Agent orchestration

How agent orchestration works

An orchestrator controls three things in a system of AI agents:

1. Who operates. It picks the next agent.
2. What each agent gets. It gives the task, the context and the earlier outputs.
3. How the results come together. It merges, votes on or summarises the outputs.

The OpenAI Agents SDK names two types: “orchestrating via code” and “orchestrating via LLM”.

Orchestrator	Who decides the next step	Good	Bad
Fixed code	The developer, before run time	Predictable speed and cost	Cannot adapt to a new type of task
Manager model	A model, at run time	Adapts the plan to each input	Harder to predict, test and make safe

Anthropic describes the model case as orchestrator-workers: “a central LLM dynamically breaks down tasks, delegates them to worker LLMs, and synthesizes their results”.

Why agent orchestration matters for security

The orchestrator holds the plan and tells agents with tools what to do. If untrusted content changes the plan, all agents after it follow the new plan.

Thus a test of each agent alone does not show that the system is safe. The orchestration guidance of Microsoft (February 2026) gives these controls:

• Authenticate agents to each other and use protected networks between them.
• Give each agent and the orchestrator least privilege.
• Keep the identity of the user across agents, and filter data in each agent.
• Put guardrails on user input, tool calls, tool responses and last output.
• Check each agent output before the next agent gets it.

See also insecure inter agent communication and cascading failures.

Five orchestration patterns compared

The Azure Architecture Center of Microsoft (updated February 2026) names five patterns. The table gives each pattern and its primary risk.

Pattern	How it works	Primary risk named by Microsoft
Sequential	Agents run in a fixed order, each on the output of the one before	Failures in early stages propagate
Concurrent	Agents work at the same time on the same input	Results that contradict, high resource use
Group chat	A chat manager picks which agent speaks next in one shared thread	Conversation loops
Handoff	One agent at a time, and each agent decides when to pass control	Infinite handoff loops
Magentic	A manager agent builds a task ledger and assigns the tasks	Slow to converge, cost hard to predict

Microsoft suggests no more than three agents in a group chat. It also says to mix patterns when the steps of a task are different.

The OpenAI Agents SDK has two model-led types:

• Handoff. A triage agent sends the user to a specialist, and “that specialist becomes the active agent for the rest of the turn”.
• Agents as tools. “A manager agent keeps control of the conversation and calls specialist agents” for bounded subtasks.

Trade-offs of more agents

More agents can do more work in parallel. They also cost more and have more failure modes.

Measure	Result	Source and scope
Quality increase	90.2% better than a single Claude Opus 4 agent	Anthropic, internal research eval, June 2025
Token cost	About 15 times the tokens of a chat	Anthropic, its multi-agent research system, June 2025
Failure modes	14 modes in 3 categories	Cemri et al., over 1,600 traces from 7 frameworks, 2025
Benchmark gains	“often minimal”	Cemri et al., popular benchmarks, 2025

Anthropic says “Agents are stateful and errors compound”. It also says tasks where all agents must share the same context are not a good fit today.

Microsoft says to “Use the lowest level of complexity that reliably meets your requirements”. It calls a single agent with tools “Often the right default for enterprise use cases”.

Where definitions disagree

Sources put the line between a workflow and orchestration in different positions.

• Anthropic lists orchestrator-workers as a workflow pattern, although a central model picks the subtasks at run time.
• Microsoft calls a fixed sequential pipeline an orchestration pattern, with no model in control of the order.
• OpenAI calls both cases orchestration, “via code” or “via LLM”.

When a vendor says “agent orchestration”, find out who decides the next step: fixed code or a model. The answer changes the risk.

Questions and answers

What is the difference between agent orchestration and an AI workflow?

Anthropic calls a workflow a system where LLMs and tools follow "predefined code paths". Agent orchestration covers that case and also the case where a manager model decides the steps at run time. The OpenAI Agents SDK calls these orchestrating via code and orchestrating via LLM.

Does a system need many agents to get good results?

Frequently not. Microsoft calls a single agent with tools "Often the right default for enterprise use cases". Cemri and colleagues found the gains of multi-agent systems on popular benchmarks "often minimal". Anthropic found a large gain for broad research tasks, at about 15 times the tokens of a chat.

What is the main security risk of agent orchestration?

Untrusted content can change what the orchestrator tells other agents to do. In tests by Triedman and colleagues, multi-agent systems with GPT-4o agents ran malicious code in 58% to 90% of trials. The attacks also worked where each agent alone resisted prompt injection.