Categories

27 categories of documented AI agent failure patterns

Every documented failure pattern is grouped into a category — from agentic security and agentic governance to accuracy, operations, and domain-specific use cases like healthcare and financial services.

Operations **Operations failures occur when agents are deployed without proper monitoring, when resource constraints cause cascading failures, when tool integrations break due to version mismatches or undocumented limits, or when distributed agent systems lack coordination and observability.** The Operations category encompasses 47 goals spanning reliability infrastructure, resource management, tool integration, and multi-agent coordination. Operations is cross-cutting because reliability, scalability, and auditability affect every agent system: an agent with brilliant reasoning but no observability infrastructure, resource limits, or recovery mechanisms becomes unreliable at scale. 409 patterns Security **Agent security fails when systems designed to protect against attacks, enforce authorization, and maintain safety instead get compromised, bypassed, or exploited to enable unauthorized access, data leakage, or policy violation.** An orchestrator agent trusts downstream agents without verifying their identity or output, and a compromised agent exfiltrates sensitive data that downstream agents blindly trust and propagate, a prompt-injection attack makes an agent ignore safety constraints and execute harmful operations, and memory poisoning injects instructions into knowledge-base that agent retrieves and executes without distinguishing malicious context from legitimate information. Security failures in agents matter precisely because agents are software systems that interact with humans, other agents, and external systems—every interaction point is a potential attack surface, and most agents were built for capability, not security. 75 patterns Knowledge Retrieval **Knowledge retrieval failures happen at every stage of a RAG pipeline independently — a query gets misunderstood before search even runs, the wrong or poorly-ranked documents get retrieved, a synthesized answer drifts from or hallucinates beyond correct context, a citation points at a source that doesn't actually support its claim, and a fact that's individually true gets applied at the wrong time, scope, or level of domain nuance.** None of the five stages named above reliably catches an error made at an earlier stage: a synthesis model has no way to know retrieval already searched the wrong corpus, and a citation-verification step has no way to know the cited fact was true a year ago but isn't anymore. That gap is what makes knowledge retrieval a category of parallel, independently-failing concerns rather than a single pipeline with one point of failure. 74 patterns Accuracy **Agents generate plausible-sounding but false content, apply outdated knowledge, lose track of constraints over long conversations, deviate from reasoning requirements, and skip verification of outputs — accuracy failures are silent because the output is well-formed and the agent is confident, so errors propagate downstream before being caught.** Accuracy issues span the entire agent pipeline: context management (losing track of instructions), reasoning quality (planning incompletely), output generation (hallucination), and verification (skipping or biasing the check). 66 patterns Speech and Audio **Voice AI agents fail in production because four largely independent layers — audio capture quality, speech recognition, dialog/conversation management, and voice synthesis — each have their own failure modes, and a breakdown in any single layer degrades the whole call even when the other three layers work perfectly.** A caller can be recognized accurately and responded to with a perfectly-worded reply, and the interaction still fails if the agent talks over the caller, mispronounces its own brand name, or loses the recording to a mid-call disconnect. Speech-and-audio failures are distinct from generic LLM failures because they carry hard real-time constraints (sub-second turn-taking, audible dead air) that a text-based chatbot never has to solve. 66 patterns Mortgage Documents **Mortgage document processing failure spans 8 interconnected goals (AI reliability, data extraction, compliance validation, cross-document validation, document integrity, document verification, fraud detection, quality control) where failures in one goal cascade to create systemic risks in others—hallucinated income values fail compliance checks and fraud detection, forged documents pass extraction but fail integrity checks, missing documents pass individual verification but fail quality-control audits—creating a "verification collapse" where AI systems validate their own outputs without independent checkpoints.** 53 patterns Financial Services **Financial-services agents face compound failures across data quality, market data timeliness, portfolio construction, regulatory compliance, and execution—each independent in mechanism but tightly coupled in impact, where data quality degradation propagates into pricing, risk calculations compound the data errors through poor correlation modeling, and execution errors realized the corrupted recommendations.** None of the five goals reliably catches errors made at earlier stages: a data-quality team fixing entity resolution errors has no visibility into whether downstream risk or compliance calculations would have caught the error, and a portfolio-construction agent optimizing for historical Sharpe ratios has no awareness that its backtest data contains look-ahead bias or survivorship bias that will make live performance substantially worse. The gap is structural: financial-services systems are built as sequential pipelines (data → pricing → risk → recommendations → execution) where each stage assumes upstream data and models are correct, yet each stage independently fails for different reasons. 