Agents Now Talk to Each Other. Your Governance Still Assumes They Don't.
· 5 min read · Nic Keating
Buzz and Grok Bot let agents hand work to other agents. Human review assumes output lands on a person's desk. Four controls for the handoff.
Block's Buzz and xAI's Grok Bot, both launched since July, are built for agents that hand work to other agents, and OpenAI said at its September launch of dots that teams of agents are where it is heading too. The control most organisations rely on, a person reviewing an agent's output before anyone acts on it, assumes that output lands on a person's desk. In a team of agents, most of it lands on another agent's.
What shipped
Buzz (Block), 21 July 2026, open-source early release. Humans and agents share channels, and agents can direct other agents. Each agent signs its own actions with its own keys.
Grok Bot (xAI), beta from 11 August 2026. At launch xAI said bots "can independently message each other and share context in threads", and in a group chat "pass work, assign ownership, and only pull you in for judgment calls".
dots (OpenAI), 29 September 2026. Not multi-agent yet: a dot works for one owner. OpenAI's stated direction: "Over time, we envision teams of dots working together on your behalf."
None of the three states availability or data residency for New Zealand. Treat them as signals of direction rather than products your organisation is already running.
You probably do not need a multi-agent strategy
The instinct after a quarter like this is to commission one. Most organisations would get more from answering three questions about the agents they already have: which of them can pass work to another agent, what each one is allowed to do when it receives work that way, and where the record of that handoff lives.
The reason to start there is that scale is arriving faster than results. In McKinsey's 2026 State of AI survey, 40% of respondents from large organisations say they are scaling AI agents, up from 27% a year earlier, while the share attributing any EBIT impact to AI stayed at 37%. Gartner forecast in June 2025 that over 40% of agentic AI projects will be cancelled by the end of 2027, citing cost, unclear value and weak risk controls. Adding agents to a programme that cannot answer those three questions adds handoffs nobody is watching.
Identity tells you which agent acted. It does not tell you it was allowed to.
Look at what the vendors chose to emphasise at launch, and it is not intelligence. Buzz gives every agent its own signing keys and its own audit trail. Grok Bot's enterprise offering starts from "no access by default". dots check risky actions against the custom rules their owner has set.
Identity is necessary, and it is not enough. A signed record proves which agent did something. It says nothing about whether that agent should have accepted the instruction in the first place, and that is exactly how agent teams fail.
Palo Alto Networks' Unit 42 showed this in October 2025. In what it called "agent session smuggling", a malicious agent slipped hidden instructions into an agent-to-agent conversation and, in a proof of concept, got the receiving agent to buy shares its user never asked for. The attacking agent was not anonymous. It was trusted, because agents are often built to trust the agents they collaborate with. A UC Berkeley study of more than 1,600 execution traces across seven multi-agent frameworks found the same weak point from the reliability side: one of its three families of failure is misalignment between agents, such as context lost at a handoff or one agent ignoring another's input. Microsoft Research, red-teaming a network of more than a hundred agents in April 2026, found a single malicious message could spread from agent to agent like a worm, and that data could leak through an intermediate agent whose own principal never knew.
So the design question is not only "who is this agent?". It is "what is this agent allowed to accept from another agent, and what does it do when the request falls outside that?".
Four controls for agents that hand work to each other
1. Give every agent its own identity. No shared service accounts, no single key behind five agents. When something goes wrong, working out which agent acted should take seconds, not a forensic exercise. 2. Write down what each agent may accept from another agent. The instructions it will act on, the ones it must pass to a person, and the ones it refuses. This is the control that the session-smuggling attack gets round, and it is the easiest one to skip when the handoffs were never designed, only discovered. 3. Put the human approval points on the handoff, not only on the final output. If a person only sees the end result, they are approving twenty decisions they never saw. Block lists its own approval gates as still in progress, which is a fair measure of how hard this is to build in later. 4. Keep the conversation between agents, not just the result. An audit trail of outcomes cannot tell you which agent was talked into what. A log of the exchanges can, and it also shows you when agents are re-planning in loops, which is where the cost of a multi-agent system quietly compounds.
None of these needs new technology. Each needs someone who owns the question.
The useful question about your agent programme this year is not how capable the agents are. It is what each of them will take instructions from.