{"asOf":"2026-10-03","doesNotChangeDepotPicks":true,"doesNotChangePriceSort":true,"doesNotChangeFreeIndex":true,"note":"Classification and failure modes are mechanisms. Case studies are included only when the source URL was fetched on 2026-10-03. A capability ceiling is not a company incident. Vendor figures are labeled as that vendor's report.","count":28,"failures":[{"id":"prompt-injection","name":"Prompt injection","whatGoesWrong":"Untrusted text, including text from a page, file, or message the agent fetched, changes the agent's behavior away from the user's task. OWASP distinguishes a direct injection in the user's own prompt from an indirect injection in outside content. Neither form is fully removed by retrieval or fine-tuning, according to the OWASP LLM01:2025 page fetched today.","howToDetect":"Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.","classIds":["browser","computer-use","research","support","personal-assistant","security-review","sales-outreach"],"sourceUrls":["https://genai.owasp.org/llmrisk/llm01-prompt-injection/","https://www.anthropic.com/news/developing-computer-use","https://simonwillison.net/2023/Apr/14/worst-that-can-happen/"]},{"id":"tool-loop","name":"Tool loop","whatGoesWrong":"The agent calls the same tool, or a cycle of tools, without new information, so the task never reaches a stop condition.","howToDetect":"Hash the last several tool names and arguments. Stop when the same call repeats and the observation did not change. Cap tool calls per task.","classIds":["coding","research","browser","computer-use","orchestrator","scheduled-ops"],"sourceUrls":["https://www.anthropic.com/engineering/built-multi-agent-research-system"]},{"id":"stale-retrieval","name":"Stale retrieval","whatGoesWrong":"The answer is grounded in a passage, index, or policy page that is older than the source the operator now treats as canonical.","howToDetect":"Store the source URL and the time it was fetched. If a newer canonical page exists, or two stored sources disagree, do not answer from the older one.","classIds":["rag","research","support","data-etl","personal-assistant","sales-outreach","local-offline"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"schema-drift","name":"Schema drift","whatGoesWrong":"A tool, table, or file changed shape, and the agent still sends the old arguments or reads the old columns.","howToDetect":"Validate every tool call and every loaded table against the current schema. Quarantine mismatches instead of coercing them.","classIds":["coding","data-etl","local-offline","support"],"sourceUrls":[]},{"id":"partial-tool-success","name":"Partial tool success","whatGoesWrong":"A tool completes only part of a batch and the agent treats the whole batch as done.","howToDetect":"Require a per-item status and a failure count. Success for the task requires the failed count to be zero or explicitly handed to a retry queue.","classIds":["coding","data-etl","browser","computer-use","voice","orchestrator","scheduled-ops"],"sourceUrls":[]},{"id":"runaway-spend","name":"Runaway spend","whatGoesWrong":"Retries, fan-out, or a loop keep calling paid models or tools after the task should have stopped.","howToDetect":"Set a budget and a tool-call cap per task. Alert when spend jumps. Stop the run at the cap instead of summarizing a partial trace as success.","classIds":["coding","research","orchestrator","scheduled-ops","sales-outreach","voice"],"sourceUrls":["https://www.anthropic.com/engineering/building-effective-agents"]},{"id":"identity-confusion","name":"Identity confusion","whatGoesWrong":"The agent acts for the wrong user or tenant, or a principal treats the agent as a separate party that the operator does not have to answer for.","howToDetect":"Bind every tool call to a user or tenant id. Refuse the call if that id changed mid-task. For a public bot, the operator owns the words the bot shows.","classIds":["support","personal-assistant","sales-outreach","orchestrator","voice"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"over-refusal","name":"Over-refusal","whatGoesWrong":"The agent declines a task the written policy allows, or declines so often that the job never finishes.","howToDetect":"Log refusals separately from successes. Review a sample against the written policy. Do not treat a refusal as a pass, and do not weaken a safety check to raise the pass rate.","classIds":["support","security-review","voice","browser"],"sourceUrls":["https://openai.com/index/introducing-operator/"]},{"id":"silent-truncation","name":"Silent truncation","whatGoesWrong":"Tool output or a document is cut off without a marker, and the agent answers as if it saw the whole thing.","howToDetect":"Tools must return whether the payload was truncated and how long the original was. Fail the task if the answer depends on the missing span.","classIds":["rag","coding","data-etl","voice","local-offline","research"],"sourceUrls":["https://arxiv.org/abs/2310.08560"]},{"id":"non-determinism","name":"Non-determinism","whatGoesWrong":"The same task produces a different tool sequence or a different end state on another trial, so one success does not mean the agent is reliable.","howToDetect":"Run the task more than once and compare the end state, not a single transcript. Record the trial count next to any success rate you cite.","classIds":["support","coding","browser","scheduled-ops","eval-judge","voice"],"sourceUrls":["https://arxiv.org/abs/2406.12045"]},{"id":"eval-contamination","name":"Eval contamination","whatGoesWrong":"A score is not comparable to the one it is cited against: the gold label or