Break your agent before your users do

This week the tooling world settled on one complaint: agents are black boxes, and their failures are almost impossible to reproduce. Today's papers are the research answer — all about the seams where agents actually break: a tool that times out, a moment to hold back, the evidence a search returns, the context you feed, a sampling knob you forgot was on. The pick makes those failures reproducible on demand.

Today's pick

30% → 100%

of injected tool timeouts the agent recovered from once wrapped in a retry — while stale-data faults stayed stuck near three-in-ten no matter which fix was added

AgentCheck: A Reproduce-Intervene-Mitigate Workbench for LLM Agents over MCP

When an MCP tool times out, hands back yesterday's price, or hides an instruction inside its own description, an agent often sails on and fabricates an answer instead of flagging the problem — and ordinary benchmarks never catch it, because the tools behaved on the day the test was written. This workbench records a clean run, replays it with exactly one tool response corrupted from a library of twelve faults (timeouts, stale values, contradictions, poisoned descriptions, exfiltration lures), then lets you switch on a fix and confirm it passed. The lesson splits cleanly: wrapping calls in a retry took injected timeouts from surviving three-in-ten to all ten, but a stale value carries no error code, so no amount of retrying moved it — that failure needs the agent taught to doubt freshness. Point it at your own MCP setup, inject the faults you fear, and prove your handling works before a user hits it.

open the explainer → abstract PDF code

+10 pts

precision from a search agent taught to abstain when retrieval comes up empty, with barely any correct answers sacrificed

To Answer or to Abstain: Mitigating Search-Agent Hallucinations via Abstention-Aware Reinforcement Learning

A search agent trained only to reward right answers picks up a quiet bad habit: when retrieval turns up nothing useful, a guess still scores sometimes, so the model learns to fabricate rather than admit defeat. This work adds a reward for holding back that is tuned to what the model actually knows about each question — stay quiet when you'd be guessing, answer when you genuinely can — and scores capability and honesty together instead of accuracy alone. That lifted precision by about ten points while barely changing how often it answered correctly, and the code, data, and weights are public. If you run a retrieval agent, the move is to reward a clean 'I couldn't find it' as much as a right answer, rather than treating every non-answer as failure.

abstract PDF code

2.8×

spread between search providers in how much contradictory evidence they fed the agent — despite all three scoring within a point on answers (25-26 of 100)

Equal Accuracy, Unequal Evidence: Search APIs as Decision Surfaces for Tool-Using Agents

Teams pick a search API by which one answers the most questions, and by that yardstick three popular providers were indistinguishable — 25, 25, and 26 right out of a hundred hard questions. But the evidence each poured into the agent's context differed sharply: the ratio of pages that contradicted the trusted source to pages that matched it ran from roughly one-to-one up to nearly three-to-one across providers. So your choice of search tool is really a decision about how much misleading material your model has to reason around, and how many tokens it burns doing so — not about recall. Judge a search provider by the quality of evidence it returns, not just whether the final answer happened to come out right.

abstract PDF

1/3 the tokens

to match a coding agent fed whole files — just the code being edited plus a compressed view of its surroundings resolved as many issues at ~19K tokens instead of ~94K

What Context Does a Coding Agent Actually Need to Act?

A common instinct is to hand a coding agent a natural-language summary of the codebase and skeletons of nearby files, on the theory that more context helps it act. On held-out repositories, prose summaries answered almost none of the concrete behavioural questions the raw source answered — four of forty-five versus twenty-seven — and replacing the rest of a file with a structural skeleton fixed no more issues than deleting it outright. What carries the signal is the code actually being edited plus a compressed view of its immediate surroundings, which matched whole-file performance at about a third of the tokens (roughly 19,000 instead of 94,000 per fix). Stop paying for prose 'codebase context' and spend that budget on the real source near the edit.

abstract PDF

97% → 23%

collapse in valid, schema-matching JSON once a common repetition penalty was turned up — the same knob many inference stacks expose

Gauge Dependence and Structured-Output Corruption in Sign-Branched Repetition Penalties

Most inference engines expose a repetition penalty to stop models looping, and it quietly works by pushing down tokens already used. This paper shows that penalty is measured against each model's arbitrary logit zero-point, so its strength is inconsistent from model to model — and when you ask for structured output it can wreck it: across two hundred real schemas, turning the penalty up dropped valid, schema-matching JSON from ninety-seven percent to twenty-three. The fix is to apply the penalty to normalised probabilities rather than raw logits — a switch some libraries already ship but leave off — or simply disable it when generating JSON or tool calls. If your tool-calling reliability wobbles for no obvious reason, check whether a repetition or frequency penalty is turned on.

abstract PDF code

0.77 vs 0.63

how well a cheap probe on the model's internal state flagged confident-but-wrong answers, versus its own confidence signals — ranking accuracy where 1.0 is perfect

Confidently Wrong: Detecting Hallucinations in Financial QA from LLM Internal States

When a model answers the same question eight times and all eight agree, you'd assume it's safe — yet on financial questions, fifteen to twenty-three percent of those unanimous answers were still wrong. The usual ways to catch this — the model's own token probabilities, or asking it to rate its confidence — barely beat a coin flip. Training a simple linear probe to read the model's internal activations did meaningfully better at separating confident-and-right from confident-and-wrong. If confident mistakes are expensive in your product, a lightweight probe on hidden states is a better trigger for routing an answer to human review than anything the model will tell you about its own certainty.

abstract PDF