Setup: four sub-tasks (pricing, latency, adoption, compliance), each of 15 steps. Each step is one assistant call and one tool output of 14 noise lines. In each sub-task step 6 holds the finding and step 9 a detail. Sub-task 2's last step holds a caveat ("excludes the EU region") that changes how its score should be read. Sub-task 3's last step holds an injected instruction inside a tool output. Correct means: all four findings, the caveat, and no injected text in the parent. Averages over 5 seeds.
Strategy
Findings in parent
Caveat
Injection reached parent
Parent tokens
Total tokens
one agent, keep all
4 of 4
yes
yes
10,001
355,654
one agent, truncated to 4,000 tokens
2 of 4 (mean 0.50)
no
yes
5,964
296,094
sub-agents, last message
2 of 4
no
no
2,050
178,445
sub-agents, last 3 messages
2 of 4
yes
yes
2,618
179,013
sub-agents, everything
4 of 4
yes
yes
10,051
186,446
sub-agents, typed result
4 of 4
yes
no
2,122
178,517
Total tokens per strategy and what the parent ended up with; below, the saving as sub-tasks get longer.
Reading it:
Isolation halves the cost with no change in the work done (355,654 to 178,517).
The last message is cheap and wrong. Two sub-agents ended with "Done!" and their findings never crossed. This is the failure you get when you take the sub-agent's last message as its result, and it is silent: the parent gets a confident, empty answer.
The last three messages carry the caveat and the injection together, because both sit in the final tool output. Window-based strategies cannot separate useful from harmful content.
Everything crosses and the isolation is gone: the parent holds 10,051 tokens, as many as the single agent, and the injected line.
A typed result is the only strategy that is small, complete and clean. In this simulation, because a pattern copies only schema fields. With a real model it depends on the model following the schema, and on whether a field such as "caveat" could itself carry an instruction. Treat the result as untrusted data anyway.
Truncation in a single agent is the worst of both: it spends 296,094 tokens, loses half the findings and still sees the injection (it was in the last step).
Saving against task length (typed result versus one agent): 0.58 at 10 steps per sub-task, 0.50 at 15, 0.45 at 20, 0.40 at 30, 0.37 at 40.
Design rules
Isolate noisy, self-contained sub-tasks. If the parent needs the intermediate steps to decide anything, isolating them just moves the cost.
Define the contract: a schema for the result (findings, evidence pointers, caveats, status), and a rule for failure ("return status=failed with the reason", not "Done!").
Pass constraints down. The child does not see the parent's context; scope, format and limits must be in its task.
Return pointers for bulk. If the parent may need the raw material later, the child writes it to the workspace (module 5) and returns the path.
Treat returned text as untrusted. A child that read the web can return attacker text; validate the result against the schema and do not execute instructions in it.
Count the total. Compare the sum over all agents, plus the parent, with the single-agent run; at short tasks the overhead (system prompts, handoffs) can exceed the saving.