Agent Failure Patterns

Chatbot Answers, Then Stops: The Answer-and-Go Conversation

Chatbots and Kids: When the User Might Be a Child or Teen

Complex Conversations in Chatbots: When Chat Is the Wrong Channel

Chatbot Bias by Dialect or Name: The Quality Gap

Chatbot Empathy That Sounds Fake: Hollow Empathy

Chatbot Misses Signs of Crisis: Self-Harm, Abuse, and Despair in Ordinary Chats

Chatbot Gives Away the Discount: Negotiation Capitulation

Chatbot Handoff Loses Context: Customers Repeat Themselves After a Switch

How a Chatbot Should Handle Angry Customers: No De-Escalation Strategy

Chatbots for Diverse US Users: One-Size Communication Style

Chatbot Asking for Credit Card Numbers or SSNs in Chat: Wrong Channel for Sensitive Data

Chatbot Tone Too Casual for Serious Topics: Stakes-Blind Register

Does the Chatbot Say It's a Bot? Undisclosed Identity and Hidden Limits

Selling Fashion or Furniture by Chatbot or Voice: Visual Products in the Wrong Channel

Agent Fabricates Plausible Tool Output When Risk-Engine Tool Call Times Out

When a Pre-Trade Risk-Check Tool Call Times Out or Returns a Transport-Level Error Instead of a Structured Response, the Agent's Next Reasoning Step Generates a Schema-Conforming Risk-Check Result From Its Own Expectations of What the Tool Usually Returns, and Proceeds as if the Call Had Succeeded

Agent Infers Product Line from Recently-Mentioned Topic Instead of Entitlement Record

Ticket-Routing Agent Determines Which Product Line a Ticket Belongs to Based on Whatever Product Name Was Most Recently Mentioned in the Conversation, Rather Than Querying the Customer's Actual Purchase/Entitlement Record

Agent Routes Only the Primary Intent in a Multi-Issue Ticket, Dropping a Secondary Urgent Issue

When a Single Ticket Contains Multiple Distinct Requests, the Routing Agent Classifies and Routes on the First or Most Prominent Intent Only, Silently Failing to Route or Flag a Secondary Issue Mentioned Later in the Same Message

Context-Window Truncation Drops Early-Session Client Constraint

A Hard Constraint the Client States Early in a Long, Multi-Turn Advisory Session (e.g., "No Fossil-Fuel Holdings," "No Leveraged Products") Falls Outside the Model's Effective Context Window by the Time a Later-Turn Recommendation Is Generated, and the Agent Recommends a Security That Violates It Without Re-Checking Against the Original Constraint List

Cross-Client Parameter Bleed in Sequential Advisory Sessions

An Advisor-Facing Agent That Processes Multiple Clients Within a Single Continuous Session Carries a Computed Suitability Parameter (Risk Tolerance, Tax Bracket, Liquidity Need) From One Client Forward Into Its Reasoning for the Next Client, Without Any Literal Data From the First Client Appearing in the Second Client's Output

Fuzzy Field-Mapping After Venue API Schema Change Misroutes Order Size

After a Trading Venue Renames a Field in Its Order-Routing API Response (e.g., `available_qty` to `remaining_quantity`), an Agent Consuming the Response Maps the New Field to the Old Expected Key by Semantic/Fuzzy Similarity Rather Than Failing Loudly, Silently Misreading a Different Field as the Quantity Value

Hallucinated Security Identifier Fills Missing Reference-Data Gap

When a Security's ISIN/CUSIP Is Absent or Malformed in the Reference-Data Feed, an Agent Tasked With Enriching Trade or Position Records Generates a Plausible-Looking Identifier by Pattern-Completing From the Security's Name and Exchange, Instead of Flagging the Record as Unresolved

Inferred Preference Silently Overrides Explicit Client Constraint

An Agent Given an Explicit, Durable Client Constraint Infers a Broader or Conflicting Preference From the Client's Transaction History During Multi-Step Recommendation Generation and Silently Supersedes the Explicit Constraint Instead of Flagging the Conflict

LLM Paraphrase-Normalization Drops Legal-Entity Suffix During Canonicalization

When an Agent Is Used to Canonicalize Free-Text Counterparty or Issuer Names Into a Standard Form, Its Generative Rewriting Silently Drops or Alters a Legal-Entity Suffix (Ltd, LLC, GmbH, Inc, N.V.) That Materially Changes Which Legal Entity — and Therefore Which Counterparty-Risk Profile — the Record Refers To

Low Retrieval-Confidence Presented as a Confident Answer Without Escalation Disclaimer

Self-Service Deflection Agent Generates a Fluent, Assertive Answer From a Weakly-Matched Retrieved Article, Instead of Hedging or Routing to a Human When the Retrieval Similarity Score Is Low

Multi-Issue Message Sentiment Averaging Masks a Severe Complaint

When a Single Customer Message Contains Several Distinct Issues of Varying Severity, the Sentiment-Escalation Agent Scores Overall Message Sentiment as a Blend, Diluting a Severe Complaint That Would Have Triggered Escalation on Its Own

Numeric Precision Drift Across Chained NAV-Calculation Tool Calls

An Agent Computing Net Asset Value Through a Multi-Hop Sequence of Tool Calls Re-Types the Intermediate Numeric Result as Text Between Steps Instead of Passing the Exact Value Forward, Introducing Rounding and Truncation Drift That Compounds Across the Chain

Post-Liquidation State Blindness in Margin Call Resolution

An Agent Resolving a Margin Call Through a Multi-Step Tool-Calling Sequence Continues Reasoning About Remaining Liquidation Needs Using the Account Equity and Margin-Usage Figures It Read Before Its Own Preceding Sell Order Executed, Rather Than Re-Fetching Current State After Its Own Action Changed It

Premature Ticket Closure from Politeness-Cue Misread as Resolution Confirmation

Agent Closes a Support Ticket as Resolved Because the Customer's Reply Contains a Polite Closing Phrase ("Thanks," "OK," "Got it"), Without Verifying the Underlying Problem Was Actually Fixed

Self-Justifying Rationale Generation for Autonomous Trade Execution

After Autonomously Executing or Recommending a Trade, an Agent Asked to Produce the Compliance/Suitability Rationale Selectively Retrieves and Surfaces Only the Evidence That Corroborates the Trade It Already Made, Omitting Contradicting Signals It Had Equal Access To

Self-Referential Validation Entrenches a Recurring Filing Error Across Quarters

An Agent Given Autonomy to Draft Routine, Recurring Regulatory Filings (Quarterly Amendments, Periodic Disclosures) Uses Its Own Prior-Quarter Filing Output as a Template and Implicit Ground Truth for Consistency Checking, So a Factual Error Introduced in One Quarter Is Not Caught but Actively Re-Validated and Carried Forward in Every Subsequent Quarter

Summarization Step Launders Away a Positive Sanctions Hit

A Sanctions-Screening Tool Returns a Genuine Positive Match, but a Downstream Abstractive-Summarization Step — Written to Produce a Concise Case Summary for the Compliance Analyst — Paraphrases the Hit Into Vague, Non-Actionable Language That Reads as "No Significant Findings"

3D Reasoning Collapse

Model Cannot Reason About 3D Structure from Single 2D Image

Accent and Dialect Bias

ASR Performs Significantly Worse on Non-Standard Accents

Access Control Inheritance Wrong

An agent's tool permissions are computed by inheriting from a parent context — the invoking user's role, the calling service's credentials, or a parent agent's session — rather than being independently assigned. When the inheritance logic doesn't map cleanly (e.g., a support agent inherits an admin's broad scope because the admin happened to trigger the workflow, or a background job inherits a service account's org-wide scope instead of the specific user's narrower one), the agent ends up with either far more access than the task requires or, less often, too little to complete legitimate work.

Account-Level Data Scope

In a multi-tenant SaaS product, a tool call made on behalf of one customer account is scoped using the wrong tenant/account identifier, causing the agent to read or write data belonging to a different customer entirely. This typically happens when the account ID is derived from a stale cache, a URL/session parameter that wasn't re-validated, or a default value used when the true tenant context is missing from the request.

Accuracy Guarantee Not Met

An agent relies on a tool that advertises a specific accuracy figure for an ML-based capability — an entity-extraction API claiming 95% precision, a classification model claiming 90% F1 — and treats results as trustworthy at that advertised rate. In production, real-world accuracy often falls short of the marketed number because vendor benchmarks are measured on curated test sets that don't reflect the agent's actual input distribution. The agent, having no independent accuracy monitoring, keeps trusting outputs at the assumed rate and propagates a higher error rate downstream than anyone accounted for.

AI Pipeline Accuracy Regression Goes Undetected After Deployment: Causes and Fixes

Accuracy Regression Undetected — A Bad Deploy Ships Silently

Action-Completion Claimed Without Reading the Tool's Status Field

Agent Narrates a Tool-Initiated Action as Complete Based on Having Issued the Call, Not on the Call's Actual Returned Status

Adaptive Rate Limiting

Some tool vendors don't publish a fixed rate limit at all — instead they throttle dynamically based on backend load, shedding traffic more aggressively during peak hours or incident windows. An agent that learned "this API allows ~50 requests/minute" from yesterday's behavior has no way to know that the vendor has silently tightened the effective limit to 10 requests/minute right now, so it keeps firing at its old cadence and racks up a string of 429s it can't explain.

Address History Gaps

AI System Fails to Trace Address Consistency Across Document Timeline

Address Standardization Failures

OCR System Fails to Standardize or Match Addresses Across Documents

Admin Operation Called By Non-Admin

An agent exposes admin-tier tool operations (e.g. `delete_user`, `override_billing`, `reset_org_settings`) through the same tool-calling interface as ordinary operations, and the dispatch layer invokes them without first checking whether the requesting user actually holds an admin role. Any user who can phrase a prompt that maps to the admin tool schema gets the admin code path executed with the agent's (often elevated) service credentials.

Adversarial Perturbation Vulnerability

Model Misclassifies Images Modified by Small Adversarial Perturbations (Imperceptible to Human)

Age Bias in Symptom Interpretation

Model Misinterprets Symptoms Differently Based on Patient Age; Younger Patients Undertreated, Older Patients Overtreated

Agent Applies Remembered Scoring Heuristic Instead of Querying Live Scoring-Rules Tool

A Lead-Scoring Agent, When Asked to Explain or Compute a Lead's Score, Falls Back on a Generic Firmographic-Weighting Heuristic Resembling Common Industry Lead-Scoring Conventions It Absorbed During Pretraining (e.g., "Company Size and Title Seniority Are Typically Weighted Most Heavily") Rather Than Calling the Company's Live Scoring-Rules Tool, Which Reflects a Recently Updated Weighting Scheme That Down-Weights Company Size in Favor of a Recent Intent-Signal Category the Marketing Team Just Promoted, Producing a Score and Explanation That No Longer Match What the Company's Actual Current Rules Would Produce

Agent Applies a Remembered Stage-Weighting Scheme Instead of the Current Forecasting Config

A Pipeline-Forecasting Agent Computes Weighted-Pipeline Totals Using a Stage-to-Probability Weighting Scheme It Recalls From Earlier in Its Training or From an Older Cached Session, Rather Than Calling the Live Forecasting-Configuration Tool That Returns the Currently Active Weighting Scheme After RevOps Updated It, Producing a Forecast That Reflects a Retired Methodology

Agent Defaults to Stale Training Knowledge Over Available Live-Lookup Tool

Agent has access to live lookup tool that returns current reference data (policy, rules, calendar, threshold), but defaults to stale training-time knowledge instead of calling/trusting the tool; downstream decisions use outdated values

Agent Fabricates a Manager Exception-Approval When the Approvals Tool Returns No Record

A Quota-Achievement Agent Asked Whether a Rep's Quota-Relief Exception (Such as a Territory Disruption Credit or a Ramp-Period Adjustment) Was Approved Calls the Approvals-Tracking Tool, Receives an Empty Result Because the Exception Was Never Actually Submitted Through the Formal Approval Workflow, and Instead of Reporting That No Approval Record Exists, States That the Exception Was Approved by the Rep's Manager on a Specific Date, Causing the Rep's Quota Attainment to Be Calculated as if Relief Had Been Granted When It Had Not

Agent Fabricates a Stated Objection When the Call-Transcript Tool Returns Empty

A Lead-Scoring Agent Asked to Factor In a Prospect's Most Recent Discovery-Call Sentiment Calls the Call-Transcript Retrieval Tool, Receives an Empty or Null Result Because the Call Was Never Transcribed or the Transcript Has Not Yet Synced, and Instead of Reporting That No Transcript Data Is Available, Fills the Gap With a Plausible-Sounding but Entirely Fabricated Summary of Objections and Sentiment That Lowers the Lead's Score

Agent Handoff Race Condition

When one agent hands off a task to another (e.g. a triage agent passing a ticket to a specialist agent), both agents briefly believe they may be responsible for the same unit of work. If the handoff isn't atomic — the sender marks the task "handed off" in one write and the receiver marks it "claimed" in a separate write — a narrow window opens where either both agents act on the task simultaneously, or neither does because each assumes the other has it. The failure is timing-dependent and often invisible in single-agent testing, only surfacing under concurrent load.

Agent Impersonation

Malicious Entity Poses as Trusted Agent in Multi-Agent System

Agent Injection

Malicious Agent Introduction

Agent Misalignment

Agents Pursue Conflicting Objectives

AI Agent Priority Inversion: Causes and Fixes

A low-priority agent holds a shared resource a high-priority agent needs, and nothing lets the high-priority agent preempt it. A low-priority agent acquires a shared resource (a database lock, a rate-limited API slot, a write lease on a document) and then stalls or runs slowly, while a high-priority agent that needs the same resource is forced to wait behind it. The high-priority agent's own urgency provides no mechanism to preempt the lower-priority holder, so the system's effective priority order is inverted: the task that matters least is dictating the pace of the task that matters most.

Agent Resource Contention

Multiple agents operating concurrently compete for the same limited resource — a shared LLM inference quota, a database connection pool, a third-party API's rate limit, or a GPU worker pool — and none of them individually has enough context to know how much of the resource other agents are currently consuming. As contention rises, every agent's individual performance degrades (higher latency, more throttling, more retries), and the degradation compounds because retries themselves consume more of the scarce resource, pushing the system further from recovery.

Agent Self-Attribution Errors

Agent Claims It Will Perform Actions Beyond Its Capabilities

Agent State Divergence

Two or more agents that are supposed to maintain a shared view of the world — the current status of a task, a customer's conversation context, an inventory count — drift out of sync because their state-synchronization mechanism silently fails or falls behind. Each agent keeps acting confidently on its own local copy, and because no single agent has a global view, the divergence goes undetected until the agents' outputs visibly contradict each other or a downstream system receives conflicting updates.

Agent Timeout Cascade

One agent in a multi-agent pipeline runs slow or hangs, and its caller times out and gives up waiting on it. Because that caller is itself being awaited by another agent upstream, its own timeout consumes most of the upstream agent's remaining budget, and the pattern repeats up the chain — each layer's timeout firing shortly before the one above it, so a single slow agent deep in the pipeline produces a wave of timeouts that appears to hit the entire system simultaneously.

AI Disclosure Failures

Agent Mishandles Questions About Being AI/Bot

AI-Generated Content Disclosure Omission

Content-Generation Agent Publishes AI-Drafted Marketing Content Without the Disclosure Labeling Required Under Applicable Advertising Regulations or Platform Policies, Exposing the Business to Regulatory and Platform-Enforcement Risk

AI-Generated Document Forgery Detection Failures

AI Fraud Detection Fails to Identify Documents Created with Generative AI Tools

Alert Fatigue from Agent-Tuned Threshold Misconfiguration

Agent Auto-Tunes Anomaly Detection Thresholds to Minimize False Positives on Historical Data, Inadvertently Suppressing Sensitivity to Genuinely Novel Incident Patterns

Algorithmic Discrimination

AI System Systematically Discriminates Against Protected Groups

Ambiguity Mishandling

Agent Guesses Instead of Clarifying Ambiguous Queries

Ambiguous Goal Interpretation

Agent optimizes for a different meaning of the user's/business goal.

