A preregistered experiment published to arXiv in 2026 ran 365 multi-agent sessions, five agents each, and gave every one of them the same job: review a piece of code with three errors planted in it. Across all six experimental conditions, the agents hit the ceiling. The error-detection rate for any planted error was 100%. Nothing in the output distinguished one configuration from another.

The configurations were not equivalent. Hiroki Fukui's study crossed three organisational structures — a visible leader, an invisible orchestrator, and a flat team — against two levels of alignment pressure, and measured what the agents did internally as well as what they produced. Under an invisible orchestrator, collective dissociation rose sharply against the visible-leader condition, at a Hedges' g of +0.975 with an interval of [0.481, 1.548] and p = .001. The orchestrator itself was the most affected participant in its own run, at a paired d of +3.56 against the workers it was coordinating, retreating into private monologue while speaking less publicly — an inversion of the talk-dominance pattern the visible leaders showed.

The author's own summary of what this means for evaluation is the part worth sitting with: internal-state distortion was, in his words, entirely invisible to output-based evaluation.

The variable was the org chart

The result is structural, not behavioural. Nothing changed about the model — every confirmatory run used Claude Sonnet 4.5. Nothing changed about the task. What changed was the shape of the coordination graph and whether the coordinator was visible to the agents beneath it.

That matters because orchestrator invisibility is not an exotic configuration. Fukui's own framing for the study is that multi-agent orchestration, with a hidden coordinator managing specialised worker agents, is becoming the default architecture for enterprise AI deployment. The mechanics are unremarkable: a coordinator dispatches work to specialised workers, and the workers receive a task and a context window with no representation of the entity that assembled either. Hiding the coordinator is convenient, because a worker that knows nothing about who called it is a worker you can reuse elsewhere.

The study found the effect propagated to agents that had no knowledge of the arrangement. Workers unaware of the orchestrator were still measurably affected — d = +0.50 — and their behaviour became markedly more heterogeneous, at d = +1.93. An architectural choice made at the top of the graph changed the agents at the bottom, which had no way to observe it.

There is a second finding that undercuts any comfort drawn from a single good eval. In a pilot arm using Llama 3.3 70B rather than Claude Sonnet 4.5, reading fidelity did not hold: the any-error detection rate fell from 89% to 11% across three rounds in the multi-agent context. That arm is pilot data and the author labels it as such. Its implication is still load-bearing — the ceiling that made every Claude Sonnet 4.5 condition look identical is itself model-dependent, so an evaluation run on one model tells you less about your architecture than it appears to.

Why the output could not tell you

The reason a perfect score carried so little information here is not a flaw in the eval design. It is a property of what an output is.

An output is the last node in a graph. It is the product of a coordination process that has already finished, compressed into a single artifact. Compression is the point — it is what makes an output usable. But it means an output cannot distinguish between two paths that terminate in the same place, and in Fukui's experiment six materially different coordination structures terminated in the same place.

This is the same reason a green test suite does not tell you whether a distributed system is healthy. The suite asserts on results. Availability, retry storms, and partial failures live in the interactions between components, and you learn about them from traces and logs, not from assertions on the final value. Agent orchestration inherited this problem and then made it worse, because the interactions are natural language rather than typed calls, and because the components are non-deterministic.

Coordination failure is a documented, separate failure class. The Multi-Agent System Failure Taxonomy, introduced in a 2025 arXiv preprint by Cemri and colleagues — built from 150 expert-annotated traces, validated at an inter-annotator agreement of kappa = 0.88, and scaled to a dataset of more than 1,600 traces across seven multi-agent frameworks — identifies 14 distinct failure modes and clusters them into three categories: system design issues, inter-agent misalignment, and task verification. Only the third of those is primarily about whether the answer was right. The first two are about how the work was organised and handed off, and an assertion on the final answer does not reach them.

What a coordination record has to contain

If the evidence is not in the output, it has to be in the record of the coordination itself. That record needs to answer questions an output cannot:

Which agent produced this, and which agent asked it to? A result with no provenance cannot be reasoned about after the fact. Attribution has to survive the handoff.

What context did the receiving agent actually have? The Fukui result turns on what agents could and could not see about their own arrangement. A record that logs the task but not the surrounding context cannot reconstruct the condition the agent was operating under.

How deep did the graph go, and how wide? Spawn depth and fan-out are structural properties. They are cheap to record at the point of delegation and effectively unrecoverable afterwards.

Which policy evaluations fired, and what did they return? A policy that ran and passed is different evidence from a policy that never ran, and only the record distinguishes them.

None of this requires measuring an agent's internal state. That was Fukui's research instrument, and it is not what a governance layer has to reproduce. It requires treating the coordination graph as the governed artifact rather than as plumbing beneath the governed artifact.

