CrossAgent: Framework for Multi-Agent AI

Updated 2 July 2026

CrossAgent is a comprehensive multi-agent AI framework that unites heterogeneous action spaces, protocols, and RL mechanisms for adaptive, dynamic operations.
It employs a unified multi-stage training pipeline, combining supervised fine-tuning and reinforcement learning to achieve state-of-the-art performance and robust generalization.
The architecture integrates secure, identity-governed protocols and specialized security tokens to ensure policy compliance, auditability, and safe cross-agent collaboration.

CrossAgent refers to a suite of methodologies, architectures, and agent models designed to enable AI systems and LLM agents to operate across heterogeneous action spaces, interoperate with other agents and systems, and facilitate secure, auditable, and flexible multi-agent collaboration. The term arises both in the context of RL agent architectures such as “CrossAgent” (He et al., 10 Dec 2025), as well as in the systems literature—most notably in frameworks for cross-agent and cross-domain interaction, including protocols like MCP × A2A (Jeong, 2 Jun 2025) and identity-governed networks such as ClawNet (Yang et al., 21 Apr 2026). CrossAgent paradigms are motivated by the need to overcome static, single-domain boundaries and to enable production-grade AI ecosystems featuring dynamic agentic action, secure interoperability, and strong governance.

1. Formalization of CrossAgent Architectures

CrossAgent, as introduced in "Training One Model to Master Cross-Level Agentic Actions via Reinforcement Learning," denotes a single RL agentic model that can dynamically select and execute actions in multiple, heterogeneous action spaces without the need for manual gating or hand-scripted switching (He et al., 10 Dec 2025). The composite action space is defined as

$A = \bigcup_{x=1}^N A_x,$

where each $A_x$ corresponds to a distinct interface (e.g., high-level motion primitives, perception-grounded GUI actions, or raw keyboard/mouse signals), each managed by its own controller $C_x$ . The policy is realized as a Transformer-based model, receiving high-dimensional sensory inputs (e.g., vision-language embeddings from Qwen2-VL-7B-Instruct) along with action history. Output actions are prefix-tagged to indicate the target action subspace.

The action representation leverages a shared language-like syntax, enabling the decoder to emit surface forms such as "Motion: forward," "Grounding: open_inventory," or "Raw: click(x,y)," which are parsed by a deterministic mapping $g(\cdot)$ into execution-level commands.

2. Unified Multi-Stage Training and Policy Optimization

The training pipeline for CrossAgent proceeds through three major stages: mixed-space supervised fine-tuning, single-turn RL “warm-up” via Group Relative Policy Optimization (GRPO), and multi-turn RL to optimize long-horizon trajectories (He et al., 10 Dec 2025). Key GRPO mechanisms are as follows:

Group-wise advantage estimation: For group size $G$ and sampled output trajectories $o_i \sim \pi_\text{old}$ ,

$\hat A_{i,t} = \frac{r_i - \text{mean}_j\, r_j}{\text{std}_j\, r_j + \delta}$

where $r_i$ is the reward, and $\delta$ is a small constant for numerical stability.

Clipped surrogate with KL regularization:

$J_{GRPO}(\theta) = \mathbb{E}\left[ \frac{1}{G} \sum_{i=1}^G \frac{1}{|o_i|} \sum_{t} \min \big( \rho_{i,t} \hat A_{i,t}, \operatorname{clip}(\rho_{i,t}, 1-\epsilon, 1+\epsilon) \hat A_{i,t} \big) - \beta D_{KL}[\pi_\theta \Vert \pi_\text{ref}] \right]$

where $A_x$ 0 is the token-level probability ratio and $A_x$ 1 controls RL regularization.

This process enables the emergence of implicit action-space selection: the model learns to switch between high-level and low-level subspaces adaptively, balancing efficiency and precision in response to task demands.

3. Interoperability: MCP × A2A Framework

The integration of MCP (Model Context Protocol) and A2A (Agent-to-Agent protocol) realizes CrossAgent capabilities at the system orchestration and multi-agent collaboration level (Jeong, 2 Jun 2025). The A2A protocol formalizes agent communication as messages of the form $A_x$ 2—sender, recipient, type, payload—transported in a standardized JSON envelope. Message routing and authentication rely on a four-phase handshake finite state machine to establish secure, bilateral channels.

Tool invocation is managed via the MCP layer: each agent request translates to a structured context $A_x$ 3, where $A_x$ 4 is user/session, $A_x$ 5 is the tool, and $A_x$ 6 the parameter set. Input and output functions, $A_x$ 7/ $A_x$ 8, provide schema-validated translation between agent requests and tool APIs.

Composite collaboration is formalized as

$A_x$ 9

with context propagation and message dispatch conducted via strict schema checks and priority-queued routing. This yields robust cross-agent interoperability, cross-tool function chaining, and secure multi-agent task workflows.

