Tool-use errors are the most measurable and recoverable failure mode
Tool-use failures—like format errors, timeouts, garbled output, and invalid actions—are the most concrete and predictable cause of agent failure. In a study of 696 model-task trajectories across six model families, tool errors and invalid actions were among the top features predicting task success, with a logistic regression model achieving 97% ROC-AUC (a near-perfect ability to distinguish successful from failing trajectories) [5]. This means tool-use problems are not just common; they are highly diagnostic of whether an agent will succeed or fail.
Crucially, tool-use errors are also the most recoverable. A dedicated recovery framework called Monitor-Classifier-Recovery (MCR) was tested on writing and programming tasks and, when combined with a multi-agent strategy optimization method (MAGRPO), boosted complex task success rates from 42% to 86.7% and resolved 92.6% of problems [1]. This shows that while tool-use errors are frequent, they can be systematically fixed with the right architecture—unlike deeper memory or planning issues.
Memory failures are the most fundamental architectural weakness
While tool-use errors are recoverable, memory failures strike at the core of an agent's ability to function over time. The Stateless Intelligence Memory (SIM) problem is defined as the structural inability of an AI agent to maintain coherent context across sessions, agents, and time [4]. This is not a minor bug: the paper argues that over 80% of enterprise AI initiatives report no measurable business impact, and Gartner projects that over 40% of agentic AI projects will be cancelled by 2027, largely due to this context continuity problem [4].
The SIM paper further shows that no existing approach—knowledge graphs, retrieval-augmented generation (RAG), episodic memory, or neurosymbolic systems—satisfies all five necessary conditions for context continuity [4]. This suggests that memory failures are not just common but are a hard architectural limitation that incremental fixes cannot solve. Other studies confirm that memory-related security failures, such as retrieval poisoning (where an agent's stored information is corrupted), have a high mean security break rate of 0.47 ± 0.09 [2], meaning nearly half of all attempts to exploit memory succeed.
Planning errors are critical but often tied to tool or memory issues
Planning failures—such as goal hijacking, authorization confusion, and sequential errors—are a major concern, but they frequently overlap with tool-use and memory problems. In a security evaluation of eight agent architectures, planning manipulation had a mean security break rate of 0.44 ± 0.11, and authorization confusion correlated strongly with objective and tool hijacking (correlation coefficients of 0.63 and 0.58, respectively) [2]. This means that when an agent's planning is compromised, it often leads directly to unauthorized tool use or corrupted objectives.
A defense-in-depth framework called TRACER-AI, which monitors planning integrity alongside tool risk and prompt injection, reduced attack success rate to just 3.6% while preserving 99% of benign task success [3]. This shows that planning errors can be mitigated, but only when combined with checks on tool use and memory. The key insight is that planning, memory, and tool-use are not independent failure modes—they interact, and fixing one often requires addressing the others.
About These Sources
This answer is built on 5 peer-reviewed studies — published in 2026, 5 from 2024 or later — selected as the most relevant from 6 studies that passed quality screening, drawn from 58 papers retrieved from a database of over 500 million.
Sources used in this answer
Tool-Use Failure Analysis and Recovery Framework for LLM Agents
Tool-use failures are common and recoverable: a Monitor-Classifier-Recovery framework boosted complex task success from 42% to 86.7% and resolved 92.6% of problems in writing and programming tasks.
Agent-Fence: Mapping Security Vulnerabilities Across Deep Research Agents
In a security evaluation of eight agent architectures, the highest-risk failure classes were operational: Denial-of-Wallet (0.62 break rate), Authorization Confusion (0.54), Retrieval Poisoning (0.47), and Planning Manipulation (0.44), with prompt-centric classes below 0.20.
TRACER-AI: A Multi-Layer Explainable Framework for Prompt Injection, Agent Goal Hijacking, and Tool Misuse Detection in Agentic AI Systems
A four-layer defense framework (TRACER-AI) combining prompt detection, goal monitoring, tool-risk control, and explainable decisions reduced attack success to 3.6% and preserved 99% of benign task success, while a standalone prompt detector achieved only 0.679 accuracy.
SIM: Stateless Intelligence Memory — The Context Continuity Problem in AI Agent Architectures
The Stateless Intelligence Memory (SIM) problem—the inability to maintain coherent context across sessions—is a fundamental architectural limitation; over 80% of enterprise AI initiatives report no measurable business impact, and no existing approach satisfies all five necessary conditions for context continuity.
Trajectory Reliability Prediction for Generalist AI Agents: Tool-Use Failure Analysis and Success Forecasting on ZClawBench
In a study of 696 trajectories across six model families, tool errors and invalid actions were top predictors of task success; a logistic regression model achieved 97% ROC-AUC and 0.913 F1-score for predicting trajectory reliability.