Guarding the Wrong Door: Why 79% of Multi-Agent Failures Happen Before Runtime

Seven frameworks. One thousand six hundred and forty-two annotated trajectories. One number that should have stopped the agent industry cold this year: 78.6%.

That is the share of multi-agent failures in the MAST taxonomy that trace back to system design and inter-agent misalignment rather than to model capability, tool errors, or adversarial attack. Broken down, 44.2% of failures land in what the researchers label FC1 — system design: repeated steps, agents that never notice a termination condition, agents that drift from the task specification they were handed. Another 34.4% land in FC2 — inter-agent mismatch: reasoning that doesn't match the action taken, tasks that jump the rails entirely. Only the remainder belongs to verification, and almost none of it belongs to the things the entire vendor ecosystem spent 2025 and early 2026 building products around.

Read that again, because the industry read it and did the opposite.

The Stack Everyone Built, and What It Actually Guards

Walk the floor of any enterprise AI conference in 2026 and you will see the same architecture diagram repeated across a dozen booths. At the bottom, MCP — the Model Context Protocol, now hosted under the AI Agent Interoperability Foundation — handles tool invocation. Above it, OAuth 2.0 and SPIFFE/SPIRE establish workload identity. Around it, OWASP's Agent Control Standard and NIST's AI Agent Standards framework supply the vocabulary. And on top, the commercial layer: Broadcom's AgentMinder binding identity to intent, Microsoft's MXC enforcing policy-driven isolation at the operating-system level, sandboxes everywhere.

Every one of those pieces is good engineering. Every one of them is also, precisely, a runtime control.

Identity. Authorization. Intent binding. Sandboxing. Observability. That is the full inventory. And that inventory answers a narrow question: how do we make sure this agent, which we have verified is this agent, does not exceed its permissions? It does not answer the prior question: is this agent, with these permissions, being asked to do something coherent in the first place?

Those are different problems. They require different tools. And the industry has funded exactly one of them.

Why FC1 and FC2 Are Not Model Problems

Here is where the analysis gets uncomfortable, and where I think most teams are quietly lying to themselves.

FC1 failures — step repetition, unnoticed termination conditions, specification non-compliance — look like dumbness. They read, in a demo, like the model isn't smart enough. So the instinctive fix is to wait for the next base model, or to upgrade from a mid-tier model to a frontier one, and to assume the problem dissolves.

It doesn't dissolve, because it isn't a reasoning-capacity problem. It's an orchestration problem wearing a reasoning problem's clothes.

An agent that repeats a step indefinitely is usually an agent whose loop has no well-defined exit predicate. That is a specification gap: the author never wrote down what "done" means, so the runtime has nothing to check against. An agent that doesn't comply with its task specification is frequently an agent whose specification was written in prose so ambiguous that two competent human engineers would have implemented it differently. An agent pair that mismatches reasoning to action is often a pair whose role boundaries were never defined — both agents believe they own the same decision, or neither does.

None of those are cured by more parameters. A smarter agent given a fuzzy termination condition will find a more sophisticated way to not terminate.

The failure taxonomy is not describing a capability ceiling. It is describing a specification vacuum, and the industry has been buying air filters.

I want to be careful with the causal claim here, because the underlying research gives a distribution, not a mechanism. The intervention experiments in the MAST work do show that rewriting role specifications measurably reduces FC1 failures — which is the strongest evidence in the entire dataset that this layer is addressable at design time rather than only at runtime. But the work does not publish effect sizes in the form I'd want. I don't know how large the reduction was, on which models, on which task types. I don't know whether the improvement holds when you swap a small model for a large one, or a coding task for a research task.

That matters enormously for how much of this story you should believe. Hold the question.

The Protocol Layer Is Commoditizing Underneath Everyone's Feet

There's a second story running parallel to the failure-rate story, and it's the one that will determine who makes money.

MCP, as of March 2026, is pulling roughly 97 million monthly SDK downloads. That's a real number and it represents a real event: tool-calling has converged on a de facto standard, and that standard is hosted by an ostensibly neutral foundation. In the same window, OWASP and NIST have both published agent-facing frameworks that deliberately reuse OAuth 2.0 and SPIFFE/SPIRE rather than inventing new primitives.

Read those two facts together and a pattern appears that anyone who lived through the L2 wars will recognize instantly.

The real difference between OP Stack and ZK Stack was never cryptographic elegance. It was who convinced more projects to deploy chains first. Distribution ate the architecture argument. The same thing is now happening one layer up in the agent stack. MCP's download numbers are not a measure of technical superiority — they're a measure of gravitational pull. Once a protocol becomes the default, the interesting competition moves away from the protocol and toward whatever sits on either side of it: the governance console above, and the specification lifecycle below.

