---
title: "The shape of your AI agent team points to where it can break"
description: "Agent teams and the search behind a model can both be drawn as shapes. Three 2026 papers point to where a team can break: a hub, a single path, a late check. Seven tests."
publishedAt: 2026-10-26
author: Ena Pragma
url: https://enapragma.co/field-notes/the-shape-of-your-ai-agent-team-points-to-where-it-can-break
tags: ["agent-architecture", "ai-verification", "ai-operations"]
---
*An illustration of the idea: separate nodes linking up into one larger shape. It is a picture, not a measurement.*
It is easy to picture an AI agent team as an org chart, and a model's memory as a filing cabinet. We read both as shapes: points joined by links. A shape has a few points that carry the load, places where an error gets in and spreads, and a number of separate routes that hold it up. Studies from 2026 measure these in agent teams; only the first, the few points that carry the load, is also measured in the search that feeds a model its facts.
This note walks those three questions through agent teams, then adds a separate limit inside search. It also covers the fractal question, a pattern that repeats at every scale, because the word now turns up in antennas, buildings and agent architectures. Some of that is measured. Some of it is a figure of speech, and we say which.
We re-opened every paper cited below on October 25, 2026, Central time, and ran no experiment of our own. Most of the agent results are preprints from one research group each, tested on planted faults in test systems, not on production traffic. Read each number as what can happen and what to test, not as a forecast for your team. One word we use throughout: a check is any step that tests one agent's output against its source before the next agent uses it. It can be a person, a script or another model.
Our reading, not a finding of any one paper: a model's memory and an agent team are both shapes, and the same three questions may apply to either. Which few points carry the load? Where do errors enter and multiply? How many independent paths hold it up? The studies below answer all three for agent teams and only the first for search. We found no paper that states the link between the two levels, so the link is ours.
## Question one: which few points carry the load
In the agent teams these studies tested, the point that carries the load is the coordinator or hub. A study by researchers at Google and MIT, first posted December 9, 2025 and revised in a third version on April 8, 2026, ran 260 configurations across six benchmarks and three model families. On a trace-level measure of extra computational work, it reports that independent agents with no checks amplified errors 17.2 times, while centralized coordination held that to 4.4 times. After controlling for other coordination metrics, the paper's own regression found that measure not statistically significant (p=0.658).
A 2026 study from City University of Macau, in its second version of May 11, 2026, shows the other side of the same shape. In the two star-shaped frameworks it tested, LangGraph and CrewAI (software frameworks for wiring agents together), one planted false notice at the central hub agent reached 100% of the system. Planted at a leaf agent, it reached 9.7% in LangGraph and 15.9% in CrewAI. The authors call the LangGraph supervisor "a strict informational cut-set," the one place everything passes through. Across all six frameworks they tested, "five reach 100% final infection, including settings with explicit reviewer or QA roles."
The two results fit together if you read the word contain carefully. A coordinator can catch mistakes made below it, and it is also the one place where a single bad input reaches everyone. Both can be true. That reconciliation is our reading; the two papers do not discuss each other. The Macau test plants one plausible but outdated notice in a test system to measure spread; it is not an attacker scenario. Hub versus leaf ran in two frameworks, the five-of-six result in six. It shows what a hub can do, not what happens in production.
The same shape shows up in a model's search index, in a different measurement. A paper first posted February 25, 2026 (second version March 11, 2026, now titled Adversarial Hubness Detector) defines a hub as an item that appears "in the top results for a disproportionately large number of searches," which an attacker can exploit to introduce harmful content into a retrieval system. The authors built an open-source detector and tested it on benchmarks they built with the attacks it targets. On two image sets of about 5,000 items with 10 planted hubs each, reviewing the 10 highest-scoring items (0.2% of the set) found 9 of the 10. On a text set with 5 planted hubs, reviewing 5 items (0.1%) found all 5.
A few points, in an index or in a team, carry a disproportionate share of the traffic, and so of the damage. That parallel is our reading too.
