Beyond the Leaderboard: A Synthesis of Tool-Use, Planning, and Reasoning Failures in Large Language Model Agents

🕒 Published (v1): 2026-07-07 03:05 UTC · Source: Arxiv · link

Why this paper was selected

Practitioner synthesis of tool-use, planning, reasoning failure modes — actionable diagnostic for agent builders

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper synthesizes 27 benchmark and audit studies (2023–2026) covering 19 distinct benchmarks into a unified six-cluster taxonomy of LLM agent failure modes. It identifies non-linear failure compounding, non-composability of sub-skill competence, and a persistent measurement-validity gap as structural cross-cutting patterns. It explicitly documents genuine progress (single-turn tool selection, short-horizon navigation, narrow coding tasks) alongside persistent failures.

Problem

Benchmark leaderboards show steady aggregate score improvements for LLM agents, but individual studies consistently document recurring failure modes that those aggregate numbers obscure. No prior work integrates failures across tool use, planning, long-horizon reasoning, multi-agent coordination, safety, and measurement validity into a single unified taxonomy—these areas have been treated separately, preventing cross-cutting structural patterns from being identified.

Method

Narrative synthesis of 27 papers meeting explicit inclusion criteria: each must provide quantitative error analysis (not just aggregate accuracy), a manually annotated failure taxonomy with reported inter-annotator agreement, or a benchmark validity investigation. The taxonomy was derived iteratively: all named error categories from all 27 papers (60+ total) were listed, then grouped into candidate themes by conceptual overlap and alignment to distinct stages of the agent's reasoning-to-action pipeline, with splits/merges iterated until minimal inter-cluster overlap was achieved. Convergence across independently annotated source taxonomies (e.g., MAST, ToolScan, REST-API framework) was used as external validation of the resulting six-cluster structure.

Key Contributions

• First cross-domain synthesis integrating tool use, planning, long-horizon reasoning, multi-agent coordination, safety, and measurement validity into a single unified failure taxonomy.
• Six-cluster taxonomy: (1) tool invocation and parameter-level errors, (2) planning and constraint-satisfaction failures, (3) long-horizon degradation from context accumulation, (4) multi-agent coordination failures, (5) safety/security failures under adversarial or underspecified conditions, (6) measurement validity problems.
• Explicit documentation of where genuine, credible capability gains have occurred, distinguishing them from corrections of prior measurement error.
• Identification of three structural cross-cutting patterns: non-linear failure compounding with task length, non-composability of sub-skill competence into end-to-end success, and scaffolding not uniformly improving reliability.
• Categorized comparative table consolidating quantitative findings across benchmarks.

Results

• TravelPlanner: GPT-4 achieves 0.6% final-plan success rate on multi-constraint itineraries; reasoning models alone raise this to ~10%; reasoning models + external formal verifiers + critics reach ~65%.
• WebArena: Success rates rose from ~14% at launch to 61.7% for a specialized enterprise scaffold; human performance remains ~78%.
• SWE-bench Verified: Leading coding agents went from ~20% resolution (mid-2024) to above 50–60% by 2026.
• METR time-horizon: Frontier models achieve near-100% success on tasks taking humans under ~4 minutes, but below 10% on tasks taking humans over ~4 hours; 50%-reliability horizon doubles ~every 7 months since 2019.
• Long-context web agents: Success rates of 40–50% on short-horizon tasks fall to below 10% when the same task is embedded in a longer interaction history.
• Berkeley Function-Calling Leaderboard: Dedicated function-calling modes produced ~77.5 incorrect function-call counts on average in multi-call settings vs. ~21 for prompting-based approaches.
• InjecAgent: Standard ReAct GPT-4 vulnerable to indirect prompt injection in ~24% of 1,054 test cases; reinforced attacks raise this to ~47%; open-source models without safety fine-tuning exceeded 80%.
• ToolEmu: Even the safest evaluated agent showed potentially severe safety failures in 23.9% of 144 test cases.
• MAST (multi-agent): Specification issues accounted for ~42% of failures across 7 frameworks; inter-agent misalignment ~37%; verification/termination failures the remainder; Cohen's Kappa = 0.88 on manual annotation.

Limitations

• Narrative synthesis, not a pre-registered systematic review (no PRISMA protocol); different researchers may draw cluster boundaries differently.
• Only 27 papers included; coverage is necessarily incomplete relative to the full literature.
• Includes 2 non-peer-reviewed or industry sources; flagged but still present.
• Test-set contamination and benchmark validity concerns apply to the quantitative figures being synthesized, introducing uncertainty into the numbers cited.
• The paper is truncated in the provided text, so limitations stated in Section 9 are only partially visible.
• Bystander-harm and third-party impact in safety evaluations are identified as gaps but not empirically addressed within this work.

Relevance to Agentic AI / LLM Agents

This paper provides the most comprehensive failure-mode synthesis to date for the exact capability stack—tool use, planning, long-horizon execution, multi-agent coordination—that defines modern LLM agent systems, making it a direct reference for anyone building or evaluating agents. The identification of non-linear failure compounding and non-composability of sub-skills directly challenges the common assumption that improving individual agent components will translate to reliable end-to-end systems. The measurement-validity cluster is particularly important for interpreting the current wave of benchmark progress, as it warns that a portion of reported gains may reflect evaluation artifacts rather than genuine capability. For practitioners deploying agents in real environments, the safety cluster's finding that tool-capable agents remain highly vulnerable to adversarial prompt injection and ambiguous instruction handling points to deployment risks that capability benchmarks alone do not capture.