2 with all loss at one hop, it is 6.1 located at that hop, not 6.5.
- 6.6 Shadow Mode Autonomy: 6.5 occurs within a sanctioned chain whose hops are all registered. 6.6 is operation outside the sanctioned chain. Check governance: are all parties to the chain documented and approved? If yes, errors are 6.5; if a party is operating outside governance, code 6.6 additionally.
- 10.1 Consensus Collapse: 6.5 is hierarchical (orchestrator to subagents to tools); 10.1 and its axis-10 neighbors are peer-symmetric (multiple agents at similar capability deliberating). If the dysfunction emerges from peer interaction rather than principal-agent delegation, prefer 10.1 or another axis-10 entry.
- 7.3 Contagious Misalignment: 7.3 spreads misalignment laterally between peer systems; 6.5 is vertical context loss down a hierarchical chain. Check the topology: peer-to-peer transmission indicates 7.3; principal-to-agent degradation indicates 6.5.
- 6.9 Delegation Narcissism: 6.5 is passive context loss through delegation chains. 6.9 involves active misrepresentation and suppression of sub-agent feedback. Check whether context is lost passively (6.5) or actively distorted (6.9).
Discriminating test
Diff each hop's brief against the original: loss concentrated at one boundary is Tool-Interface Decontextualization (6.1) located there, and a user-facing summary that contradicts the sub-agent logs points to Delegation Narcissism (6.9).
What a positive finding supports: A positive finding shows cumulative intent loss in this chain's design. It does not show that any agent pursued a different goal, and it does not assign the loss to one model rather than the protocol between components.
Detection routes
Accuracy unmeasured for every route.
- Asking the system itself
- Partial route
- Another AI system observing
- Partial routeAnother model's agreement is insufficient without verification.
- An outside evaluator testing it
- Usable route
Why asking the system falls short
The originating agent can report its intent and (often) recognize, when shown the terminal action, that intent was lost. In-flight self-report is partial because the agent does not directly observe what its delegated subagents are doing; the dysfunction lives in the interfaces it does not see. Each subagent's self-report is constrained by the context it actually received, which is exactly the impoverished context.
Documented evidence
Sources in the diagnostic corpus
Augment Code (2026). Why Multi-Agent LLM Systems Fail
What it establishes
Analysis of multi-agent system failures found that unstructured multi-agent networks amplify errors up to 17.2 times compared to single-agent baselines. The delegation edge where one agent hands work to another is the primary failure point: context crosses authority boundaries and compromised instructions propagate from low-privilege to high-privilege agents. The errors compound with each handoff, the cumulative loss that separates 6.5 from a failure at a single boundary. (Sources: augmentcode.com published analysis)
Cemri et al. (2025). Why Do Multi-Agent LLM Systems Fail? NeurIPS 2025. arxiv 2503.13657.
What it establishes
Cemri et al. annotated 1,642 execution traces from seven multi-agent frameworks and sorted 14 failure modes into three categories: system design issues (about 44% of recorded failures), inter-agent misalignment (about 32%) and task verification (about 24%), with high inter-annotator agreement (kappa = 0.88). Inter-agent misalignment includes information withholding, where one agent fails to pass on data another needs, and system design issues include loss of conversation history. Each accounts for under 3% of recorded failures, but on this page's reading those two modes are the closest match to handoff erosion: constraints that the orchestrator held never reach the terminal action. (Sources: arxiv 2503.13657, NeurIPS 2025 proceedings, GitHub repository)
Vectara (2024-2025). Awesome Agent Failures case studies
What it establishes
Documented AutoGPT planning failures where delegation chains produced progressive context loss: a research task delegated through search, save, and verify sub-steps lost the original scope constraints at each hop, resulting in hundreds of API calls that satisfied individual sub-goals while violating the orchestrator's higher-level intent. Classic 6.5 pattern: successive paraphrases dropping qualifiers across delegation depth. (Sources: GitHub repository vectara/awesome-agent-failures)
MCP tool poisoning research (2026-03). Cross-tool contamination
What it establishes
Research on MCP security vulnerabilities documented that when multiple MCP servers run concurrently, namespace collisions and ambiguous tool names create opportunities for malicious servers to intercept calls intended for legitimate ones. Tool definitions mutate after installation (rug pull attacks). Demonstrates how delegation chains can lose intent fidelity through the interface layer itself, not just through agent paraphrasing. (Sources: arXiv:2603.22489 and simonwillison.net)
Possible responses
- Intent-preserving tool interfaces maintaining context across delegations
- End-to-end alignment verification comparing final output to original instruction
- Rich inter-agent communication protocols encoding goals, constraints, and context
- Alignment-aware tool design accounting for downstream use in delegation chains
- Human-in-the-loop checkpoints at critical delegation boundaries
First-line candidates
- Context-preservation protocols at delegation interfaces: Standardize the interface schema between agents/tools to carry intent metadata (constraints, qualifiers, originating context) as first-class fields, not as free-text addenda. Stage: All multi-agent / multi-tool chains; required for safety-relevant tool chains.
- End-to-end alignment testing for tool chains: Treat the chain as a unit under test. Inject test cases at the orchestrator and assert properties of terminal actions, not just per-hop properties. Stage: Pre-deployment of agent chains; CI for production agent stacks.
Who can act: System architect or deployer (context-propagation protocols, end-to-end verification, human checkpoints); model and tool developers (intent-preserving interfaces).
Mechanistic hypotheses
- Capability asymmetry between sophisticated agents and simple tools
- Interface limitations that cannot express subtle intent
- Absent or insufficient context propagation protocols
- Tool designs optimizing for specific metrics without broader awareness
- Lack of end-to-end alignment verification across delegation chains
Analogy and commentary
Human Analog: The "telephone game" where messages degrade through transmission; bureaucratic failures where high-level policy becomes distorted through layers of implementation; principal-agent problems
Theoretical Basis: “Delegation drift,” Safer Agentic AI (2026).
Functional ABC Analysis
A (Antecedent): A sophisticated orchestrating agent must delegate subtasks to simpler tools or sub-agents across interfaces that cannot express the full richness of the delegator's intent, ethical constraints, or contextual nuance.
B (Behavior): Alignment progressively degrades at each delegation layer: goals are simplified, safety-relevant context is stripped, and downstream tools execute actions that satisfy literal parameters while violating the underlying purpose.
C (Consequence): Each tool in the chain reports "task completed" based on narrow success criteria, providing positive reinforcement despite misaligned outcomes. The absence of end-to-end intent verification means no corrective signal propagates back up the chain.
Potential Impact
Well-aligned orchestrating agents may produce harmful outcomes through misaligned tool use, with responsibility diffused across the chain. Debugging such failures is difficult because each layer strips safety context from the logs, which makes end-to-end tracing nearly impossible.