Faults Enter Early in Failed Agent Runs
The Invisible Infrastructure of Failure Analysis
When a large language model agent fails partway through a long task, the standard postmortem produces a label. The run gets tagged “task derailment” or “incorrect verification,” or an annotator points at the agent and step that bore responsibility. These labels are useful, and they are also incomplete in a way that matters for anyone trying to build a better system. They record a symptom. They do not record where the error entered, which part of the agent’s state carried it forward, whether anything in the trajectory contradicted it along the way, or which kind of control could have caught it. As far as the authors of a new study can tell, nobody had measured these things on released trajectories at any scale before they did.
That gap is the subject of a paper that turns failure analysis from symptom-spotting into a structured record of cause and propagation. The work, described in a study of multi-agent systems, defines an episode record that ties a candidate fault to its origin, propagation, detection, response and consequence, located by operational phase and state domain, and that names the control families whose observation and reach cover it. The researchers turned this record into a written annotation protocol and applied it to 95 failed runs of six multi-agent systems drawn from the public Who&When and MAD corpora, reading each trajectory in full. [1] The concrete gain is not a new benchmark score or a product announcement. It is a way of seeing that makes the invisible visible: a method that locates where a fault enters, how it propagates, and which control could have caught it, and then asks which of these is the one worth designing against. The answer, as the data turns out, is not a dramatic deception. It is the quiet, structural failure that nobody catches because the evidence to catch it was already sitting in the trajectory, unused.
What the Episode Record Actually Captures
The framework separates when an operation occurs from which state it affects. Execution phases run from admission through deliberation, execution, verification and termination, with governance and delivery as cross-cutting concerns. State domains cover hardware and compute, task and knowledge state, interface and tooling, external environment, coordination and shared memory, and human or organizational state. These two coordinates — phase and domain — locate a fault precisely enough that a reader can check it against the trace.
The record itself is a tuple: origin, affected invariants, dependency links, detections, responses, manifestations, evaluation scale, and uncertainty. Each event retains its phase, domain, order, version and source. Each dependency is marked as observed, intervention-supported, or hypothesized. Every step-valued field has to point at a concrete step or line of the normalized trace, so a reader can verify the annotation rather than trust it.
This is the first real improvement the paper offers: failure analysis that is checkable. A label like “incorrect verification” tells you a verifier failed. It does not tell you what the verifier should have looked at. The episode record does. When the researchers assigned the MAST failure mode “incorrect verification” to 44 runs, those runs turned out to have five different kinds of origin: 16 wrong decisions, 16 fabrications, 6 corrupted handoffs, 4 misread observations, and 2 defective briefs. The verifier rubber-stamped something in all of them, but what it should have checked differed completely — the provenance of a claimed fact, the environment state behind a belief, or whether the task it was verifying was the task the user asked for.
Faults Enter Early, and the Label Points Late
The numbers from the annotation are stark. Faults enter early: the median origin sits at 0.18 of the run length. They are mostly wrong decisions or fabrications over task state, clustering in deliberation and execution. The median gap between origin and symptom is 0.67 of the run — in other words, the error typically appears in the first fifth of the trajectory and surfaces only near the end.
On the Who&When corpus, the researchers compared their origin step with the human-labelled “decisive step” — the step whose correction would have avoided the failure. In 40 of 88 runs the two coincide, and in 52 they are within one step. In 37 runs the annotated origin is earlier, by a median of three steps. When the origin comes earlier, it is usually because the plan or the fact sheet already contained the wrong assumption and the decisive step merely acted on it. When it comes later, the labelled step was in most cases a genuine error that the agents went on to repair, and a different fault, never corrected, is what reached the failure.
This is the second concrete gain: a diagnostic that points upstream. A human annotator watching a run unfold sees the moment where things visibly break. The episode record sees the moment where the wrong belief was first written into a plan, which is often several steps before anyone could have noticed the breakage. For anyone building controls, that difference is the whole game — you cannot install a check at a step you never identified as the origin.
The Evidence Was There, and Nobody Used It
If one number from the study should be remembered, it is this: in 72% of failed runs, the trajectory already contained, before the failure, an observation or message that contradicted the erroneous belief. In 88% of those runs, no agent acted on it. [1] In 41 runs the evidence was in an agent’s input and was never mentioned. In 19 an agent explicitly acknowledged it and continued unchanged — as when a verifier noted that distances were “simulated” and still reported the gyms as verified.
Detection is not the bottleneck. Something flagged a deviation in 31% of runs: the erring agent or its orchestrator itself in 17, a tool or verifier in 9, another agent in 3. A response followed in 34 runs, usually a replan or retry. Not one of those responses removed the deviated state; four removed part of it. The typical case is a replan that changes the next action while keeping the belief that caused the loop, so the loop comes back in a different form.
