Comparing the subagent models, orchestration patterns, and communication mechanisms of Claude Code, Codex, Antigravity, Cursor, Windsurf, Devin, LangGraph, and CrewAI, with a capability matrix and a spectrum of design philosophies.
By 2026 nearly every mainstream coding agent supports subagents. Design philosophies split three ways: deterministic scripted orchestration (Claude Code Workflow), model-driven autonomy (Codex, Devin), and IDE command-center integration (Windsurf 2.0, VS Code). This overview maps product positioning, a capability matrix, and the design-philosophy spectrum.
Parallel + nested agent spawns can burn 200K+ tokens in a single conversation turn. From Anthropic to Microsoft, the industry is converging on tiered responses: compress → downgrade → stop, rather than a binary kill switch.
Multi-agent orchestration splits into three camps: scripted determinism (LangGraph, Claude Code Workflow) is predictable but rigid, model-driven (Codex, Devin) is flexible but unpredictable, and hybrid (Windsurf 2.0) acts as a command center integrating multiple agents. The choice depends on how much predictability you need.
Should a sub-agent see the parent's conversation? Fork carries full history but token costs grow exponentially. Fresh saves money but lacks context. Industry consensus: default to Fresh, Fork only when needed, and always pair it with history truncation and result compression.
Agent-to-agent communication falls into three patterns: handoff (transfer control), delegate (dispatch and wait for results), and mailbox (real-time peer-to-peer messaging). Implementations vary widely, but MCP and A2A are driving protocol standardization.
The most common debug nightmare in multi-agent systems is 'the answer is wrong, but I don't know which agent did it.' Three layers of observability are essential: per-agent token metering, execution traces, and real-time cost dashboards.
Multi-agent security risks aren't just amplified single-agent risks — inter-agent communication is itself an attack surface. A compromised sub-agent can pass malicious instructions to the parent through its return value. Core defense: treat agent output as untrusted data.