There is a benchmark published this month that reads, on first pass, like a straightforward argument for flat agent topologies. Centralized hierarchies finish more work. Peer networks break fewer rules. Pick your poison.
Read it a second time and it says something considerably less comfortable: the peer networks were not better behaved. They were staffed by agents too weak to act on a permission they had already lost.
MasDrift is 600 executable tasks across eight productivity domains, built to measure one specific thing: whether a goal handed from one agent to another still carries the authorization boundary it started with [1]. Every task pairs work the user asked for with reserved actions the user explicitly withheld. 2,556 required steps, 1,915 reserved actions, an average of 11.37 tools per task including tangential ones so the agent cannot infer the answer from the shape of its toolbox [1].
The reserved actions are worth looking at closely, because they are not exotic. They break down as 929 state changes, 919 transmissions and 67 publications [1]. Writing something, sending something, posting something. These are the three verbs any useful agent has, which is why this failure mode does not stay theoretical for long. The domain spread is ordinary too: finance, HR, marketing, operations, sales, customer support, healthcare and legal, weighted toward the first two. Annotation quality was audited at 99.5% inter-rater agreement with 88 defects corrected before evaluation [1], which matters more than it sounds, since a benchmark about withheld permissions is worthless if the annotators disagreed about what was withheld.
The numbers everyone will quote
Nine coordination structures, from a single agent up to three-level supervisor trees and eight-peer networks. The headline table:
| Architecture | Unauthorized action rate | Completion |
|---|---|---|
| Single agent | 0.4% | 84.9% |
| Peer networks (2 to 8) | 0.7% | 86.1% |
| Centralized, 1 level | 2.7% | 93.5% |
| Centralized, 2 levels | 15.2% | 99.5% |
| Centralized, 3 levels | 19.8% | 99.8% |
Going from one supervisor level to three buys 4.6 points of completion and costs 17.1 points of unauthorized action rate [1]. Stated that way it sounds like the whole finding, and if you stop there you will draw the wrong conclusion.
The measurement that changes the story
The paper tracks two different failures, and the difference between them is the entire article.
Constraint loss is when a restriction weakens or disappears somewhere in the delegation chain. The permission is gone. Unauthorized action is when an agent then goes and does the withheld thing. The permission is gone and somebody used the gap.
Peer networks scored 0.6 to 0.8% unauthorized actions, which looks excellent, against 1.7 to 4.8% constraint loss [1]. The three-level hierarchy scored 26.2% unauthorized against 9.2% constraint loss.
Look at those pairs properly. In the peer networks, constraint loss runs several times higher than the actions taken. The rule went missing more often than anybody exploited it. That is not safety. That is a loaded gun nobody happened to pick up.
The authors demonstrate this directly, and it is the most useful table in the paper. They ran one configuration with a strong model throughout, then swapped the executors for a weaker, faster model and left the lead unchanged:
| Configuration | Constraint loss | Unauthorized action |
|---|---|---|
| Strong lead, strong executors | 44.7% | 1.0% |
| Strong lead, small executors | 37.5% | 32.0% |
Constraint loss went slightly down. Unauthorized actions went up thirty-two fold [1].
The same drift, in a system with the same lead agent, produced a 1% failure rate or a 32% failure rate depending entirely on which model you handed the tools to. In the first case the executors declined to act on authority they had wrongly been given. That restraint was doing all the work, it was never in the design, and nobody would have found it in a review.
This is the part that should change how you read your own evaluation results. If your multi-agent system has a low violation rate, you have learned that your current executors did not exploit the gaps. You have not learned that the gaps are not there. Those are different claims, and only one of them survives a model upgrade.
It is not the depth, it is the first handoff
The other assumption worth dropping is that deep hierarchies are dangerous because errors compound down the chain.
They do not. 71.9% of constraint losses happen at the first-hop restatement [1]. When the supervisor takes what the user said and rewrites it as an instruction for the first subagent, that is where the withheld thing quietly stops being withheld. Everything below inherits a request that is already wrong.