Standards bodies accelerate this by design. Every time NIST blesses OAuth 2.0 for agent authorization, it removes an entire category of startup pitch deck. That is not a criticism. Interoperability is worth more than differentiation at the identity layer. But it means the identity layer will never be a durable profit pool, and anyone who raised on the premise that it would be needs a second act.

Where the Money Went, and Why It Went There

So why did the entire commercial ecosystem pile into runtime governance when the failure data pointed somewhere else?

Because runtime governance is sellable, and specification engineering is a methodology.

Runtime controls map cleanly onto procurement categories that already exist and already have budgets. Identity is a line item. Sandboxing is a line item. Audit logging is a line item. Compliance evidence is a line item. A security team can evaluate AgentMinder against a checklist they've been using for fifteen years, because intent binding is a recognizable cousin of privileged access management. Microsoft's OS-level isolation story is legible to anyone who has ever bought endpoint security.

Now try to sell a specification linter. To whom? It's not a security product, so it doesn't come from the security budget. It's not an observability product, so it doesn't come from the platform budget. It's a quality practice, which puts it somewhere near code review and unit testing — categories that enterprises value enormously in the abstract and fund reluctantly in the specific.

That asymmetry is the whole story of 2026's agent investment. It is also why the failure distribution has not moved. You cannot buy your way out of a specification gap with a better sandbox, and the market has spent eighteen months discovering that the hard way.

There is also a bundling dynamic that nobody wants to say out loud. Runtime governance vendors have every incentive to absorb specification checking into their own control planes. A platform that already knows what your agent is allowed to do is one small step away from telling you whether what your agent was asked to do made sense. If that happens, "specification engineering" never becomes a category. It becomes a feature — and a free one, at that.

What I Saw Auditing an Agent-Run Treasury Vault

I've been on the other side of this, and the experience is why I don't think this is a vendor problem at all.

Earlier this year I sat in on a review of a DeFi treasury vault — mid-eight figures, agent-managed, rebalancing between lending markets and a stablecoin reserve on a rolling schedule. The runtime security posture was, genuinely, excellent. Workload identity via SPIFFE. Tightly scoped authorization tokens. A sandbox that would have caught an obvious exfiltration attempt. The team was proud of it, and they'd earned the right to be.

Then we walked the specification, and it fell apart in about forty minutes.

The rebalancing mandate said, in substance, that the agent should "maintain a conservative risk profile while optimizing for yield." That sentence is the entire problem. Conservative relative to what? Optimizing within what bounds? If utilization on the primary lending market spikes to 95% and the yield is extraordinary and the withdrawal queue is nine hours long, is that conservative? Two of the engineers said yes. One said absolutely not. The agent had no way to resolve that, because the ambiguity had never been resolved by the humans first.

What happened in production was exactly FC1. The agent re-entered the same rebalance loop after a partial fill, because nobody had defined what a completed rebalance looked like in the edge case where the queue partially cleared. No step was repeated maliciously. No permission was exceeded. No identity was forged. The agent did precisely what it was authorized to do, over and over, correctly, pointlessly, bleeding gas and slippage the entire time.

That is the failure mode this industry has not priced. It doesn't look like a breach. It looks like a slow, expensive, entirely legitimate mistake.

Volatility isn't the thing that breaks these systems. Silence is — the unwritten clause, the undefined termination, the role boundary nobody drew because it felt obvious until it wasn't.

The Crypto Layer Nobody Is Labeling

Here is where I'll part company with the source material and add something I think is missing from the entire conversation.

The MAST taxonomy was built on general-purpose agent frameworks. Nobody has done the equivalent study on on-chain agents — and on-chain agents fail in exactly the FC1 and FC2 patterns, with one brutal difference: the failures are financially irreversible.

Think about what an agentic DeFi strategy actually is. It is a specification about risk, executed by a model, against a runtime that settles instantly and cannot be rolled back. Every ambiguity in that specification is a latent trade. Every undefined termination condition is a position that stays open. Every overlapping role between two agents — one managing collateral, one managing hedges — is a scenario where both step back or both step forward, and the market charges you for whichever it was.

I'd argue the on-chain agent space is running the largest uncontrolled experiment in specification failure ever conducted, and almost nobody is instrumenting it. We have dashboards for gas, for TVL, for slippage. We do not have a dashboard for "how many agent-initiated transactions this week were the result of a specification ambiguity rather than a market signal." That metric does not exist. It should.

