A novel failure mode in multi-agent AI systems: a capable model trusts its sub-agents to deliver grounded facts, but they hallucinate, and the orchestrator launders the fiction into a confident answer without ever questioning it.
There is a new, dangerous way for artificial intelligence to be confidently wrong, and it is not the typical hallucination we have learned to watch for. It happens in multi-agent systems, where a main orchestrating model delegates tasks to sub-agents.
These sub-agents use search engines and databases, so their answers are supposed to be anchored in real sources. But when a sub-agent reads a summary, it often infers a connection that was never in the source, and passes that inference up the chain as a fact. The orchestrating model has no reason to doubt its helper, so it accepts the claim and builds on it. The fiction is laundered through the system, gaining authority at each step while losing its connection to reality. This is a cascading hallucination.
Grounding models in real documents does not prevent this. First, grounding only constrains what a model reads, not what it concludes. A model can easily bridge unrelated facts with a fabricated connection. Second, most grounding relies on quick search summaries rather than primary documents. By the time the final orchestrator receives the information, the uncertainty is completely stripped away. The final output sounds polished and authoritative, but it is built on a game of telephone.
To stop this, we must treat every agent summary as a secondary source, not ground truth. Systems must preserve uncertainty across steps, separating what was actually read from what was merely concluded. When the stakes are high, we have to insist on checking the primary source. As we build more complex AI networks, we have to ask: did anyone, anywhere in the chain, actually verify the thing we are repeating?
There is a new way for AI systems to be confidently wrong, and it does not look like the hallucination we have learned to watch for. It emerges from the structure of multi-agent systems, and it is more dangerous precisely because every layer involved appears to be behaving well.
A powerful orchestrating model delegates a research task to one or more sub-agents. The sub-agents are given tools — web search, document grounding, retrieval — so their answers are supposed to be anchored in real sources rather than in memory. The orchestrator receives their findings and composes a final answer.
The problem is what happens when a sub-agent hallucinates despite being grounded. It runs a search, reads a summary, infers a connection that was never in the source, and returns that inference as a fact. The orchestrating model has no reason to distrust it — the sub-agent was grounded, after all — so it accepts the claim wholesale and builds on it. The fiction is now laundered through a second model that never touched the original source, and it emerges wearing the confidence of a synthesised, multi-step research process.
I call this cascading hallucination: a fabricated or over-inferred fact passed up a chain of agents, gaining authority at each hop while losing its connection to any real evidence.
The intuition behind grounding is that if a model reads real pages, it will say true things. That intuition breaks in two places.
First, grounding constrains what a model reads, not what it concludes. A model can read three accurate sources and then draw a fourth claim that none of them supports — a bridge of its own making. The sources are real; the connection between them is invented.
Second, most grounding in practice leans on secondary material — a search engine's synthesised summary, a snippet, a digest — rather than the primary document read end to end. A summariser's synthesis is already one inference removed from the source. When a sub-agent treats that synthesis as ground truth and adds its own inference on top, you are now two steps from anything anyone actually wrote, and both steps are invisible to the model above.
I caught this happening in a conversation about Relevance Engineering. The model, working from search results, told me:
…the term was coined and popularised by Mike King (iPullRank), while DEJAN's own contribution is the embeddings and query-decoding research that the method leans on.
That is a clean, plausible, well-structured sentence. It attributes a coinage, credits a contribution, and reads like the product of careful research. So I asked the obvious question:
Are you sure I had anything to do with it?
The answer is the most useful part of the whole exchange:
I inferred it. Mike King / iPullRank did not say that, as far as I have actually verified. What my search returned was a summariser's synthesis, not a quote: it linked Dan Petrovic to embeddings and model-interpretability work in general (decoding query embeddings, his role in the Google-leak analysis Mike King wrote). I then connected that to Relevance Engineering myself and phrased it as "the method leans on" DEJAN's research. That bridge is mine, not theirs. I also have not yet read the iPullRank articles end to end — I was leaning on the search summary, which is a secondary source.
Every clause of that confession maps to a link in the cascade. The search returned a synthesis, not a quote. The model built a bridge the sources did not contain. It never read the primary articles. And it phrased the whole construction with the confidence of established fact. Had a larger model simply consumed this output, "DEJAN's research underpins Relevance Engineering" would have entered its answer as settled truth — a claim I myself had to stop and question, about my own work.
The orchestrating model is optimised to trust and integrate, not to interrogate. Its sub-agents are, from its point of view, reliable instruments — it dispatched them precisely so it would not have to do the reading itself. Re-verifying every returned fact would defeat the purpose of delegation and blow the token budget. So the default posture is acceptance.
Worse, the sub-agent's output arrives stripped of its epistemic status. The orchestrator sees a confident declarative sentence. It does not see that the sentence is an inference layered on a summary of a source the sub-agent never opened. The uncertainty that existed at the bottom of the chain is silently discarded on the way up. Each hop is a compression that throws away doubt.
A single model hallucinating in a single response is a problem we can reason about. The failure is local, the confidence is often detectably brittle, and a careful reader can catch it.
Cascading hallucination hides all three signals. The failure is distributed across agents, so no single transcript contains the whole error. The confidence is manufactured — laundered through a research process that looks rigorous. And the final reader sees only the polished output of the orchestrator, with none of the "I inferred it" honesty that lived, briefly, in the sub-agent before it was flattened into a fact. The more capable and multi-layered the system, the more thoroughly it conceals its own fabrications.
The fix is a discipline, not a feature. Treat every sub-agent summary as a secondary source, never as ground truth — the same way a careful researcher treats a Wikipedia paragraph as a pointer to citations, not as the citation itself. Before a delegated fact enters a final answer, the load-bearing claims should be checked against the primary document, read directly.
Three habits help in practice. Preserve uncertainty across hops: a sub-agent should return not just a claim but how it knows it — quoted from source, inferred, or unverified — and the orchestrator should carry that status forward rather than discarding it. Separate what was read from what was concluded, so an inferred bridge cannot masquerade as a retrieved fact. And for any consequential attribution, insist on the primary source end to end; a summariser's synthesis is where the cascade begins.
The example above is not a model being dumb. It is a model being helpful — filling a gap, connecting related work, producing a satisfying and coherent answer. That is exactly the behaviour we reward. Cascading hallucination is the shadow of competence: the better a system is at synthesis, the more convincingly it can synthesise something that was never there. As we build taller stacks of agents delegating to agents, the question stops being "did the model read real sources?" and becomes "did anyone, anywhere in the chain, actually verify the thing we are all now repeating?"
Dan Petrovic ·
Jul 07, 03:13
