Summary: Source page for Galileo’s multi-agent engineering book. Not a security document — ingested for one chapter: the four context failure modes, which describe T1’s mechanism arriving with no attacker.
Sources: raw/Agentic/Mastering Multi-Agent Systems eBook.pdf
Last updated: 2026-07-30
Provenance
Mastering Multi-Agent Systems: Real-World Strategies for Multi-Agent Development, v1.01, by Pratik Bhavsar, published by Galileo as part of its “Mastering GenAI Series”. 30 MB PDF, 26,521 words extracted with pdftotext -layout. Undated internally.
Vendor content — Galileo sells agent evaluation and observability, and the book’s later chapters run on its platform. The engineering material is nonetheless independent of the product.
Extraction note: as with the ASI PDF, the text was extracted to the session scratchpad, not to raw/, per the rule that raw/ is never modified. Re-extract rather than expecting a text file. Figures 4.2–4.5 illustrate the failure-mode cascades and are lost in text extraction; the prose is self-contained without them.
Why it is in a security wiki
It is a reliability book. Its five chapters cover when multi-agent systems are worth their coordination cost (1–2), four architectures — centralized, decentralized, hierarchical, hybrid (3), context engineering (4), and a LangGraph build-and-monitor walkthrough with a “ConnectTel” telecom support system (5).
Only Chapter 4 was ingested, as context-failure-modes. The decision was deliberate: that chapter documents the exact mechanisms behind T1, T5 and T2, but as accidental engineering failures with measured effect sizes. The security literature in this vault asserts these mechanisms; this source measures them.
The rest — architecture selection, coordination-cost analysis, the LangGraph tutorial, the observability and continuous-improvement chapters — is engineering guidance with no security content that the vault does not already hold better. It is available in raw/ if a future question needs it.
What Chapter 4 contributes
Four failure modes, catalogued from Drew Breunig’s taxonomy and each backed by a named study:
| Mode | Mechanism | Evidence |
|---|---|---|
| Poisoning | One error enters context and is re-referenced until it self-validates | DeepMind’s Gemini Pokémon agent |
| Distraction | Long history crowds out reasoning; the model pattern-matches instead | Gemini 2.5 team, > 100k tokens; Databricks |
| Confusion | Too many tools; selection degrades | Berkeley Function-Calling Leaderboard; 46 → 19 tools |
| Clash | Contradictory information competing, corrections losing to originals | Microsoft + Salesforce, 39% average drop |
Full treatment, including why each matters for security, in context-failure-modes.
Also useful, and folded into that page: the book’s distinction between context (what influences every decision) and memory (what is retrievable), and Lance Martin’s five management approaches — offloading, isolation, retrieval, compaction, and caching — of which context isolation is the one with a direct security reading.
Two claims worth citing elsewhere
Context isolation’s cost profile. Anthropic’s multi-agent research system spawns specialised sub-agents with independent context windows and a coordinator that synthesises summaries: “improved performance by 90% despite using 15 times more tokens overall.” The source is careful that this works for read-heavy research and analysis, and not for coding, “where changes in one file ripple through others, and the coordination overhead undermines the benefits gained from isolation.”
This is the strongest empirical case in the vault for the architecture that also happens to be the security-preferable one — see context-failure-modes on isolation as blast-radius containment. It comes with a 15× token bill, which is the honest version of “just isolate the contexts.”
Offloading compression. The Manus team treats the filesystem as unlimited external memory, reporting “100:1 compression while maintaining full information recovery.” Relevant because offloaded content is content that left the context window and now lives somewhere with different access controls.
Assessment
Strengths: mechanisms explained rather than asserted; every failure mode carries a named study and a number; consistently honest about trade-offs (the 15× token cost, the coding counter-example, retrieval efficiency targets of 50–70%).
Limits for security use:
- No adversary anywhere. The word “attack” appears twice in 26,000 words, both times describing an agent that performs security scanning as a task. Every failure is accidental. The security value is in reading the mechanisms adversarially, which the book never does.
- Secondary sourcing throughout. The Breunig taxonomy, the DeepMind, Databricks, Microsoft/Salesforce and Berkeley results are all reported, not conducted. The 39% figure and the tool-count results should be traced to their primaries before being cited as findings — none of the underlying papers are held in
raw/. - Vendor platform dependency in the back half. Chapter 5’s monitoring, custom metrics and alerting run on Galileo. The concepts transfer; the walkthrough does not.
- Some figures are load-bearing for the cascade explanations and are not recoverable from the text.
Related pages
- context-failure-modes — the ingested chapter
- memory-poisoning — T1, the adversarial twin of context poisoning
- cascading-hallucination — T5, propagation through memory and agents
- agentic-reference-architecture — the ASI patterns these architectures map onto
- agent-observability-and-logging — the detection side of the same operational concern