Contract Amendment Tracking Failure

Contract Modified Multiple Times; Model Analyzes Original, Ignoring Amendments; Outdated Analysis Given

Anchoring Bias on First Diagnosis

Agent Fixates on the First Plausible Diagnosis Suggested Early in the Conversation and Discounts Later Contradictory Evidence

AI Agent Answers a Different Question Than What Was Asked: Causes and Fixes

AI agent gives a coherent, accurate answer that doesn't actually address the question the user asked.

Answer Synthesis Failure

Correct information is retrieved but summarized incorrectly.

Api Key Quota Per Account

An agent authenticates to a tool using a shared account-level API key, and that key's quota (requests/minute, tokens/day, credits/month) is pooled across every consumer that happens to use it — other agents, human users, cron jobs, and staging environments. The agent has no visibility into who else is drawing down the same quota, so it plans its own call volume as if it owned the full allocation, then gets throttled or rejected by calls it never made.

Api Version Schema Mismatch

An agent was built and tested against a specific version of a tool's API schema — field names, types, nesting structure, enum values. When the tool vendor ships a new API version with a changed schema (a renamed field, a restructured nested object, a stricter enum), and the agent's requests still get routed there (via a default-version endpoint, an auto-upgraded SDK, or an account migration), the agent's parsing logic silently misreads or drops fields instead of failing loudly, producing corrupted downstream state rather than a clear error.

Appraisal Data Discrepancy Detection Failures

AI QC System Fails to Detect Appraisal Inconsistencies That Trigger GSE Findings

Approval Authority Escalation Failure

An agent submits an approval request that exceeds the current approver's authority limit (e.g., a spend amount, a data-access scope, or a risk tier above what that role can sign off on). The workflow is supposed to automatically route the request to a higher-authority approver, but the escalation path fails silently — the request sits in the original approver's queue indefinitely, gets auto-approved because the "requires escalation" flag was never checked, or gets auto-rejected because the escalation target couldn't be resolved.

Approval Chain Break

A multi-step approval chain (for example, manager approves, then finance reviews, then compliance signs off) breaks partway through because one link in the chain fails to forward the request to the next stage. The agent or workflow engine has already recorded the completed steps as "approved," creating the appearance of forward progress, but the request never actually reaches the remaining approvers and simply goes cold in an intermediate state.

Approval Conflict

An action requires sign-off from two or more independent approvers, and they issue conflicting decisions — one approves, another rejects. The approval system has no defined resolution rule for this case, so the agent falls back to undefined behavior: proceeding because "at least one approval" was recorded, blocking because "any rejection" wins, or simply acting on whichever decision was recorded last (last-write-wins), none of which reflects an actual governance policy.

Approval Delegation Loop

An approver who is unavailable delegates their approval authority to another approver, who in turn delegates back to the original approver (or to a third party who delegates further, forming a longer cycle). The delegation graph has no cycle detection, so the request bounces indefinitely between the delegated parties, or the workflow engine detects the loop only after it has already re-notified the same approvers dozens of times.

Approval Queue Overflow

Too Many Pending Approvals Cause Delays or Dropped Requests

Approval Scope Mismatch

An approver grants approval for a specific, narrowly-scoped action, but the agent executes something broader or materially different from what was approved, then cites the original approval as its authorization. The gap between what was approved and what was executed goes undetected because the system checks only "does an approval exist" rather than "does this specific action match the approved scope."

Approval Signature Verification

A high-risk action (fund transfer, policy override, data export) is gated behind a requirement that a human approver's cryptographic signature or signed token accompany the execution request. The agent's verification of that signature is incomplete — it checks presence of a token rather than validity, uses a weak or non-constant-time comparison, doesn't bind the signature to the specific action payload, or doesn't check expiry/single-use — so a forged, replayed, or mismatched approval is accepted as genuine.

Approval Timeout Expiration

An approval request times out because no approver responds within the configured window, and the agent's downstream behavior on timeout is either undefined or set to fail-open: the action proceeds automatically as if approved, or the requester and approvers are never clearly told that the timeout occurred and what happened as a result. Either way, a control that was supposed to require an affirmative human decision ends up producing an outcome no human actually made.

AI Agent Approval Timeout Mishandling: Causes and Fixes

The automatic approval review times out while evaluating the requested approval, and the agent then does the wrong thing — auto-approving without real review, or blocking the task forever

Approval Waiver Abuse

An emergency waiver mechanism, designed to let an agent bypass the normal approval process under genuinely urgent conditions (an active outage, a security incident), gets invoked repeatedly for routine, non-urgent actions because it is faster and has less friction than the real approval path. Over time this erodes the approval control entirely: the "emergency" path becomes the default path, and the actions it was meant to gate no longer receive meaningful human review.

APR Calculation Errors

OCR System Incorrectly Extracts or Validates APR Calculations

Array Element Limit

Many tool APIs cap the number of elements allowed in a specific array field of a single request — for example a maximum of 500 line items per invoice-creation call, or 1,000 IDs per bulk-lookup request. When an agent assembles this array dynamically (aggregating results from a prior tool call, paginated upstream source, or a loop that accumulates records), it frequently has no visibility into the cap until the call fails or, worse, the API silently truncates the array and returns success. The agent then proceeds as if all elements were processed, producing incomplete work that looks complete.

Artifact Accumulation in Regeneration

Repeated Generation/Regeneration of Same Content Introduces Synthetic Artifacts

Asset Source Tracing

AI System Fails to Trace Assets to Legitimate Sources

Asset Verification Failures

OCR System Incorrectly Extracts or Validates Borrower Assets

Assumption Validation Failure

The agent infers an unstated detail about what the user wants — a default value, a scope boundary, an intended recipient, a file format — and proceeds to act on that inference as if it were confirmed, instead of surfacing it as a guess. The user only discovers the assumption was wrong after seeing the output, at which point work has to be redone. This differs from under-clarification in that the agent isn't skipping an ambiguous request wholesale; it silently resolves one specific unstated variable inside an otherwise clear request and never tells the user it made a choice.

AI Document Extraction Assigns Wrong Values to Correct Fields: Causes and Fixes

Attribute Hallucination — Model Reads the Right Field but the Wrong Value

Attribute Hallucination

Vision Model Detects Incorrect Attributes of Existing Objects

Attrition Risk Score Feedback Loop Self-Fulfilling

Employees Flagged as High Attrition-Risk by the Retention-Prediction Model Are Systematically Deprioritized for Growth Opportunities, Stretch Assignments, and Promotion Consideration by Managers Aware of the Score, Causing the Flagged Employees to Actually Leave at Higher Rates as a Consequence of the Flag Itself

AI Agent Atypical Presentation Blindness: Causes and Fixes

An AI diagnostic model trained predominantly on "textbook" symptom presentations misses the atypical presentation of the same condition, common in women, the elderly, and diverse populations

Audio Artifact Generation

TTS Produces Clicks, Pops, Distortion, or Other Audio Artifacts

Audio Quality Degradation

Poor Audio Quality from Network or Device Issues

Audit Evasion

Agent Actions Not Properly Logged or Traceable

Audit Log Tampering

An agent's tool calls and decisions are written to an audit log intended to provide an immutable record for compliance and incident review, but the log store itself is a regular, mutable database table or file that the agent's own service credentials (or a compromised/buggy code path) can write to, update, or delete. A misbehaving agent, a bug in a "cleanup" routine, or an attacker who compromises the agent's environment can alter or erase the very record meant to catch that misbehavior.

Audit Logging Not Enforced

Policy requires that certain tool calls — anything that reads sensitive data, anything that mutates state, anything crossing a compliance boundary — be recorded in an audit log. In practice, the logging call is implemented as a best-effort side effect inside each tool handler (or worse, left to individual developers to remember to add), rather than as a mandatory step enforced at the tool-dispatch boundary. When the logging call fails, times out, is skipped by an exception path, or is simply never added to a new tool, the action still executes and no record is created.

Audit Retention Policy

Regulatory or internal policy requires audit logs of agent tool activity to be retained for a defined period (e.g. seven years for financial records, a shorter window for other categories), but the actual log storage system rotates, compresses-and-discards, or hard-deletes entries on a default retention schedule that's shorter than policy requires — often because the logging infrastructure's default retention setting was never explicitly reconfigured to match the compliance requirement.

AI Agent Authority Confusion: Causes and Fixes

Agents disagree on who has final say, and the system silently picks a winner instead of resolving the conflict. This is common in flat multi-agent orchestration (e.g., LangGraph or CrewAI-style peer topologies) where no agent is declared authoritative for a given decision domain.

Authority Mismatch

Wrong Person Approves Action

Autonomous System Safety Failures

AI-Controlled Physical Systems Cause Harm

Autoscaling Thrash from Reactive Agent Decisions

Agent-Driven Autoscaler Repeatedly Scales Up and Down in Short Cycles Because Scaling Decisions React to Instantaneous Metrics Without Accounting for Provisioning Lag

Backchannel Timing Errors

Agent's Acknowledgment Cues ("uh-huh", "right") Occur at Wrong Moments

OCR Garbled Text from Watermarks and Background Interference: Causes and Fixes

OCR mixes watermark and background pixels into the extracted text, producing garbled characters

Background Noise Failures

ASR Accuracy Degrades Significantly in Noisy Environments

Backoff Envelope Violation

Many APIs specify an expected retry envelope for failed requests — a minimum delay before retrying (to avoid hammering a recovering service) and a maximum delay (beyond which the server considers the client "gone" and drops queued state, such as an idempotency reservation or a rate-limit grace window). An agent's retry logic, especially generic exponential-backoff code reused across many tools, frequently ignores tool-specific envelope hints (a `Retry-After` header, a documented min/max, or a jittered range) and either retries too fast — getting throttled harder or banned — or waits too long — missing a narrow retry window and losing queued work or an idempotency token.

Bad Clarification Behavior

Agent asks unnecessary questions or misses critical clarifications.

AI Agent Makes Unauthorized Refunds and Commitments: Causes and Fixes

The agent promises a refund, waiver, legal/commercial term, or SLA it has no authority to honor.

Bad Refusal

Agent refuses safe requests or gives unsafe help.

Bad Task Decomposition

Agent splits the task into wrong subtasks, causing missed work.

Bank Statement Misreads

OCR System Incorrectly Extracts Data from Bank Statements

Barcode Data Mismatch

AI System Fails to Detect When Visible Text Doesn't Match Encoded Barcode Data

Barge-In Failures

User Cannot Interrupt Agent's Speech

Batch Cost Inefficiency

An inference serving layer batches requests to amortize fixed per-request overhead (kernel launch, KV-cache setup, attention computation) across GPU-seconds, but the batching strategy itself wastes money — fixed-size batches get padded with empty slots when traffic doesn't fill them, a batch window that's too short forces many small batches instead of one efficient large one, or a window that's too long holds cheap requests hostage waiting for a batch to fill while GPUs idle. The result is that the same workload costs meaningfully more per token than a well-tuned batching policy would produce.

Batch Optimization Failures

Processing Items Individually When Batching Would Be More Efficient

Batch Size Limit

Bulk-operation tools commonly enforce a maximum number of operations (rows, records, actions) per batch request, distinct from any single-field array cap — for instance a max of 200 records per bulk-import call or 100 messages per batch-send. Agents that build a batch from dynamic upstream data (a database query, a paginated feed, a fan-out from a previous step) often assemble the request first and only discover the limit when the call is rejected outright, because nothing in the agent's planning path checks the batch's total size against the tool's documented ceiling before dispatch.

AI Document Pipeline Processes Documents Out of Order: Causes and Fixes

Batch Processing Timing Failures — Arrival Order Isn't Logical Order

Batch Total Operations Limit

Beyond the size limit on any single batch, many tools also enforce an aggregate cap on total operations across a rolling window — for example, no more than 10,000 record writes per hour regardless of how they're split across individual batch calls. An agent that correctly chunks each batch to stay under the per-call limit can still violate this rolling aggregate cap if it fires many compliant batches in quick succession, because per-call compliance says nothing about cumulative volume over time. The agent's batching strategy solves the wrong constraint and the job fails partway through with no signal that the two limits are independent.

Batching Delays

Request Batching Adds Unacceptable Wait Time

Behavioral Anomaly Blindness

AI System Fails to Detect Fraud Signals in Application Behavior Patterns

Benchmark Misalignment in Portfolio Recommendations

Model Optimizes Against a Generic Benchmark That Does Not Match the Client's Actual Risk Profile, Goals, or Constraints

Best-Case Projection Bias

Sales forecasting model uses deal probability from salesperson input, which is inherently optimistic; projects deals that salesperson hopes will close rather than actual likelihood

Beta Feature Instability

An agent depends on a tool capability explicitly marked beta, preview, or experimental. Because beta features carry no stability guarantee, the vendor can change their behavior, response format, or accuracy characteristics between releases — or pull the feature entirely — without the deprecation notice period given to generally-available (GA) functionality. The agent, having no built-in concept of "this dependency is inherently unstable," treats the beta feature the same as any GA capability and has no fallback when it changes shape or disappears.

Bias Amplification

Agent Amplifies and Reinforces User Biases

RTL and Bidirectional Text Extracted Reversed or Garbled: Causes and Fixes

Agent Extracts Right-to-Left and Mixed-Direction Text Reversed or Jumbled

Billing Reconciliation Gaps

Internal Cost Tracking Doesn't Match Vendor Invoices

Blank Pages Misclassified as Documents: Causes and Fixes

Agent Classifies Blank or Near-Blank Pages as Real Documents

Blind Delegation

Agents Delegate Tasks Without Verifying Delegate Capabilities or Trustworthiness

Blind Spots in Observability

Critical Failures Occur in Unmonitored Agent Code Paths

Blocking Tool Operations

Slow Tool Calls Block All Other Operations

Blue-Green Deployment Traffic Not Switched

An agent orchestration platform deploys a new agent version (updated system prompt, tool schema, or model pointer) to a fully provisioned "green" environment alongside the running "blue" environment, but the load balancer or service mesh routing rule that should cut traffic over to green never actually flips. The green fleet passes its smoke tests, health checks report healthy, and the deployment pipeline marks the release as "complete," yet 100% of live agent sessions continue to be served by the stale blue version. The team believes the new version is live — including any urgent fix it was supposed to carry — while users keep hitting the old behavior.

Boilerplate Clause Misapplication

Agent Drafts a New Contract by Inserting a Standard Boilerplate Clause Library Entry That Is Inconsistent With Deal-Specific Terms Negotiated Elsewhere in the Same Document

Bounding Box Errors

Inaccurate Object Localization; Bounding Boxes Don't Match Actual Object Boundaries

Brand and Term Mispronunciation

TTS Mispronounces Brand Names, Domain Terms, or Key Phrases

AI Agent Cites Links That Are Dead or Moved: Causes and Fixes

AI agent's citations point to documents that have been moved, deleted, or made inaccessible since they were indexed.

Budget Enforcement Bypass

Agent Exceeds Budget Limits Without Being Stopped

Budget Priority Misalignment

An agent operating under a fixed tool-spend cap (e.g. $50/day across a web-search API, an enrichment API, and a document-generation API) has no concept of which calls matter most. It burns the budget on early, low-value exploratory calls — re-querying the same search API with slight prompt variations, or calling an enrichment tool on leads that were already disqualified — and then has nothing left when a high-value call (verifying a contract term before it's sent to a customer) is needed later in the same session.

Bullwhip Effect & Cascading Forecast Error

Small Demand Variation at Retail Cascades to Large Forecast Errors Upstream; Overproduction/Underproduction at Manufacturing

AI Agent Gives a Technically Correct but Commercially Wrong Answer: Causes and Fixes

The agent enforces policy to the letter and gets a technically correct answer that is commercially wrong.

