AI agents hallucinating tool call parameters — wrong types, invented fields, malformed arguments
7 patterns
AI agents hallucinating tool call parameters — wrong types, invented fields, malformed arguments. We've tracked 7 distinct AI Tool Parameter Hallucination patterns across production AI agent deployments — most commonly in Operations, Reasoning and Thought, Speech and Audio systems. One recurring example: Account-Level Data Scope — In a multi-tenant SaaS product, a tool call made on behalf of one customer account is scoped using the wrong tenant/account identifier, causing the agent to read or write data belo…
Each pattern below documents the specific failure mode, why it happens, and how teams have mitigated it in practice — use this page as a reference when building guardrails, writing evals, or debugging an agent that's already misbehaving in this way.
In a multi-tenant SaaS product, a tool call made on behalf of one customer account is scoped using the wrong tenant/account identifier, causing the agent to read or write data belonging to a different customer entirely. This typically happens when the account ID is derived from a stale cache, a URL/session parameter that wasn't re-validated, or a default value used when the true tenant context is missing from the request.
Agent Omits Required Tool Parameters
A router selects a model version that doesn't support a specific feature the calling code assumes is available — a particular tool-calling schema format, a structured-output mode, a system-message convention, or a token/parameter that a newer or older version handles differently — causing the call to fail, silently ignore part of the request, or behave unexpectedly. The mismatch arises because routing logic treats models within a family as interchangeable by name/cost/latency, without tracking per-version feature support as a routing constraint.
An agent constructs a downstream command, query, or markup document by directly interpolating its own generated text (or text derived from user/tool input the agent passed through) into a SQL statement, shell command, or HTML page without parameterization or escaping. Because the interpolated content can contain characters with special meaning in the target language, it can alter the structure of the command rather than being treated as inert data — the classic injection pattern, but with the agent's own generated or relayed text as the injection vector instead of a raw user form field.
Agent Passes Wrong Parameter Types to Tools
Vague or Poor Tool Descriptions Cause Wrong Tool Calls or Bad Parameters
The agent mistranslates its own document understanding into tool call parameters, silently extracting from the wrong page or region