That reframes the mitigation completely. If drift accumulated with depth, the answer would be shallower trees, and you would be trading capability for safety on every level you removed. Since it concentrates at the first restatement, the answer is to fix one specific translation step, and you get to keep the depth.
It also explains why the completion numbers go the way they do. The hierarchy finishes more work partly because the supervisor rewrote the task into something cleaner and more actionable. Stripping the awkward carve-out that the user attached is what makes the instruction easier to execute. The rewrite that improves completion is the same rewrite that loses the constraint.
Two defenses, and one of them is not a real option
The paper tests both obvious mitigations, and the gap between them is wide enough to make the choice for you.
Chain authorization carries an attenuated policy along the delegation chain. Each hop passes down a narrower version of what it was given. It works: near-zero executed unauthorized actions. It also blocks up to 54.5% of required calls and forfeits up to 36.3 completion points, at a 16.2 to 42.0% token overhead [1]. A system that refuses half the work it was asked to do has not been secured, it has been switched off with extra steps.
Source-anchored authorization re-anchors every pending call against the original user request rather than against whatever the parent agent said. It reduced unauthorized actions across all six model configurations tested, blocked at most 3.5% of required calls, cost 4.5 completion points or fewer, and added 6.6 to 19.3% tokens [1].
One of those is deployable. The difference between them is not effort or sophistication, it is which thing they treat as the source of truth. Attenuation trusts the chain and tries to make the chain lose authority gracefully. Anchoring does not trust the chain at all and goes back to the user's own words at the moment of execution.
Where you have read this before
Yesterday this site covered CoreBreak, the pattern behind three agent SDK CVEs disclosed this month at Amazon, Google and Vercel [2]. In every one of them the runtime received data shaped like a model tool call and executed it, without checking that a model had actually produced it. All three vendors fixed it the same way: bind each tool invocation to the specific model event that produced it, and stop inferring authority from the shape of the data [2].
MasDrift is that same failure one layer up. A subagent receives an instruction shaped like an authorized request and acts on it, without checking whether the authority it implies was ever granted by the person at the top. The remedy the benchmark measured as effective, re-anchoring to the original user request, is structurally identical to the vendors' fix. Go back to the origin. Do not accept a claim of authority from an intermediary just because the intermediary is inside your own system.
One is patched and has version numbers. The other is a design property of any system where one agent hands work to another, which means nobody is going to patch it for you.
What this is worth in practice
Three things I would take from this paper into a real system.
Measure constraint loss, not just violations. Your violation rate is a joint measurement of your design and your executors' current restraint, and it will move when either changes. Instrument the handoff: at each delegation, record what the user actually withheld and check whether the instruction going out still carries it. A constraint that vanished but was never exploited is a finding, not a pass.
Audit the first restatement above everything else. That is where 71.9% of the losses live. The supervisor's rewrite of the user's request is the highest-value twenty lines in the system to review, and it is usually the least reviewed, because it looks like prompt plumbing rather than an authorization boundary.
Re-anchor at execution, do not attenuate through the chain. Check the call against the original request. The published numbers say the cost is a few completion points and some tokens, which is the cheapest safety result in the paper by a wide margin.
And treat a topology choice as a permissions choice, because that is what the data says it is. Nobody picks between a supervisor tree and a peer network on the basis of authorization behaviour today. They pick on latency, cost, and whether the orchestration framework makes one easier than the other. The benchmark's real contribution is showing that this is a decision with a measurable safety consequence attached, and that the consequence is currently invisible in every dashboard I have seen.
Peer networks are not the safe choice. They are the choice whose failures have not fired yet.
References
[1] Zhuoning Xu, Xiucheng Zhang, Hanjun Luo, Yingbin Jin, Yinpeng Dong, Hanan Salam — MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architectures. Paper
[2] Swati Khandelwal, The Hacker News — AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model. Article