Why Do Agent Teams Fail Across Boundaries? A Failure Taxonomy for Agent-to-Agent Systems with Private States

Sarath Shekkizhar; Prathyusha Jwalapuram; Zixuan Ke; Vaidehi Patil; Jiayu Wang; Srijan Bansal; Trong Huy Nguyen; Dingfeng Jiang

cs.MAOct 14, 2026

Why Do Agent Teams Fail Across Boundaries? A Failure Taxonomy for Agent-to-Agent Systems with Private States

Authors: Sarath Shekkizhar, Prathyusha Jwalapuram, Zixuan Ke, Vaidehi Patil, Jiayu Wang, Srijan Bansal, Trong Huy Nguyen, Dingfeng Jiang,

Organizations: Salesforce · UNC Chapel Hill · Singapore University of Technology and Design · Nanyang Technological University ·

Abstract

Agents are increasingly interacting with other agents that act for different principals (people or organizations on whose behalf they work), such as a buyer's personal agent negotiating with an enterprise's seller agent. In such agent-to-agent (A2A) scenarios, each agent has its own environment and holds information and authority that the other cannot see. Moreover, the interests of each agent may be aligned (cooperative), partly aligned (mixed-motive), or opposed (competitive). Existing multi-agent system failure studies assume one orchestrator, shared workspace, or single principal. We ask how A2A systems fail when these assumptions are removed. We study more than 2,500 recorded runs of A2A systems built from different agent harnesses and models, spanning 488 scenarios across eight families (legal, CRM, security, commerce, etc.). From these traces, we derive $A^2$ -Failures, a taxonomy of 20 A2A failure modes in four categories: (i) discovery and delegation, (ii) grounding and record consistency, (iii) verification, and (iv) conduct and fidelity. Three findings hold across every harness, model, and scenario studied: (1) discovery and interaction are driven by the phrasing of the task rather than the availability of peer agents; (2) no agent verifies a peer's factual claim on its own initiative, so an A2A system inherits the reliability of its least reliable participant unless the protocol or mechanism performs the check; and (3) the aggregate outcome score credits the agent completing the task while staying blind to the coordination, verification, and conduct failures beneath it, so A2A systems must be evaluated per agent, against each agent's own principal. We release the run logs behind the taxonomy at https://huggingface.co/datasets/a2a-salesforce/a2-failures.

Figures & tables

Panel of Figure 1 — Figure 1: An agent-to-agent (A2A) setup with two agents serving different principals. Left: Each agent runs in its own container with private documents, tools, credentials, and network reach, acting for a separate principal whose interests may be cooperative, mixed, or competitive. The only path between agents is a message protocol the host relays. Each run is recorded and scored at three layers: what the environment did ( L0 ), whether the outcome artifact is correct ( L1 ), and how each agent behaved in its A2A messages ( L2 ). From the traces we derive $A^{2}$ -Failures, 20 failure modes in four categories: D iscovery, G rounding, V erification, and C onduct & fidelity. Right: The flow of one A2A exchange: an agent discovers its peers ( a2a_list_agents ), initiates a conversation ( a2a_send_message ), the peer does its own work and responds, and the initiator files a deliverable ( a2a_task_complete ).

interest	family	roles	what is private	L0 and L1 evals	scenarios
cooperative	legal	2–5 agents	documents per role	rubric, LLM judge	$224$
	CRM	5 agents	records per role	deterministic checks	$48$
	risk management	2–4 agents	egress or credential	exact / DB state	$19$
	evolving enterprise	growing team	context per agent	SQL execution	$83$
mixed-motive	software engineering	2–5 agents	shards, rules, policies	deterministic tests	$46$
mixed-motive	security	2–4 agents	evidence vs. memo	coverage checks	$10$

Table 1: Scenario families organized by their position on the interest-alignment axis (cooperative, mixed-motive, competitive). Each family is a work vertical realized through an A2A mechanism and scored with the corresponding criteria. The scenarios column counts distinct scenarios; each is run under multiple protocol, harness, and model configurations. Harnesses and models evaluated include Claude Code (Opus-5, Sonnet-5), Codex (GPT-5.6-Sol, GPT-5.6-Terra), and Cursor (Grok-4.6).