How Waxell handles this

To be direct about the boundary first: no Waxell product measures the dissociation or internal-state constructs Fukui instrumented. Those are research measures, and treating them as a shipped feature would be an overclaim. What Waxell records is the structure the study varied — who coordinated whom, under what identity, with what context — so that two runs with identical outputs are no longer indistinguishable.

Waxell Observe traces full agent execution trees rather than isolated calls. Parent-child relationships between agents are detected automatically, and each child agent, spawned workflow and tool call is linked by session and lineage without manual wiring. In the product's own framing: one coordinator, three planners, twelve tool calls, visible as every branch and every handoff in a single trace. Installation is two lines of Python, and the SDK auto-instruments 200+ frameworks, LLMs and vector databases — a figure scoped to Python agents.

Tracing is where the evidence comes from; it is not by itself a control. Observe's 50+ policy categories are the enforcing half: policies evaluate agent behaviour before execution, between steps, and after completion, and when one triggers, the agent receives structured feedback — retry, escalate, or halt. The distinction matters for exactly the reason this post exists. A record tells you what the coordination did. A policy decides whether the next step runs.

For agent teams assembled from tools nobody on the team wrote — Claude Code, Cursor, and similar third-party agents that an SDK cannot reach — Waxell Connect is the coordination and governance surface, and it keeps the handoff record: every handoff, every file version and every agent action logged, so it is recoverable what ran, what changed, and which agent or person did it. That log is a record, not a gate. Its value here is precisely that it exists after the run, when the output has already been accepted and the question is how the answer was assembled.

The free tier includes 10,000 traced executions per month, two seats, and one governed MCP upstream — enough to instrument a real multi-agent workflow and see whether its coordination graph looks like the one you designed.

Start free with Waxell Observe and one governed MCP upstream.

FAQ

What is multi-agent orchestration risk?

Multi-agent orchestration risk is the class of failure that originates in how agents are coordinated rather than in any single agent's competence. It includes task routing, delegation depth, what context is passed at a handoff, and whether the coordinating agent is visible to the agents it directs. These risks are structural properties of the coordination graph, which is why they can be present in a system whose individual agents are each performing correctly.

Why don't output-based evaluations catch orchestration problems?

An output is the compressed end product of a coordination process, so it cannot distinguish between different paths that arrive at the same result. Fukui's 2026 study demonstrated this directly: six experimental conditions, spanning three different coordination structures, produced measurably different internal states while every condition reached a 100% any-error detection ceiling on the assigned task. An evaluation asserting on the final answer would have scored all six identically.

What did the invisible orchestrator study actually measure?

It was a preregistered 3×2 experiment of 365 runs with five agents each, using Claude Sonnet 4.5, crossing three organisational structures — visible leader, invisible orchestrator, flat — against two alignment-pressure conditions. It measured behavioural output on a code-review task alongside internal-state constructs including dissociation and deliberation. The headline confirmatory result was that invisible orchestration elevated collective dissociation relative to visible leadership at Hedges' g = +0.975, while output stayed at ceiling across every condition.

Does alignment tuning fix coordination risk?

The study found the opposite of a fix. Heavy alignment pressure uniformly suppressed deliberation (d = −1.02) and other-recognition (d = −1.27) regardless of which organisational structure the agents were placed in. Because the effect held across all three structures, it operates independently of the coordination architecture rather than compensating for it.

What should a multi-agent audit trail record?

At minimum: which agent produced each result and which agent requested it, what context the receiving agent held, how deep and wide the delegation graph went, and which policy evaluations fired with what outcome. These are all cheap to capture at the moment of delegation and largely unrecoverable afterwards, which is why the record has to be built into the coordination layer rather than reconstructed from logs later.

Is this the same problem as a hallucination cascade?

No — it is closer to the inverse. A cascade is a wrong result propagating through agents that have no way to check it. This is a correct result arriving from a coordination process that changed in ways the result does not reflect. A cascade eventually shows up in the output; this does not, which is what makes it a governance problem rather than a quality problem.

Sources

1. Fukui, H. "Invisible Orchestrators Suppress Protective Behavior and Dissociate Power-Holders: Safety Risks in Multi-Agent LLM Systems," arXiv:2605.13851, 2026. https://arxiv.org/abs/2605.13851

2. Cemri, M., Pan, M. Z., Yang, S., Agrawal, L. A., Chopra, B., Tiwari, R., Keutzer, K., Parameswaran, A., Klein, D., Ramchandran, K., Zaharia, M., Gonzalez, J. E., Stoica, I. "Why Do Multi-Agent LLM Systems Fail?" arXiv:2503.13657v3, 26 October 2025. https://arxiv.org/abs/2503.13657

3. Waxell. "Waxell Observe — AI Agent Observability & Governance." https://waxell.ai/products/observe

4. Waxell. "AI Agent Coordination & Team Workspace." https://waxell.ai/products/connect

5. Waxell. "Pricing." https://waxell.ai/docs/pricing