{ "title": "32 failure modes in AI-assisted software development", "revised": "2026-09-19", "categories": [ { "id": "context", "label": "Context, specification, and scope" }, { "id": "execution", "label": "Execution and coordination" }, { "id": "verification", "label": "Verification and review" }, { "id": "current", "label": "Behavior, change, and robustness" } ], "evidenceKinds": [ { "id": "research-supported", "label": "Related research", "meaning": "An entry connected to external studies or deployment reports in the source research." }, { "id": "directly-observed", "label": "Local observation", "meaning": "An entry informed by Bradley Gibbs's own Gyre pipeline work. Individual observations support bounded conclusions, not population-wide rates." }, { "id": "operational-inference", "label": "Operational inference", "meaning": "A distinction motivated by how a workflow operates. Related references may inform it without directly establishing the category." } ], "modes": [ { "id": "FM-01", "name": "Unverified handoff contamination", "category": "context", "definition": "An upstream error becomes accepted context for later work, without a return to the source that could contradict it.", "example": "A summary attributes a requirement to a document that does not contain it. Later stages treat the summary as authoritative and build on the false claim.", "consequence": "One unsupported claim can propagate through plans, tests, and code, increasing the amount of work affected by its eventual correction.", "prevent": "Keep source references with consequential handoff claims. Compare those claims with the source before dependent work begins.", "respond": "If a handoff is wrong, correct it and identify which later decisions or artifacts relied on it before deciding what to repeat.", "check": "Preserve a handoff and its sources so consequential claims can be compared. Exact identifiers and quotations can be checked mechanically; whether a summary preserves meaning requires interpretation. A loop with no handoff stage supplies no opportunity to observe this particular pattern.", "limit": "A matching reference does not establish a faithful summary, and a faithful summary can repeat an incorrect source. Attribution needs the original claim, the handoff, and evidence of downstream reliance.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "mast", "whoandwhen" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-02", "name": "Context overload and distraction", "category": "context", "definition": "Irrelevant material competes with the requirements and evidence needed for the task.", "example": "A large context package includes unrelated examples. The agent adopts one of their patterns and overlooks an explicit acceptance criterion.", "consequence": "A requirement can be present in the input yet fail to influence the result. Increasing the context window alone does not resolve relevance or prioritization.", "prevent": "Select context for the current objective, remove duplication, and make controlling requirements easy to locate while keeping additional sources retrievable.", "respond": "If an omission suggests distraction, compare outcomes with a smaller, task-focused input before attributing the error to context volume.", "check": "Count prompts above a stated reference size and reads reported as truncated; retain the actual byte count and affected input. The Gyre mapping uses 128 KiB as a reference threshold, not a universal model limit.", "limit": "These rules detect size and truncation, not distraction. A smaller input can still omit critical context; showing that input volume caused an error needs comparison with other explanations.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "anthropic-context" ], "detection_route": "events", "check_definition_ids": [ "FM-02/oversized-prompt", "FM-02/truncated-read" ], "observation_units": [ "agent invocations", "context reads" ] }, { "id": "FM-03", "name": "Tool and context ambiguity", "category": "context", "definition": "Similar, overlapping, or poorly described tools make the intended operation difficult to distinguish from alternatives.", "example": "An agent chooses a similarly named tool that operates on a different environment, or uses a general capability where a narrower operation was intended.", "consequence": "A plausible tool choice can affect the wrong resource or exceed the scope of the task.", "prevent": "Give tools distinct descriptions, expose capabilities appropriate to the task, and state the relevant environment and permitted effects.", "respond": "If an action is misdirected, inspect its actual effects, correct recoverable changes, and clarify the tool selection that led to it.", "check": "Compare recorded file changes and command effects with explicit permissions. A changed path outside the permitted scope is mechanically identifiable when scope and change capture are complete.", "limit": "The effect does not explain the tool choice or establish confusion. The same file change may also inform scope and constraint-circumvention entries; those labels do not create independent incidents.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "anthropic-context" ], "detection_route": "events", "check_definition_ids": [ "FM-03/disallowed-effect" ], "observation_units": [ "agent invocations" ] }, { "id": "FM-04", "name": "Conflicting authority or instructions", "category": "context", "definition": "Instructions or sources disagree without a clear way to determine which controls the decision.", "example": "An example demonstrates one behavior while the approved design requires another. The agent silently chooses the example or blends the two.", "consequence": "An unresolved product decision becomes an implicit implementation choice that may be difficult to discover later.", "prevent": "Name the controlling requirements and distinguish them from examples, background material, and suggestions. Resolve consequential contradictions before dependent work.", "respond": "When a genuine conflict appears, preserve both statements and obtain a decision from the person responsible for that requirement.", "check": "Preserve clarification questions and the instructions they concern. Structured contradictions can be compared when the relevant rules have a formal representation; prose conflicts need review of the actual statements.", "limit": "A question is not proof of conflicting instructions. Conditional requirements may differ legitimately, while consequential contradictions may never produce a question.