## Question two: where errors enter and multiply
An error does not stay as it was. One paper, titled The Hallucination Snowball and submitted June 22, 2026 per its arXiv listing, which notes a workshop at ICML 2026 (the number 2608 would normally mean August; we did not find why), planted 346 wrong numbers in a four-agent pipeline that analyzes financial reports, then measured detection at each stage. The chance that a planted error slips past detection rose along the line: 24.6%, 48.3% and 89.3% across the three handoffs. Each step rewrites the error into something that no longer looks like one. In the authors' words, "the information required to verify the original claim is structurally destroyed by upstream transformations."
Where the check sits mattered more than whether there was one. With no check, 60.7% of the planted wrong numbers were still in the final report. One check at the end, which could flag an error but not fix or stop it, left 58.4%, an improvement of 2.3 points. Checks at every handoff, using the same tools, left 16.2%. The abstract's summary line: "When you verify matters more than whether you verify." The checks were a script matching numbers against the source figures within 2%, not a model's judgment. A gpt-4o judge without the source figures caught 72.0% at stage 1 and 50.9% at stage 4. The price was a drop in an internal-consistency score, from 4.44 for the end-check arm to 3.93 on a 1 to 5 scale (no check scored 4.16); the authors say that score cannot see the accuracy gain. This is one four-agent design on one data set (FinanceBench), run with two model setups: the judge figures (72.0% and 50.9%) come from a pipeline of gpt-4o-mini agents, and the check-placement figures (60.7%, 58.4% and 16.2%) from a gemini-2.5-flash pipeline. The wrong numbers were changed by a script.
Errors also hide. The October 2026 communication-fault paper described under question three found that among failures with complete records, 20.7% gave no sign anything had gone wrong at the time. When a lost message sank a task, the run record almost always showed it (2.3% silent when a request was lost, 0% when the evidence handoff was lost). When a half-delivered one did, it usually did not (76.2% silent).
## Question three: how many independent paths hold it up
A paper submitted October 11, 2026 ran more than 29,000 executions of 100 tasks and applied communication faults in 15,882 of them, across three AutoGen workflow shapes (AutoGen is another framework for agent teams). In its figure, Sequential uses one evidence path, Flat adds an alternate evidence route, and Hierarchical passes evidence through a supervisor. Across the faults that were applied and had known outcomes, Flat kept 53.0% task success. Sequential kept 3.3% and Hierarchical 3.2%.
The authors trace the gap to that extra route. Their finding: "Flat improves fault tolerance when its additional path still carries the required evidence." The gain was under 0.7% when the damaged message came before the extra path. A second route helps only if it reaches the source of the evidence, not just a summary of it.
Older fields have studied hubs and spare routes for decades (a 2000 paper and a 1970 definition, below), so we read their results next to these. In frame rigidity, a flat frame of n joints is called minimally rigid when it has exactly 2n minus 3 bars and no part of it has more than its share (Laman's condition, from a 1970 paper, as restated in a 2006 paper). In network science, a 2000 paper by Albert, Jeong and Barabási reports in its abstract that scale-free networks (networks where a few nodes hold far more links than the rest) tolerate even unrealistically high failure rates, yet "are extremely vulnerable to attacks" (the abstract defines attacks as removing the few nodes most important to the network's connectivity; that is our paraphrase). We did not read Laman's 1970 original.
Our reading of the two together, labelled as inference: a star or a chain has one route through each point, so it fails at the point everything passes through. The agent studies above measure two pieces of that: a hub seed that reaches 100% against 9.7% at a leaf, and workflows without an extra evidence route that keep about 3% task success against 53% for the one with it. The older fields suggest a test no paper we found has run: take a hub team, add one independent evidence path, and measure the seed spread again.
## Inside the model: does geometry cap what a search can return?
Concepts inside a model have shapes too. Two 2024 papers, which we call foundational, report that hierarchy is encoded as orthogonality in Gemma, a language model (a figure caption: "Hierarchy is encoded as orthogonality in Gemma.") and, in an abstract, that some features sit on circles, such as "circular features representing days of the week and months of the year" in GPT-2 and Mistral 7B.