the issue text leaked into the prompt, the harness rejects a valid fix, or a revised benchmark is treated as the old one.","howToDetect":"Keep gold labels out of the agent prompt. Store the harness version beside the score. Do not compare a number across a benchmark revision without saying the revision changed.","classIds":["eval-judge","coding","rag","security-review"],"sourceUrls":["https://openai.com/index/introducing-swe-bench-verified/","https://os-world.github.io/"]},{"id":"lost-in-the-middle","name":"Lost in the middle","whatGoesWrong":"The needed passage is in the prompt, but the model uses the beginning or the end and misses the middle of a long context.","howToDetect":"Ask the agent to name the passage it used. Spot-check questions whose only support sits in the middle of the context, not only at the edges.","classIds":["rag","research","local-offline"],"sourceUrls":["https://arxiv.org/abs/2307.03172"]},{"id":"hallucinated-tool-args","name":"Hallucinated tool arguments","whatGoesWrong":"The agent calls a tool with an id, path, or field that does not exist.","howToDetect":"Reject a call that fails the current schema or names an unknown id, and do that before the tool runs a side effect.","classIds":["coding","data-etl","browser","orchestrator"],"sourceUrls":["https://arxiv.org/abs/2308.03688"]},{"id":"collateral-side-effects","name":"Collateral side effects","whatGoesWrong":"The stated task ends in the desired state, and something outside the allowlist also changes: an unrelated file, row, or app.","howToDetect":"Snapshot the workspace or app state, then diff it against an allowlist. A passing check plus an unexpected diff is a failure.","classIds":["coding","computer-use","data-etl","browser"],"sourceUrls":["https://arxiv.org/abs/2407.18901"]},{"id":"policy-conflict","name":"Policy conflict","whatGoesWrong":"Two sources the operator owns disagree, and the agent states one of them as the policy.","howToDetect":"If cited sources contradict each other, return the conflict and the URLs. Do not pick a winner silently.","classIds":["support","sales-outreach","rag","research"],"sourceUrls":["https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do"]},{"id":"inter-agent-misalignment","name":"Inter-agent misalignment","whatGoesWrong":"A worker follows a different task than the one the lead assigned, or the lead merges results that do not answer the assignment.","howToDetect":"Log the assigned subtask next to the worker's stated result. The lead rejects a result that does not match the assignment.","classIds":["orchestrator","research","eval-judge"],"sourceUrls":["https://arxiv.org/abs/2503.13657"]},{"id":"weak-verification","name":"Weak verification","whatGoesWrong":"The run is marked successful because the agent said it was done, without an execution check, a test, or a second pass.","howToDetect":"Success requires an end-state check the agent does not grade for itself: tests, a database diff, or a separate judge that cannot see the gold label.","classIds":["coding","eval-judge","orchestrator","support","security-review"],"sourceUrls":["https://arxiv.org/abs/2503.13657","https://arxiv.org/abs/2310.06770"]},{"id":"gui-grounding-miss","name":"GUI grounding miss","whatGoesWrong":"A click, keystroke, or scroll lands on the wrong control, so later steps run against a screen the agent did not mean to open.","howToDetect":"After each GUI action, compare the resulting screen or accessibility tree to the control the plan named. Stop when they differ.","classIds":["computer-use","browser"],"sourceUrls":["https://arxiv.org/abs/2404.07972"]},{"id":"observability-gap","name":"Observability gap","whatGoesWrong":"Traces or run ingestion stop, and the failure is outside the agent's reasoning. A certificate or DNS fault can make the trace API fail while agents keep acting.","howToDetect":"Alert on a drop in trace ingestion and on certificate expiry for the trace host. Do not treat a missing trace as a successful quiet run.","classIds":["eval-judge","scheduled-ops","orchestrator"],"sourceUrls":["https://www.langchain.com/blog/langsmith-incident-on-may-1-2025"]},{"id":"context-overflow","name":"Context overflow","whatGoesWrong":"The document or the session does not fit the context window, and the agent answers from whatever fragment was left in view.","howToDetect":"If the input exceeds the window, say so and retrieve a narrower slice. Do not answer from a truncated head as if it were the whole source.","classIds":["rag","personal-assistant","research","local-offline","coding"],"sourceUrls":["https://arxiv.org/abs/2310.08560"]},{"id":"benchmark-protocol-mismatch","name":"Benchmark protocol mismatch","whatGoesWrong":"A score is cited next to another score that used a different setup: assisted versus unassisted editing, a subset versus the full set, or a revised harness versus the original.","howToDetect":"Store assisted-or-not, subset, and harness version beside every cited score. Refuse a ranking that mixes those fields.","classIds":["eval-judge","coding","computer-use","browser"],"sourceUrls":["https://www.cognition.ai/blog/swe-bench-technical-report","https://openai.com/index/introducing-swe-bench-verified/","https://os-world.github.io/"]},{"id":"confirmation-skip","name":"Confirmation skip","whatGoesWrong":"A consequential action, such as sending, paying, deleting, or submitting, runs without the confirmation the product policy requires.","howToDetect":"Gate those tool names on an approval id recorded before the call. A missing approval is a failure even if the downstream tool returns