The gain here is a target, and it is specific. A control earns its place if it reads the evidence the worker left on the table. Independent judges and environment re-verification do this by construction, and they are the two families that reach most of the episodes. An independent judge that reads the evidence the worker did not use reaches 74% of episodes. Task contracts and scope rules fixed at admission reach 67%. Environment re-verification of beliefs before acting reaches 43%. Stall and termination rules reach 40%, and provenance on stored facts reaches 38%. As the single most direct control, provenance comes first, at 20 runs — mostly the fabrications, which a rule of the form “no unsourced claim is stored” would have rejected.
The Checkpoint That Replays the Mistake
Classical dependable computing offers mature theories of checkpointing, compensation and redundancy, and the paper draws on that vocabulary deliberately. But LLM agents give three of the classical problems new forms. Requests are generated, so a retry may differ in content and form, and a key derived from the original request may not match it. State is partly semantic, so an intact stored item can still be wrong because its correctness depends on where it came from and what it means. And effects reach services the agent does not control, so restoring local state leaves committed external effects in place.
The data confirm that local rollback is a weaker tool than intuition suggests. Restoring the agent’s own state to just before the origin would have sufficed in 35 of 95 runs. In 56 runs the fault lay in the plan, the task brief, or a stop rule, so a restore would simply replay it. Magentic-One’s orchestrator has loop detection, and it fired in a good share of the runs; the replans that followed changed the next action and kept the belief that had caused the loop, so the loop came back in a different form. Recovery that does not revise the contaminated state reproduces the failure.
The improvement on offer is a correction of a natural instinct. When a system goes wrong, the first thought is to rewind. The episode record shows why rewinding alone so often fails: the thing that needs revising is not the position in the sequence but the content of the belief, and that content lives in the plan, the fact sheet, or the task contract, none of which a checkpoint touches.
A Harness Failure Wearing an Agent’s Name
While annotating the Magentic-One runs, the researchers kept seeing the same ending: an HTTP 400 from the model provider’s content filter on the orchestrator’s progress-ledger call, after which the experiment script printed a final answer that no agent had produced. A deterministic scan of all raw Who&When trajectories found this crash in 26 of 58 hand-crafted runs — 45% — with 25 ending in such a fallback answer. [1] It appeared in zero of 126 algorithm-generated runs.
For those 25 fallback runs, the corpus attributes the failure to the orchestrator in 4 cases and to another agent, mostly the web surfer, in 21. In the episode records the event is a termination fault in the interface domain, the kind of fault that neither an agent-level symptom taxonomy nor a responsible-agent label represents. Attribution methods evaluated on this split are therefore partly scored on runs whose final answer came from the harness, not from any agent.
This is the sharpest illustration of the paper’s value as a diagnostic instrument. A method that learns to blame the web surfer for a provider’s HTTP 400 will look good on this benchmark and will be wrong about the system. The episode record makes the distinction visible, and attribution benchmarks should mark such runs, with evaluations of agents reporting harness-terminated runs separately from agent errors.
Where the Framework Stops, and Why That Matters
The study is explicit about its boundaries, and that explicitness is part of the contribution. The records were produced by a language model following a written protocol, with no human inter-annotator agreement to report in this version. What the paper offers instead: every step field is anchored to a line in the trace and can be checked; records passed mechanical schema validation; origins agree with human decisive steps within one step in 59% of cases and disagree in the direction of “later” in only 11 of 88; and the harness-fault result is independent of annotation. A human check of a subset is the obvious next step.
The sample is 96 annotated runs out of 203 normalized traces, selected by annotation batch rather than at random. The Who&When part matches the corpus in run length; the MAD part is small and short-biased and is shown only for completeness. Both corpora are question answering and programming in sandboxes. Not one run in the sample changes a shared or third-party system, so external impact and recovery of committed effects — which the framework was partly built for — cannot be studied here. That would need corpora like tau-bench or TheAgentCompany trajectories, or fault injection.
And “would have reached” is a judgment about the trace, constrained by the control contracts, not a measured intervention. Whether a control would actually have prevented a given failure requires re-running the agents with the control in place, which the authors have not done.
The Barrier That Is Not Technical
The paper closes on a recognition that is easy to state and hard to act on.
None of this requires a new model. It requires a different posture toward the trajectory: treating the run as a sequence of state changes whose dependencies can be inspected, rather than as a black box that either succeeds or fails. The infrastructure for that inspection is now written down, applied to a partial sample, and released — protocol, records and scripts included — so the analysis can be repeated, extended to new corpora, and checked against human annotation.
The barrier, in the end, is not primarily technical. A record that names the origin, traces the propagation, and identifies the control that would have caught it is a modest artifact. But it converts a vague sense that agents fail mysteriously into a concrete list of places to put a check — and that is the kind of gain that compounds.