4. Cross-Agent Security, Policy Enforcement, and Semantic Flow Analysis

CrossAgent ecosystems present novel security challenges, notably context-fragmented violations (CFVs), where locally rational actions aggregate into global policy breaches (Wu et al., 24 Apr 2026). Distributed Sentinel introduces the Semantic Taint Token (STT) protocol and sidecar architecture to propagate security state and mediate privacy-preserving, cross-domain enforcement:

STT tokens: Opaque cryptographic artifacts (including source IDs, taint vectors, constraints, and signatures) travel with agent messages. Before a sensitive action, sidecars check STT validity through 1-bit remote queries to the state of origin.
Counterfactual graph simulation: System dynamically forks local knowledge graphs, applies the candidate action, and verifies against both local and cross-domain invariants in parallel.

PhantomEcosystem benchmarks, with nine violation categories, demonstrate that such centralized enforcement substantially reduces cross-domain violation rates, with F1 reaching 0.95, surpassing prompt-based and rule-based defenses.

Complementary to enforcement, MAScope (Wei et al., 4 Mar 2026) provides execution-aware attack detection by reconstructing cross-agent semantic graphs. Each operation is abstracted as an event $C_x$ 0, and entire system activity is modeled as $C_x$ 1 (Equation 1). The reconstruction algorithm identifies contiguous behavioral trajectories and invokes a supervisor LLM to audit for intent inconsistency, data flow breaches, and control-flow violations. Empirical studies yield F1 = 85.3% (node-level), 66.7% (path-level), demonstrating effective detection of sophisticated, multi-stage attacks.

5. Identity and Governance for Human-Centric CrossAgent Networks

ClawNet (Yang et al., 21 Apr 2026) extends the CrossAgent paradigm to cross-user, identity-governed agent networks by anchoring agents to distinct human owners and enforcing rigorous authorization and auditability. The architecture is built around three governance primitives:

Layered identity architecture: Each user $C_x$ 2 has a manager agent $C_x$ 3 with holistic knowledge, and multiple identity agents $C_x$ 4 representing context-specific roles. Only identity agents may communicate externally; $C_x$ 5 is strictly architecturally isolated.
Scoped authorization protocol: Every $C_x$ 6 possesses a dedicated permission scope $C_x$ 7, with all operations subjected to L1 (server-side) and L2 (client-side) ACL checks. Escalations are routed to the human owner for override.
Action-level accountability: All operations are logged as $C_x$ 8 in an append-only, cryptographically checksummed ledger.

Cross-user collaboration sessions are established via bilateral approval and mutual inclusion in authorized collaborator sets. This enables secure, auditable, multi-user agent workflows while mirroring organizational authority and accountability structures.

6. Benchmarking, Evaluation, and Comparative Outcomes

Experimental results validate the practical and performance advantages of CrossAgent methodologies. In the OpenHA Minecraft suite, CrossAgent achieves state-of-the-art task completion and generalization (ASR up to 54.6% over 800+ tasks), outperforming single-space and static multi-space baselines (He et al., 10 Dec 2025). In enterprise deployments of MCP × A2A, time-to-completion and resolution latencies are reduced by 60%, with message latency per hop of ~50 ms and code complexity reduced by 70% (Jeong, 2 Jun 2025). Security frameworks such as Distributed Sentinel and MAScope deliver F1 up to 0.95 and 0.85, respectively, for detecting and blocking complex cross-agent violations (Wu et al., 24 Apr 2026, Wei et al., 4 Mar 2026).

A summary of empirical findings:

Method / System	Security/Task Metric	Score
CrossAgent (RL agent, MineRL)	ASR (All Tasks)	54.6%
MCP × A2A (enterprise)	Latency (per hop)	~50 ms
Distributed Sentinel	F1 (PhantomEcosystem)	0.95
MAScope	F1 (node / path)	0.853 / 0.667

Key insight: CrossAgent concepts—spanning from multi-modal RL agents to enterprise-grade agent interoperability frameworks and human-governed collaboration networks—are foundational for the next phase of scalable, general, and secure agentic AI.

7. Limitations and Ongoing Research Directions

Open challenges include sample efficiency for multi-turn RL (CrossAgent RL still incurs considerable environment interaction cost), extension to further-diversified action spaces (e.g., APIs, shell, web GUI), and sim-to-real transfer for physical robotics (He et al., 10 Dec 2025). Identity-governed systems such as ClawNet must address client trust (endpoint is assumed trustworthy) and further expand scope to encompass external APIs, databases, and cryptographic decentralized identity (Yang et al., 21 Apr 2026). Security frameworks require evolutionary extensions for continuous policy learning, compositional attack detection over long event horizons, and formal verification of policy-compliant execution (Wei et al., 4 Mar 2026, Wu et al., 24 Apr 2026).

A plausible implication is that comprehensive CrossAgent infrastructures will increasingly underpin distributed, interoperable, and secure AI agent ecosystems across academic, industrial, and organizational domains, demanding advances in training, security formalism, identity, and governance.