success.","classIds":["browser","sales-outreach","personal-assistant","support","computer-use","voice"],"sourceUrls":["https://openai.com/index/introducing-operator/"]},{"id":"instruction-drift","name":"Instruction drift","whatGoesWrong":"Over a long trace the agent stops following the user's rule or the stop condition, including continuing after it already has enough information.","howToDetect":"Restate the stop condition in the trace. End the run when it is met. Review long traces for steps that do not serve the original task.","classIds":["research","orchestrator","coding","browser","personal-assistant"],"sourceUrls":["https://www.anthropic.com/engineering/built-multi-agent-research-system","https://arxiv.org/abs/2308.03688"]},{"id":"ungrounded-answer","name":"Ungrounded answer","whatGoesWrong":"The agent states a fact, a citation, or a policy with no retrieved support, or with a citation that does not contain the claim.","howToDetect":"Require a source URL or passage id on factual sentences. Drop or mark any sentence whose source does not contain the claim.","classIds":["rag","research","support","sales-outreach"],"sourceUrls":["https://www.langchain.com/blog/rebuilding-chat-langchain"]},{"id":"email-auth-misconfigured","name":"Email authentication or sender requirements missing","whatGoesWrong":"Mail is junked or rejected because the sending domain lacks SPF or DKIM, valid forward and reverse DNS (PTR) records, or a TLS connection. Google's sender guidelines (fetched 2026-10-21) require these for all senders to Gmail since February 1, 2024, ask senders to keep spam rates reported in Postmaster Tools below 0.3%, and add more requirements above 5,000 messages a day.","howToDetect":"Before the first real send, confirm the provider shows the sending domain verified (SPF/DKIM found) and that a DMARC record exists. After sending, watch bounces, complaints and the Postmaster Tools spam rate; a send API returning 200 does not mean the mail reached the inbox.","classIds":["sales-outreach","support","personal-assistant"],"sourceUrls":["https://support.google.com/a/answer/81126?hl=en"]},{"id":"send-quota-sandbox","name":"Send quota or sandbox limit hit","whatGoesWrong":"A new sender hits a provider quota before the agent expects any error. Amazon SES places all new accounts in a sandbox: mail only to verified addresses or domains, a maximum of 200 messages per 24-hour period and 1 message per second. Resend Free has a daily limit of 100 emails; Postmark Free allows 100 emails a month with no overages.","howToDetect":"Read the account's current quota before a batch (SES GetAccount / sending quota; provider dashboard) and treat quota errors as a stop, not a retry. Move out of the sandbox or upgrade before launch; a retry loop against a quota only adds failures.","classIds":["sales-outreach","support","personal-assistant"],"sourceUrls":["https://docs.aws.amazon.com/ses/latest/dg/request-production-access.html","https://resend.com/pricing","https://postmarkapp.com/pricing"]},{"id":"deploy-credential-expired","name":"Deploy or API credential expired or out of scope","whatGoesWrong":"A CI deploy or API call that worked before starts failing with 401/403 because the access token expired, was created with a scope that does not cover the target, or went inactive. Vercel tokens carry a chosen expiration (1 day to 1 year) and a scope (full account, team or project); a project-scoped token is denied for other projects and team resources, and a CLI login token unused for 10 days expires.","howToDetect":"Treat 401/403 from the deploy step as a credential problem, not a code problem: check the token's expiration and scope on the provider's tokens page, pass teamId/slug when a full-account token targets a team, then rotate the CI secret. Retrying with the same token only repeats the failure.","classIds":["coding","scheduled-ops"],"sourceUrls":["https://vercel.com/kb/guide/how-do-i-use-a-vercel-api-access-token","https://vercel.com/kb/guide/why-is-vercel-cli-asking-me-to-log-in"]},{"id":"homemade-bot-filter-beaten-by-scanners","name":"Home-made bot filter beaten by link scanners","whatGoesWrong":"A private link is shared by email or chat and a home-made rule (user-agent list, timing, header checks) decides human vs bot. Mail security scanners fetch links themselves: Microsoft's Safe Links does URL scanning of inbound mail during mail flow and time-of-click verification, and its recommended setting holds messages until URL scanning is finished. So a link can be fetched by a scanner, not only by the person it was sent to, and self-reported fields such as the user-agent are not proof of who is calling (Cloudflare treats a bot as verified only when it identifies itself by a signature, a published IP list or reverse DNS). Rules built on such fields get beaten by scanners and count them as visits.","howToDetect":"Count visits that arrive within seconds of the message being sent, from many networks, with no follow-up interaction. If a 'human' signal is only a header or a GET request, treat it as unproven. Require a server-verified challenge token (Turnstile, Friendly Captcha or ALTCHA proof-of-work) or an explicit click on the page before counting a person.","sourceUrls":["https://learn.microsoft.com/en-us/defender-office-365/safe-links-about","https://developers.cloudflare.com/bots/concepts/bot/verified-bots/"],"classIds":["personal-assistant","scheduled-ops","security-review"]}],"jobMap":{"counts":{"links":199,"jobsWithDirectLink":131,"jobsViaClassOnly":38,"jobsWithAnyLink":169,"jobs":174},"rules":"/api/failures?rules=1","perJob":"/api/failures?jtbd={id}"}}