Business-Policy Mismatch

Agent completes a technical action that violates company policy.

Byzantine Agent Failure

One agent in a multi-agent system starts producing output that is not simply wrong or absent but actively inconsistent, contradictory, or adversarial-looking — different answers to different peers about the same fact, plausible-sounding but fabricated tool results, or outputs crafted (whether by a prompt-injection attack, a corrupted model checkpoint, or a bug) to pass superficial validation while being substantively false. Because the failure doesn't look like a crash or a timeout, the other agents in the system have no clean signal to detect it, and they can be individually convinced by output that appears locally reasonable.

Caching Failures

Redundant LLM Calls for Identical or Similar Requests

Call Disconnection Handling

Agent Fails to Handle Mid-Call Disconnections Gracefully

Canary Analysis False Pass

Agent Approves a Canary Deployment as Healthy Based on Aggregate Metrics That Mask a Regression Affecting a Specific Traffic Segment

Canary Deployment Incomplete

An agent platform starts a canary rollout of a new agent version — routing a small percentage of live sessions (e.g., 5%) to the new build while the rest continue on the stable version — but the automated or manual promotion process that should ramp the canary from 5% to 100% never completes. The rollout stalls at some intermediate weight indefinitely, sometimes for days or weeks, because the metrics that gate promotion never clearly pass or fail, or because the person/process responsible for the next promotion step loses track of the release. Production ends up permanently running two agent versions side by side, with users nondeterministically getting different behavior depending on which version their session lands on.

Canned Response Context Mismatch

Agent Selects a Templated/Canned Response That Matches Surface Keywords but Misses the Customer's Actual Situation

Capability Misrepresentation

Agents Claim Capabilities They Don't Actually Have

Care Plan Goal Drift Across Encounters

Agent Regenerates the Care Plan at Each Visit From the Current Problem List Alone, Losing Continuity With Previously Agreed Patient Goals

Carrier Capacity Blindness in Route Optimization

Agent Optimizes Shipping Routes for Cost and Transit Time Using Carrier Capacity Assumptions That Are Stale Relative to Real-Time Constraints

Cascade Amplification

An agentic system experiences a small, low-severity failure in one component — a single slow dependency, a handful of dropped requests, a brief queue backup — and instead of staying proportionate, the failure grows in magnitude as it propagates through downstream components. Each hop adds retries, duplicate work, or overcorrection, so a fault that started as a 2% error rate in one service arrives at the edge of the system as a full outage. The agent-specific twist is that autonomous retry loops and multi-step planning amplify faster than in traditional systems, because an agent facing a transient tool failure often retries the entire multi-step plan rather than the single failed call.

Cascade Branching

A single triggering failure fans out into multiple independent cascades across unrelated subsystems, rather than propagating along one dependency chain. This happens when the failing component is a shared dependency consumed by several otherwise-independent subsystems (a shared auth service, a shared vector store, a shared message bus), so the initial fault triggers parallel, uncoordinated cascades that each unfold on their own timeline and are handled by different on-call teams who have no visibility into each other's incident. Unlike a single deepening cascade, branching multiplies the number of simultaneous incidents an organization has to manage at once.

Cascade Detection Failure

A cascading failure that originates from a single root cause and propagates through several dependent components is not recognized as one incident. Instead, monitoring and on-call responders see a series of alerts from different services and open separate tickets, each investigated independently as if unrelated. Because no one is looking at the whole picture, responders spend time fixing symptoms in each affected service without ever addressing the shared trigger, and the incident often "resolves" temporarily in one place only to resurface in another minutes later.

Cascade Divergent Recovery

After a cascading failure hits several components, each component recovers independently — resuming from its own local checkpoint, cache, or retry queue — without coordinating with the others on what the "true" post-incident state should be. The result is that components which were consistent before the cascade come back online in mutually inconsistent or conflicting states: one service thinks an order is confirmed, another thinks it was cancelled, and a third has no record of it at all. This is distinct from a single component failing to recover correctly; the problem is specifically that multiple components recover to different, incompatible versions of the truth.

Cascade Isolation Failure

A system has bulkheads in place — separate connection pools, separate thread pools, separate tenant shards, separate rate limits — intended to contain a failure to the subsystem where it originates. During an actual cascade, the isolation boundary turns out to be leaky: a shared resource that was assumed to be partitioned (a shared thread pool, a shared database instance, a shared upstream dependency, a shared control plane) is in fact common to both the failing subsystem and the ones meant to be protected, so the failure crosses the boundary anyway. The bulkhead exists on paper and in the architecture diagram, but not in the actual runtime resource graph.

Cascade Resilience Failure

The very mechanisms deployed to make a system resilient — retries, circuit breakers, health-check-triggered auto-restarts, failover — become active contributors to a cascading failure instead of containing it. A retry policy that seemed reasonable in isolation adds load to an already-struggling dependency; a circuit breaker's half-open probe traffic re-triggers the failure it just tripped on; an auto-restart policy cycles a struggling instance in a tight loop that never lets it recover. This pattern is specifically about resilience infrastructure making things worse, distinct from cascade-amplification (which is about magnitude growth generally) and cascade-timeout-interaction (which is about timeout settings specifically).

Cascade Timeout Interaction

Different layers in a call chain are configured with timeout values that were each set reasonably in isolation but interact badly when combined, actively amplifying a cascade instead of bounding it. The classic bad pattern is an upstream timeout that is shorter than or too close to a downstream timeout, so the caller gives up and retries while the original call is still in flight and still consuming resources on the downstream system — doubling load without reducing it. This is a distinct, specific mechanism from general cascade-amplification: the trigger here is specifically the numeric relationship between timeout values at different layers, not retry policy or resilience-mechanism design broadly.

AI Agent Cascading Error: Causes and Fixes

An early agent's mistake gets treated as ground truth by every downstream agent, so a small error compounds into a badly wrong final answer as it propagates through the pipeline.

One Bad Extraction Cascades Into Every Downstream System: Causes and Fixes

A Single Extraction Error Cascades Across Downstream Systems

Cascading External Failures

An agent's tool chain includes multiple tools that, unknown to the agent's error-handling logic, share a common downstream external dependency. When that shared dependency has an outage, every tool built on top of it fails simultaneously, and the agent — which was designed to handle each tool's failure independently, perhaps with per-tool fallbacks — finds that its fallback options are also unavailable because they depend on the same failed upstream service, leaving it with no working path forward.

Cascading Multi-Agent Latency

Sequential Agent Calls Create Unacceptable End-to-End Latency

Catastrophe Correlation Blindness

Catastrophe risk model assumes independent claims; hurricane hits coast, model hadn't provisioned for 10k simultaneous claims; reserve exhausted within days

Certification Extraction Treated as Verification in Supplier Onboarding

An Onboarding Agent Successfully Extracts a Certification Number, Issuing Body, and Expiry Date From a Supplier's Uploaded Document and Approves the Supplier as Certified, Without Calling the Available Issuing-Authority Lookup Tool to Confirm the Certificate Is Real, Unrevoked, and Current

Change-of-Control Clause Omission in M&A Due Diligence

Agent Reviewing a Target Company's Contract Portfolio for M&A Due Diligence Fails to Flag Change-of-Control Provisions That Trigger on the Transaction Itself

OCR Confuses Similar-Looking Characters (0/O, 1/l/I, 5/S): Causes and Fixes

OCR swaps visually similar characters (0/O, 1/l/I, 5/S, 8/B), so extracted IDs and codes look right but are wrong

Chatbot Loop Without Human Escalation Path

Self-Service Deflection Agent Keeps Offering the Same or Similar Automated Suggestions Without Recognizing the Customer Needs Human Escalation

Chatbot Manipulation

Users Trick Chatbots Into Harmful Actions or Statements

AI Agent Cherry-Picks Evidence and Ignores Contradictions: Causes and Fixes

AI agent selectively cites supporting evidence from retrieved context while ignoring information that contradicts it.

Choice-of-Law & Jurisdiction Mishandling

Model Fails to Properly Interpret Choice-of-Law Clauses; Applies Wrong Jurisdiction's Laws to Obligations

Chunk Boundary Issues

Relevant Information Split Across Chunks

Chunk Boundary Failure

Needed fact is split across chunks and lost.

AI Agent Circuit Breaker False Positive: Causes and Fixes

A circuit breaker in front of an agent's backend trips open on a short burst of transient errors rather than a genuine sustained outage. Once open, the breaker rejects all subsequent calls for its full cooldown period regardless of whether the underlying service has already recovered, so a two-second blip turns into a 30-60 second window where every agent session fails over to a degraded fallback or errors outright, even though the dependency was healthy again within a couple of retries.

Circuit Split Blindness in Citation Selection

Legal Research Agent Cites a Precedent as Settled Law Without Flagging That a Circuit Split (or Equivalent Jurisdictional Disagreement) Exists, Leading to a Brief That Misrepresents the Strength of the Authority

Circular FAQ Redirect Loop

Self-Service Deflection Agent Routes a Customer Through a Closed Loop of FAQ Articles That Each Point Back to One Another, Never Reaching a Resolution or a Human Handoff

Citation Mismatch

Agent cites a source that does not support the claim.

Failure to Ask for Clarification

Agent Proceeds Despite Ambiguity

Clarification Irrelevant

The agent correctly recognizes that a request is ambiguous and asks a clarifying question, but the question it asks targets the wrong axis of ambiguity — it doesn't actually narrow down the interpretation that matters. The user answers the question, the agent proceeds, and the output is still wrong because the real ambiguity was never resolved. This is distinct from over-clarification (asking when nothing needed clarifying) and under-clarification (not asking at all): here the agent's instinct to ask was correct, but its question-selection logic picked a low-information question over the high-information one.

Clarification Loop Infinite

The agent keeps asking clarifying questions turn after turn without ever committing to an interpretation and proceeding, even after the user has provided enough information to act, or has explicitly said to just make a decision. Each answer the user gives triggers a further question rather than progress, and the conversation never converges on output. This differs from clarification-irrelevant (a wrong single question) in that the loop never terminates at all — the failure is in the stopping condition, not the question content.

Cloud API Acknowledgment Mistaken for Completed Resize/Termination

Cost-Optimization Agent Reports an Autonomous Resize or Termination as Successful Based on the Cloud API's Synchronous "Request Accepted" Response, Without Polling the Resource's Actual Post-Action State

Co-Borrower Data Mixing

AI System Incorrectly Attributes Data Between Borrower and Co-Borrower

Cold Start Latency

First Request After Idle Has Unacceptable Delay

Multi-Column Text Extracted Out of Reading Order: Causes and Fixes

Agent Interleaves Text From Different Columns Into Nonsensical Output

Command Injection

Agent passes unsafe user/tool input into shell/API commands.

Communication Breakdown

Information Lost or Corrupted Between Agents

Multi-Agent Communication Loss: Causes and Fixes

Agents lose or drop key information passed between them, so a downstream agent acts without facts that an upstream agent already discovered.

Comorbidity Neglect in Treatment Recommendations

Model Recommends Treatment Optimal for Primary Condition But Dangerous for Comorbidities Patient Has

Compaction Information Loss

Memory Compaction Removes Critical Information

AI Fails to Parse Merged Cells and Nested Table Headers: Causes and Fixes

Merged Cell and Nested Header Failures

Compliance Boundary Violation

Agent Outputs Violate Regulatory Data Handling Requirements

AI Agent Loses Critical Information When Compressing Context: Causes and Fixes

Summarizing or compressing retrieved context before it reaches the model drops the specific numbers, dates, or conditions the answer needed.

Compression Artifacts & Quality Sensitivity

Model Fails When Images Compressed (JPEG Artifacts); Accuracy Sensitive to Compression Quality

Computed Field Cost Not Disclosed

A tool exposes a "computed" or derived field — one assembled on the fly by joining, aggregating, or inferring across multiple underlying sources (e.g., a `customer_risk_score`, `estimated_lifetime_value`, or `inferred_household_income` field) — but the field's metadata doesn't flag it as either sensitive or expensive to compute. Because the access-scoping layer typically makes decisions based on static field metadata (classification tags, cost annotations), an unflagged computed field slips through with no gate at all, and the agent queries it as freely as any plain stored column.

Concurrent Request Resource Explosion

A sudden spike in concurrent inference requests — from a traffic burst, a retry storm, or an agent fan-out pattern that issues many parallel sub-calls — exhausts GPU memory, CPU, or connection-pool capacity faster than autoscaling or admission control can react. Instead of degrading gracefully, the serving layer either crashes (taking down in-flight requests and forcing expensive retries) or silently over-admits requests into an already-saturated batch, driving per-request latency and cost up simultaneously as the system thrashes rather than serves.

Concurrent Session Not Licensed

A tool's license agreement caps the number of simultaneous active sessions (e.g., a data-provider API allows 3 concurrent connections per account, a desktop-automation tool allows 1 active session per seat), but the agent architecture spins up multiple parallel task instances — sub-agents, worker threads, or concurrent user requests — that each open their own session against the same licensed tool without any shared awareness of how many sessions are already open. The N+1th session either gets rejected outright or, worse, silently kicks an existing session offline mid-task.

Concurrent State Conflict

Multiple agents/users modify same object without coordination.

Concurrent State Modification

Two or more agent instances (or an agent and a background job) read the same piece of shared state — a task queue entry, a customer record, a conversation memory slot — modify their own in-memory copy, and write it back without any locking or optimistic-concurrency check. Whichever write lands last silently overwrites the other, so one agent's update disappears without either agent, or the user, ever being told a conflict occurred.

Concurrent User Quota

Many SaaS tools license access by concurrent "seats" or "sessions" rather than by request volume. When an agent authenticates as if it were a human user — holding a persistent session or logging in under a shared service account — it consumes one of those concurrent slots. This either locks the agent out when human users have filled the pool, or worse, silently evicts a human user's active session when the agent logs in and the license enforces a hard cap.

Conditional Permission Logic

Some permissions are conditional on runtime state rather than static role membership — "allow withdrawal only if account balance exceeds the requested amount," "allow this API call only during business hours," "allow escalation only if the ticket is marked P1." The agent evaluates these conditions against stale, cached, or incorrectly fetched data, or implements the comparison logic incorrectly (off-by-one, wrong field, wrong currency/unit), and grants access that the live condition would have denied.

Confidence Calibration Failure

Agent's verbalized or scored confidence does not correlate with its actual answer correctness, so confidence cannot be used to gate downstream decisions.

AI Document Extraction Shows High Confidence on Wrong Answers: Causes and Fixes

Overconfident Wrong Answers — Model Confidence Doesn't Track Accuracy

AI Agent's Confidence Doesn't Match How Reliable Its Answer Is: Causes and Fixes

AI agent sounds equally confident whether its answer is well-supported by context or barely grounded at all.

Confidence Miscalibration

Model Confidence Doesn't Match Hallucination Probability

Confident Fabrication

Agent States False Information with High Confidence

Confirmation Bias from Prior Clinical Notes

Agent Anchors on a Prior Visit's Diagnosis and Discounts New Evidence Contradicting It

Conflicting Feedback

Different reviewers prefer different behaviors.

Agent Picks Wrong Value When a Document Field Appears Multiple Times: Causes and Fixes

The same field appears in multiple document locations with conflicting values, and the agent grabs the first or an arbitrary occurrence instead of the authoritative one

Conflicting Instructions

Agent Receives Contradictory Instructions

Conflicting Objectives

Agent cannot resolve tradeoffs like speed vs accuracy, helpfulness vs compliance.

Conflicting Source Failure

Agent fails to reconcile contradictions between sources.

