Bardia Mohammadi and Laurent Bindschaedler at MPI-SWS posted arXiv 2609.00275 on 31 August 2026, for the Agentic OS workshop at SOSP. It is a controlled study, not a production runtime. The number that stuck is the composition failure.
They simulate fifty procurement agents. Each one may place a supplier order up to $50k under a per-agent rate limit. The tenant will tolerate $250k of unhedged exposure in a trading day. On a quiet day that envelope holds. Then a shared price-spike alert makes "buy now" the rational move for every agent at once.
Every purchase clears its local cap. In 300 seeded runs, those local gates still overdrew the tenant limit in every run, at 2.4× on average. Grow the fleet to a thousand agents and keep the same $250k envelope, and the overdraw reaches 48×. The budgeted ledger, which charges residual loss before commit and denies the marginal effect, stayed inside the limit at every size.
I keep seeing the same shape in smaller form. Five coding agents, each allowed to open a PR, merge on green, or bump a dependency. Each one is in policy. They all wake up on the same CVE email. You wanted five reviews. You got five merges.
Counting calls does not help. A canceled draft, a completed order, and a signed contract do not leave the same residual loss after refunds. A control that treats every tool call as one unit is either unsafe on the irreversible ones or so conservative that ordinary work dies.
