Josh Rosen, an AI builder who writes about system design on X, argues the industry has been measuring the wrong thing when it comes to recursive agent delegation. As autonomous agents increasingly spin up subagents to handle pieces of a large task, engineers have defaulted to asking how many layers of nesting are safe. Rosen’s answer is that nesting depth predicts almost nothing about reliability.
The question worth asking, in Rosen’s framing, is not how many layers deep an agent hierarchy runs. It is how much damage a given node can do if it turns out to be wrong. Two systems can nest agents to identical depths and carry entirely different risk, because risk tracks where an error occurs in the structure rather than how far down the chain it sits.
That structure, Rosen points out, stops being a simple tree once real systems are running. A parent agent’s subagents research, plan, and execute, but their outputs get joined together, reused as another agent’s input, and checked by reviewers before a result moves back up. He calls modeling that structure explicitly, as a dependency graph rather than a stack of nested calls, graph engineering.
The distinction between a leaf and a root node does the real work in his argument. An agent producing one narrow output that only its immediate parent consumes can be wrong without damaging anything else: the failure is contained to that branch. An agent that sets a plan or decides which competitors merit research, closer to the root of the graph, establishes the premises every downstream worker then inherits. If that early node is wrong, the workers beneath it can execute their individual steps correctly and the final output is still wrong, because they built faithfully on a bad foundation rather than making a mistake of their own.
Rosen calls this an artifact’s blast radius: the share of the eventual output that becomes wrong if that one artifact is wrong. Fan-out multiplies it. A planning agent whose decomposition feeds ten downstream workers gives a single mistake ten separate paths to spread, and each of those workers can pass the error forward again to whatever consumes its output next.
That framing produces a concrete engineering prescription rather than a general call for caution. Provenance matters because agents downstream of a compromised node typically consume a summary rather than the original evidence, so tracing an error back to its cause requires the source material to travel alongside the conclusion. Verification matters most at the nodes with the largest blast radius, because catching a bad plan before it fans out to ten workers is far cheaper than catching it after those ten workers have each built further work on top of it. And added scrutiny, whether a second independent agent, a structured output format, or a human sign-off, belongs specifically at high-impact nodes rather than spread evenly across a system, since uniform review wastes budget on leaf nodes that could never do much damage regardless.
The argument lands the same day AI Insiders is covering separate Anthropic research on how individually benign agent behaviors compound into unsafe outcomes once multiple agents share an environment. Different mechanism, same conclusion: the danger sits in how agents are connected to each other, not in any single agent’s competence.
Rosen offers no universal depth limit and says explicitly that he does not believe one exists. Teams running recursive agent systems in production should stop auditing nesting depth as a safety metric and instead map which nodes in their agent graphs carry outsized downstream influence, then route verification budget, provenance tracking, and human review toward exactly those nodes before the next release.
Josh Rosen, writing on X on August 13, 2026.
