How it works
A single agent hallucinates constantly; the harness usually absorbs it because the output is checked, discarded, or overwritten on the next turn. Propagation is different. It needs three conditions to line up:
- A fabrication that reads as fact. An agent emits a plausible claim — a file path, an API field, a metric, a prior decision — with no source attached.
- A shared surface. That claim is written into context every later agent trusts: a scratchpad, a plan document, a message on the bus, a retrieved memory.
- No verification boundary. Downstream agents consume upstream output as ground truth rather than as a claim to check.
Once those align, the error stops being one agent's mistake and becomes the team's shared premise. A planner invents a config key; an implementer writes code against it; a reviewer validates that code against the same invented key; a summarizer reports success. Each step is locally coherent and individually confident. The fabrication is never re-examined because re-examining upstream output is nobody's job. Worse, confidence tends to rise as the claim travels — every agent that repeats it adds apparent corroboration, so the fifth mention looks better-sourced than the first even though nothing was ever verified.
Why it matters in an agent harness
Propagation converts a recoverable error into an unrecoverable one. In a single-agent loop you can roll back one turn. Once a fabrication has fanned out across a plan, generated code, and a review, rollback has to unwind a graph, not a line — and you often can't tell which node introduced the falsehood.
It also defeats your cheapest safety mechanism: majority agreement. If you run three agents and trust the consensus, propagation makes consensus meaningless, because the three didn't reason independently — they inherited the same bad premise. Agreement then measures shared ancestry, not truth.
For observability, the damage is that the failure is legible only in aggregate. Every individual trace looks clean. The bug lives in the edges of the graph — what one agent accepted from another — not in any single transcript. If your logging captures per-agent output but not provenance (who asserted this, backed by what), you cannot reconstruct the point of divergence.
The containment lever is the same one that bounds any blast-radius problem: put a verification boundary between production and consumption, and carry provenance so a claim can never silently upgrade to a fact.
Hallucination propagation vs a single-agent hallucination
| Single-agent hallucination | Hallucination propagation | |
|---|---|---|
| Scope | One output, one turn | A shared premise across the team |
| Detection | Visible in the trace | Hidden; every trace looks clean |
| Recovery | Roll back one step | Unwind a dependency graph |
| Consensus | Still meaningful | Corrupted — agreement ≠ truth |
The distinction matters because it moves the fix off the model and onto the harness. You don't stop propagation by prompting agents to hallucinate less; you stop it by controlling how unverified output crosses agent boundaries.
The Rifty take
We treat every cross-agent handoff as untrusted until proven otherwise. An agent's output is a claim, not a fact, and it stays a claim until a deterministic check, a first-party source, or a human confirms it. We accept the coordination cost of that boundary — it is slower than letting agents free-associate off each other — because the alternative is confident, coordinated wrongness that no downstream step will catch. Provenance travels with the claim, or the claim does not travel.
Common failure modes
- Unattributed shared scratchpad — every agent reads a flat blob, so nobody can tell a verified fact from a guess.
- Consensus from agents that shared context — agreement reflects common ancestry, not independent verification, and launders a fabrication into apparent truth.
- Summarizer laundering — a summarization step drops the hedges and source tags, turning "the code may reference X" into "the code references X."
- Retrieved memory as ground truth — a fabrication written to long-term memory outlives the run and re-infects future ones.
- No verification boundary at the handoff — downstream agents build directly on upstream output instead of re-deriving or checking it.
- Confidence inflation — repetition across agents reads as corroboration; the harness has no way to see that one assertion was simply echoed N times.
Frequently asked questions
How is hallucination propagation different from a normal hallucination?
A normal hallucination is one agent's wrong output, visible in its trace and reversible in a single turn. Propagation is what happens when that output crosses into shared context and downstream agents treat it as fact — the error becomes the team's premise, hides from per-agent logs, and requires unwinding a dependency graph to fix.
Does running more agents in agreement protect against it?
No — it often makes things worse. If the agents share context, their agreement reflects a common source, not independent verification, so consensus can launder a fabrication into apparent truth. Majority voting only helps when the voters reasoned independently; agents that inherited the same premise are one voter wearing several hats.
How do you stop hallucination propagation in a harness?
Put a verification boundary at every cross-agent handoff: treat upstream output as a claim, not a fact, and require a deterministic check, first-party source, or human confirmation before a downstream agent builds on it. Carry provenance with each claim so it can never silently upgrade to ground truth as it travels.
Where does propagation usually enter a multi-agent system?
It usually enters at shared surfaces: a common scratchpad, a plan document, a message bus, or retrieved long-term memory. Any place where one agent writes and many agents read without attribution is a propagation vector, because the reading agents cannot distinguish a verified fact from an unsourced guess.
Can better prompting prevent it?
Prompting helps at the margin but does not solve it, because propagation is a harness problem, not a model problem. You can ask agents to hedge and cite, but the fix lives in how output crosses boundaries — verification gates, provenance, and independent checks — not in asking each agent to hallucinate less.