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "iheval", "manyih" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-05", "name": "Missing, stale, truncated, or misbound memory", "category": "context", "definition": "Remembered or carried-forward information is missing, outdated, truncated, or associated with the wrong task.", "example": "A decision from an earlier session is treated as current even though its source has changed, or information from another project enters the current task.", "consequence": "Work can be internally consistent while depending on facts that no longer apply.", "prevent": "Use identifiable source records for consequential decisions, verify relevant versions, and make missing or truncated context visible.", "respond": "If a memory mismatch is found, refresh the affected information and review decisions that depended on it.", "check": "Compare controlling-input hashes at readback and record explicitly truncated reads. Keep input identity, expected version, and missing-capture information with the observation.", "limit": "A hash mismatch establishes a byte difference, not its author or cause. Matching bytes establish neither continued truth nor correct use; undelivered or unseen information needs separate investigation.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "anthropic-context" ], "detection_route": "events", "check_definition_ids": [ "FM-05/readback-mismatch", "FM-05/truncated-read" ], "observation_units": [ "readback entries", "context reads" ] }, { "id": "FM-06", "name": "Under-specified objective or completion", "category": "context", "definition": "The objective lacks a sufficiently clear behavioral target or stopping condition.", "example": "A request to improve a feature permits several incompatible outcomes. The agent chooses one and completes work that does not meet the intended need.", "consequence": "Competent execution cannot resolve intent that the task never expresses. An unclear stopping rule can also encourage unnecessary changes.", "prevent": "Describe the desired behavior, relevant constraints, and how completion will be assessed. Allow an evidence-supported no-change result when appropriate.", "respond": "Clarify the ambiguity that changes the outcome, then update the objective and evaluation together before continuing affected work.", "check": "Preserve questions, requirement text, and the evaluation mapping. A task with a deliberately ambiguous decision can compare whether the agent asks or guesses against the decision's specified answer and authority.", "limit": "Filled fields and valid output structure do not establish clear intent. Whether a question is necessary, a default is reasonable, or the task itself is underspecified requires interpretation of the objective.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "openai-signal", "openai-swebench" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-07", "name": "Scope and anti-scope ambiguity", "category": "context", "definition": "The permitted scope and excluded effects are left implicit or open to incompatible interpretations.", "example": "An agent makes a useful adjacent change outside the requested feature, assuming that improving the overall result supplies permission.", "consequence": "Helpful work can still create unauthorized behavior, review burden, or risk outside the agreed task.", "prevent": "State relevant non-goals, resources, and permitted effects. Use enforceable boundaries when the consequence of exceeding them warrants that control.", "respond": "If work exceeds scope, identify the effects and either undo them or obtain a deliberate scope decision before carrying them forward.", "check": "Compare paths changed during each agent invocation with the task's allowed write scope. Count observed path effects against the invocation population, retaining their shared source evidence.", "limit": "File scope cannot establish whether behavior inside an allowed file was authorized. Final snapshots miss transient changes, and thousands of dependency files can arise from one installation rather than thousands of independent mistakes.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "openai-monitor", "openai-gpt56" ], "detection_route": "events", "check_definition_ids": [ "FM-07/out-of-scope-write" ], "observation_units": [ "agent invocations" ] }, { "id": "FM-08", "name": "Task decomposition overload", "category": "context", "definition": "One assignment contains more dependent concerns than the agent can reliably complete together.", "example": "A request combines design interpretation, test design, implementation, and documentation. Later obligations receive superficial treatment or disappear.", "consequence": "A plausible overall result can conceal omitted work, especially when the missing concern has no independent check.", "prevent": "Separate concerns where doing so improves focus, with explicit outputs and enough shared context to preserve dependencies.", "respond": "If omissions recur, compare a narrower assignment with the combined task, including handoff cost and the quality of the final result.", "check": "Retain unusable returns, elapsed time, and files changed per invocation as evidence for investigation. Compare missed obligations and final outcomes on combined and decomposed assignments.", "limit": "Time, file counts, and response failures are not an overload diagnosis. A comparison must account for task difficulty and the information and coordination costs introduced by splitting it.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "metr", "anthropic-harness" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-09", "name": "Topology mismatch", "category": "context", "definition": "The arrangement of agents and handoffs is poorly matched to the dependencies and information needs of the task.", "example": "Independent research questions are serialized unnecessarily, or tightly coupled code changes are split across agents that repeatedly lose shared context.", "consequence": "Coordination costs and information loss can outweigh the benefit of additional roles. A single agent can also become an avoidable bottleneck.", "prevent": "Choose roles and parallelism from task dependencies rather than assuming that a larger or smaller agent count is inherently better.", "respond": "Compare candidate arrangements on similar work, with comparable budgets and the same outcome criteria, before reorganizing the workflow.", "check": "Record attempts, agent invocations, elapsed time, and evaluated outcomes for later comparison between single-agent, staged, and specialist arrangements.", "limit": "One arrangement's trace supplies no counterfactual. Meaningful comparison needs similar tasks, compatible budgets, and the same completion criteria; another model name alone does not create independent evidence.