Figure 2:

A^{2}

-Failures: A2A failure modes across four categories (rows), mapped across the interaction lifecycle (columns): pre-exchange , in-exchange , and post-exchange filing/execution. Modes spanning multiple columns can manifest at any of those stages. Every failure is defined relative to individual principal mandates.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

	failure mode	suggested intervention
D. Discovery and Delegation
D1	Silent lead. Never contacts a listed counterpart that holds material the task needs	model, harness
D2	Wording-driven discovery. Contacts a peer only when the task names what the peer holds, not because the directory lists it	protocol, model
D3	Undiscovered capability. A holder concludes it lacks a capability it has, because one tool path is refused	harness
D4	Delegation without integration. Routes a request to the right peer but does not integrate the reply, or does not re-route when the peer cannot supply it, and never reaches the end state	model
D5	Scope distortion. A downstream delegation or filing omits, changes, or broadens a material constraint inherited from its parent authority	protocol, model

Appendix

Table 2:

A^{2}

-Failures: 20 A2A failure modes grouped by the interaction function that breaks, with the layer of the A2A stack at which we suggest an intervention would most directly mitigate each. Every mode is defined relative to the agent’s own principal and the scenario’s mechanism.

Figure 3: Whether the lead contacts every specialist, by lead harness and by whether the assignment names the specialists’ documents.

Figure 4: Filing with a request still outstanding (G2). The share of messaging runs that file before a contacted peer has replied rises with team size, so the failure is structural: more peers mean more outstanding requests when the lead files.

Figure 5: Reaching every specialist co-varies with the outcome score, but the effect flows through the lead: the within-scenario difference between fully activated and under-activated runs stays positive, yet holding the lead harness fixed shrinks it, showing that the lead—not the specialists—carries it. Referenced from § 4 .

Task	Capability holder	$S$
Web (2–3)	None / One / All	0 / 1 / 1
Web (4)	None	0.33
	Codex only	1.00
	Cursor only	0.67
	All	1.00
ERP write	None / Executor	0.12 / 0.95

Appendix

Table 3: Deterministic outcomes by capability holder. Web (4) with no holder had one escape.

Figure 6: Contract-negotiation performance by team size and model assignment. L1 is the mean fraction of six contract checks passed by the buyer and seller; points average 30 runs and bars show the standard deviation across three trial means. Model labels follow buyer/seller order. Higher is better; comparisons are descriptive. Referenced from § 4 .

Figure 7: Paired within-scenario score differences. Swapping the lead moves the score; swapping the specialists does not. Referenced from § 4 .

$A^{2}$ -Failures mode	nearest MAST mode	relation
D. Discovery and Delegation
D1 Silent lead	FM-2.2 Fail to ask for clarification	sharper
D2 Wording-driven discovery	—	native
D3 Undiscovered capability	—	native
D4 Delegation without integration	FM-2.5 Ignored other agent’s input	shared
D5 Scope distortion	FM-1.1 Disobey task specification	sharper

Appendix

Table 4: Each

A^{2}

-Failures failure mode mapped to its nearest MAST mode ( Cemri et al., 2025 ) . shared : occurs in both regimes; sharper : a MAST analog made more acute by the boundary; reframed : the MAST mode changes meaning when scored against a principal; native : no MAST analog, as the mode needs separate principals, private state, or a sandbox to arise. MAST modes that presuppose a shared process (FM-1.3, FM-1.4, FM-2.1) have no

A^{2}

-Failures counterpart.

Agent Failure Analysis

Agent failure analysis studies how and why AI agents make errors, traces causes through execution, and helps detect or prevent recurrence.