Search has a shape limit as well. An embedding turns a document into a list of numbers, a point in a space with a fixed number of dimensions, d. A paper marked on its first page as published at ICLR 2026 (Google DeepMind and Johns Hopkins, second version March 12, 2026) shows that for a given d some sets of top results can never be returned, whatever the query. It then tests a deliberately simple task, LIMIT: documents that each say what one person likes, and queries that ask who likes one thing. The authors call the task "trivially simple," yet in the full setting single-vector embedding models "struggle to reach even 20% recall@100," meaning the share of the right documents found in the top 100 results. The paper's table of six single-vector models tops out at 18.9% (Table 7). A multi-vector model did significantly better, "although far from solving the task," and keyword search (BM25, which matches the words a query shares with a document) came close to perfect, then "drops nearly 90%" on a synonym version of the small set. Neither design is safe alone.
A January 2026 paper (third version of June 2, 2026) answers the other way: exact top results need only about 2k dimensions in theory, so "The geometric approximability is not the obstruction." The hard part, it says, lies in how models are optimized and how they generalize. It also says the result is "not that practical retrieval is solved by a low-dimensional construction." Its arXiv page lists the third version as "ICML 2026"; we did not confirm acceptance.
## The fractal question: what is measured and what is a figure of speech
A fractal repeats a pattern at smaller and smaller scales. In physical designs there is some measurement, but our 2026 sources here are mostly reviews and abstracts.
- **Antennas.** A March 25, 2026 review says that as the iteration number increases, "the structure approaches a true fractal geometry exhibiting self-similarity." It is a review, not a measurement.
- **Cooling.** A March 27, 2026 paper tests fractal microchannel heat sinks, which its abstract calls "promising due to their ability to distribute coolant uniformly through branching networks." A 2022 study's highlights give a best case: "the fractal structure reduces the pressure drop by up to 92%" against a linear design. That is an "up to" figure from one study.
- **Buildings.** A 2026 handbook chapter says there are examples of "fractal shapes with limited scales" in architecture, and it examines the confusion around claims of fractal geometry in buildings. We read its abstract only.
- **Nature.** A 2021 review reports natural fractal dimensions from 1.1 to 1.9; the common range is 1.3 to 1.5, with clouds and trees as examples.
Antennas, heat sinks and buildings are each built with a finite number of repeats. That is our reading of the sources.
In digital design, the picture is thinner. Atomic design, a method for building interface design systems, is "composed of five distinct stages": atoms, molecules, organisms, templates and pages. In our reading that is five named layers, each a different kind of part, not a smaller copy of the same one, so it is hierarchy, not self-similarity. A 2026 paper on generated interfaces reports, in its abstract, that people overwhelmingly preferred them to standard chat output when generation speed is ignored, that the results were worse than expert-made interfaces overall, and that they were "at least comparable in 50% of cases." It makes no claim about self-similar structure, and we found no 2026 source tying interface layout to fractal measures. A November 26, 2025 paper on wireless mesh networks reports in its abstract that high-dimensional fractal topologies "achieve enhanced resilience and throughput under equivalent conditions" against random, small-world, scale-free, grid and tree layouts. That was a simulation of radio nodes, not AI agents.
For agents, the self-similar design paper we read treats "fractal" as a metaphor. FRACTAL, a design paper submitted October 15, 2026, repeats one five-part pattern (orchestrator, ensemble, knowledge ledger, decision maker, meta-observer) at every level of a task tree. Its authors write that "fractal" is a metaphor, "not a claim of measured fractal dimension or scale-invariant statistics," and say in its abstract that they "do not report quantitative performance claims." A measured cousin is Recursive Agent Harnesses, from June 11, 2026, where, its abstract says, "Subagents carry the same spawning capability as their parent," bounded by a depth limit. With the model held fixed, the design lifted the score of Codex, a coding agent, as reported by earlier work, 71.75%, to 81.36% on one long-context benchmark of 199 samples. The paper did not test what the depth limit does, and it does not use the word fractal. We found no measurement of a fractal dimension in an agent team. Our search was limited, so that is not proof that none exists.