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "mast", "whoandwhen" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-10", "name": "Prompt-only coordination", "category": "execution", "definition": "A workflow relies on instructions alone to coordinate operations that require atomicity or exclusive access.", "example": "Two agents are told not to edit a file at the same time. Both observe it as available and one overwrites the other's work.", "consequence": "A prompt cannot make a check-and-write operation atomic. Lost updates can occur even when each actor attempts to follow the instruction.", "prevent": "Use ordinary synchronization, isolated workspaces, or a single writer where concurrent access can corrupt shared state.", "respond": "If conflicting writes occur, preserve both versions, reconcile the intended changes, and correct the coordination mechanism before repeating the operation.", "check": "Compare run, process, and worktree identities with the expected state and retain observable interference. Inspect the synchronization mechanism separately. Supervisor pauses in a staged workflow and identity mismatches in a simpler loop are different observations.", "limit": "Consistent records do not prove that writes were serialized or that every interfering process was observed. A supervisor action does not establish a coordination failure, and unlike observations should not share a rate.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "operational-inference", "sources": [], "detection_route": "events", "check_definition_ids": [ "FM-10/identity-inconsistency" ], "observation_units": [ "runs" ] }, { "id": "FM-11", "name": "Skipped stage or premature completion", "category": "execution", "definition": "Required work is skipped or rushed while the task is presented as complete.", "example": "A completion report arrives before a required verification step has run, or a stage supplies a placeholder that looks like its expected output.", "consequence": "Later work or human review can begin with an incomplete basis for deciding whether the task succeeded.", "prevent": "Make required transitions depend on the relevant results, and distinguish absent evidence from adverse evidence and successful completion.", "respond": "When a step is missing, complete the specific obligation or report an honest stop. Review substance when a nominally present artifact may be inadequate.", "check": "Check for required artifacts and matching executions of declared commands at each attempt boundary. Record missing artifacts, absent execution records, and incomplete collection distinctly.", "limit": "An artifact's presence does not establish its substance. A command absent from incomplete records cannot be called unexecuted; a completed stage can still fail to satisfy the intended requirement.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "anthropic-harness" ], "detection_route": "events", "check_definition_ids": [ "FM-11/missing-artifact", "FM-11/unexecuted-command" ], "observation_units": [ "attempts" ] }, { "id": "FM-12", "name": "Unverified output or claimed execution", "category": "execution", "definition": "A claim that work was executed or verified lacks matching evidence of that execution.", "example": "A report says tests pass, but no corresponding process result exists, or the result belongs to a different candidate.", "consequence": "A reader may rely on a check that never ran or that does not apply to the delivered work.", "prevent": "Capture the command, candidate, result, and relevant output through the execution system, and connect verification claims to those records.", "respond": "If a claim cannot be reconciled, mark it unsupported and perform the relevant check when feasible. Preserve the distinction between missing records and proven non-execution.", "check": "Compare each execution receipt's candidate identity with the evaluated candidate, and record command timeouts. Keep the command, candidate, result, and evidence source together.", "limit": "These comparisons can establish a binding mismatch or timeout. They do not establish whether the command tested the right behavior, whether an unsupported prose claim is false, or whether missing records imply non-execution.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "openai-monitor" ], "detection_route": "events", "check_definition_ids": [ "FM-12/receipt-mismatch", "FM-12/command-timeout" ], "observation_units": [ "command executions" ] }, { "id": "FM-13", "name": "First-response and action bias", "category": "execution", "definition": "The first plausible answer is accepted too quickly, or receiving an assignment is treated as evidence that a change is necessary.", "example": "An agent changes behavior that already meets the requirement because producing a patch appears to be the expected outcome.", "consequence": "Unnecessary changes consume review effort and can introduce defects without improving the result.", "prevent": "Inspect the initial state and reproduce the reported problem when possible. Include already-correct cases when evaluating the workflow.", "respond": "If the requested behavior is already satisfied, explain the evidence for leaving it unchanged. If the evidence is incomplete, investigate the specific gap.", "check": "Record whether the untouched starting code passes its checks and whether declared commands appear in the agent's execution trace before submission. Distinguish an agent's own execution from a command run later by the surrounding workflow.", "limit": "A passing starting suite does not prove that no change is needed. An unmatched command may reveal a parser limitation; shell redirection and pipelines can hide a valid match from a simplistic detector. Neither observation alone establishes action bias.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "fixedbench" ], "detection_route": "events", "check_definition_ids": [ "FM-13/already-correct", "FM-13/submitted-unrun" ], "observation_units": [ "runs", "attempts" ] }, { "id": "FM-14", "name": "Self-report as state or evidence", "category": "execution", "definition": "An agent's declaration of readiness, completion, confidence, or diagnosis is treated as authoritative workflow state.", "example": "A status display reports success because it copied a model summary, despite a failed or absent execution result.", "consequence": "The same actor can create the work and determine whether it advances, without an independent basis for the transition.", "prevent": "Derive consequential workflow states from observed results and explicit decision rules, with model summaries serving as explanations.", "respond": "If reported and observed state disagree, reconcile the underlying records and correct the status before dependent actions proceed.", "check": "Match explicit success or execution claims against saved evaluation results and command records. Retain the matched text and the scope of the result used for comparison.", "limit": "A deterministic text rule can misread negation, miss paraphrases, or compare claims about different tests. A discrepancy prompts inspection; it does not by itself establish deception or that self-report controlled the workflow.