Connection Draining Incomplete

When an old agent-serving instance is terminated during a deployment, the platform sends a shutdown signal without waiting for in-flight agent sessions — especially long-running, multi-turn, or streaming tool-use conversations — to finish. Because agent interactions routinely run far longer than a typical stateless HTTP request (a single tool-calling loop can span tens of seconds to several minutes across multiple LLM round-trips), the default drain timeout tuned for short-lived requests expires while sessions are still mid-conversation, and those sessions are hard-killed. Users see a session abruptly disconnect, a streaming response cut off mid-token, or a tool call left in an indeterminate state with no completion or error ever recorded.

Connection Pool Exhaustion

An agent's HTTP client (or the SDK wrapping a tool) maintains a fixed-size connection pool, typically sized for a single-threaded request/response app rather than an agent fanning out dozens of parallel tool calls. When the agent spawns concurrent sub-tasks that all hit the same tool, requests queue up waiting for a free connection from the pool and start timing out or erroring — even though the remote API itself has plenty of headroom and would happily serve the traffic.

Connection Timeout No Retry

A tool call's underlying TCP/TLS connection times out — a transient blip caused by network jitter, a brief DNS hiccup, or a momentary vendor load spike — and the agent has no retry logic wrapping the call. Instead of treating the timeout as a one-off, recoverable event, the agent surfaces it as a hard tool failure: it aborts the current task, marks the tool "unavailable," or hands the user a generic error, even though a second attempt a moment later would very likely have succeeded.

Consensus Deadlock

Multi-Agent Voting or Agreement Fails to Resolve

AI Agent Consensus Illusion: Causes and Fixes

Agents appear to agree, but only because they were all seeded from the same flawed context or bias -- not because they independently verified the answer.

Consistency Failure: Identity Loss Across Generations

Generated Images Lack Consistency Across Multiple Generations (Same Subject, Different Outputs)

Content Fabrication

AI Generates False Content Presented as Fact

Context Aggregation Error Across Multiple Images

Model Fails to Properly Aggregate Context from Multiple Images; Makes Decisions Based on Incomplete Context

Context Assembly Race

Race Conditions During Context Assembly Cause Inconsistent State

Context Coherence Loss

Over a long-running session, an agent's live working context (the conversation buffer, scratchpad, and accumulated tool outputs for the current run) comes to contain multiple, mutually contradictory statements about the same fact — an earlier tool result, a superseded plan, or a value that later changed — with no mechanism marking any of them as authoritative. Unlike long-term memory-store conflicts, which surface across sessions, this happens entirely within one continuous run: partial compaction, tool retries, and branching sub-tasks leave old and new versions of the same fact co-resident in context, and the model attends to whichever is more salient rather than resolving the conflict.

AI Agent Ignores Retrieved Context and Answers from Memory Instead: Causes and Fixes

AI agent answers from its own training knowledge instead of using the specific documents retrieved for it.

Context Injection Leakage

Sensitive Data in RAG Context Exposed Through Agent Responses

Context Window Overflow

Task Exceeds Context Window Limits

Context Priority Inversion

Low-Priority Content Displaces High-Priority Content

Context Refresh Stale State

Many agent architectures periodically "refresh" a block of context — re-fetching current system state (order status, ticket state, account balance, feature flags) and re-injecting it into the prompt so the agent reasons over up-to-date information rather than what it read at session start. When the refresh mechanism itself reads from a stale source — a lagging read replica, a cache with a long TTL, a materialized view that hasn't recomputed — the agent receives a context block that looks fresh (it was "just refreshed") but actually contains old data, and the agent has no way to distinguish this from a genuine refresh.

Context Size Latency Impact

Large Context Windows Cause Quadratic Latency Growth

Context Stuffing

Overloading Context with Irrelevant Information

Context Stuffing Failure

Too many chunks dilute relevant evidence.

Context Window Awareness Failure

An agent has no internal tracking of how much of its context window is currently consumed, so as the session grows — tool outputs, retrieved documents, prior turns — early content gets silently truncated or evicted by the underlying context-management layer without the agent ever registering that it happened. The agent continues to reason as if everything it was told earlier is still available, producing answers that ignore or misremember instructions, constraints, or facts that were established at the start of the session and have since fallen out of the window.

AI Agent Forgets Earlier Document Content (Context Window Limits): Causes and Fixes

Long documents exceed the agent's context window, so naive chunking breaks cross-references and the agent loses track of earlier content

Context Window Overflow with Silent Truncation

Agent Silently Drops Input Context When Message Exceeds Context Window

Context Window Poisoning

Malicious Content Injected into Agent's Context Persists Across Interactions

AI Agent Answer Quality Drops When Given Too Much Context: Causes and Fixes

Stuffing the context window with more retrieved documents makes the AI agent's answers worse, not better — the "lost in the middle" effect.

Contingency Plan Missing

An agent generates a plan as a single linear sequence of steps with no fallback for what to do if a given step fails, returns an unexpected result, or becomes unavailable. When the primary path breaks partway through execution, the agent has no pre-defined alternative to fall back to and either halts entirely, retries the same failing step indefinitely, or improvises an ungrounded workaround on the spot with no guardrails.

Contract Ambiguity Detection Failure

Model Misses Ambiguous or Conflicting Clauses in Contracts; Leads to Dispute When Parties Interpret Differently

AI Agents Give Contradictory Outputs: Causes and Fixes

Two or more agents disagree and nothing in the pipeline resolves the conflict, so contradictory answers reach the end user or downstream system.

Contraindication Omission

Agent Recommends or Approves a Medication Without Checking Patient-Specific Contraindications Beyond Drug-Drug Interactions

Conversation Coherence Loss

Over an extended multi-turn conversation, the agent's responses stop tracking the accumulated state of the discussion — it loses track of decisions already made, entities already introduced, or the current sub-task within a larger goal, and later replies read as disconnected from what came before. Unlike relevance drift, where the topic itself gradually shifts, coherence loss can occur on the same topic: the agent simply can't hold the thread together, producing responses that are locally sensible but don't fit the conversation's actual state.

Conversation Contradiction

The agent states something in one turn and then states something incompatible with it later in the same conversation, without acknowledging the change or reconciling the two claims. This erodes trust independent of whether either individual statement was correct, because the user cannot tell which one to believe. Unlike coherence loss, which is about losing track of state generally, contradiction is a specific, checkable failure: two concrete claims made by the same agent in the same session are logically incompatible.

Conversation Depth Mismatch

The agent calibrates the wrong amount of detail for the question at hand — giving a two-line answer to something that needed a careful multi-step explanation (e.g. a nuanced tradeoff or a risk-bearing decision), or producing an exhaustive multi-section breakdown for something the user just wanted a quick yes/no on. Both directions cause friction: too shallow leaves the user under-informed and forces follow-up questions, too deep buries the actual answer and wastes the user's time.

Conversation Formality Mismatch

The agent's register — word choice, sentence structure, use of humor or emoji, level of hedging — doesn't match what the context calls for: overly casual language in a request about a legal or medical matter, or stiff corporate boilerplate in a casual back-and-forth where the user has been informal throughout. The mismatch itself becomes a distraction from the content, signaling the agent isn't reading the room even when the substance of the answer is correct.

Conversation Length Explosion

A conversation that should resolve in a handful of turns instead grows to dozens or hundreds of turns without reaching a conclusion, driven by the agent's own behavior — asking follow-ups instead of finalizing, re-explaining instead of confirming, or generating verbose responses that themselves prompt more back-and-forth. Cost (both token spend and user time) grows roughly linearly or worse with turn count while the probability of resolution per additional turn keeps falling, meaning the conversation is on a bad trendline that nothing forces it off.

Conversation Mood Whiplash

The agent's emotional tone swings sharply and without cause between adjacent turns — upbeat and enthusiastic in one response, curt or apologetic-and-somber in the next, then breezy again — even though nothing in the conversation's content justifies the shift. Unlike formality mismatch, which is a single response miscalibrated to context, mood whiplash is specifically about the jarring delta between consecutive turns; the tone itself might be individually defensible each time, but the swing feels erratic and makes the agent seem unstable or inattentive to the user.

Conversation Relevance Drift

Across a multi-turn conversation, the subject matter gradually shifts away from the user's original goal, one small step at a time, until the conversation is addressing something meaningfully different from what the user came in for — without either party explicitly deciding to change topics. Each individual step feels like a natural continuation, but the cumulative drift means the original goal quietly falls out of scope and is never actually completed.

Conversation Repetition

The agent restates information, asks a question, or repeats an instruction that it (or the user) already covered earlier in the same conversation, as if encountering it for the first time. This differs from coherence loss in scope: repetition is the narrow, directly observable symptom — the same content appearing twice — whereas coherence loss is the broader state-tracking failure that often, but not always, produces it (a single instance of repetition can also come from a template default firing regardless of history).

Conversation Tangent Proliferation

The agent enthusiastically follows every side topic the user (or its own reasoning) introduces mid-conversation, opening multiple simultaneous side-threads instead of resolving the primary task, so the conversation branches outward rather than converging. This differs from relevance drift, which is a single-direction gradual walk away from the original topic; tangent proliferation is specifically about accumulating multiple open side-threads in parallel, none of which get closed, while the main task also stalls.

Conversational Forecast Adjustment Discards Structured Model Baseline

When a Planner Asks the Agent to Adjust a Forecast Conversationally ("Bump Up SKU X for the New Campaign"), the Agent Regenerates an Entirely New Forecast Number Through Free-Text Reasoning Instead of Applying a Bounded Delta to the Existing Statistical Model's Output, Silently Discarding the Baseline's Seasonality and Trend Components

AI Agent Coordinator Failure: Causes and Fixes

The manager/orchestrator agent (the coordinator role in LangGraph supervisor graphs or CrewAI's manager pattern) assigns subtasks to the wrong worker agents, or fails to correctly synthesize their outputs into a coherent final answer.

Corporate-Action Blindness

Agent Fails to Adjust Prices, Positions, or Historical Series for Splits, Dividends, Mergers, or Spin-Offs

Corporate Hierarchy Misattribution

Agent Attributes Risk, Exposure, or Performance Data to the Wrong Entity Within a Corporate Family Due to Incomplete Parent-Subsidiary Mapping

Correlation Breakdown in Portfolio Diversification

Assumed Diversification Fails When Correlations Spike (Tail Dependence Not Captured)

Correlation-Induced False Positives in Multi-Metric Anomaly Detection

Multiple Correlated Metrics All Spike Together; Model Flags as Coordinated Attack But Actually Cascading Failure

Correlation Narrated as Causation in Financial Due-Diligence Risk Memo

Agent Synthesizing a Due-Diligence Risk Memo From Disclosed Financial Facts Constructs a Confident Causal Narrative Linking Two Temporally Adjacent Facts, Without Any Underlying Transaction-Level Evidence That One Actually Caused the Other

Corrupted Agent State

Agent's Internal State Compromised, Affecting All Its Interactions

Cost Anomaly Blindness

Unusual Cost Patterns Go Undetected

Cost Attribution Errors

Costs Cannot Be Accurately Attributed to Users, Agents, or Use Cases

Cost-Quality Tradeoff

Cost Optimization Degrades Agent Quality

Counterfeit Supplier Verification Gap

Agent Onboarding a New Supplier Verifies Business Registration and Pricing Competitiveness but Does Not Verify Component Authenticity or Sub-Tier Sourcing Chain

Cpu Quota Per Job

A tool executes agent-submitted work as a job (e.g., a serverless function, a batch data-processing task, a sandboxed code-execution call) under a fixed CPU quota — a cgroup limit, a vCPU-second cap, or a throttling policy. When the agent's request involves more computation than expected (a larger dataset, an unexpectedly expensive query plan, a recursive operation), the job gets throttled mid-execution or killed outright by the orchestrator, and the agent receives a generic failure with no indication that CPU exhaustion was the cause.

CPU Saturation Cascade

Inference serving is usually thought of as GPU-bound, but the CPU-side work around it — request tokenization, sampling/logits post-processing, tensor-parallel coordination, response serialization, and health-check handling — runs on a shared CPU pool that can saturate independently of GPU load. When one node's CPU saturates, the GPU sits partially idle waiting on CPU-bound preprocessing/postprocessing, so the fleet's effective throughput drops; the resulting backlog shifts load onto neighboring nodes, whose CPUs then saturate in turn, cascading a single node's bottleneck into a fleet-wide throughput collapse that shows up as a spike in cost-per-token because GPUs keep billing while doing less useful work.

Credential Exposure

Agent Leaks API Keys, Passwords, or Tokens

Credential Leakage

Agent Exposes API Keys, Passwords, or Secrets in Output

Credential Leakage in Logs

API Keys, Passwords, Tokens Exposed in Logs or Error Messages

AI Agent Extracts the Wrong Amount, Date, or ID from a Document: Causes and Fixes

The agent extracts a wrong amount, date, name, address, account number, or ID and nothing catches it before use.

Critical Lab Value Notification Delay

Agent Summarizes a Critical Lab Result Within a Routine Note Instead of Triggering Immediate Notification

Cross-Border Data Transfer Clause Miss

Agent Reviews a Contract Involving Cross-Border Data Flows Without Checking for Required Transfer Mechanism Clauses

Cross-Image Reference Loss

Model Fails to Match or Reference Objects Across Different Images

Cross-Session Data Bleed

Data from One User's Session Appears in Another's

Cross-Session Confusion

Agent Confuses Information Across Sessions

Cross-Tenant Data Leak

Agent mixes data across customers/accounts.

Cross-Tenant Data Leakage

AI Agent Exposes Data Between Isolated Customer Environments

Cross-Tool Total Budget Exceeded

An agent has separate, independently-tracked budget caps for each tool it uses — say $10/day for a search API, $15/day for an enrichment API, and $25/day for an LLM-based summarization tool — and each individual cap is respected. But no component tracks the sum across tools, so the agent can legitimately spend up to $50/day per user session while whoever set the budgets believed they were capping total spend at, say, $20/day. The org discovers the real number only when the consolidated vendor invoice arrives.

Cross-Turn Contamination

Current task is polluted by unrelated previous context.

Unhedged Currency Exposure & FX Risk

Model Recommends International Assets Without Accounting for Currency Risk; FX Movements Dwarf Asset Returns

AI Agent Misreads Customer Emotion and Sounds Tone-Deaf: Causes and Fixes

The agent mishandles empathy in debt collection, healthcare, support, or complaints and gives a procedurally correct but tone-deaf reply.

Data Classification Access Not Enforced

Records or fields are tagged with a sensitivity classification (e.g., `public`, `internal`, `confidential`, `restricted`) in the data catalog, but the tool-serving layer the agent calls through doesn't actually check that classification before returning results. The classification exists as documentation and governance metadata, not as a runtime enforcement rule, so an agent with generic tool access retrieves `restricted`-tagged data exactly as easily as `public`-tagged data.

Data Deletion Compliance

A user or data-subject deletion request (e.g. a GDPR/CCPA erasure request) is supposed to propagate through every tool, cache, vector store, and downstream system the agent has ever written that person's data to. In practice, the agent's deletion logic only reaches the primary data store it knows about, missing copies written to secondary systems — search indexes, embedding/vector stores, analytics warehouses, third-party tool integrations, or logs — that the agent wrote to during normal operation but that the deletion workflow was never extended to cover.

Data Exfiltration

Agent leaks private or sensitive data.

Data Leakage

Agent Exposes Sensitive Information

Data Lineage Loss

As data moves through a multi-stage pipeline (ingestion, normalization, enrichment, aggregation, and into an agent's context), each stage typically emits only its output, not a record of which input rows or upstream events produced it. When the agent later needs to explain a decision, trace an anomaly back to its source, or honor a downstream correction (a customer disputes a charge derived from a specific transaction), there is no reliable path from the final artifact back to the originating record.

Data Pipeline Backpressure Unhandled

An agent's downstream consumer (a database writer, an LLM enrichment call, a rate-limited third-party sync) slows down, but the upstream producer stages of the pipeline keep emitting data at the original rate because no signal travels backward to tell them to slow down. The gap between production and consumption rate is absorbed by an in-memory or disk queue that has no bound, until it either fills and starts dropping messages or exhausts host memory and crashes the whole pipeline.

