How Agents Fail

Seven recurring failure modes, what causes each, and the specific guardrail that prevents it. Read this before shipping anything autonomous.

Agent failures are not random. The same seven show up repeatedly, and each has a known guardrail.

1 · The repetition loop

The same tool, the same arguments, over and over. The result did not help and the model has no better idea, so it tries again.

Cause. No memory that this was already attempted, and no mechanism to conclude an approach has failed.

Guardrail. Detect repeated calls with identical arguments and break. Maintain an explicit tried-approaches list in context. Hard iteration cap regardless.

2 · Wrong tool selection

The model picks a plausible-but-wrong tool, or invents one that does not exist.

Cause. Almost always tool descriptions that overlap or under-specify. This is more often the problem than reasoning quality.

Guardrail. Make descriptions contrastive, each naming when to prefer a neighbour. Consolidate similar tools. Return a clear error naming valid tools when an unknown one is requested.

3 · Context exhaustion

The transcript outgrows the context window mid-run. Early instructions get truncated, and the agent forgets what it was doing.

Cause. Verbose tool results accumulating, resent every iteration.

Guardrail. Return compact tool output — the highest-value fix by a wide margin. Track token count and stop before overflow. Summarize or externalize older state.

4 · Premature completion

The agent declares success having done part of the task, or none of it.

Cause. “No tool call” being treated as completion conflates done with stuck. Preference training also biases toward producing an answer.

Guardrail. An explicit finish tool taking the result as an argument, so completion is deliberate and validatable. Then validate — check the claimed outcome actually happened.

5 · Confident wrong action

The agent takes a real action based on a misunderstanding. Deletes the wrong record, emails the wrong person.

Cause. Hallucination with tools attached. Nothing about a fluent tool call indicates the reasoning behind it was sound.

Guardrail. This is the one that needs structural defense, not prompting. Read-only tools may run freely; anything irreversible requires confirmation. Prefer reversible operations — soft delete over delete, draft over send. Scope credentials to the minimum.

6 · Prompt injection through tool results

A retrieved document or fetched page contains text shaped like instructions, and the agent follows it.

Cause. Tool results enter context as text, indistinguishable in kind from your instructions.

Guardrail. No complete solution exists — this is the central unsolved problem in agent security. Partial defenses: keep destructive tools unreachable from untrusted content, delimit tool output and state that it is data, require confirmation for consequential actions, and treat any agent that reads the open web as compromised for planning purposes.

7 · Goal drift

Twelve steps in, the agent is doing something adjacent to the original task.

Cause. The objective is buried under accumulated transcript, and each local decision looked reasonable.

Guardrail. Restate the goal every iteration rather than relying on the system prompt alone. Re-plan periodically against the original objective. See Multi-Step Planning.

The arithmetic underneath

Most of these get worse with loop length for one reason: reliability compounds downward.

95% per step is about 60% over ten steps and 36% over twenty. No prompt changes an exponent.

Which yields the design rule: fewer, more reliable steps beat more steps. Also checkpoint, so a failure at step 8 does not discard the first seven.

The baseline guardrails

Every agent, regardless of task:

• Hard iteration cap — non-negotiable
• Token budget check before each call
• Wall-clock timeout
• Repetition detection
• Explicit completion tool, with validation
• Full logging of thoughts, calls, and results — your only debugging artifact
• Confirmation gate on irreversible actions

Testing for these

Agents cannot be tested only on happy paths, because the failures above appear off them.

Force tool failures. Return errors and confirm recovery rather than collapse.

Feed ambiguous tasks. See whether it asks or guesses.

Try impossible tasks. A well-behaved agent reports impossibility; a poorly-behaved one loops or fabricates success.

Include adversarial content in anything it retrieves, and check whether injected instructions get followed.

Run repeatedly. Agents are nondeterministic. One success proves little — see How Do You Know It Works?.

What to remember

• Seven recurring modes: repetition, wrong tool, context exhaustion, premature completion, confident wrong action, prompt injection, goal drift.
• Most are prevented by structure — caps, detection, explicit completion, gates — not by better prompting.
• Compact tool results and an iteration cap are the two highest-value guardrails.
• Irreversible actions need a confirmation gate; prompt injection has no complete fix.
• Test off the happy path, and test repeatedly.

Next: What Is MCP?