50 patterns Document Processing **AI agents that process documents most often fail not at reading text, but at trusting the extracted text** — bad OCR characters, lost table and column structure, hallucinated field values from vision-language models, and silent accuracy regressions once a pipeline reaches production. Because document-processing agents typically sit upstream of a payment, claims, or contract system, document-processing failures are rarely visible at the point of extraction; a failure surfaces later as a wrong value in a downstream system. 46 patterns Vision and Images **AI agents that see or generate images fail in five distinct ways: they hallucinate content that isn't there, they misjudge spatial relationships like depth, scale, and occlusion, they lose consistency when reasoning across multiple images or video frames, they degrade in quality across iterative image generation, and they break down under adversarial, compressed, or out-of-distribution input.** Unlike document-processing failures — which are largely about misreading known text — vision-and-images failures are about a vision model's confident prior overriding weak or ambiguous visual evidence, whether that model is interpreting a photo, tracking objects across frames, or generating new pixels. 43 patterns Healthcare **Healthcare AI-agent failures cluster around nine clinical domains — diagnosis, treatment, medication safety, documentation, compliance — and within each domain, failures are not hallucinations or knowledge gaps but rather architectural blind spots: checks scoped too narrowly, information dropped at agent handoffs, data treated as ground truth without verification, or a model's learned pattern applied with inappropriate confidence to an individual case.** Across all nine goals, the pattern is the same: an agent can reason correctly within its scoped input, but the scoped input is narrower than the clinical reality it is supposed to represent. 38 patterns Governance **Agents operate without approval gates, audit trails, human accountability, or compliance controls — decisions execute without authorization, actions leave no record, no one owns the outcome if something fails, and compliance requirements are unenforced at the tool level.** Governance failures are unique because they don't require the agent to make a *wrong decision* to constitute a failure — a correct decision with no audit trail, made by no one, is still a governance failure that violates compliance and accountability principles. 33 patterns Support Services **Support-services agents fail across five distinct workflows — ticket routing, sentiment escalation, SLA management, self-service deflection, and issue resolution — and the failure mechanisms span a broader landscape than insurance workflows because support-services systems are more algorithmically diverse. Retrieval-based mismatches recur (embedding-similarity taxonomy matching, deprecated-article retrieval), multi-agent handoff losses recur (prior-attempt loss, VIP-tier loss, SLA-override loss), and stale-parametric-knowledge overrides recur, but support-services also documents distinctly different patterns: measurement gaming (priority inflation), stateless reclassification (mid-conversation ticket reassignment), and silent resolution counting (false deflections). The three mechanisms that dominate insurance workflows still appear here, but they account for only half of support-services patterns; the other half documents failures in measurement-system design, orchestration-layer statefulness, and agent-output transparency.** The distinction between support-services and insurance failure patterns matters because it suggests that support-services agent failures, while more diverse, are also more addressable through non-architectural means (metric redesign, improved visibility) alongside structural fixes. 31 patterns Devops **DevOps agents fail across the full lifecycle — from monitoring and alerting, through incident response, to deployment and recovery — because they optimize local signals without end-to-end validation, treat proxy metrics (API acceptance, orchestrator state, average utilization) as ground truth, or lose critical scope and constraints at handoff boundaries between separately-invoked agents.** Eight goals and 30 patterns are documented here, spanning alert routing, anomaly detection, capacity planning, cost optimization, deployment safety, incident response, monitoring, and rollback safety. These eight goals are not a linear pipeline; they represent parallel failure surfaces that must each be monitored independently, because a system can have perfect monitoring, perfect alerting, and perfect rollback, yet still deploy an unsafe change or route an alert to the wrong team. 30 patterns Legal Contracts **Legal-contracts agents fail when they reason from stale information (outdated amendments, changed regulations), when they substitute similarity matching for jurisdiction-specific or legal-effect matching (wrong template retrieved, wrong jurisdiction's rule applied), when they fail to verify that downstream agents actually received and acted on critical information (exceptions lost between agents, overruled citations cited as good law, negotiated values never reach the final draft), and when they stop short of cross-validating across related clauses and obligations (caps without evaluating carve-outs, presence-checking without scope evaluation, multi-party obligations tracked ambiguously).