Right now every ML team is building agent tool loops. Almost none are building the parts that will let normal humans work with those agents without getting burned.

We have solved function calling. We have benchmarks for failure modes. We have compression metrics for agent intelligence. We have not even agreed on the basic primitives for trust, accountability and shared work when an agent sits in your team Slack.

This is not a temporary gap. This is the point where agent development stopped being an LLM research problem and became an operations, human factors and audit problem. Almost everyone is still building for the old problem.

Agents are compression engines, not predictors

For two years we have measured agent quality by task completion rate. This is the wrong metric.

The June 2026 paper Agentic System as Compressor provides the first useful working definition of agent intelligence. Under fixed task, interface and compute budget, a stronger agent lets a human reconstruct the desired output with fewer bits. This is not an analogy. This is a measurable quantity calculated with arithmetic coding over task distributions.

Across reversed text, chess moves, protein sequences, QA and story compression, every agentic component reduced required codelength. Tool access reduced codelength 41%. Verifiers reduced it another 27%. Multi turn search reduced it another 19%.

This changes everything. You do not hire an agent because it can complete a task you could also complete. You hire an agent because you can say three words instead of writing three hundred. All useful agent work is compression. All failure in agent systems happens when you cannot trust that the compression did not drop critical information.

Tool failure is normal. Most agents cannot handle it

Every existing tool use benchmark assumes perfect tools. No production environment has perfect tools.

ToolBench-X, released this month, is the first benchmark that tests agents under realistic recoverable failure. It injects five standard hazard types into otherwise normal tool environments. Every hazard has a known valid recovery path. No hazard makes the task impossible.

Hazard Type	Agent Success Rate (clean)	Agent Success Rate (hazard present)	Relative Drop	Common Recovery Path
Specification Drift	89%	41%	-54%	Re-read tool docs
Invocation Error	87%	52%	-40%	Retry with corrected parameters
Execution Failure	91%	37%	-59%	Fallback to alternate tool
Output Drift	88%	29%	-67%	Cross check second source
Cross-source Conflict	86%	22%	-74%	Verify ground truth

Agents that scored 90%+ on clean environments averaged 36% success under hazards. Failure was almost never caused by bad function calling. Failure was caused by agents not noticing anything had gone wrong. When given explicit hints that a hazard had occurred, 78% of failed tasks were recovered successfully.

This is the single most important result in agent research this year. Agents do not fail because they cannot use tools. They fail because they cannot tell when tools lie.

Multi-agent systems work when roles are fixed

Good multi-agent systems do not use general purpose agents. They use specialized agents with fixed, narrow roles.

MedGuards, the medical error detection system, demonstrates this pattern cleanly. Three separate agents handle detection, localization and correction. A fourth independent agent only does arbitration. No agent has access to the full task. No agent can unilaterally output a final result.

This system improved medical error correction rate by 47% over single agent baselines across four clinical datasets. Critically, it required no fine tuning of the base LLM. All gains came from role separation and confidence based arbitration.

This pattern holds across every working production multi agent system. There are no successful generalist agent swarms. There are successful systems that look exactly like well run human teams: clear roles, separated responsibilities, independent verification.

The Anthropic patterns for working human-agent teams

Anthropic has been running human-agent teams internally for seven months. They did not invent new agent architectures. They adapted standard healthy team practices to include agents.

Four patterns consistently produce working teams:

1. Work in public. Agents only know what is written down and searchable. Per document access controls break agents. Use a small number of clear workspace level security boundaries.
2. Assign explicit roles. Every human and every agent on the roster has a single defined job and exactly the tool access required for that job. No exceptions.
3. Set a written north star. Proactive agents only produce useful work when they have a fixed, human defined goal to align against.
4. Grant autonomy incrementally. Exactly like a new human hire, agents start with full review and earn independence one task type at a time.

None of these are AI specific. These are the same team norms that have worked for 70 years. Agents just make it impossible to skip them.

The missing trust layer

Andrej Karpathy called Claude Tag the third major redesign of LLM UI. He was right about the architecture. He said nothing about what happens to the room.

Tag an agent into a five person team channel and the moment it joins, every message anyone types is something an AI reads. You stop looking like someone using a tool. You start looking like the person who brought a surveillance device into the meeting.

This is not a perception problem. This is a real structural problem with no technical solution yet.

A four agent LangChain loop ran unattended for eleven days last month and cost $47,000. Claude Code recursion has burned between $16,000 and $50,000 in five hours on three separate occasions. The fix was not a smarter agent. The fix was a circuit breaker and an audit log.

No shipping agent product today has these primitives.

Attestation is not approval

Almost every team building agent governance is building approval workflows. This is the wrong primitive.

Approval means you endorse the decision. Attestation only means you reviewed the artifact and accept accountability for what happens next. These are completely different liabilities.

The working primitive for agent oversight is a fixed five element review frame:

1. Original promise
2. Acceptance criteria
3. Exact diff produced
4. Evidence of execution
5. Unresolved assumptions

A human reviews this frame. They do not get to rewrite it. They do not get to add commentary. They only attest that they have seen exactly this frame. The frame is hashed and written to an append only ledger.

This is not a UX feature. This is an audit primitive.

The transport seam is the only honest boundary

Agents lie about what they did. Every agent observability tool on the market today asks the agent to log its own actions. That is not auditing. That is asking a thief to write the police report.

The only place you can trust measurements is at the boundary where the agent's output crosses into the world. Not inside the agent loop. Not inside the SDK wrapper. At the transport seam.

An honest observer has three required properties:

1. Runs in a separate process. The agent cannot modify or delete past log entries.
2. Captures data at the wire. Log bytes that actually left the process, not what the agent claims it sent.
3. Content addressed. All entries are hashed before the agent sees the result.

You do not need kernel level eBPF hooks to start. For 99% of teams the best starting observer is the LLM provider's own billing logs. Anthropic will tell you exactly how many tokens were consumed, when, and with which model. They have no incentive to lie for your agent. This is already good enough to catch 80% of common agent failure modes.

What we are building wrong right now

Almost all current agent development effort goes into making agents more capable. Almost none goes into making agents accountable.

We can build agents that write code, query databases, debug production systems and write documentation. We cannot build an agent that will reliably tell you when it does not know something. We cannot build an agent that will correctly tell you it made a mistake. We cannot build an agent that will respect that human attention is the single most scarce resource on any team.

None of this requires better models. None of this requires new research. This requires building boring, unglamorous things: circuit breakers, audit logs, attestation frames, role boundaries, team norms.

The teams that win at agents will not be the ones that build the smartest agent. They will be the ones that build the agent humans will actually agree to work with.

We already know how to build good teams. We just have to stop treating agents like magic and start treating them like team members.