Three papers from November 9 and 10 look at agent failures that leave the output looking normal.
Where agent errors enter
A trajectory study annotates 95 failed runs of six multi-agent systems from the public Who&When and MAD corpora, reading each in full. Faults enter early, at a median of 0.18 of the way through a run, mostly as wrong decisions or fabrications about task state. In 37 of 88 Who&When runs they entered before the step that the human labels mark as decisive. "In 72% of failed runs the trajectory already contained evidence against the error before the failure; in 88% of those no agent acted on it." Restoring the agent's own state would have been enough in 35 of 95 runs. The authors also found that 45 percent of the hand-crafted Who&When failures ended with a provider content-filter crash, "after which the harness emitted a final answer no agent produced".
Poisoned skills that still work
StealthyPoison attacks agents that fetch third-party skills from public registries. Rather than adding obviously malicious instructions, it "corrupts a skill's decision-critical rules to induce incorrect task outcomes while preserving its advertised functionality". Tested on 566 target skills and 5,244 requests against more than 26,000 registry entries, it improves top-1 placement of the poisoned skill by 13.6 percent relative to HotFlip and GCG. The payloads transferred to three held-out models, succeeded end to end in a Claude Code workflow on Opus 4.8, and mostly evaded both SkillSpector and GPT-5.4-mini as detectors.
A burst that outlasts itself
A November 10 paper reaches a conclusion close to that of a separate paper we covered yesterday. With the same base workload, "a few minutes of extra arrivals" left a vLLM server at about a 10 percent prefix-cache hit ratio and half its throughput, with a backlog growing for the remaining 70 minutes, in 9 of 12 paired runs. It also appeared on SGLang. The recovery results are new: throttling new admissions rescued 1 of 7 collapsed runs, while suspending admitted sessions against a capacity limit rescued all of them within minutes. A CPU offload tier only delayed the collapse.
What remains uncertain. We read the abstracts only. The trajectory study covers 95 runs from two research corpora, not production systems. The poisoning results depend on how registries rank skills, and the serving results come from controlled traces.
Analysis: At Belgavi's Book Store, Hansini could add one cheap check to the refund agent: before it closes a CASE, compare its stated facts, such as the order total, with the order record, since the evidence against early errors was usually already there. Pin third-party skills to a reviewed version, and test them on cases with known answers, because a poisoned skill still looks like it works. On the serving side, limit how many sessions hold cache at once instead of only slowing new arrivals.
Sources and evidence
- Dependable Long-Horizon LLM Agents: A Trajectory-Centered Empirical Study of Where Errors Enter and Which Controls Reach Them (arXiv, November 9)
- StealthyPoison: Manipulating LLM Agent Behavior through Procedural Poisoning of Third-Party Skills (arXiv, November 9)
- Bursts That Outlast Themselves: Persistent Degradation in Prefix-Cached Agent Serving (arXiv, November 10)
In 95 failed multi-agent runs, errors entered early and evidence against them was already present but ignored in most cases. StealthyPoison corrupts skill decision rules while keeping skills functional, and most payloads evaded two detectors. A second serving study finds short bursts can leave vLLM at half throughput, fixed by suspending sessions rather than throttling arrivals. Check stated facts, pin skills and cap resident sessions.