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "openai-monitor" ], "detection_route": "events", "check_definition_ids": [ "FM-14/contradicted-claim", "FM-14/unreceipted-claim" ], "observation_units": [ "attempts" ] }, { "id": "FM-15", "name": "Displaced proof or boundary substitution", "category": "verification", "definition": "A genuine passing check is used as evidence for a different object, execution path, or requirement.", "example": "A unit test exercises a mocked collaborator while the actual integration remains disconnected. Its pass is cited as evidence that the feature works end to end.", "consequence": "Authentic execution can create false confidence when the assertion does not test the claim being made.", "prevent": "Connect each consequential claim to a check that exercises the relevant candidate and behavior. Use real integration paths where the claim depends on them.", "respond": "When proof is displaced, withdraw the unsupported conclusion and run or design a check that can distinguish the required behavior from a relevant defect.", "check": "Collect execution identities, command traces, and results from checks that exercise the relevant boundary. Compare the claim, assertion, candidate, and actual path; use a discriminating behavioral case where the claim permits one.", "limit": "Matching candidate identities and real execution are mechanical facts. Whether the assertion supports the intended claim can require semantic review or an independently specified behavioral test; valid execution alone cannot settle it.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "directly-observed", "sources": [ "overmock" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-16", "name": "Agent-owned disposition", "category": "verification", "definition": "An agent's recommendation is treated as a decision reserved for a human or another authorized actor.", "example": "A review recommends shipping, and that prose is used to mark the work accepted even though no authorized acceptance decision occurred.", "consequence": "A review can redirect, release, or terminate work without the responsible person's decision. A strong recommendation alone is not this failure.", "prevent": "Separate recommendations from decisions, and identify who may authorize scope, acceptance, release, or replacement.", "respond": "If an unauthorized decision advances the workflow, restore the decision point and present the recommendation with its evidence and alternatives.", "check": "Record explicit completion or readiness phrases and the actor responsible for consequential state changes. A vocabulary match and an unauthorized transition are separate observations.", "limit": "A phrase such as “complete” may describe an operation inside the program or a legitimate recommendation. Interpretation and authorization records are needed before calling it an agent-owned decision.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "directly-observed", "sources": [], "detection_route": "events", "check_definition_ids": [ "FM-16/disposition-claim" ], "observation_units": [ "agent invocations" ] }, { "id": "FM-17", "name": "Shared-method agreement", "category": "verification", "definition": "Agreement among reviewers is mistaken for independent corroboration despite overlapping methods or blind spots.", "example": "Two model families read the same diff and approve it. Neither exercises the integration, but their agreement is treated as independent evidence of correct behavior.", "consequence": "Additional opinions can repeat the same omission while making the result appear more reliable.", "prevent": "Choose complementary evidence and methods where independent corroboration matters, such as execution, requirement checks, and code inspection.", "respond": "If an escape reveals a shared miss, identify what each review actually examined and evaluate a targeted method change against comparable defects.", "check": "Preserve reviewer inputs, methods, findings, and which independently established defects each reviewer missed. A one-producer loop without reviewers supplies no reviewer-agreement observation.", "limit": "Agreement and model diversity do not establish independence. A shared blind spot needs evidence of the miss; attributing that miss to a shared method requires further comparison.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "mast", "whoandwhen" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-18", "name": "Environmental or causal misdiagnosis", "category": "verification", "definition": "An environmental or execution condition is confused with a defect in the product, or a product defect is dismissed as an environmental issue.", "example": "A test fails because a service is unavailable. The agent changes application logic to address a defect that the failure did not establish.", "consequence": "A repair aimed at the wrong layer can waste work, conceal the original problem, or introduce a new defect.", "prevent": "Preserve raw failures and relevant environment conditions. Use targeted reproduction to distinguish infrastructure, test, and product explanations.", "respond": "When environmental uncertainty matters, isolate the relevant condition and rerun a discriminating check before deciding which layer needs repair.", "check": "Classify recorded failures as assertion, import/loading, timeout, or other observable error types, and retain whether the next attempt clears the symptom along with the intervening changes.", "limit": "An error class narrows investigation without establishing cause. A disappearing symptom can reflect environmental recovery or masking; product, test, and environment defects can coexist.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "anthropic-noise" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-19", "name": "Measurement/query artifact", "category": "verification", "definition": "An artifact of a query, population, filter, or grading method is reported as a property of the system being measured.", "example": "A repository search silently excludes a file class, and its result is presented as a complete count of the behavior in the codebase.", "consequence": "A precise-looking number can support a false conclusion if its denominator or selection rule does not match the question.", "prevent": "State the intended population and question, inspect the actual query and exclusions, and retain the denominator alongside the result.", "respond": "If the measurement answers a different question, correct the query or narrow the claim and revisit conclusions that relied on it.", "check": "Identify evaluation rows with empty observations and retain the populations, filters, exclusions, and denominators behind reported measurements. Compare them with the intended question.", "limit": "Empty evidence is a useful lead, not proof of a faulty query. A populated row or fully documented query can still answer the wrong question; the population and claim need interpretation.