Data Pipeline Latency

An agent that reads from a multi-stage pipeline treats the data it receives as current, but each stage (ingestion, normalization, enrichment, batching, indexing) adds its own processing delay, and those delays compound. By the time the agent acts — approving a trade, flagging inventory as low, answering "what is the current status" — the data reflects the world as it was minutes or hours earlier, not as it is now, and nothing in the agent's context signals how stale the value actually is.

Data Pipeline Lossy Transformation

An intermediate stage in a data pipeline — a normalization step, a schema-mapping step, a "clean up the data" step written before the agent's needs were fully known — silently drops or truncates fields, coerces types in ways that lose precision, or collapses distinct source values into the same output value. The pipeline continues to run without errors because the transformation is syntactically valid; it is only semantically incomplete, and the agent downstream never learns that information it needed was discarded before it ever saw the data.

Data Pipeline Ordering Change

An agent's processing logic implicitly assumes events arrive in the order they occurred (a "created" event before an "updated" event, a payment "authorized" before a "captured"), but a pipeline change — adding parallel processing, repartitioning a queue by a different key, introducing retries, or migrating to a different message broker — reorders events in transit. The agent applies updates in the new arrival order, producing state that reflects an event sequence that never actually happened.

Data Pipeline Replay Idempotency

When a pipeline stage fails partway through, gets redeployed, or a consumer's offset is reset for recovery, the standard remedy is to replay events from a checkpoint. If the agent's downstream processing logic performs side effects (sending a notification, charging a payment, incrementing a counter, calling an external API) without checking whether that specific event was already processed, replaying the event log causes those side effects to happen again, producing duplicate charges, duplicate notifications, or double-counted metrics.

Data Pipeline Schema Drift

An upstream system or team changes the shape of the data it emits — renaming a field, changing a type, adding a required field, deprecating an enum value — without coordinating with every downstream consumer. Because the pipeline has no contract enforcement between producer and consumer, the change ships silently, and the agent's parsing logic either throws on the first unexpected value, silently coerces it to null/default, or misinterprets a renamed field as absent, breaking downstream behavior with no upstream-visible signal that anything happened.

Loss of Data Provenance

Data Origin and Classification Lost During Processing

Data Residency Violation

Data subject to a jurisdictional residency requirement (e.g. EU customer data must stay within the EU, certain government data must stay within national borders) passes through a tool call — an LLM inference API, a third-party enrichment service, a logging pipeline, a backup destination — that processes or stores it in a different region than required, because the tool's regional routing wasn't configured or verified against the residency requirement at integration time.

Data Scope Boundary Violation

An agent scoped to operate within a specific business boundary — a department, project, or team — issues a tool query that crosses into a sibling boundary it was never intended to see, because the boundary is a soft, business-logic construct rather than a hard constraint enforced at the tool layer. Unlike multi-tenant or workspace isolation, these boundaries usually live inside a single shared database and account, distinguished only by a filter (e.g., `department = 'Engineering'`) that the application is expected to apply consistently but doesn't always.

Deadlock in Multi-Agent

Two or more agents each hold a resource that another agent in the group needs, and each is waiting for the resource held by the next, forming a closed cycle of dependencies where no agent can proceed. Unlike a simple timeout or a single stuck agent, deadlock is a stable state — none of the agents involved will ever make progress on their own, because each is correctly waiting for something that will never be released, since the releaser is itself waiting.

Debt Obligation Detection Failures

OCR System Fails to Detect All Borrower Debt Obligations

Debug Information Loss

Information Needed for Debugging Lost Before Investigation

Deepfake Impersonation Detection Failures

AI System Fails to Detect Video/Voice Deepfakes in Remote Closings

Deflection of Unresolved Issues

Self-Service Agent Marks a Conversation as "Deflected" (Resolved Without Human Agent) Based on the Customer Not Replying, Rather Than the Issue Actually Being Resolved

Degraded SLA Not Communicated

A tool vendor experiences an internal incident — an overloaded backend, a partial regional outage, a resource-constrained fallback mode — and quietly degrades service quality (higher latency, lower accuracy, reduced feature availability) to keep the system technically "up," without posting to a status page or notifying API consumers. The agent has no explicit signal that anything has changed; it just observes worse results and, absent any error or status indicator, has no basis to distinguish a genuine data or logic problem from a vendor-side degradation it should be working around.

Delayed Outcome Attribution

Business outcome arrives later and cannot be attributed to agent action.

Delegation Depth Explosion

Agents Delegate to Sub-Agents Creating Unbounded Depth

Delegation Impersonation Not Limited

A user grants an agent limited authority to act on their behalf — e.g. "book travel under $2,000" or "respond to routine emails but don't send anything financial." The agent (or a sub-agent it spawns to handle part of the task) continues acting under the user's identity or impersonation token beyond that delegated scope, because the scope was expressed as a natural-language instruction rather than an enforced, machine-checkable boundary on the credential itself.

Demographic Bias in Diagnosis & Treatment Recommendations

Model Biased Toward/Against Certain Demographics (Race, Gender, Age); Different Accuracy for Different Groups

Dependency Availability Region

An agent's toolchain depends on a third-party service, model endpoint, or package registry that is not available in every region the agent is deployed to — due to data residency law, provider infrastructure gaps, or export restrictions. The dependency works fine in development and in the primary deployment region, so the regional gap goes unnoticed until the agent is deployed or scaled into a new region and a specific tool call starts failing for every user in that geography.

Dependency Breaking Change

A library, SDK, or API the agent's toolchain depends on ships a breaking change — a removed function, an altered response format, a changed default behavior — and the agent's own team has no process that surfaces the change before it reaches production. Automated dependency updates, transitive upgrades pulled in by an unrelated package bump, or a provider's server-side API change (which requires no client-side upgrade at all) all ship the break silently from the agent team's point of view, and it is discovered only when the agent's behavior degrades or a build fails.

Dependency Circular Reference

Two or more services, modules, or agents depend on each other, directly or through an intermediate chain, in a cycle: Service A calls Service B during initialization or request handling, and Service B (directly, or via Service C) calls back into Service A before A has finished. Under normal, low-latency conditions the cycle can complete without anyone noticing, but under load, during startup ordering, or when one leg of the cycle is slow, the mutual wait never resolves and the system deadlocks or spins in an infinite resolution loop.

Dependency Hell & Version Compatibility Blindness

Deployment Agent Doesn't Detect Breaking Changes in Dependencies; Deploys Incompatible Versions

Dependency License Incompatibility

An agent's development workflow — often an agent itself, tasked with "add a library that does X" — pulls in a new dependency without checking its license against the project's own licensing terms or the terms of the dependencies already in the tree. A permissively-licensed project unknowingly incorporates a copyleft-licensed package (or one with a restrictive commercial-use clause), creating a legal obligation (source disclosure, attribution, non-commercial restriction) the project's license terms don't account for, and the conflict surfaces only during a legal review, an acquisition due-diligence process, or a customer's compliance audit.

Dependency Security Vulnerability

A library the agent's system depends on — directly or transitively — has a publicly disclosed CVE, but the vulnerable version remains in production because no process reliably surfaces the disclosure, prioritizes it against other work, and ships a patch. The gap between disclosure and patching leaves an exploitable window, and for agents specifically, a vulnerable dependency in a tool-execution or code-execution path can be a direct route to prompt injection, arbitrary code execution, or data exfiltration triggered by attacker-controlled input the agent processes.

Dependency Version Conflicts

Two direct dependencies the agent's system relies on each require different, incompatible versions of the same shared transitive dependency (Package X needs library Z at version 1.x, Package Y needs library Z at version 2.x, and 1.x/2.x are not compatible). The package manager either fails to resolve the tree, silently picks one version and breaks the other package at runtime, or (in ecosystems that allow multiple versions to coexist) installs both, producing subtle bugs when an object created by one version's code is passed into code expecting the other version's shape.

Dependency Version Pinning Conflict

A team pins a dependency to an exact version — often deliberately, to avoid an earlier breaking-change incident or to satisfy a compliance requirement for reproducible builds — and later, a different part of the system introduces a new requirement (a new package, a new feature, a security patch) that needs a minimum version higher than the pin. The pin, which was added specifically to provide stability, now actively blocks a change the system needs, and resolving the conflict requires either revisiting the original reason for the pin or accepting the very risk the pin was meant to prevent.

Deploy-Correlated Anomaly Misattribution

Anomaly-Detection Agent Attributes a Metric Anomaly to the Most Recent Deployment by Default, Missing the Actual Independent Cause

Deployment Dependency Deadlock

Two services in an agent pipeline — for example, the orchestrator that calls tools and the tool-schema registry it depends on — each have a deployment that is written to wait for the other to update first, so neither team is willing to deploy. The orchestrator team wants the registry to publish the new tool schema before they roll out code that assumes it exists; the registry team wants the orchestrator's new validation logic live before they push a schema change that would otherwise break the old validator. Both releases sit staged and ready, and the system stays on outdated, incompatible-in-the-making versions indefinitely because each side is correctly avoiding breaking the other, but nobody has sequenced who actually moves first.

Deployment Ordering Violation

A release requires a specific sequence — for example, a database migration adding a new column that the updated agent orchestrator code depends on must land before the orchestrator itself is deployed — but the deployment pipeline applies the two changes out of order, or applies them concurrently without an enforced dependency. The new orchestrator code starts up and immediately queries or writes the column that doesn't exist yet, crashing on startup or, worse, silently defaulting to null/empty values that corrupt downstream agent state (e.g., losing a conversation's tool-permission scope because the column that stored it isn't there yet).

Deployment Validation Skipped

A required pre-production gate — a regression eval suite against known agent conversation transcripts, a tool-schema compatibility check, a canary soak period — is bypassed for a given release, either through an explicit manual override ("hotfix, skip the eval run, we need this live now") or because a pipeline misconfiguration silently short-circuits the gate. The release ships straight to production without the validation that was specifically designed to catch the class of regression it turns out to contain, and the failure surfaces in front of real users instead of in the gate that existed to prevent exactly that.

Deprecated Endpoint Retirement

A tool endpoint the agent depends on is formally deprecated by the vendor and, after a notice window, retired outright — returning 404s or 410s instead of the expected response. The agent has no fallback path coded because the endpoint "always worked" during development, so once the retirement date passes, every call fails outright with no graceful degradation, and the failure often isn't noticed until the retirement is already in effect.

Depth Estimation Failure

Monocular Depth Estimation Wrong; 3D Positioning Fails

Depth Estimation Hallucination: Monocular Vision Failure

Vision models fail to accurately estimate depth from single images; hallucinate depth cues when monographic features (shadows, perspective, texture) are ambiguous or misleading

Deterministic Verification Bypassed

Agent relies solely on an LLM-judge to assess its own output when a deterministic, executable check (schema validation, test suite, linter, tool-call format check) was available and would have caught the error at near-zero cost.

Device Compatibility Issues

Performance Varies Significantly Across Devices

Digital Signature Validation

AI System Fails to Properly Validate Digital Signatures on Documents

Direct Prompt Injection

User prompt manipulates agent to ignore instructions.

Disambiguation Strategy Ineffective

When a request is genuinely ambiguous, the agent has some strategy for resolving it — asking a question, picking the most likely interpretation, presenting options — but the strategy itself is a poor fit for the type of ambiguity present, so the ambiguity survives the resolution attempt. This is a broader, strategy-level pattern than clarification-irrelevant (a single wrong question): it covers any mismatched approach, including choosing to guess when asking was needed, presenting an unusable list of options, or asking when a simple default would have sufficed.

Discharge Medication Reconciliation Gap

Agent Generates Discharge Medication List Without Reconciling Against Pre-Admission Home Medications

Disclosure Document Gaps

OCR System Fails to Detect Missing or Incomplete Required Disclosures

Discovery Document Relevance Misclassification

Litigation-Support Agent Marks Materially Relevant Documents as Non-Responsive (or Vice Versa) During Discovery Review, Creating Spoliation or Over-Production Risk

Disfluency Calibration Failures

Agent's Filler Words and Speech Disfluencies Don't Match Persona or Context

Disk Space Exhaustion

Inference nodes accumulate disk usage from request/response logs, prompt-cache and KV-cache spill files, downloaded model checkpoints (including duplicate versions kept for rollback), and container image layers. When disk fills up, the failure isn't graceful — model loading fails for new deployments, log writes start silently failing or blocking, and in some serving stacks the engine crashes outright — taking healthy GPU capacity offline and forcing traffic onto fewer nodes, which raises effective cost-per-token even though the root cause has nothing to do with compute pricing.

Distribution Shift

Production Queries Differ Significantly from Golden Dataset

Document Authenticity Marker Failures

OCR System Fails to Validate Document Authenticity Markers

Document Completeness Check Failures

OCR System Fails to Detect Missing Pages, Sections, or Required Information

Document Date Correlation

AI System Fails to Verify Document Dates Align with Stated Timeline

Document Dating Validation Failures

OCR System Fails to Validate Document Dates and Date Relationships

Document-Level Retrieval Mismatch Pulls Wrong Billing-Dispute Template

A Billing-Dispute Agent That Retrieves a Dispute-Handling Template or Policy Article From a Knowledge Base Via Embedding Similarity to the Customer's Complaint Wording Pulls an Entire Document That Is Topically and Lexically Close -- Covering a Structurally Similar but Different Dispute Type, Product Tier, or Region -- Rather Than the Document That Actually Governs the Customer's Account, and Applies That Wrong Document's Resolution Steps and Dollar Thresholds Confidently

Document Template Validation

AI System Fails to Verify Documents Match Expected Institution Templates

AI Agent Misclassifies a Document Type: Causes and Fixes

The agent misclassifies a paystub, W-2, bank statement, invoice, policy, or similar document, so the wrong extraction schema gets applied.

Domain Best-Practice Ignorance

An agent retrieves and applies information that was once the accepted best practice in a domain but has since been superseded by an evolved standard, even though the underlying fact is still technically true. The agent's knowledge source (a fine-tuned model, a static knowledge base, or a cached document set) captured the practice at a point in time and was never re-indexed against the field's current consensus, so the agent confidently recommends an approach that a current practitioner would flag as outdated. The advice isn't factually wrong in isolation — it's wrong relative to what the domain now considers correct.

Domain Constraint Violation

An agent produces output or takes an action that violates a hard, non-negotiable constraint of the domain it's operating in — a regulatory requirement, a safety interlock, a licensing restriction — because the constraint was never surfaced by its retrieval layer. Unlike a best-practice miss, this isn't a matter of degree: the agent crosses a bright line (e.g. recommending a drug dosage that exceeds a labeled maximum, or drafting a contract clause that's unenforceable in a given jurisdiction) because its knowledge base treated the constraint as optional context rather than a gating rule.

Domain Context Loss

An agent correctly establishes domain-specific context early in a session — the specialty, jurisdiction, or technical stack it should reason within — but loses track of it as the conversation grows, silently reverting to generic, domain-agnostic behavior. The regression isn't triggered by the user changing topics; it happens because the domain-framing information falls out of the effective context window or gets diluted by intervening turns, and nothing in the agent's architecture re-asserts it.

Domain Exception Not Handled

An agent correctly retrieves and applies a general domain rule, but fails to recognize that the specific case at hand falls under a documented exception that overrides or modifies the general rule. The exception exists in the knowledge base — often in a separate section, footnote, or appendix — but the agent's retrieval or reasoning never connects the specific case to it, so the general rule is applied as if it were universal.

Domain Mismatch

Agent Fails on Out-of-Distribution or Specialized Inputs

Domain Risk Blindness

An agent operating in a specialized domain fails to flag a risk factor that any competent domain practitioner would immediately recognize as significant, not because the underlying fact is missing from its knowledge base, but because that fact was never tagged or weighted as risk-relevant. The agent retrieves and states the fact correctly when directly asked, yet doesn't proactively surface it as a concern in a context where a domain expert would treat it as a red flag requiring attention.

