The multi-agent system is broken. Not because the models lack intelligence, but because we designed the guardrails before we designed the road.
A new taxonomy—MAST—analyzed 1,642 annotated trajectories across seven major multi-agent frameworks. The result: nearly 79% of failures stem from specification and coordination problems, not model capability. FC1 (system design issues) accounts for 44.2%—repeated steps, unacknowledged termination conditions, non-compliance with task specs. FC2 (inter-agent mismatches) adds another 34.4%—reasoning-action misalignment, task derailment. Only FC3 (task verification) takes the remainder.
You’d think the industry would rush to fix the root cause. Instead, all energy is flowing into runtime governance: Broadcom’s AgentMinder, Microsoft’s MXC, the MCP protocol hosted by AAIF, OWASP ACS, NIST’s agent standards, OAuth 2.0, SPIFFE/SPIRE. Identity binding, intent binding, OS-level isolation, policy-driven sandboxing, audit trails—the entire stack of guardrails. Monthly MCP SDK downloads hit 97 million by March 2026. The market is building walls while the house lacks a blueprint.
I’ve seen this before. In 2020, I audited a DeFi yield aggregator that repeatedly entered the same liquidity pool because its termination condition was an absolute price target that never triggered. That was a specification failure—FC1—not a model intelligence gap. We spent months tuning the agent, but the fix was a single line: “if goal reached, stop.” The runtime protocols couldn’t help because they assumed the goal was correct.
The MAST intervention experiments confirm this: improving role specification significantly reduces FC1 failures. But the paper doesn’t report effect sizes or control for model version. The 79% is a correlation, not a causal law. Swap the model to GPT-7 tomorrow, and the distribution might shift—yet the fundamental design problem remains. Stronger models can compensate for fuzzy specs, but they can’t eliminate the need for clear termination, decomposition, and validation.
Why is the industry ignoring the design-time gap? Simple: runtime governance sells. Security, compliance, identity—these are line items in enterprise budgets. Specification engineering doesn’t have a product category yet. It’s a methodology gap, not a SaaS subscription. Vendors like Broadcom and Microsoft bundle runtime tools into existing platforms (VMware, Azure), capturing procurement dollars. Startups chasing agent safety naturally pitch “real-time monitoring” because that’s what buyers understand. The deeper problem—agents failing because no one defined “done”—is harder to monetize.
But here’s the trap. Runtime governance cannot correct a fundamentally flawed task specification. An agent with perfect identity binding and OS isolation will still waste compute cycles repeating a step it already completed. It will still execute actions that drift from the original intent, because the intent was never formally captured. You can audit every invocation, but if the goal is misspecified, the audit log reads like a tragedy—all correct, all wrong.
The market doesn’t care about your narrative. It cares about your termination condition.
The MAST taxonomy exposes a blind spot that won’t go away with better models. I’ve lived through multiple crypto cycles where everyone chased runtime protection—firewalls, KYC, transaction screening—while the real vulnerabilities were economic design flaws. The Tornado Cash sanctions made code illegal, but they didn’t fix the incentive mismatch in DeFi protocols. Similarly, the agent governance stack is responding to a symptom: unauthorized actions. The root cause is ambiguous specification.
Consider FC1’s “unacknowledged termination condition.” In a multi-agent trading system, one agent may keep executing because the “when to stop” signal was never passed between agents. Runtime tools can’t repair that. They can only flag the behavior after the fact. The cost of those extra compute cycles isn’t just financial—it’s the erosion of trust in autonomous systems. No enterprise will deploy agents that repeat steps indefinitely.
And yet, the protocol stack is commoditizing rapidly. MCP, OAuth 2.0, SPIFFE/SPIRE—these are open standards that lower the barrier to interoperation. The value is shifting from the protocol itself to the tools that ensure agents operate correctly within that protocol. That’s where design-time specification engineering comes in. It’s not a replacement for runtime governance; it’s the prerequisite. Without design-time specs, runtime telemetry is just noise.
We didn’t see the blind spot. In 2021, I watched NFT communities spend millions on floor-price tracking bots that ignored social capital metrics. The bots were “secure”—they used trusted oracles, audited smart contracts—but they missed the market’s actual driver. That was a design-time failure: the specification didn’t include narrative resonance. The MAST taxonomy would classify it under FC2—reasoning-action mismatch. The bot’s reasoning (price) didn’t match the action (buy/sell based on community sentiment).
The contrarian view: The crash of agent reliability is the setup for a new infrastructure layer. Just as the 2022 bear market cleared the way for better protocol design in crypto, the mounting failures of poorly specified agents will create demand for formal specification tools. The question is whether these tools emerge as independent startups or get absorbed by platform giants like Microsoft and Broadcom.
Consider the parallels to the compute-for-equity model I worked on in 2026. We designed tokenomics for AI agents where rewards tied to verifiable outputs. The critical part was the “verifiable” condition—it required a precise specification of what success looked like. Without that, agents could game the metrics. That’s design-time specification engineering, embedded in economic incentives. It worked because we defined “done” before writing a single line of token contract.
The market’s blind spot is precisely this over-fixation on runtime safety. MAST shows that 78.6% of failures originate before execution begins. Yet every product launch, every standard body meeting, every venture deck highlights runtime governance. It’s a structural bias: runtime problems are visible, quantifiable, and mapped to existing budgets (security, compliance, identity). Design-time problems are invisible until the agent fails, and even then, the blame often falls on the model or the developer, not the toolchain.
Three signals to watch:
- MAST replication: If other teams replicate the 79% figure across different models and task domains, specification engineering becomes an undeniable bottleneck. Look for papers that control for model capability.
- Platform moves: If GitHub, GitLab, or JetBrains adds agent spec linting to their CI/CD pipelines, it signals commoditization of the design-time layer. If Microsoft integrates spec validation into MXC, the window for independent tools narrows.
- Funding: If a startup emerges focused solely on agent specification lifecycle (role definition, task decomposition, termination conditions, simulation testing), it validates the market. Current silence suggests early stage.
The industry’s blind spot isn’t technological—it’s commercial. We know how to build specification tools (formal methods, model checking, contract-based design). But we haven’t justified their ROI. An enterprise team that reduces FC1 failures by 20% might save millions in runtime costs and improve deployment confidence. That’s a number worth calculating.
My take: most of the runtime governance stack will become table stakes, bundled into cloud platforms at near-zero marginal cost. The competitive advantage will shift to the entities that can formalize agent intent and validate it at scale. This is not a distant future—it’s the next 12–18 months. The agents are already failing. The question is who builds the debugger for their souls.
Takeaway: The next wave of agent infrastructure will not come from better models or smarter sandboxes. It will come from a formalization of design-time specifications. The race is not for runtime security; it’s for specification clarity. When every agent fails because no one defined what “done” means, who gets the blame—the developer or the framework?