** Legal-contracts failures are particularly consequential because the output of contract work is the contract document itself, which becomes binding and enforceable. Errors in agent analysis do not surface as obviously as model hallucinations — the contract reads as well-drafted and internally consistent, the risk assessment looks thorough, the compliance determination appears authoritative — until a dispute arises, a counterparty redlines, or a post-closing issue forces a re-read of what the agent missed or misunderstood. 30 patterns Supply Chain **Supply-chain agents systematically fail when operating on stale, cached, or averaged data rather than live signals; when selected analogs or benchmarks are textually similar but structurally mismatched; when conversational or planning-stage decisions are not synchronized with downstream operational agents; and when structural risks (concentration, bullwhip, geopolitical exposure) are invisible to performance-based historical models.** The category spans 25 patterns across 5 goals (Demand Forecasting, Inventory Optimization, Logistics Routing, Supplier Onboarding, Supplier Risk), concentrating in five failure mechanisms: stale and cached data, retrieval-based mismatches, multi-agent coordination loss, structural blindness (concentration, bullwhip, forward-looking risk), and arithmetic/calculation errors. Supply-chain errors propagate through multiple tiers; a 10% demand-forecast error cascades into 30-40% variance at manufacturing, inventory errors compound into carrier over-commitment, and supplier-risk blindness exposes the chain to single-point failures. 25 patterns Agent Interaction **Agent-interaction failures happen when an agent mishandles the fundamental loop of asking, acting, tracking state, and calibrating its outputs to the user's context, producing conversations that feel frustrating, untrusworthy, or repetitive even when individual responses are technically correct.** The failure modes are not primarily about wrong answers or missing capabilities; they are about conversation-level defects in how the agent manages ambiguity, remembers its own context, and matches its tone and detail to the stakes and complexity of what the user asked. 23 patterns Reasoning and Thought **Reasoning-and-thought failures happen because a language model's degradation is almost always soft and statistical rather than a hard error — the same fluent, confident response format covers a model silently exceeding its effective capacity, a router silently sending a request to the wrong model, and a provider silently retraining or swapping the model underneath an agent that never asked for a change.** None of the three failure surfaces below produce an exception the calling code can catch; each requires its own instrumentation, built by the team, to notice that something changed. That shared invisibility — not a shared cause — is what ties model-behavior degradation, routing mismatches, and version drift together as one capability area. 23 patterns Task Planning **AI agents most often fail at task planning not by being unable to plan, but by misreading the goal before planning starts or building a plan that doesn't survive contact with reality** — an ambiguous request answered with the wrong interpretation, a goal that quietly drifts over a long session, a plan built around a hallucinated tool, or a plan kept running after the world it was built for has already changed. Task planning sits upstream of action execution: a flawlessly authorized, correctly-targeted action still produces the wrong outcome if the goal or plan driving it was wrong to begin with. 20 patterns Hr Recruiting **HR and recruiting agents systematically fail at three interdependent stages of the talent lifecycle: screening (demographic bias, skill-assessment conflation, fairness violations), offer generation (compensation-benchmark staleness, precedent mismatches, negotiation-term dropouts), and the ongoing employment cycle (onboarding compliance loss, accommodation loss, retention-prediction hallucination and self-fulfilling loops).** These failures are interconnected: bias upstream in screening propagates into attrition modeling; offer-generation exceptions that are not carried to onboarding create day-one trust violations; retention predictions that become visible to managers alter manager behavior in ways that self-fulfill the prediction. The category spans 19 patterns across 4 goals, concentrating in four failure mechanisms: demographic bias and proxy discrimination, knowledge staleness (training data overriding live tools), multi-agent handoff information loss, and self-fulfilling feedback when predictions become visible to decision-makers. 19 patterns Content Marketing **Content-marketing failures happen at four distinct quality gates — brand consistency, regulatory compliance, factual accuracy, and search-ranking optimization — and each gate has a distinct failure surface that generic quality checks cannot catch.** Brand voice drift requires detecting model-version changes and monitoring consistency metrics; compliance requires cross-referencing claims against substantiation sources and live regulatory guidance; fact-checking requires verifying statistics against traced sources, not just pattern-matching prohibited terms; and SEO requires constraint tracking across long planning sessions and preventing retrieval-based source contamination. A single content piece can pass through all four gates individually — sound on brand, compliant on disclosure, accurate on facts, optimized on keywords — and still contribute to a systematic failure if the four gates are not synchronized. 18 patterns Multi Agent Systems **Multi-agent AI systems most often fail not because any individual agent is weak, but because the coordination layer between agents — authority, handoffs, communication, and consensus — is left implicit and breaks silently under real workloads.