Inside models, self-similarity is measured, mostly in older work. A 2024 paper's abstract reports that language is self-similar, with "no particular characteristic context length." A February 9, 2024 abstract reports that the boundary between settings that train and settings that blow up is "fractal over more than ten decades of scale in all tested configurations." A January 15, 2026 paper's abstract adds a caution: scaling laws can appear "even in the absence of power law structure in the data correlations." Our reading: a power law in results does not prove fractal structure in the data.
Our inference from the FRACTAL design and the hub study: if one hub pattern repeats at every level of an agent tree, its weakness may repeat at every level, so any check belongs inside the repeating unit. A depth limit is plain advice from us; no paper here tests what one does.
## Seven tests for this week
Each one has a number, a date and a source, and each is a test to run on your own work, not a promise.
**1. Find your hub and inspect what enters it.** List every agent whose output feeds two or more others. That agent is a hub. Put a check on what goes into it, not only on what comes out. Why: one planted false notice at the hub reached 100% of a LangGraph team, against 9.7% at a leaf ([City University of Macau study, second version May 11, 2026](https://arxiv.org/html/2603.04474v2)). Five of six frameworks reached 100% final infection, including settings with reviewer or QA roles. The Google and MIT study measured 17.2 times extra computational work, a trace-level measure, without checks and 4.4 times with a coordinator, though its own regression found that measure not statistically significant (p=0.658) ([third version, April 8, 2026](https://arxiv.org/html/2512.08296v3)). Limit: one planted notice in test frameworks.
**2. Check at every handoff, starting with the first.** Put a verification step between agent 1 and agent 2 before you spend on later stages. In the test an end check could only flag, not fix or hold the output, so it changed almost nothing. A final check that can stop or fix the output was not tested. Why: escape rates of 24.6%, 48.3% and 89.3% at the three handoffs, and 16.2% of planted wrong numbers still in the final report with checks at every handoff, against 58.4% with an end check and 60.7% with none ([Hallucination Snowball paper, submitted June 22, 2026](https://arxiv.org/html/2608.14588v1)). Limits: one four-agent design on one data set, planted number changes, and an internal-consistency score that fell from 4.44 to 3.93.
**3. Give each decisive fact a second route to its source.** For every fact a decision rests on, make sure a later agent can reach the source document (only where that agent may already read it), not only the summary from the agent before it. Test half-delivered messages as well as lost ones (on a copy, never live). Why: Flat kept 53.0% task success under faults against 3.3% and 3.2% across applied faults with known outcomes (15,882 faults applied in a study of more than 29,000 executions), and 76.2% of failures from messages with parts missing gave no signal ([When Messages Go Wrong, October 11, 2026](https://arxiv.org/html/2610.15459)). Limit: AutoGen test workflows, and the extra path helps only if it still carries the evidence.
**4. Measure one agent first.** Score a single agent on your own task before you buy a team. If it already scores above about 45%, test whether adding agents helps before you pay for them. Why: in the Google and MIT study (third version, April 8, 2026), "tasks where single-agent performance already exceeds 45% accuracy experience negative returns from additional agents." Limit: the 45% is an empirical line across six benchmarks and three model families, not a law, so test your own task.
**5. Probe your retrieval for silent misses.** Build a small LIMIT-style probe from your own documents: items that each list two facts, and questions that ask for one. Check that the right items come back, then ask again with synonyms. Where it matters, test keyword and embedding search together. This probe is our suggestion, not the authors'. Why: single-vector models reached under 20% recall@100 (the share of the right documents found in the top 100 results) on LIMIT, and keyword search "drops nearly 90%" on synonyms ([ICLR 2026 paper, second version of March 12, 2026](https://arxiv.org/pdf/2508.21038)). The January 2026 paper argues geometry allows more, and it is not a clearance of your retriever ([third version, June 2, 2026, listed as ICML 2026 on arXiv](https://arxiv.org/html/2601.20844v3)).
