Why AI agents fail at tool calling

AI agents usually do not fail at tool calling because they cannot emit JSON. They fail because a real tool workflow is a small distributed system: choose the right interface, satisfy its contract, preserve values across calls, recover from errors, verify the side effect, and stop only when the task is actually complete.

The current Agent Death Trap board makes the gap visible. In the single-tool grounding room, 36 of 44 models earn a perfect aggregate outcome. In the underdocumented multi-step tool chain, zero of 44 are perfect and eight fail outright. In the tool maze, only four are perfect; the other 40 are partial, wrong, failed, refused, or errored.

Calling a function is easy. Maintaining a correct transaction across a hostile sequence is not.

The three tool rooms

The average damage is 2.32 HP in toolUse, 9.80 in toolChain, and 9.82 in toolMaze. Complexity, not syntax, creates the failure surface.

1. The agent trusts the tool list too much

Tool descriptions are data, and data can be stale. The benchmark's grounded tool room labels wiki_search as recommended. It works and returns a confident answer, but the answer comes from an old index and has no citable revision ID. The correct path is the more awkward ask_question tool.

The tool-chain room repeats the pattern. A recommended ticket search returns the wrong account from a cached snapshot. The agent has to list the candidates and select the account that is both active and in the requested region.

This is the retrieval version of prompt injection: the mistake is not malformed JSON but unearned trust. A reliable agent treats tool metadata and tool output as claims to validate, not authority.

2. A JSON-looking value is not a JSON object

One MiniMax-M2.7 trace shows the most common integration bug in miniature. The citation tool expects a nested object, but the model sends a serialized string inside the object:

{"citation":"{\"revisionId\":255484}"}

The tool returns the exact required shape. The model repeats the same invalid call three times. Later, in the tool chain, it makes the same category error by sending the entire nested body as a string. It has all the right values and still cannot cross the API boundary.

Strict JSON Schema helps, but only if the provider and adapter preserve structured arguments end to end. Validate the parsed value at the tool boundary, and return field-level errors rather than a generic failure.

3. The agent preserves meaning instead of identity

Agents are good at paraphrasing. Tool workflows often require the opposite.

The benchmark returns opaque values such as revisionId, balanceToken, requestId, and leaseId. They may look interchangeable, but only one is valid in the next call. In one gpt-5-nano trace, the model initially uses the account balance, 4200, where the API requires the opaque balance token, 391547. It recovers after an error, fetches the record, and commits with the exact token.

Do not ask the model to remember opaque values in prose. Store tool results in typed state and pass references programmatically. The model should decide which field to use; application code should preserve the bytes.

4. State decays across a long chain

The tool-chain commit needs values from three earlier calls: a session ID, an account ID plus balance token, and a policy reference. It also needs a new idempotency key and a safe dry_run mode. Each field is easy alone. Together they create a state-tracking problem.

This is why a model can look excellent in chat and still fail as an agent. The model is repeatedly converting structured observations back into a conversational context, then reconstructing a transaction from that context. One missing field, confused decoy, or reformatted token invalidates the whole call.

A better harness maintains an explicit state object, records provenance for every value, and generates the final request from validated state rather than from the model's free-form recap.

5. The agent mistakes progress for completion

In the tool maze, writing a new secret only stages it. A separate commit makes the change real. One gpt-5-nano trace generates the correct token and writes it successfully, then stops with: The new secret is staged but not yet committed. Please commit to finalize. The agent understands exactly what remains and still hands the job back unfinished.

This last-mile failure appears constantly in production agents: draft created but not sent, file edited but not saved, cart filled but not checked out, migration generated but not applied.

Define completion in machine-checkable terms. After the model says "done," query the system of record and assert the postcondition. A success sentence is not a success signal.

6. Recovery becomes repetition

Useful errors should change the next action. Weak agents often treat them as prompts to retry the same call with cosmetic edits.

MiniMax-M2.7 repeats the same stringified body after receiving the required object shape. A Qwen3.6 Plus run goes far enough into repetitive calls that the provider rejects the conversation for an apparent loop. Both failures come from the same missing control rule: a retry must carry a new hypothesis.

Track error fingerprints. If the tool name, arguments, and error are unchanged, block the retry and require a strategy change. Cap attempts per tool, but preserve enough budget for a legitimate discovery call followed by a corrected request.

7. Fluent output hides an empty trace

The most dangerous failure is fabricated completion. In one gpt-5-chat tool-maze trace, the model emits a service name and says the secret was rotated without making the required tool calls. The sentence sounds finished; the trace is empty.

This is why agent evaluation must grade the complete trajectory. A final-answer judge cannot distinguish a real side effect from a convincing status update. Agent Death Trap's verifier reads the calls, returned values, and final state before assigning the outcome.

How to make tool calling more reliable

• Give every tool a real schema, examples for nested fields, and stable error codes.
• Keep opaque values in typed application state instead of conversational memory.
• Separate planning from execution, and validate arguments before side effects.
• Make destructive operations explicit; do not let a missing mode default to live.
• Require a changed hypothesis after an identical error.
• Verify postconditions against the system of record before reporting success.
• Test with stale-but-plausible tools, decoy fields, malformed responses, and partial commits.
• Score full traces and retry cost, not just whether the final sentence looks correct.

The model still matters. All four perfect tool-maze results on this board belong to GPT variants, while several smaller models die in that room. But harness design determines whether a model's small mistake becomes an actionable error, an infinite loop, or a production incident. The AI agent benchmarks guide explains why full-trace evaluation matters; the methodology documents the deterministic outcomes behind these examples.