AI Agent Misses an Industry-Specific Rule or Exception: Causes and Fixes

The agent applies the general-case policy and misses an industry-specific rule or exception, producing a wrong decision.

Domain Rule Misunderstanding

An agent retrieves a correctly-stated domain rule but misapplies it because it misreads the precise conditions under which the rule holds — extending it to cases just outside its actual scope, or narrowing it to exclude cases it actually covers. The rule text itself is never altered or hallucinated; the failure is in the agent's interpretation of qualifying language like "only if," "except when," or "applies to X but not Y" that defines the rule's true boundary.

Domain Rule Violation

Agent Violates Domain-Specific Constraints

Domain Terminology Confusion

An agent interprets a domain-specific term using its common, general-language meaning instead of the narrower or entirely different meaning the term carries within the specialized domain, producing a response that's coherent but answers the wrong question. This happens most with terms that are ordinary English words repurposed with precise technical meaning (e.g. "significant" in statistics, "material" in accounting, "positive" in a lab result), where the domain meaning can even be the near-opposite of the everyday connotation.

Domain Vocabulary Gaps

ASR Fails to Recognize Industry-Specific Terms

Dosage Renal/Hepatic Adjustment Failure

Agent Recommends Standard Adult Dosing Without Adjusting for Impaired Renal or Hepatic Clearance

Drug Interaction Misses & Contraindication Blindness

Model Recommends Drug Combination Without Flagging Known Dangerous Interactions

AI Agent Creates Duplicate Orders, Charges, or Tickets: Causes and Fixes

The agent retries a write-type tool call after a timeout or ambiguous error and ends up creating duplicate tickets, emails, orders, or charges.

AI Agents Duplicate Work: Causes and Fixes

Multiple agents independently solve the same subtask -- often calling the same expensive tool or API -- because there's no shared task ledger to prevent redundant work.

Earlier-Established Negative-Keyword Constraint Lost from Context in Long Keyword-Research Session

During an Extended Single-Session SEO Content-Planning Conversation Covering Dozens of Target Pages, an Editor's Early Instruction That a Specific Keyword Cluster Must Be Excluded (Because It Cannibalizes an Existing High-Ranking Page or Conflicts With a Paid-Search Exclusion List) Falls Out of the Agent's Effective Context as the Session Grows, and the Agent Later Recommends or Drafts Content Targeting the Excluded Cluster as if the Constraint Had Never Been Stated

Echo and Feedback Issues

Agent's Own Audio Interferes with User Speech Detection

Agent Misses Embedded Attachments in Documents: Causes and Fixes

Agent Swallows Attachments and Embedded Documents Into the Parent Document's Classification

Embedded Object Analysis

AI System Fails to Detect Hidden or Suspicious Objects Embedded in PDFs

Embedding Model Drift

Embedding Model Changes Break Retrieval

Embedding Retrieval Applies Wrong Jurisdiction's Clause Template by Name Similarity

A Drafting Agent Asked to Insert a Jurisdiction-Specific Clause (a Non-Compete, a Consumer-Arbitration Provision, a Statutory Notice) for a Contract Governed by One State or Country's Law Retrieves the Clause From a Multi-Jurisdiction Template Library Using Semantic Similarity Over the Clause's General Subject Matter, Rather Than Matching Strictly on Governing Jurisdiction, and Pulls a Differently-Jurisdictioned Template That Is Lexically Almost Identical but Legally Ineffective or Unenforceable Under the Contract's Actual Governing Law

Embedding Retrieval Applies Wrong Jurisdiction's Disclosure Template by Name Similarity

A Compliance Agent Assembling a Required Regulatory Disclosure for a Filing Retrieves the Applicable Disclosure Template From a Multi-Jurisdiction Template Library Using Semantic Similarity Over the Regulation's Name and Subject Matter, Rather Than Matching on the Controlling Jurisdiction Itself, and Pulls a Template Built for a Differently Named but Substantively Different Regulatory Regime in Another Jurisdiction That Happens to Share Closely Overlapping Terminology

Embedding-Retrieval Applies Wrong Occupation-Class Rate Precedent by Lexical Similarity

An Underwriting Agent's Retrieval Step, Used to Find a "Similar Prior Case" Precedent for Classifying an Applicant's Occupation Into the Correct Risk Class for Pricing, Surfaces a Prior Underwriting Case That Is Embedding-Similar by Job-Title Wording but Belongs to a Materially Different Risk Class, Causing the Agent to Apply the Wrong Class's Rate Factor to the Current Applicant

Embedding Retrieval Applies Wrong Service's Capacity Profile by Name Similarity

A Capacity-Planning Agent That Selects a Reference Capacity Profile for a New or Under-Profiled Service by Semantic Similarity Over the Service's Name and Description Pulls a Lexically Similar but Operationally Different Profile -- One Built for a Stateless, Horizontally-Scalable API Service -- When Planning Capacity for a Stateful, Single-Writer Cache Service, Recommending an Autoscaling Strategy That Does Not Apply

Embedding Retrieval Applies Wrong Service's Deployment Checklist

A Deployment-Safety Agent That Retrieves the Applicable Pre-Deploy Safety Checklist by Semantic Similarity Over the Service's Name and Description Pulls a Lexically Similar but Substantively Different Checklist -- One Written for a Stateless Service -- When Deploying a Stateful Service, Omitting a Required Migration-Compatibility Gate

Embedding Retrieval Applies Wrong Workload's Cost Playbook by Tag Similarity

A Cost-Optimization Agent That Selects a Cost-Reduction Playbook for a Flagged Resource by Semantic Similarity Over Its Tags, Name, and Description Pulls a Playbook Written for a Fault-Tolerant Batch Workload -- Recommending Migration to Spot/Preemptible Instances -- and Applies It to a Latency-Sensitive, Interruption-Intolerant Workload That Shares Overlapping Tag Vocabulary but Cannot Tolerate the Same Risk

Embedding Retrieval Flags Unrelated Claimant as Fraud-Ring Match

A Fraud-Detection Agent's Link-Analysis Retrieval Step, Which Searches for Claimants Embedding-Similar to Known Fraud-Ring Members Based on Free-Text Claim-Narrative and Address Fields, Surfaces a Coincidental Lexical Match (a Common Surname, a High-Density Apartment Complex Address) and Treats It as a Fraud-Ring Association, Escalating a Legitimate Claimant for SIU Investigation Based on a Retrieval False Positive

Embedding Retrieval Maps New Product to Wrong Regulatory Rule by Lexical Similarity

A Compliance Agent Classifying a Newly Launched Financial Product Against the Applicable Regulatory Rule Set Selects the Rule Whose Description Is Most Lexically or Embedding-Similar to the Product's Marketing Description, Rather Than Matching on the Product's Structured Regulatory Classification Code, Applying the Wrong Rule Set to a Structurally Different Product

Embedding-Retrieval Match Treats a Lexically Similar but Legally Distinct Substantiation Source as Adequate

A Compliance-Review Agent's Retrieval Step Over a Vector Store of Approved Substantiation Documents Returns a Source That Is Embedding-Similar to the Marketing Claim Under Review Because It Discusses the Same Product Category and Uses Closely Related Phrasing, but the Retrieved Source Actually Supports a Narrower, Differently Conditioned, or Already-Expired Claim Than the One the Copy Makes, and the Agent Approves the Claim as Substantiated on the Strength of the Similarity Match Alone

Embedding Retrieval Matches Look-Alike/Sound-Alike Drug Name

A Medication-Reconciliation Agent Matching a Free-Text or Handwritten Medication Entry Against a Structured Formulary Database Uses Similarity-Based Lookup That Resolves the Entry to a Lexically Similar but Pharmacologically Different Look-Alike/Sound-Alike (LASA) Drug, and the Reconciled Medication List Carries the Wrong Drug Forward Into the Patient's Active List

Embedding-Retrieval Matches New Supplier to Wrong Certification Template

A Supplier-Onboarding Agent's RAG Step, Used to Retrieve the Correct Compliance/Certification Checklist Template for a New Supplier Based on Its Stated Industry and Product Category, Pulls a Lexically Similar but Substantively Different Template Because the New Supplier's Self-Description Text Is Embedding-Similar to a Different Product Category's Template

Embedding Retrieval Matches Similarly Named Lab Panel With Different Reference Range

An Agent Interpreting a Lab Result That Looks Up the Applicable Reference Range Via Semantic Search Over a Reference-Range Knowledge Base, Rather Than an Exact Assay-Code Match, Retrieves the Range for a Differently Named but Textually Similar Test -- Such as Confusing "Vitamin D, 25-Hydroxy" With "Vitamin D, 1,25-Dihydroxy" -- and Flags or Clears the Result Against the Wrong Range

Embedding Retrieval Matches Structurally Similar, Different-Class Drug for Interaction Check

An Agent Checking a Medication List for Drug-Drug Interactions, Using Semantic Similarity Search Over an Interaction Knowledge Base to Find the Relevant Interaction Profile for a Given Drug, Retrieves the Profile for a Structurally or Name-Similar but Pharmacologically Distinct Drug, and Clears or Flags the Combination Based on the Wrong Drug's Interaction Data

Embedding-Retrieval Matches Wrong SLA-Tier Policy Document

An SLA-Management Agent's RAG Step, Used to Retrieve the Applicable Response-Time and Resolution-Time Commitments for an Incoming Ticket Based on the Customer Account's Description, Pulls a Lexically Similar but Wrong-Tier SLA Policy Document, Causing the Agent to Apply Incorrect Commitment Clocks to the Ticket

Embedding Retrieval Merges Similarly Named Issuer Entities in Data-Cleansing Pipeline

A Data-Quality Agent Deduplicating Issuer Records Across Multiple Source Feeds Using Embedding Similarity Over Issuer Names, Rather Than Matching on a Unique Identifier Such as LEI or CUSIP Issuer Code, Merges Two Distinct Issuer Entities With Coincidentally Similar Names Into a Single Record, Corrupting Downstream Holdings and Exposure Calculations

Embedding Retrieval Misroutes Alert via Similar Runbook Match

An Alert-Routing Agent That Decides Which Team to Page by Retrieving the Most Semantically Similar Past Incident Runbook for the Incoming Alert Text Pulls a Lexically Similar but Substantively Different Runbook -- Written for a Different Service With Overlapping Error-Message Vocabulary -- and Pages the Wrong Team

Embedding Retrieval Misroutes Ticket via Similarity to Wrong Product-Line Taxonomy Node

A Ticket-Routing Agent That Classifies an Incoming Ticket's Product Category by Embedding Similarity Against a Product-Taxonomy Description Index, Rather Than Against the Account's Actual Provisioned Product List, Matches the Ticket to a Superficially Similar but Incorrect Product Line, Routing It to a Specialist Queue That Cannot Resolve the Customer's Actual Issue

Embedding-Retrieval Pulls Competitor Claim into Own Content

A Content-Generation Agent's RAG Step, Used to Ground Marketing Copy in "Similar High-Performing Content" Retrieved from a Crawled Corpus, Pulls in a Factual or Comparative Claim from a Competitor's Published Content Because It Is Embedding-Similar to the Target Topic, and the Agent Incorporates That Claim into the Brand's Own Copy as If It Were a Verified, Brand-Owned Fact

Embedding Retrieval Pulls Deprecated Style-Guide Version as Current

A Content-Generation Agent's Retrieval Step over a Vector Store Containing Both the Current and a Superseded Style-Guide Version Ranks the Deprecated Version's Chunk Higher Due to Denser, More Frequently Indexed Older Content, and the Agent Applies Retired Terminology and Tone Rules as if They Were Current

Embedding Retrieval Pulls Discontinued SKU as Demand Analog for New Product

A Demand-Forecasting Agent Generating a Cold-Start Forecast for a New Product by Retrieving the Most Similar Historical SKU via Embedding Similarity Over Product Descriptions Selects a Past SKU That Reads as Similar in Category and Description but Was Discontinued for Demand Reasons Specific to That Product, Producing a Forecast That Inherits a Demand Pattern Unrelated to the New Product's Actual Market

Embedding Retrieval Pulls Generic OSS License as IP Assignment Template

A Contract-Drafting Agent's RAG Step, Asked to Retrieve the Company's Standard Work-for-Hire IP-Assignment Template for a New Contractor Agreement, Retrieves a Lexically and Semantically Similar but Substantively Different Document -- An Open-Source Contributor License Agreement or Inbound-IP Template -- Because Both Documents Share Dense "Intellectual Property," "Assignment," and "License Grant" Vocabulary

Embedding Retrieval Pulls Mismatched Historical Attrition Cohort as Comparable

A Retention-Prediction Agent's Embedding Search over Past Departed-Employee Records Surfaces a Lexically Similar but Substantively Different Attrition Case as the Nearest-Neighbor Comparable, and the Agent Anchors a Current Employee's Risk Score to That Mismatched Precedent

Embedding Retrieval Pulls Mismatched Historical Deal Cohort as Stage-Conversion Benchmark

A Pipeline-Forecasting Agent Justifying Its Stage-Conversion-Rate Assumption for a Set of Open Opportunities Retrieves "Comparable Historical Deals" via Embedding Search over Closed-Deal History, and the Search Surfaces a Cohort of Past Deals That Share Lexical Similarity in Industry Tags or Deal-Name Keywords but Differ Substantially in Buying-Committee Structure or Deal Size, Producing a Stage-Conversion Benchmark That Systematically Overstates or Understates the Forecast for the Current Cohort

Embedding Retrieval Pulls Mismatched Job-Family Leveling Precedent for Offer Band

An Offer-Generation Agent's Embedding Search over Past Leveling Decisions Surfaces a Role with Lexically Similar Title and Description but a Different Career Track or Leveling Framework, and the Agent Anchors the New Offer's Band to That Mismatched Precedent

Embedding Retrieval Pulls Mismatched Rating-Territory Policy Precedent for Renewal

A Policy-Renewal Agent's Retrieval Step Surfaces a "Similar Policy" Precedent via Embedding Similarity to Determine an Appropriate Rate Adjustment for an Unusual Risk Profile, but the Matched Policy Is in a Different Rating Territory With Different Loss Experience, Leading to a Mispriced Renewal

Embedding Retrieval Pulls Mismatched Rep Playbook for Quota Coaching

A Quota-Coaching Agent's Retrieval Step Surfaces a "Similar Rep" Coaching Playbook Based on Embedding Similarity to a Rep Profile in a Different Territory or Segment, and the Coaching Recommendation It Generates Is Mismatched to the Actual Rep's Deal Dynamics

Embedding Retrieval Pulls Similar-but-Unrelated Past Incident as Resolution Precedent

An Incident-Response Agent That Retrieves a Past Incident's Resolution Steps via Semantic Similarity Search Over Incident Descriptions, Rather Than Matching on Root-Cause Signature or Affected-Component Identity, Surfaces a Past Incident That Reads Similarly but Had a Different Underlying Cause, and Applies That Incident's Resolution Steps to the Current One

Embedding Retrieval Pulls Wrong Analog Supplier's Risk Profile by Name Similarity

A Supplier-Risk Agent, Lacking Sufficient Direct History on a New or Thinly-Documented Supplier, Retrieves a Semantically or Lexically Similar Supplier's Risk Profile as an Analog to Inform Its Risk Score, but the Retrieved Analog Is Selected by Name or Description Similarity Rather Than the Structured Attributes (Industry Code, Ownership Structure, Geography, Tier) That Actually Determine Comparable Risk

Embedding-Retrieval Pulls Wrong Clause Version from Template Library

A Contract-Drafting Agent's RAG Step, Used to Pull the Firm's or Company's Approved Boilerplate Clause for a Given Section (Limitation of Liability, Indemnification, Governing Law) from the Template Library, Retrieves a Lexically Similar but Superseded or Jurisdiction-Wrong Version of the Clause, and the Drafted Contract Is Issued with the Wrong Terms