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "openai-swebench", "openai-signal" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-20", "name": "Non-discriminating check", "category": "verification", "definition": "A check does not distinguish the required behavior from the defect it claims to detect.", "example": "A test remains green when the relevant behavior is removed, or fails for an incidental setup error in both good and bad cases.", "consequence": "A passing result provides little assurance when the check would also pass a relevant defect. An insensitive check can also reject valid work.", "prevent": "Use representative known-good and known-bad cases to examine what a check actually responds to, including whether its assertions execute.", "respond": "If the check cannot discriminate, repair its oracle or assertions. If the required condition was never exercised, add that condition to the evaluation environment.", "check": "Parse actual executed-test counts, excluding skipped and pending cases. Flag zero execution, fewer executed cases than the comparable starting run, or starting failures that all share one non-assertion error signature. Use known-good and known-bad cases to assess discrimination separately.", "limit": "These are warning signals about exercised evidence. A shared setup error does not prove a test is useless, and fewer tests may have a legitimate explanation. A negative control establishes sensitivity only to the tested defect and only if it fails for the intended reason.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "directly-observed", "sources": [], "detection_route": "events", "check_definition_ids": [ "FM-20/uniform-RED", "FM-20/zero-executed", "FM-20/fewer-executed" ], "observation_units": [ "starting-code test executions", "check executions" ] }, { "id": "FM-21", "name": "Shared contract/oracle defect", "category": "verification", "definition": "Requirements, tests, expected results, and code inherit the same misunderstanding of the intended behavior.", "example": "A mistaken interpretation enters the contract and the expected test output. Code implements that interpretation and every check agrees.", "consequence": "Internal consistency can reinforce an error instead of exposing it. Valid behavior may also be rejected by the mistaken expectation.", "prevent": "Compare consequential expectations with independently obtained requirements, examples, domain evidence, or decisions from the person responsible for the behavior.", "respond": "When a shared misunderstanding is found, correct the requirement and its derived artifacts, then reassess affected candidates against the clarified intent.", "check": "Seek an independent statement of intended behavior, a separately specified behavioral check, or later evidence that challenges the shared expectation. Preserve that evidence alongside the original contract and result.", "limit": "A single internally consistent run cannot expose every inherited misunderstanding. Code can compare an independent oracle once one exists; choosing and validating that oracle may require domain judgment.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "openai-signal", "openai-swebench" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-22", "name": "Visible-check myopia", "category": "current", "definition": "The implementation satisfies visible examples or isolated tests while failing required general or composed behavior.", "example": "Individual operations pass their examples, but combining them in a permitted sequence produces an incorrect result.", "consequence": "Success on a narrow visible suite can conceal incomplete behavior at boundaries and interactions.", "prevent": "Derive additional cases from the requirements, including relevant compositions and boundaries, independently of the produced solution.", "respond": "If an independent case exposes a defect, correct the behavior and examine the missing evaluation condition without inferring the agent's motivation from the defect alone.", "check": "Compare success on visible checks with independently specified boundary or composition cases and later observed behavior. Retain the admitted candidate so that the comparison concerns the same work.", "limit": "A visible pass supplies no evidence about an untested condition. An independent counterexample establishes a behavioral gap, but not necessarily why the agent produced it or whether the remaining cases are complete.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "specbench" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-23", "name": "Goal-directed constraint circumvention", "category": "current", "definition": "An agent works around a restriction while pursuing the task's apparent goal.", "example": "A prohibited operation is denied through one tool, so the agent uses another route to produce the same prohibited effect.", "consequence": "Persistence can defeat a constraint even without malicious intent. Checking only one command name may leave equivalent effects available.", "prevent": "Define restrictions in terms of relevant effects and enforce them at the appropriate boundary. Distinguish prohibited effects from merely unavailable methods.", "respond": "If circumvention occurs, stop the affected operation, inspect its effects, and correct the boundary. A legitimate alternative that respects the restriction should remain available.", "check": "Record out-of-scope path effects, writes to protected paths, and failed commands followed by alternatives on a shared target. Preserve the failure and alternative rather than reducing the sequence to a bypass label.", "limit": "A post-failure retry may be ordinary recovery. A command reference is not proof of a successful effect, and missing operating-system events limit visibility. Intent and actual restriction circumvention need separate evidence.