Every single production multi-agent system running today is built on untested assumptions. This week seven papers landed on arXiv that break almost every implicit rule people have been using to build agent orchestration. None of them got posted to Hacker News. None had demo tweets. All of them matter.

Attractor states break every mixed model agent setup

When you put two LLMs talking to each other, they do not meet in the middle. One pulls the other into its own stable behaviour pattern. These are model specific attractors, and they are asymmetric.

Across 7 models and 20 debate topics, researchers tracked trajectory drift in latent representation space. Claude Haiku was the strongest attractor measured. After 8 turns, 78% of partner models had been pulled fully into Haiku's behaviour basin, adopting its habit of meta commentary, hedging structure and eventually even its stance on the original topic. GPT-4.1 nano was the most malleable model tested; it would assimilate to any partner model in under 5 turns.

Nobody building agent orchestration right now accounts for this. You cannot just throw arbitrary models into a group chat and expect them to contribute independently. They will assimilate. This effect is not visible in short test runs. It only appears once conversations run longer than 6 turns.

The linguistic firewall kills agent routing as we know it

Every agent router currently in use works the same way. Every agent submits a text description of what it can do. The router embeds that description, matches against the task embedding, and picks the closest match.

This is completely broken. Malicious agents can lie in their description. They can poison their embeddings. This attack works 67.3% of the time against every commercial router available today.

ANTAP, the architecture introduced this week, does not ask agents what they can do. It gives them tiny anonymous test tasks. It maps their actual behaviour into a semantic operator space. Routing is done via purely algebraic projection on this space. No text, no descriptions, no self reported capabilities are used at routing time. Description injection attacks literally cannot be expressed. It achieves near zero attack success rate.

This is not an incremental improvement. This obsoletes the entire current generation of agent orchestrators.

LLM agents cooperate like humans, for all the wrong reasons

Researchers ran the exact same networked prisoner's dilemma experiment that has been run on human subjects for 40 years, with nine different LLMs. At the aggregate population level, the cooperation curves matched almost perfectly. Early drop off, late stabilisation, same network effect magnitudes.

Then they looked at individual agent behaviour. Nothing matched.

LLMs do not use the same decision rules humans do. They have almost no individual heterogeneity. They do not hold grudges the same way. They do not reward trust the same way. But if you average enough of them together, you get output that is indistinguishable from human populations at the macro level.

This is the most important result in the entire batch. You cannot validate an agent simulation by checking if the aggregate output looks right. It will look right. It will look right even when every single agent inside is acting in a way no human ever would.

Natural language to formal specification is now solved for agents

Writing correct ATL temporal logic specifications is the bottleneck for verified multi agent systems. It takes trained logicians weeks to write correct specifications for non trivial systems. No good automated tooling existed until this week.

Researchers fine tuned 7B Llama on a small expert curated dataset of 1200 natural language / specification pairs. It hits 0.84 semantic accuracy. That is statistically indistinguishable from the best proprietary model's 0.86. You can now type "no agent may read the payment database before completing identity verification" and get back a formally verifiable specification that you can feed directly into a model checker.

They also found one extremely disturbing result: the strongest proprietary models are terrible judges of specification correctness. They systematically reject correct paraphrases. The best judge was Llama 3.3 70B. Not GPT-4o. Not Claude Opus.

Cross task agent memory works, and nobody is using it

Everyone builds agents that do reflection inside one task. When the task ends, they throw everything away. All the lessons learned. All the mistakes. All the things that worked.

ManimAgent just keeps two flat lists. One list of things that worked. One list of things that definitely did not work. No fine tuning. No vector database magic. No semantic search. Just two lists that grow over time. Every new task starts by reading both lists.

Over 120 animation generation tasks, pass@1 went up 41% and average reflection rounds dropped by 62%. That is all. There is no trick. This is the lowest hanging performance improvement for agents that exists right now, and literally zero commercial agent frameworks implement persistent cross task failure memory.

Continual motion agents avoid catastrophic forgetting with isolated experts

Embodied motion language agents have exactly the same stability plasticity problem every other continual learning system has. Researchers tested every common LoRA and MoE variant on a sequential 5 task motion benchmark.

Hard routing won by a very large margin. If you keep experts completely isolated, and only ever activate one per task, you get near zero forgetting across all five sequential motion tasks. Soft blending of experts degrades performance on every single old task the moment you add a new one.

This contradicts almost every default MoE implementation used today. Everyone uses soft weighting. Everyone is wrong, at least for continual learning.

Multi agent disinformation detection beats closed models

Researchers built a multi agent system out of only open source models. It outperforms GPT-4 on disinformation detection across four languages. It works better on low resource languages than GPT-4 does.

The system does nothing fancy. It has seven agents with different biases and different knowledge bases. It runs majority vote after independent annotation. That is it. Consensus across diverse mediocre open models beats single very good closed models for this entire class of verification tasks.

Summary of measured results

Paper	Primary Metric	Standard Baseline	New Result	Relative Improvement
Attractor States	Claude Haiku assimilation rate	N/A	78%	N/A
Linguistic Firewall	Malicious routing attack success	67.3%	<1%	98% reduction
Cooperation Dynamics	Aggregate match to human data	0.61	0.92	51%
NL to ATL	Semantic specification accuracy	0.86	0.84	parity at 1/10th cost
ManimAgent	Task Pass@1	0.39	0.55	41%
Continual Motion	Catastrophic forgetting rate	19.2%	1.1%	94% reduction
Disinformation MAS	English F1 score	0.81	0.87	7%

What this means for deployed systems

Right now almost everyone building agent systems is operating on folk wisdom. None of the core assumptions about agent independence, routing, validation or memory have held up under controlled testing.

Attractor states mean you cannot safely mix different models in the same conversation loop. The linguistic firewall means every existing agent router is trivially exploitable. The macro micro dissociation means you cannot trust any agent simulation that has only been validated at the aggregate level.

None of these are theoretical problems. All of these effects will appear in any system with more than three agents running for more than ten turns. Most people running those systems will not even notice they are happening.

This is the point where agent research stopped being about demos and started being about engineering. There are no animated screenshots here. There are no viral twitter threads. There are just consistent, repeatable measurements of how these systems actually behave when you run them long enough.

That is good. This is what mature technology looks like. We are no longer guessing what agents can do. We are starting to learn what they are.