** A pipeline can pass every single-agent test and still fail once agents have to hand off state, agree on a conclusion, or recover from one agent's mistake, because those are properties of the system as a whole, not of any one agent in it. 18 patterns Sales Crm **Sales and CRM agents face compound failures across lead scoring, pipeline forecasting, deal management, and quota achievement—each independent in mechanism but tightly coupled in impact, where poor lead scoring cascades into inflated pipeline forecasts, deal-management exceptions are lost at handoff boundaries, and quota calculations apply outdated policies or fabricate missing approval records.** Unlike financial-services failures which have data-quality and regulatory dimensions, sales failures are primarily about information propagation at agent-to-agent handoffs and configuration drift (scoring rules change, discount policies update, territories realign) that agents fail to detect. The core failure is that sales agents operate on workflows with many asynchronous handoffs (SDR → scoring, scoring → forecasting, negotiation → deal-desk, deal-desk → quota), and each handoff has a fixed schema that drops contextual information (budget ceilings, disqualifying signals, territory realignments, exception approvals) that should gate downstream decisions. 16 patterns Customer Service **Customer-service failures happen across three distinct workflows: reactive support handling inbound customer requests (conversation resolution), proactive outreach reaching out to at-risk customers (retention outreach), and specialized financial-risk handling (refund and billing disputes).** The shared underlying failure modes are the same conversation-quality problems documented in general agent-interaction — clarification miscalibration, state tracking, tone — but customer-service adds domain-specific constraints: support agents select canned responses by account state (not just topic), escalate by attempt count (not just confidence), and handle financial claims that carry monetary risk if wrong. A support-specific failure is when the agent's general conversation is fine but the canned response was for the wrong account tier, the escalation threshold was calibrated to bot-solvable requests, or a prior credit was issued but not carried through a handoff. 15 patterns Insurance **Insurance agents fail across five distinct workflows — claims processing, claims reserve modeling, fraud detection, policy management, and underwriting — but the failure mechanisms within these workflows fall into exactly three repeating patterns: a retrieval step that ranks by textual similarity without verifying structural attributes, a multi-agent handoff that narrows the interface too narrowly and loses task-relevant context, and a parametric memory that defeats tool-grounding for actively maintained data.** The three mechanisms (retrieval mismatch, handoff loss, stale-corpus override) repeat consistently because they reflect fundamental structural choices in how agents are built: whether to filter retrieval by structure before similarity ranking, whether handoff schemas carry all task-relevant determinations or only the most common ones, and whether tool calls are mandatory or optional when parametric knowledge exists. The business impact of each mechanism varies by workflow — an embedding-retrieval mismatch costs $15,000 in one claim but underprices an entire policy cohort in another — but the technical root cause and the architectural fix are identical across all five insurance use cases. 13 patterns Learning **Agent learning fails when systems designed to improve behavior through feedback, examples, or self-adaptation instead degrade capability, persist incorrect patterns, or oscillate between contradictory learned behaviors.** An agent ingests feedback that contradicts known facts and ships with inverted behavior, a system learns from three examples in a conversation but forgets the patterns by message ten, and a self-improving agent patches one failure case with a prompt change that silently breaks unrelated behaviors in production. Learning failures are particularly dangerous because they hide inside the feedback and adaptation systems that make agents responsive and adaptive—a well-instrumented learning loop becomes a vector for degradation at scale when validation gates are absent. 12 patterns External Actions **AI agents most often fail at external actions not in deciding what to do, but in the mechanics of doing it safely** — acting without authorization, hitting the wrong target, firing the same action twice, or executing an action with no way to undo it. External-action failures matter more than most because external actions are the point where an agent stops reasoning internally and starts changing the state of a real system — a payment processor, a production deployment, a customer's account — where the consequences of a mistake exist independently of whatever reasoning produced the mistake. 11 patterns Domain Expertise **AI agents most often fail at domain expertise not by lacking facts, but by misapplying domain-specific judgment to facts they already have** — missing an industry rule's exception, misjudging how severe an issue really is, promising a commitment they have no authority to make, or deciding a case that should have escalated to a human expert instead. Because domain-expertise failures are judgment failures rather than knowledge gaps, they concentrate in regulated, rule-heavy domains — finance, healthcare, insurance, legal, and compliance-sensitive support — where a technically defensible decision can still be the wrong one. 10 patterns