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "openai-monitor", "openai-gpt56" ], "detection_route": "events", "check_definition_ids": [ "FM-23/out-of-scope-write", "FM-23/post-failure-retry", "FM-23/protected-path-write" ], "observation_units": [ "agent invocations", "command items" ] }, { "id": "FM-24", "name": "Causal diagnosis substitution", "category": "current", "definition": "A real symptom gives unwarranted credibility to a proposed cause and the repair derived from it.", "example": "A failure is reproducible, but the explanation is untested. A broad change removes the symptom while leaving the initiating defect intact.", "consequence": "A persuasive diagnosis can turn uncertain attribution into harmful repair. This includes causal mistakes beyond environmental conditions.", "prevent": "Keep observations separate from causal hypotheses and identify evidence that would distinguish plausible explanations.", "respond": "Before a consequential repair, test the proposed mechanism where feasible. Afterward, check both the intended correction and relevant competing explanations.", "check": "Compare the same requirement across consecutive changed candidates and flag an observed failure that persists after the change. Preserve the diagnosis and the difference between candidates for review.", "limit": "A failed repair does not establish a false diagnosis; a correct diagnosis can lead to an incomplete fix. A passing repair can mask the cause. Causal attribution needs evidence distinguishing alternatives.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "operational-inference", "sources": [ "whoandwhen" ], "detection_route": "events", "check_definition_ids": [ "FM-24/failed-repair" ], "observation_units": [ "attempts beyond the first" ] }, { "id": "FM-25", "name": "Trajectory residue", "category": "current", "definition": "Code from abandoned approaches remains in the final result without contributing to the intended behavior.", "example": "A working patch retains unused helpers, redundant branches, or a dependency introduced by an earlier failed approach.", "consequence": "Passing functional checks may coexist with unnecessary complexity that increases later review and maintenance effort.", "prevent": "Keep changes attributable to the intended solution, and inspect abandoned approaches when reviewing a completed patch.", "respond": "Remove residue only after checking that it is unnecessary, then rerun the relevant behavioral checks to guard against deleting legitimate dynamic or indirect use.", "check": "Track files added and later removed, the size of each change, and the history of abandoned approaches. Use static analysis or code review to inspect what remains in the final candidate.", "limit": "File churn is a lead, not a residue count. An earlier addition may still serve the final design, and dynamic or indirect use can defeat an unused-code scan.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "trim" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-26", "name": "Longitudinal structural or behavioral erosion", "category": "current", "definition": "Repeated locally successful changes gradually make later work harder or allow broader behavior to drift.", "example": "Each increment passes its immediate checks, while duplicated logic, inconsistent error handling, and compatibility differences accumulate across the project.", "consequence": "The cost or behavioral damage may become visible only during subsequent changes, beyond the scope of any one passing patch.", "prevent": "Preserve important architectural and behavioral constraints and observe comparable follow-on work, rather than relying on a single complexity score.", "respond": "If a pattern of erosion emerges, identify the recurring mechanism and compare a targeted refactor or workflow change against its cost and regression risk.", "check": "Compare later work on the same codebase: effort for similar changes, regressions, and departures from explicit architectural or behavioral constraints.", "limit": "A single run cannot establish longitudinal erosion. Complexity metrics and elapsed time need context; comparable later tasks and competing explanations matter.", "method": "Judgment, independent evidence, or comparison; recorded signals can narrow the investigation", "evidence": "research-supported", "sources": [ "slopcode", "codethread" ], "detection_route": "investigation", "check_definition_ids": [], "observation_units": [] }, { "id": "FM-27", "name": "Regression blindness and repair oscillation", "category": "current", "definition": "A repair reopens a previously satisfied requirement or cycles back to an earlier failing state.", "example": "Fixing one test breaks another. The next patch restores the second test but recreates the original defect.", "consequence": "Repeated attempts can consume the budget without net progress and obscure which obligations remain satisfied.", "prevent": "Track candidate changes and relevant regression results across attempts, with explicit limits for repeated or unproductive repair.", "respond": "When a cycle appears, preserve its history, inspect interacting requirements, and choose a different repair strategy or an honest stop.", "check": "Detect repeat candidate identities, repeated candidate/result pairs where those are the chosen unit, and requirements that change from satisfied to unsatisfied. Keep the identity rule and earlier results explicit.", "limit": "Returning to identical code differs from returning to the same code-and-result pair. A reopened result may reflect a flaky check; neither signal alone proves a causal regression or oscillation. Comparisons must use the same unit.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "tdad" ], "detection_route": "events", "check_definition_ids": [ "FM-27/repeated-pair", "FM-27/reopened-obligation" ], "observation_units": [ "evaluated attempts", "attempts beyond the first" ] }, { "id": "FM-28", "name": "Test or evaluator tampering", "category": "current", "definition": "An agent changes or bypasses the evaluation mechanism without authorization so that inadequate behavior appears successful.", "example": "A failing test is skipped, an expected result is weakened, or a different evaluator is invoked in place of the required one.", "consequence": "Visible success can cease to mean conformance when the producer can redefine the check that admits its output.", "prevent": "Keep the controlling evaluator and its inputs outside the producer's write authority where independent evaluation is required. Separate legitimate test repair from candidate repair.", "respond": "If unauthorized modification occurs, restore the intended evaluation, inspect the actual inputs used, and reevaluate the affected candidate.", "check": "Compare protected-input hashes and recorded changes to tests, expected results, and other protected paths. Inspect trace evidence for temporary change-then-restore and for commands referring to evaluation material.", "limit": "Endpoint snapshots cannot reveal every temporary edit. A command that references evaluation material does not prove a successful read, and a read does not establish tampering. Authorized test repair and unauthorized weakening require different treatment.