Embedding Retrieval Pulls Wrong Contract Clause by Lexical Similarity Across Boilerplate Agreements

A Deal-Management Agent Assembling a Custom Order Form or Amendment Retrieves a Liability-Cap or Termination-for-Convenience Clause via Embedding Search over the Company's Contract Repository, and Because Most Enterprise Agreements Share Highly Standardized, Boilerplate Language, the Retrieval Step Surfaces a Clause From a Different Customer's Contract With a Different (and More Favorable to That Other Customer) Negotiated Term, Which the Agent Inserts Into the Current Deal's Document as if It Were the Company's Standard Clause

Embedding Retrieval Pulls Wrong-Jurisdiction Benefits Policy During Onboarding

An Onboarding Agent's Retrieval Step Surfaces a Benefits-Eligibility Policy Document for a Similarly Named but Different Work Jurisdiction or Employment Classification, and the New Hire Is Told Incorrect Eligibility Terms Because the Embedding Match Favored Lexical Similarity Over an Exact Jurisdiction/Classification Match

Embedding Retrieval Pulls Wrong Substitute SKU as Safety-Stock Variance Proxy

To Calculate Safety Stock for a New SKU Lacking Sufficient Sales History, an Inventory-Optimization Agent Retrieves the Most Similar Existing SKU via Embedding Similarity Over Product Descriptions to Borrow Its Demand-Variance Profile, but Selects a SKU That Is Textually Similar Yet Has a Fundamentally Different Volatility Pattern, Producing a Safety-Stock Level Calibrated to the Wrong Risk Profile

Embedding Retrieval Selects Similar but Wrong Canned Response

A Support Agent That Selects a Canned Response or Macro From a Library Via Semantic/Embedding Similarity to the Customer's Message, Rather Than by Matching the Customer's Actual Account State or Issue Category, Retrieves a Response That Is Lexically and Topically Close to What the Customer Wrote but Answers a Different Underlying Situation -- Sending Confident, On-Topic-Sounding Guidance That Does Not Actually Apply to the Customer's Case

Embedding Retrieval Selects Wrong Escalation Playbook by Keyword Similarity

A Sentiment-Escalation Agent That Selects an Escalation Playbook by Embedding Similarity Against a Playbook-Description Index, Rather Than Against the Structured Severity Tier the Conversation Actually Belongs To, Matches the Conversation to a Superficially Similar but Wrong Playbook, Routing It Through an Escalation Path That Does Not Match the Actual Risk Level

Embedding Retrieval Selects Wrong Historical Benchmark Order for TCA Comparison

A Transaction-Cost-Analysis Agent Benchmarking a Trade's Execution Quality Against Historical Comparable Orders Selects the "Most Similar" Past Order Using Embedding Similarity Over Free-Text Order Notes, Rather Than Matching on Instrument, Order Size, and Time-of-Day Liquidity Regime, Producing a Benchmark That Was Never Executed Under Comparable Conditions

Embedding Retrieval Selects Wrong Historical Lane as Transit-Time Benchmark for New Route

A Logistics-Routing Agent Estimating Transit Time for a New Origin-Destination Lane Retrieves the Most Similar Historical Lane via Embedding Similarity Over Route Descriptions, Selecting a Lane That Shares a Similar Region-Pair Label but Has a Materially Different Mode or Border-Crossing Profile, Producing a Transit-Time Estimate the Agent Then Commits to a Customer as an ETA

Embedding Retrieval Selects Wrong Reference Instrument for Freshness Benchmark

A Market-Data Freshness-Monitoring Agent Checking Whether an Illiquid Instrument's Price Is Plausibly Current Selects a "Comparable" Reference Instrument Using Embedding Similarity Over Free-Text Descriptions Rather Than Matching on Sector, Duration, and Credit-Quality Attributes, Producing a Freshness Benchmark That Moves Differently From the Instrument Being Checked

Embedding Retrieval Surfaces Deprecated Help Article in Deflection Suggestion

A Self-Service Deflection Agent's RAG Step, Used to Suggest a Help Article to Resolve a Customer's Question Without Human Involvement, Retrieves a Lexically and Semantically Similar but Deprecated or Product-Version-Mismatched Article Instead of the Current Correct One, Deflecting the Customer With Stale Instructions Framed as the Solution

Embedding Retrieval Surfaces Similarly Named, Unrelated Subsidiary in Corporate-Structure Chart

A Due-Diligence Agent Building a Target Company's Corporate-Structure Chart From Filings and Registry Data, Using Semantic Similarity Search to Match Entity Names Across Documents, Merges or Links a Subsidiary Into the Target's Structure Based on Name Similarity Alone, When the Matched Entity Is in Fact an Unrelated Company With a Coincidentally Similar Name

Embedding Retrieval Treats Mismatched Prior Claim as Confirming Precedent

A Quality-Control Agent's Self-Check Retrieves a Previously Approved Statistical Claim via Embedding Similarity to "Confirm" That a New Claim Is Accurate, but the Retrieved Precedent Is for a Different Year, Population, or Methodology, So the Confirmation Is Not Actually Evidence the New Claim Is Correct

Embedding-Retrieval Wrong Endorsement Version Applied

A Claims-Adjudication Agent's RAG Retrieval Step Pulls a Lexically Similar but Superseded or Wrong-State Policy Endorsement from the Document Store Instead of the Endorsement Actually Attached to the Policy in Force, Causing the Agent to Apply Incorrect Coverage Terms to the Claim

Embedding-Similarity Retrieves Superficially Similar Deal as Precedent

A Lead-Scoring Agent That Justifies Its Score by Retrieving "Similar Past Deals" via Embedding Search over the Closed-Deal History Pulls a Lexically Similar but Substantively Different Deal (Same Industry Keywords, Different Buying Stage or Company Size) and Cites It as Supporting Evidence for an Inflated Score

Multi-Agent Emergent Behavior: Causes and Fixes

Agents interacting live produce unintended behavior -- loops, oscillation, runaway cost -- that never shows up when each agent is tested in isolation.

Emotional Expression Overuse

Agent Overuses Laughter, Exclamation Marks, and Emotional Cues

Emotional Tone Mismatch

Voice Emotion Doesn't Match Message Content or Context

Employment Fabrication Detection Failures

AI System Fails to Detect Fake Employers or Fabricated Employment

Employment History Gap Detection Failures

OCR System Fails to Detect or Flag Gaps in Employment History

Employment Timeline Conflicts

AI System Fails to Detect Inconsistent Employment Dates Across Documents

Empty Allergy-Query Result Documented as Confirmed No-Known-Allergies

A Clinical-Summary or After-Visit-Note Agent Queries a Structured EHR Field for the Patient's Allergy History, the Query Returns Zero Records (Because the Field Was Never Populated, Not Because a Clinician Affirmatively Confirmed the Patient Has No Allergies), and the Agent's Note-Generation Step Renders This as "No Known Drug Allergies" -- an Affirmative Clinical Statement the Underlying Data Never Supported

End-of-Turn Detection

Agent Can't Reliably Detect When User Has Finished Speaking

Entity Confusion

Agent Confuses Similar Entities

AI Extraction Writes Data to the Wrong ERP Fields: Causes and Fixes

Extracted Data Lands in the Wrong ERP Fields

Error Code Semantic Drift

A tool vendor changes what an existing error code means — repurposing a generic `400 Bad Request` to also signal a new condition like "rate limited by a downstream partner" or reusing `409 Conflict` for a newly introduced idempotency-key collision case — without incrementing the API version or announcing a breaking change. The agent's error-handling logic, written against the old, narrower meaning of that code, applies the wrong recovery strategy (e.g. retrying a request that will never succeed, or treating a transient condition as permanent), and because the HTTP status and error code string are unchanged, nothing about the failure looks abnormal at the transport level.

Error Information Leakage

Raw Errors Expose Internal Details and Waste Context

Agent "Fixes" Correct Data and Corrupts It: Causes and Fixes

The agent's own error-recovery step corrects a value that wasn't actually wrong, corrupting good data to satisfy a validation check

Error Response Format Inconsistency

The same tool returns errors in inconsistent shapes depending on which layer of its stack produces the failure — a structured JSON body with an `error.code` field for application-level validation errors, a bare plain-text string for a load balancer timeout, and a full HTML error page for a gateway-level 502 or a WAF block. An agent's error parser, built to expect one shape (usually the documented JSON structure), successfully handles the cases that match it and silently mishandles or crashes on the rest, because the alternate formats don't fail loudly — they just don't match, and the fallback behavior for a non-match is often to treat the response as a generic unknown failure or, worse, to attempt to parse it as JSON and swallow the resulting exception.

Escalation Not Triggered

Agent Fails to Escalate to Human When Required

Escalation Too Early

Agent gives up despite solvable request.

ESG Data Greenwashing Blindness

Agent Incorporates Self-Reported Corporate ESG Disclosures Into Portfolio Scoring at Face Value, Without Adjusting for Known Greenwashing or Disclosure-Quality Variance

Eval-Data Mismatch

Tests do not represent production inputs.

Evaluation Data Leakage

Golden Data Contaminated Training or Model Has Seen Eval Cases

Evaluation Metric Mismatch

Metrics Don't Measure What Actually Matters for Success

Excessive Agency

Agent Takes Actions Beyond Expected Scope

Execution Time Quota

A tool enforces a hard maximum execution time per call (a Lambda-style 15-minute cap, a synchronous API's 30-second gateway timeout, a query engine's statement timeout). When the agent issues a request whose natural completion time exceeds that ceiling — a large data export, a bulk transform, a long-running search — the call is killed at the boundary with no partial results returned and often no clear indication that a timeout, rather than a crash, was the cause.

Expensive Model Cascade

Agent Escalates to More Expensive Models for Tasks That Don't Require Them

AI Agent Triggers Unexpected Side Effects: Causes and Fixes

AI agent's action unexpectedly triggers notifications, billing charges, shipments, or deployments it never intended to cause.

External System Failures

External APIs and Tools Fail, Causing Agent Errors

Extraction Hallucination

LLMs Fabricating or Misreading Values from Mortgage Documents

Extrapolation Beyond Data

Agent Makes Unsupported Inferences

AI Agent Cites Sources That Don't Exist: Causes and Fixes

AI agent invents plausible-sounding citations — studies, articles, or case law — that don't actually exist.

AI Document Extraction Fabricates Content Not in the Source: Causes and Fixes

Fabricated Content Not Grounded in Input

Fabricated Disclosure Figure Fills a Retrieval Gap in Fund Comparison

An Agent Generating a Client-Facing Fund Comparison or Recommendation Document Retrieves Most Required Disclosure Fields (Expense Ratio, Standardized Performance, Minimum Investment) From the Firm's Actual Fund Documents, but When Retrieval Misses One Specific Field for One Fund, Fills the Gap With a Plausible-Sounding Fabricated Number Rather Than Marking the Field as Unavailable

Fabricated Usage-Decline Justification When Analytics Tool Returns Empty

A Proactive Retention Agent That Calls a Usage-Analytics Tool to Determine Why a Customer Has Been Flagged as At-Risk of Churning Receives an Empty or Partial Result -- Because the Customer's Product Tier Is Not Instrumented for That Metric, or the Analytics Service Timed Out -- and Composes a Specific, Plausible-Sounding Usage-Decline Narrative ("You Haven't Logged In Since Early Last Month and Your Team's Usage Dropped 60%") to Justify the Outreach, Rather Than Stating the Actual Usage Data Was Unavailable

Fact-Check Skipped on Statistical Claims

Content-Generation Agent Includes Specific Statistics, Percentages, or Research Citations in Marketing Copy Without a Verification Step Confirming the Figures Are Accurate or the Cited Source Actually Says What the Copy Claims It Says

Fact Context Loss

A retrieval system pulls a fact that is accurate on its own terms, but the qualifying context that makes it correctly applicable — the condition, population, or scope it was originally stated under — is dropped somewhere between the source document and the agent's final answer. The fact survives; the sentence or clause that scoped it does not, usually because chunking, summarization, or context-window truncation separated the fact from its qualifier.

Fact Generalization Error

An agent takes a fact that is true only under narrow, specific conditions — a particular study population, a specific product configuration, a specific regulatory jurisdiction — and presents it as a general truth applicable broadly. The source fact isn't misquoted; the error is in stripping away the scope that made it narrowly true and applying it as if it held universally.

Fact Inversion

An agent retrieves a fact correctly in terms of subject matter but reverses its direction or polarity — reporting "increases" when the source says "decreases," "improves" when the source says "worsens," or swapping which of two entities has the higher value. The topic and the entities involved are right; the relationship between them is flipped, which is often more damaging than an unrelated error because it's confidently stated and directionally opposite to the truth.

Fact Negation Confusion

An agent drops, adds, or misplaces a negation while processing retrieved text, asserting the opposite of what the source actually states. Unlike a full directional inversion, this failure is specifically about negation words and constructions ("not," "no longer," "except," "unless," double negatives) being mishandled during retrieval, summarization, or paraphrase, producing a claim that reads fluently but contradicts the source on the single most important word in the sentence.

Fact Partial Truth

An agent presents a fact that is technically accurate as stated but omits a critical qualifier that would materially change how a user should act on it — not because the qualifier is missing from the source, but because it was dropped somewhere in retrieval or generation and the resulting statement, while not false, is misleadingly incomplete. This differs from a fabrication: every word the agent says checks out against the source, but the selective omission changes the practical meaning.

Fact Probabilistic Mismatch

An agent retrieves a fact that was expressed by its source with explicit probabilistic or statistical framing — a likelihood, a confidence interval, a rate observed in a sample — and restates it as a flat, deterministic certainty, dropping the uncertainty that was integral to the original claim's meaning. The number or direction carried over is often correct; what's lost is the epistemic status of the claim, turning "this happens in about 30% of cases" into "this happens" or "this is what will happen."

Fact Source Confusion

An agent retrieves facts about two distinct entities — companies, people, products, or regulations — that share a similar name, and conflates attributes from one with the other in its response. The resulting statement is internally coherent and often partially correct, but attributes a fact that belongs to Entity A to Entity B, because retrieval matched on name similarity rather than correctly disambiguating which entity the query actually concerns.

Fact Timestamp Error

An agent retrieves a fact that was true during a specific window of time and applies it outside that window, because the fact's temporal validity period was mishandled — the agent misattributes when the fact was true, or fails to notice that the fact is now outside its valid period. Unlike a stale cache issue, this is specifically about misreading or mismanaging the time-scoping of the fact itself: applying a 2019 regulatory limit as though it were still current in 2026, or applying a "current" fact to a past scenario the user is actually asking about.

AI Agent Factor-Crowding Blindness: Causes and Fixes

A portfolio-recommendation model recommends factor exposures with no awareness of market-wide crowding, causing correlated unwind risk when crowded positions all retreat at once.

Failover Correctness Failure

A failover mechanism does exactly what it's supposed to on the surface — it detects the primary's failure, promotes a standby, and traffic resumes flowing within the expected time — but the standby produces incorrect results once it's live. This is distinct from failover being slow (failover-delay-too-long) or losing data in flight (failover-data-loss): here the mechanics of the switch itself work, but the standby was running different code, stale configuration, an outdated model version, or an incomplete replica of reference data, so it silently serves wrong answers with full apparent availability.

Failover Data Loss

When failover to a standby is triggered, writes that were in flight to the primary at the moment of failure — accepted by the client as successful, or in the process of being processed — never make it to the standby and are permanently lost. This is distinct from replication lag causing the standby to be generally behind (recovery-point-objective-miss is the measurement of that gap); this pattern is about the specific in-flight requests that were being processed at the exact instant of the failure, which fall into a gap between "already acknowledged to the client" and "durably replicated to the standby."

Failover Delay Too Long

The failover mechanism eventually works — the standby is correct, no data is lost, no state is corrupted — but it takes materially longer to complete than the service's defined SLA or failover-time objective, extending customer-visible downtime well beyond what was promised or designed for. This is purely a timing failure: every other part of the failover (detection, promotion, correctness) can be functioning as designed, but the accumulated latency across detection, decision, and cutover steps blows through the target window.