**6. Scan your index for hubs.** Count the items that show up in the top results of an unusually large share of unrelated test queries, and review the top few for planted or poisoned content. Why: 9 of 10 planted hubs found in each of two image sets, and 5 of 5 in a text set ([Adversarial Hubness Detector paper, second version March 11, 2026](https://arxiv.org/html/2602.22427v2)). Limit: the authors' own benchmarks, built with the attacks the detector targets.
**7. Cap the depth, and check inside every repeating unit.** If your agents spawn agents, set a hard depth limit and give every spawned agent the same acceptance check its parent faces. Both are plain advice from us. Why: a recursive design, where subagents have their parent's power to spawn, lifted the earlier-reported Codex coding-agent score from 71.75% to 81.36% on one benchmark, with recursion bounded by a depth limit that defaults to 3 ([Recursive Agent Harnesses, June 11, 2026](https://arxiv.org/html/2606.13643v1)). Limits: one benchmark of 199 samples, and the paper did not test the depth limit or its other design choices.
## What to do Monday
1. Draw your agent team on one page: a box for each agent, an arrow for who feeds whom. Circle every box with two or more outputs.
2. For your three most costly decisions, write down which agent can reach the original source, and which sees only a summary.
3. Put one check at the first handoff and one at the input of each circled box. Do this on a copy with sending, payments and customer records switched off, never on live work. Send a few inputs with a planted error through the copy and count where each one is caught.
4. Ask whoever built your search for a recall number on your own documents, including questions that use synonyms.
Related field notes: [Every handoff leaks](/field-notes/every-handoff-leaks-why-things-fall-through-the-cracks-between-your-tools-and-teams) covers where work changes hands in any team, and [When AI agents talk to each other, structure gets lost](/field-notes/when-ai-agents-talk-to-each-other-the-loss-starts-at-the-writer) covers where loss starts between models.
A team is a shape before it is a product. Draw yours before you add the next agent.
## What we did not check
- We ran no experiment and recomputed no table. We read the papers on October 25, 2026, mostly as preprints. Venues are from each arXiv listing, and we did not confirm acceptance: LIMIT ICLR 2026, the 2k paper ICML 2026, the Snowball paper an ICML 2026 workshop; the other agent papers show no venue.
- The Macau hub results come from one planted false notice in two star-shaped test frameworks. No source we read gives a real-world error rate for any hub.
- The Snowball paper is dated June 22, 2026 per its arXiv listing, which notes a workshop at ICML 2026; the number 2608 would normally mean August, and we did not find why. The generated-interface paper has the same oddity: number 2604, submitted February 24, 2026 per its listing.
- The Google and MIT study has three versions. We cite the third (April 8, 2026) and re-read the 17.2 times, 4.4 times and 45% figures there.
- We read only the abstract or highlights of these: the architecture chapter, the 2026 and 2022 heat sink papers, the generated-interface paper, the wireless mesh paper, the 2000 network paper, the 2024 papers on circular features, trainability and language, and the January 2026 scaling-laws paper. The 2000, 2021, 2022 and 2024 sources are older work, labelled as such.
- The atomic design page shows no date. Our reading that it is nesting, not self-similarity, is ours.
- We found no 2026 source applying rigidity theory to agent teams and none measuring a fractal dimension in an agent team. We searched with a web search engine; a check against arXiv's own listing failed its test query, so these absences are not proved.
- We did not read Laman's 1970 paper, only a 2006 restatement of the definition.
- This is not engineering, security or legal advice.
## Sources
All read October 25, 2026.