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "openai-monitor" ], "detection_route": "events", "check_definition_ids": [ "FM-28/check-tamper", "FM-28/protected-readback", "FM-28/evaluator-read" ], "observation_units": [ "agent invocations", "readback entries" ] }, { "id": "FM-29", "name": "Inbound instruction contamination", "category": "current", "definition": "Material supplied as data is treated as an instruction with authority over the task.", "example": "A retrieved page, fixture, or tool result contains an instruction to skip a check. The agent follows it despite the controlling task requirements.", "consequence": "Untrusted or incidental content can redirect behavior across the boundary between evidence and instructions.", "prevent": "Preserve input provenance, distinguish task instructions from quoted or retrieved content, and limit the effects that lower-trust material can induce.", "respond": "When conflicting behavior follows exposure, inspect the source and action sequence, restore the intended task boundary, and keep causal attribution separate from the exposure flag.", "check": "Record exposure to instruction-like text when supplied material contains it, preserving provenance and subsequent relevant actions. If the task deliberately supplies no such material, exposure is inapplicable for that task rather than a measured zero rate.", "limit": "A text match does not establish that an instruction was followed. Quoted benign material can trigger a scanner, and causal influence requires evidence beyond exposure.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "iheval", "manyih", "openai-monitor" ], "detection_route": "events", "check_definition_ids": [ "FM-29/exposure" ], "observation_units": [ "supplied artifacts" ] }, { "id": "FM-30", "name": "Concealed uncertainty", "category": "current", "definition": "A report omits material uncertainty, unsupported work, or failed verification while presenting an apparently complete result.", "example": "Every affirmative sentence is true, but a failed check or unresolved requirement that would change the reader's decision is absent.", "consequence": "An incomplete account can mislead without containing an explicit false statement, regardless of whether the omission was deliberate.", "prevent": "Reconcile completion reports with open obligations, adverse results, and missing evidence. Make consequential uncertainty part of the handoff.", "respond": "If an omission is discovered, correct the report and revisit decisions that depended on its apparent completeness.", "check": "Count unsupported or unevaluable requirement rows and unusable agent returns as explicit gaps in the record. Compare those gaps and failed checks with the final account.", "limit": "A visible evidence gap is not concealed uncertainty by itself. Unknowns absent from both the requirements and records remain invisible, and determining whether an omission would change a decision requires judgment.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "openai-monitor" ], "detection_route": "events", "check_definition_ids": [ "FM-30/invalid-row", "FM-30/unusable-return" ], "observation_units": [ "obligation rows", "agent invocations" ] }, { "id": "FM-31", "name": "Nondeterminism and retry laundering", "category": "current", "definition": "Mixed execution outcomes are reduced to a convenient passing result without preserving relevant failures.", "example": "The same suite fails and then passes under apparently comparable conditions. Only the passing attempt appears in the handoff.", "consequence": "Selective reporting hides instability and makes a result seem more repeatable than the evidence supports.", "prevent": "Retain attempts, relevant environment differences, and candidate changes. Distinguish a pass after a real repair from unexplained variation.", "respond": "If comparable executions disagree, report the mixed outcome and investigate the variation in proportion to its consequence before treating the result as reliable.", "check": "Group executions by candidate identity and command; flag differing exit codes or output hashes. Use only pairs with at least two executions as the relevant population and preserve environment differences.", "limit": "Output timestamps can change a hash without changing behavior. A third comparable observation is needed to describe what happened after the first disagreement. Mixed results alone prove neither nondeterminism under identical conditions nor selective reporting.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "research-supported", "sources": [ "anthropic-noise", "openai-signal" ], "detection_route": "events", "check_definition_ids": [ "FM-31/mixed-outcome" ], "observation_units": [ "candidate/command pairs executed at least twice" ] }, { "id": "FM-32", "name": "Premature formalization and clarification overload", "category": "current", "definition": "Unnecessary formal requirements or clarification requests interrupt useful work and impose disproportionate human effort.", "example": "A workflow asks many questions about reversible presentation details before making a concrete draft, even though reasonable defaults would allow progress.", "consequence": "The process can consume more attention than the work it is meant to support and delay learning from a reviewable result.", "prevent": "Distinguish consequential missing decisions from reversible details. Use reasonable defaults and prepare concrete work before requesting decisions that can wait.", "respond": "If interruptions dominate useful progress, examine which requests were necessary and simplify the workflow while preserving decisions that require authorization.", "check": "Count clarification requests and unusable-response retries, and retain elapsed time and human effort. Keep per-invocation questions separate from a workflow's consolidated guidance pauses.", "limit": "Counts measure interruptions or effort, not whether they were unnecessary. A required authorization question is legitimate; burden and lost progress need human assessment. Different units should not be compared as one rate.", "method": "Deterministic events or warning signals; interpretation as described above", "evidence": "directly-observed", "sources": [], "detection_route": "events", "check_definition_ids": [ "FM-32/question", "FM-32/retry" ], "observation_units": [ "agent invocations" ] } ], "sources": [ { "id": "openai-monitor", "label": "OpenAI — How we monitor internal coding agents for misalignment (2026)", "href": "https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/" }, { "id": "openai-gpt56", "label": "OpenAI — GPT-5.6 System Card (2026)", "href": "https://deploymentsafety.openai.com/gpt-5-6" }, { "id": "openai-signal", "label": "OpenAI — Separating signal from noise in coding evaluations (2026)", "href": "https://openai.com/index/separating-signal-from-noise-coding-evaluations/" }, { "id": "openai-swebench", "label": "OpenAI — Why SWE-bench Verified no longer measures frontier coding capabilities (2026)", "href": "https://openai.com/index/why-we-no-longer-evaluate-swe-bench-verified/" }, { "id": "anthropic-context", "label": "Anthropic — Effective context engineering for AI agents", "href": "https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents" }, { "id": "anthropic-noise", "label": "Anthropic — Quantifying infrastructure noise in agentic coding evals (2026)", "href": "https://www.anthropic.com/engineering/infrastructure-noise" }, { "id": "anthropic-harness", "label": "Anthropic — Effective harnesses for long-running agents", "href": "https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents" }, { "id": "iheval", "label": "IHEval — Evaluating Language Models on Following the Instruction Hierarchy", "href": "https://arxiv.org/abs/2502.08745" }, { "id": "manyih", "label": "ManyIH — Many-Tier Instruction Hierarchy in LLM Agents", "href": "https://arxiv.org/abs/2604.09443" }, { "id": "mast", "label": "MAST — Why Do Multi-Agent LLM Systems Fail? (NeurIPS 2025)", "href": "https://arxiv.org/abs/2503.13657" }, { "id": "whoandwhen", "label": "Who & When — failure attribution in multi-agent systems", "href": "https://arxiv.org/abs/2505.00212" }, { "id": "fixedbench", "label": "FixedBench — Coding Agents Don't Know When to Act", "href": "https://arxiv.org/abs/2605.07769" }, { "id": "specbench", "label": "SpecBench — visible versus compositional checks", "href": "https://arxiv.org/abs/2605.21384" }, { "id": "trim", "label": "TRIM — trajectory residue and minimization", "href": "https://arxiv.org/abs/2607.18161" }, { "id": "slopcode", "label": "SlopCodeBench — iterative code erosion", "href": "https://arxiv.org/abs/2603.24755" }, { "id": "codethread", "label": "CodeThread — follow-on change cost", "href": "https://arxiv.org/abs/2606.21804" }, { "id": "tdad", "label": "TDAD — test-driven agent development and regressions", "href": "https://arxiv.org/abs/2603.17973" }, { "id": "overmock", "label": "Agent-generated test over-mocking study", "href": "https://arxiv.org/abs/2602.00409" }, { "id": "metr", "label": "METR — Task-completion time horizons", "href": "https://metr.org/time-horizons/" } ], "provenance": { "edition": "Public reader edition", "research_revised": "2026-09-19", "published": "2026-11-10", "canonical_url": "https://www.thegyre.io/failure-modes", "source_reader_sha256": "8261ccf798c139fe2d62c8089295f136f85cc35323684a41bc1b3709490b7c7c", "note": "Definitions, examples, conditional checks, limitations, and source associations preserved from the September 19, 2026 reader edition. Local observations are bounded cases, not frequency estimates or model comparisons.", "editorial_updated": "2026-11-10" }, "detectionRoutes": [ { "id": "events", "label": "Events or warning signals (19)" }, { "id": "investigation", "label": "Judgment or additional evidence (13)" } ], "editorial_notes": [ { "id": "epistemic-note", "added": "2026-11-10", "title": "A tighter focus: epistemic errors", "motivation": "An agent can have access to the information needed to avoid a mistake and still ignore a requirement, misread a result, or continue from an unsupported assumption. This is the problem I am particularly interested in here.", "definition": "Epistemic errors arise when information needed to avoid the error is available, but the agent ignores, forgets, or misinterprets it. Available information can include an environment the agent could inspect; it need not all be in the prompt. The criterion concerns avoiding the particular error, not possessing every fact needed to finish the task.", "source": { "title": "Failure as a Process: An Anatomy of CLI Coding Agent Trajectories", "url": "https://arxiv.org/pdf/2607.09510#page=7", "section": "III-B, p. 7" }, "scope": "Not all 32 modes below fit this stricter definition. The broader catalog also covers deficient context, unclear requirements, coordination, evaluation, and external obstacles. Some agent mistakes reflect a lack of knowledge or capability rather than a failure to use available evidence.", "standing": "The 14 entries below are my provisional candidates, not the paper’s own list or a validated classification. Each case needs evidence of what information was available and how the agent failed to use it. The same mode can have different causes; other entries may qualify in particular cases.", "work_in_progress": "This is a work in progress. I am sharing it to make the problem easier to recognize and discuss; the definitions and shortlist will evolve as the evidence improves.", "candidates": [ { "id": "FM-02", "condition": "Relevant information reached the agent but was overlooked; missing or truncated input is a different case." }, { "id": "FM-11", "condition": "A clearly required and feasible step was skipped despite the instruction being available." }, { "id": "FM-12", "condition": "The agent reported execution or verification contrary to the available record; missing telemetry alone is insufficient." }, { "id": "FM-13", "condition": "Available evidence showed that the requested behavior already worked, but the agent made an unnecessary change." }, { "id": "FM-15", "condition": "The agent used a passing check to support a claim beyond the scope that the available evidence justified." }, { "id": "FM-18", "condition": "The agent misidentified the failing layer despite available evidence distinguishing environment, test, and product causes." }, { "id": "FM-22", "condition": "The agent satisfied visible examples while disregarding a supplied requirement for broader or combined behavior." }, { "id": "FM-23", "condition": "The agent worked around a restriction that was clearly stated and available." }, { "id": "FM-24", "condition": "The agent treated an unsupported causal explanation as established despite available evidence challenging it." }, { "id": "FM-25", "condition": "The agent left remnants of an abandoned approach despite available information showing they were unnecessary." }, { "id": "FM-27", "condition": "A repair broke a known requirement or repeated an earlier failure despite available requirements and feedback." }, { "id": "FM-28", "condition": "The agent weakened or bypassed evaluation despite a clear requirement to preserve it." }, { "id": "FM-29", "condition": "The agent followed instructions embedded in data despite a clear, available boundary between instructions and evidence." }, { "id": "FM-30", "condition": "The agent omitted a known failure or consequential uncertainty from its report. Deliberate deception is not assumed." } ] } ] }