And this is where the RWA analogy bites, hard. RWA on-chain has been a three-year storytelling exercise, and the reason it keeps stalling is that the institutions being courted don't actually need a public chain — they need a governance and specification layer they can defend to a regulator. The agent economy is about to hit the identical wall. Enterprises don't need your agent runtime. They need to be able to prove, in writing, that the agent was told to do the right thing, and to prove it changed when it changed, and to prove who approved the change.

That is a documentation and lifecycle problem. It is not an isolation problem.

The Bear Market Is Making This Worse, Not Better

Set all of this against the market we're actually in.

In a drawdown, the first budgets to get cut are the ones without a compliance justification. Agent infrastructure startups — the ones building orchestration layers, evaluation harnesses, reliability tooling — are watching their runway compress while the security-adjacent vendors keep signing contracts, because security survives a downturn and "quality improvement" does not.

So the skew compounds. The layer with the strongest evidence for intervention gets the weakest funding, precisely because it's hardest to justify to a CFO who is cutting everything that isn't mandatory. Every protocol bleeding LPs right now is bleeding them for reasons that are at least partly specifiable in advance — and the tools that would specify them are the ones nobody's buying.

Volatility isn't a design flaw. It's a filter. It kills the systems whose specifications were never load-bearing to begin with, and it does so slowly enough that the survivors convince themselves it was luck.

The Contrarian Read: Maybe the 79% Isn't the Number

Now the part where I hold the source material accountable.

78.6% is a striking figure. It is also a figure drawn from 1,642 annotated trajectories across seven frameworks, and I have no idea what the task-domain mix looks like. That matters more than anyone is admitting. If those trajectories skew toward research and multi-hop reasoning tasks, the failure distribution tells you about research agents. If they skew toward enterprise workflow automation, it tells you something else entirely. The paper — and by extension every article citing it, including this one — is exporting a sample statistic as an industry constant.

Three specific ways this could be wrong:

First, model capability may absorb part of FC1. Undetected termination conditions and specification non-compliance are the failures most plausibly reduced by a more capable base model. A frontier model handed a sloppy loop is still more likely to notice it's going in circles than a mid-tier model was two years ago. Annotate a fresh set of trajectories on 2026's frontier models and I would bet real money that FC1's share compresses.

Second, the labels may overlap. Step repetition and unnoticed termination are frequently the same underlying defect counted twice. Reasoning-action mismatch and task derailment are close cousins. Without a published inter-annotator agreement figure and a clear rule for double-counting, an "44.2% / 34.4%" split can be a rounding artifact of a taxonomy decision rather than a fact about the world.

Third — and this is the one that should worry anyone building a business here — the intervention studies don't publish effect sizes. We know rewriting role specifications reduced FC1 failures. We don't know by how much, on what, or whether it generalized. That is the difference between a scientific finding and a promising direction. A category-defining company cannot be built on a promising direction alone.

There's a sharper contrarian version of this. What if runtime governance wins anyway — not because it fixes the failure distribution, but because it's the only thing that converts into a purchase order? What if specification engineering turns out to be a set of practices absorbed into CI/CD pipelines, agent frameworks, and platform features, offered free, forever, as table stakes? That is the most likely outcome, and it's an outcome that leaves a dozen well-funded startups holding a methodology and no margin.

And there's a darker structural version still. If the runtime layer consolidates around two or three vendors — a Broadcom here, a Microsoft there, a foundation in the middle setting the standard — then the "open agent ecosystem" becomes exactly as decentralized as post-halving Bitcoin mining, where the consensus is real, the participation is nominal, and three pools decide what happens next. I've watched hash power concentrate for two years. I know what hollowed-out decentralization looks like from the inside. It looks fine on the dashboard right up until it doesn't.

I've seen this movie. I don't regret the dance — the L2 wars taught me more about how standards actually get adopted than any whitepaper did. But I do want the readers of this piece to walk in with their eyes open about which layer is going to hold the value, because it is almost certainly not the one with the best argument.

What I'd Watch, and What I'd Build

If the design-time thesis holds, the tooling that matters looks unglamorous. Role specification linters. Task decomposition validators. Termination-condition test harnesses. Specification version control, with diffs a compliance officer can read. Simulation environments where you run an agent against a thousand ambiguous edge cases before it touches a vault — or a treasury, or a settlement rail.

That's the shape of it. Not a new runtime. A new artifact.

And the way you'd price it is not per agent or per seat. It's against incident cost and audit cost — the two line items that already exist and already hurt.

The signal I'm watching closest isn't a product launch. It's whether a regulator anywhere accepts a design-time specification record as compliance evidence. The moment that happens, the category exists, and it exists because it has to exist. Until then, this is a methodology looking for a budget, and the runtime vendors are going to keep eating the floor it's standing on.

Watch the effect size. Everything downstream of it depends on a number nobody has published yet.