Failover State Corruption

During the process of transferring state to a failover instance — replicating in-memory session data, migrating an in-progress agent execution context, transferring a partially-written data structure — the state itself becomes corrupted in transit, so the standby comes up with internally inconsistent or malformed data rather than a clean (if slightly stale) copy. This differs from failover-data-loss (specific writes missing entirely) and failover-correctness-failure (standby running stale-but-internally-consistent code/config): here the transferred state is actively broken — partial objects, torn records, mismatched cross-references — because the transfer mechanism itself was not atomic or crash-safe.

Fair Lending Red Flag Detection Failures

OCR System Fails to Detect Fair Lending Compliance Concerns

False Completion Claim

Agent says done when action was not completed.

False Premise Acceptance

System Accepts User's Incorrect Assumptions

Faulty Decomposition

Agent Breaks Down Task Incorrectly

Feature Entitlement Limit

An agent calls a tool feature or API endpoint that exists and is documented, but the calling account's subscription tier doesn't actually include entitlement to it — the feature is gated behind a higher plan. The agent's tool-selection logic was built (or tested) against a fuller-featured tier and has no awareness that entitlements vary by account, so it attempts the call as a matter of course and only discovers the gap when the tool rejects the request, often deep into a multi-step task where a cheaper, entitled alternative was available but never considered.

Feature Flag Disabled

A tool capability the agent's logic depends on is gated behind an account- or environment-level feature flag that the vendor has not enabled for this particular customer, tier, or region. The agent has no API-level way to check whether the flag is on before calling the feature, so it discovers the gap only when the call fails or silently no-ops, and the failure looks identical to a bug in the agent's own code rather than an environment configuration gap.

Feature Flag Toggle Lag

An operator flips a feature flag controlling agent behavior — for example, disabling a newly-launched tool that's producing bad outputs, or switching the active system-prompt variant — expecting the change to take effect immediately across the fleet. In reality, flag state propagates to running agent instances on a delay: some instances poll the flag service on an interval, some cache the value in memory for a TTL, some read it only once at process startup. For anywhere from tens of seconds to several minutes, different agent instances (and sometimes different requests within the same instance) are operating on inconsistent flag state, so some users get the old behavior and some get the new one simultaneously, and an emergency kill-switch doesn't actually stop the behavior it was meant to stop right away.

Feedback Ambiguity

Feedback says 'bad' but not why.

Feedback Not Incorporated

Human Corrections Ignored in Subsequent Agent Decisions

Feedback Sparsity

Not enough signal to learn safely.

Field Length Limit

Text fields in most APIs have a maximum length — a ticket description capped at 4,000 characters, a product title capped at 200, a commit message capped at 72 characters for the summary line. When an agent generates the content for such a field with an LLM (a summary, a composed message, a generated description), the output length is not guaranteed to respect the target field's limit, since the generation step and the submission step are typically decoupled. The tool either rejects the write outright or, more insidiously, silently truncates the string mid-word or mid-sentence, producing corrupted or nonsensical stored content that the agent has no way of detecting from a success response alone.

Field-Level Access Not Restricted

A table or record type has some fields an agent should be permitted to see (e.g., order status, ticket subject) and others it shouldn't (e.g., internal margin, a customer's raw payment token), but the access-control system was built to grant or deny access at the record level only. Once an agent is authorized to read a record at all, every field on it — including the ones that were never meant to be exposed to that agent or context — comes along for free, because there's no enforcement point that operates below record granularity.

Fill-Confirmation Status Trusted Without Diffing Against Submitted Order Intent

An Execution Agent Receives a "Filled" or "Success" Status From an Order-Management/Broker Tool and Narrates the Trade as Correctly Executed Based on That Status Alone, Without Comparing the Confirmation Payload's Own Symbol, Quantity, Side, and Price Fields Against the Order It Actually Submitted

Filler Word Mishandling

ASR Misinterprets or Fails to Filter Conversational Fillers

Financial Distress Signal Blindness

Agent's Supplier Risk Monitoring Relies on Quarterly or Annual Financial Statements, Missing Faster-Moving Distress Signals That Precede a Supplier Failure by Months

Fine-Tuning Data Poisoning

Poisoned Training Data Causes Agent to Behave Maliciously or Unreliably After Fine-Tuning

Follow-Up Context Loss

Agent Doesn't Maintain Context Across Conversation Turns

OCR Misreads Stylized Fonts and Logos: Causes and Fixes

OCR fails on decorative fonts, stylized brand typography, and logos, consistently misreading the same sources

Font Substitution Detection

AI System Fails to Detect Font Inconsistencies Indicating Document Tampering

Footnotes Merged Into Body Text or Lost: Causes and Fixes

Agent Appends Footnotes as Inline Text Instead of Linking Them to Their Reference

Invoice Automation Breaks on Non-Standard Vendor Formats: Causes and Fixes

Document Format Diversity Overwhelms Rule-Based Extraction

Fraudulent Document Detection Failures

OCR System Fails to Detect Altered, Forged, or Fabricated Mortgage Documents

Full Reprocessing on Incremental Change

A Small Edit to a Source Document Triggers Full Re-Embedding/Re-Analysis of the Entire Document Instead of an Incremental Update to Just the Changed Portion

Geographic Data Access Restriction

Data subject to geographic access or residency restrictions — most commonly EU personal data under GDPR, but also sector-specific rules like data-localization laws — is returned to an agent whose processing, storage, or invoking context sits outside the permitted region. This happens when the tool layer checks whether the requester is authorized in a general sense but doesn't verify that the specific data-residency or cross-border-transfer condition is also satisfied for that particular request.

Geopolitical Risk Blindness in Supplier Risk Scoring

Agent's Supplier Risk Score Is Based on Financial and Delivery-Performance History Alone, Missing Geopolitical Exposure That Has Not Yet Materialized as a Performance Problem

Goal Drift

Agent Loses Focus on Original Objective

Goal Drift Across Turns

Agent's objective changes over long conversations or workflows.

Goal Drift and Task Mutation

Agent Gradually Modifies Its Own Goals or Learns Unintended Behaviors Over Time

Goal Expansion / Scope Creep

Agent performs additional actions that were not requested.

Golden Data Coverage Gaps

Golden Dataset Missing Critical Scenarios or Edge Cases

Golden Data Staleness

Golden Dataset Contains Outdated Information or Expectations

Graceless Call Ending

Call Ends Awkwardly Without Natural Closure

Granular CRUD Permission Not Enforced

A role is defined with fine-grained access — e.g. "read-only" or "can create tickets but not delete them" — but the tool wrapper the agent calls exposes the underlying API's full create/read/update/delete surface regardless of which operations the role is actually meant to permit. The agent, having no operation-level gate in the tool itself, can invoke update or delete through a tool nominally scoped to a narrower capability.

AI Agent Citations Point to the Wrong Level of Detail: Causes and Fixes

AI agent cites an entire document when a specific section is needed — or vice versa — leaving the user to search for the actual supporting passage.

Guideline Conflict Resolution Failure

Agent Cannot Reconcile Conflicting Recommendations From Different Clinical Guideline Bodies and Defaults to an Arbitrary or Most-Recently-Retrieved Source

Hallucinated Completion When Upstream Dependency Fails

When an agent's external API call (validation, lookup, confirmation) times out or fails, the agent completes a plausible result claiming success instead of treating failure as a blocking condition; downstream systems trust the fabricated success status

Hallucination: Attributes

Model Hallucinates Object Attributes Not Present in Input

Hallucination: Base Mechanism

Large Language and Vision Models Generate Plausible but False Content

Hallucination and Confidence Miscalibration

Model Confidence Doesn't Match Answer Reliability (Hallucination Sub-Pattern)

AI Agent Hallucinates Facts Not in Retrieved Context: Causes and Fixes

AI agent generates information that sounds plausible but isn't actually present in the documents it retrieved.

Hallucination: Objects

Model Hallucinates Objects or Fields Not Present in Input

Handoff Accountability Loss

An agent completes its portion of a multi-agent workflow and hands the remaining work to another agent, but no entity is ever explicitly marked as the owner of the outstanding task after the transfer. Both the sending agent and the receiving agent treat the handoff itself as the completion event, rather than the downstream task being resolved. The task sits in the receiving agent's queue, an inbox, or a shared work-item store with no active owner tracking it to completion, and it silently stalls.

Handoff Approval Skipped

A workflow is designed so that one agent must obtain sign-off from a human or a designated approval agent before handing a task to the next agent in the chain, but the handoff occurs without the gate being satisfied. This happens most often when the approval step is implemented as a soft convention rather than a hard dependency — the sending agent's code path can reach the handoff call whether or not the approval response was received, correct, or even requested. The receiving agent, having no way to know an approval was expected, proceeds to execute.

Handoff Circular Dependency

Two (or more) agents are each configured to hand off a task to the other under specific conditions, and those conditions form a cycle: Agent A decides the task needs Agent B's capability and hands it off, Agent B decides the task actually needs Agent A's capability and hands it back, and neither agent's handoff logic contains a way to recognize that the task has already been through this loop. The task bounces indefinitely (or until an unrelated resource limit like a timeout or step cap kills it) without either agent making progress on the underlying work.

Handoff Context Incompleteness

When one agent hands a task to another, it passes along a summary or subset of the context it accumulated, rather than the full working state. The receiving agent then either proceeds on incomplete information (producing a subtly wrong result) or has to spend additional tool calls and turns re-deriving context the sending agent already had — re-reading source documents, re-querying an API, or asking the user to repeat information already provided upstream.

Handoff Idempotency Violation

A handed-off task gets executed more than once because the handoff mechanism retries on a suspected failure (timeout, dropped acknowledgment, transient network error) without any way to detect that the receiving agent already processed the original attempt. The receiving agent has no concept of "I've seen this task ID before" and treats each retry as a fresh, independent instruction, resulting in duplicate side effects — a second email sent, a second charge issued, a second record created.

Handoff Permission Downgrade

The sending agent hands off a task assuming the receiving agent has sufficient permissions to complete it, but the receiving agent actually operates under a narrower permission set — a different service account, a scoped API token, or a role with fewer grants. Rather than failing loudly, the task often degrades silently: the receiving agent's tool calls are denied or return partial results, and it either produces an incomplete output without flagging the gap or falls back to a lower-quality path that masks the permission problem entirely.

Handoff Protocol Version Mismatch

The sending agent packages a handoff using one version of the task schema (field names, required/optional fields, encoding conventions) while the receiving agent was built against a different version. The two versions overlap enough that the handoff doesn't fail outright — the receiving agent parses the payload without an error — but fields have been renamed, restructured, or reinterpreted between versions, so the receiving agent either misreads a field's meaning or silently drops fields it doesn't recognize.

Handoff Rollback Failure

After a task is handed off, the receiving agent fails partway through execution, and the workflow attempts to roll back to the pre-handoff state — but the rollback cannot be cleanly performed. This happens because the receiving agent has already taken irreversible or partially-irreversible actions (sent a message, committed a write, called an external API with a side effect), and no compensating action exists, or the sending agent no longer has the context or authority to undo what the receiver did.

AI Agent Handoff Loses Upstream Confidence Signal: Causes and Fixes

An upstream agent flags low confidence or ambiguity in its free-text reasoning, but the structured handoff schema passed to the downstream agent -- a common MCP/tool-call handoff pattern -- carries only the final value and status. The confidence/provenance signal is invisible to the downstream agent, which uses the value with full confidence.

Handoff State Loss

Task state accumulated by the sending agent — intermediate results, partial progress, resolved variables, in-progress computation — fails to fully transfer to the receiving agent during a handoff. Unlike context incompleteness, where a summary deliberately omits detail, state loss is typically accidental: a serialization step drops fields, a transport mechanism truncates a payload, or the receiving agent initializes its own fresh state instead of loading the transferred one, and the task effectively restarts from a blank slate without anyone intending it to.

AI Agent Handoff Timing Mismatch: Causes and Fixes

A task is handed off to another agent before it's ready to receive it, or after its action deadline has already passed. In both directions, the handoff is transmitted successfully at the protocol level (in LangGraph, CrewAI, or a custom message-queue-based orchestration) but arrives at the wrong moment for the receiver to do anything useful with it — the receiving agent might still be cold-starting, mid-way through another task, or the task's validity window may have already elapsed by the time it's actually read.

OCR Fails on Handwritten Text and Signatures: Causes and Fixes

OCR/ICR returns garbled or nonsensical text on handwritten form fields and signatures

Happy-Path-Only Evals

Edge cases are missing from tests.

Headers and Footers Leak Into Extracted Body Text: Causes and Fixes

Agent Interleaves Repeating Headers/Footers Into Body Content

Health Check Flapping

An agent instance's health check oscillates rapidly between healthy and unhealthy — not because the instance is genuinely alternating between working and broken, but because the check itself is measuring something noisy near a hard threshold (e.g., LLM inference latency hovering right around a 2-second cutoff, or memory usage from a request-scoped context cache sawtoothing above and below a limit). Each flip triggers the orchestrator to pull the instance from rotation and then add it back, repeatedly, which causes constant partial-capacity loss, connection churn for any in-flight sessions on that instance, and load balancer/service-mesh reconfiguration overhead — all without the instance ever being reliably unhealthy or reliably healthy.

Herbal & Supplement Interaction Blindness

Agent Checks Prescription-Drug Interactions but Ignores Patient-Reported Supplements and Herbal Products

Hesitation Mishandling

Agent Pressures Hesitant Callers Instead of Providing Low-Friction Options

Hidden Requirement Miss

Agent misses unstated but critical constraints such as policy, geography, role, or SLA.

Hidden Tool Costs Not Visible

An agent calls a tool whose advertised, per-call price is small or fixed, but the tool internally fans out to other billable services to fulfill the request — a "web search" call that triggers a paid image-recognition pass on every result thumbnail, or a "document lookup" that silently invokes an OCR sub-API for scanned PDFs. The agent's cost tracker only sees the price of the outer call, so its running budget total is systematically wrong, and the discrepancy is invisible until the vendor's actual invoice includes line items the agent never logged.

High-Effort Ticket Misrouting

Support Ticket Routing Model Routes Complex Issues to Tier-1 (Auto-Response); Requires Escalation After Wasted Time

AI Agent HIPAA De-Identification Failure: Causes and Fixes

An agent produces "de-identified" patient samples, clinical samples, or a patient-level database extract for research or analytics that still contains re-identifiable information

HMDA Data Extraction Errors

OCR System Incorrectly Extracts Data Required for HMDA Reporting

Homophones Confusion

ASR Selects Wrong Word Among Sound-Alike Options

Human-in-the-Loop Bypass

Circumventing Human Approval Controls

Human Unavailability

No Fallback When Required Approver Is Unavailable

Hyperscaler Cold Start Lag in Auto-Scaling

Auto-Scaling Agent Doesn't Account for Cloud Provider Cold-Start Latency; Instances Take 2-5 Min to Start; Traffic Lost During Gap

Idempotency Failure

Agent repeats a write action and creates duplicates.

Identity Manipulation

Agent Can Be Manipulated Into Adopting Different Personas or Revealing Prompt

Image Contradiction Detection Failure

Model Fails to Detect Logical Contradictions Across Multiple Images

Image Forensics Failures

AI System Fails to Detect Manipulated Images in Documents

Imaging Report Discrepancy Blindness

Agent Summarizes the Radiology Impression Line Without Reconciling It Against the Ordering Clinician's Stated Question or Prior Comparison Imaging

Implicit Requirements Missing

Agent Misses Unstated but Expected Aspects of Query

Income Calculation Errors

OCR Incorrectly Extracts or Calculates Borrower Income from Documents

Income Triangulation Failures

AI System Fails to Reconcile Income Across Multiple Document Sources