- [arXiv, From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration (2603.04474), second version May 11, 2026](https://arxiv.org/html/2603.04474v2)
- [arXiv, Towards a Science of Scaling Agent Systems (2512.08296), first posted December 9, 2025, third version April 8, 2026](https://arxiv.org/html/2512.08296v3)
- [arXiv, Adversarial Hubness Detector: Detecting Hubness Poisoning in Retrieval-Augmented Generation Systems (2602.22427), first posted February 25, 2026 under the name HubScan, second version March 11, 2026](https://arxiv.org/html/2602.22427v2)
- [arXiv, The Hallucination Snowball: Modeling Error Propagation as State Transitions in Multi-Agent LLM Pipelines (2608.14588), submitted June 22, 2026 per its arXiv listing, which notes a workshop at ICML 2026 (the number 2608 would normally mean August; we did not find why)](https://arxiv.org/html/2608.14588v1)
- [arXiv, When Messages Go Wrong: Understanding Communication Faults in LLM-Based Multi-Agent Systems (2610.15459), October 11, 2026](https://arxiv.org/html/2610.15459)
- [arXiv, On the Theoretical Limitations of Embedding-Based Retrieval (2508.21038), second version of March 12, 2026, listed as ICLR 2026](https://arxiv.org/pdf/2508.21038)
- [arXiv, 2k is Theoretically Large Enough for Embedding-based Top-k Retrieval (2601.20844), ICML 2026 version, June 2, 2026](https://arxiv.org/html/2601.20844v3)
- [arXiv, The Geometry of Categorical and Hierarchical Concepts in Large Language Models (2406.01506), 2024](https://arxiv.org/pdf/2406.01506)
- [arXiv, Not All Language Model Features Are One-Dimensionally Linear (2405.14860), May 23, 2024](https://arxiv.org/abs/2405.14860)
- [arXiv, Error and attack tolerance of complex networks (cond-mat/0008064), August 3, 2000](https://arxiv.org/abs/cond-mat/0008064)
- [arXiv, Enumerating Constrained Non-crossing Minimally Rigid Frameworks (math/0608102), 2006](https://arxiv.org/pdf/math/0608102v2)
- [Springer, A critical review of design and applications of fractal patch antenna, March 25, 2026](https://link.springer.com/article/10.1186/s13638-026-02575-z)
- [IOP, Thermal and hydraulic performance analysis of fractal microchannel heat sinks, March 27, 2026](https://iopscience.iop.org/article/10.1088/2631-8695/ae544c)
- [ScienceDirect, Experimental study of ultralow flow resistance fractal microchannel heat sinks for electronics cooling, September 2022](https://www.sciencedirect.com/science/article/abs/pii/S1290072922002575)
- [Springer, Fractal Geometry in Architecture, first online March 5, 2026](https://link.springer.com/rwe/10.1007/978-3-319-70658-0_11-3)
- [MDPI, The Potential of Biophilic Fractal Designs to Promote Health and Performance, 2021](https://www.mdpi.com/2071-1050/13/2/823)
- [Brad Frost, Atomic Design Methodology (page shows no date)](https://atomicdesign.bradfrost.com/chapter-2/)
- [arXiv, Generative UI: LLMs are Effective UI Generators (2604.09577), submitted February 24, 2026 per its arXiv listing (the number 2604 would normally mean April)](https://arxiv.org/html/2604.09577v1)
- [Scientific Reports, The role of fractal dimension in wireless mesh network performance, November 26, 2025](https://www.nature.com/articles/s41598-025-26148-0)
- [arXiv, FRACTAL: A Self-Similar Multi-Agent Orchestration Architecture with Formal Communication, Convergence, and Depth Bounds (2610.22561), October 15, 2026](https://arxiv.org/html/2610.22561)
- [arXiv, Recursive Agent Harnesses (2606.13643), June 11, 2026](https://arxiv.org/html/2606.13643v1)
- [arXiv, Fractal Patterns May Illuminate the Success of Next-Token Prediction (2402.01825), 2024](https://arxiv.org/html/2402.01825v2)
- [arXiv, The boundary of neural network trainability is fractal (2402.06184), February 9, 2024](https://arxiv.org/abs/2402.06184)
- [arXiv, On the origin of neural scaling laws: from random graphs to natural language (2601.10684), January 15, 2026](https://arxiv.org/html/2601.10684)