See all 154 papers

Jul 30, 2026

Model or Harness? An Interaction-Centric Taxonomy for Localizing Agent Failures

Existing evaluations often reduce agent failures to system-level outcomes, obscuring where the fault originated and which intervention would improve the agent system. This creates a repair-assignment problem: the same visible failure may call for model post-training, harness engineering, environment redesign, or benchmark repair depending on its source. Because agent behavior emerges from interactions among models, harnesses, users, tools, memory, and environments, outcome-level labels are often insufficient for improvement. Most failure taxonomies do little to resolve this problem because they are benchmark-specific and lack a shared structure. We introduce an interaction-centric taxonomy that localizes failures to the interactions in which they originate and identifies the responsible component. It organizes 41 failure modes by assigning each to an edge between two components and a fault side indicating where the repair belongs. This makes the taxonomy actionable: model-side failures identify targets for post-training, harness-side failures point to scaffolding and tool-integration fixes, and environment or grader failures reveal evaluation conditions requiring redesign. The schema applies across agent architectures, from coding assistants to long-horizon personal assistants and multi-agent systems. We ground the taxonomy in worked examples from public benchmarks, model system cards, published reports, and logged agent trajectories, and evaluate its reproducibility using independent reasoning agents as judges. Across four frontier models, the strongest judge reaches Cohen's

κ=0.76

against human category labels, suggesting that the categories capture shared structure rather than annotator-specific preferences.

Harsh Raj, Vipul Gupta, Anas Mahmoud +4

Scale AI

Agent Failure Analysis LLM Agent Evaluation AI Agent Benchmarks LLM Agent Reliability

Ask PDF

Feb 2, 2026

AgentRx: Diagnosing AI Agent Failures from Execution Trajectories

AI agents often fail in ways that are difficult to localize because executions are probabilistic, long-horizon, multi-agent, and mediated by noisy tool outputs. We address this gap by manually annotating failed agent runs and release a novel benchmark of 170 trajectories across 11 diverse task settings, including structured API workflows, incident management, and open-ended web/file tasks. Each trajectory is annotated with a critical failure step and a category from a grounded-theory derived, cross-domain failure taxonomy. To mitigate the human cost of failure attribution, we present AgentRx, an

\textit{automated diagnostic framework}

that pinpoints the critical failure step in a failed agent trajectory. It synthesizes constraints, evaluates them step-by-step, and produces an auditable validation log of constraint violations with associated evidence; an LLM-based judge uses this log to localize the critical step and category. AgentRx improves step localization by 75% on average over prior work, while providing failure category attribution.

Shraddha Barke, Arnav Goyal, Alind Khare +3

1Microsoft Research · 2Microsoft · 3UIUC

Fault Diagnosis AI Agent Reliability LLM Agent Evaluation Agent Failure Analysis AI Agent Benchmarks Fault Localization+2

Ask PDF

Oct 23, 2026

Understanding Communication Failures in Multi-Agent LLM Systems

Multi-agent LLM systems aim to improve reasoning through debate, evidence sharing, and mutual correction, but interaction can also introduce failures that final accuracy alone cannot explain. Agents may converge too early, ignore dissent, suppress correct minority answers, or preserve a wrong framing across rounds. We present a corpus-grounded taxonomy of communication failures, built from 3,211 failed multi-round trajectories across medical QA, coding, finance, multi-hop reasoning, ethics, and embodied text tasks. Using this taxonomy, we analyze failure distributions across datasets and system designs, round-level error dynamics, recovery hardness, majority transitions, minority-signal suppression, and self-reported confidence. We find that failures are dominated by recovery/correction and consensus/decision problems rather than isolated first-round mistakes, with many emerging after agents first observe peer responses. Based on these findings, we recommend stronger disagreement handling, evidence verification, minority-signal preservation, and recovery checks before finalization.

Priya Pitre, Jun Hou, Yi Fang +2

Virginia Tech, Blacksburg, VA 24061, USA

Multi-Agent LLM Systems Multi-Agent Communication LLM Agent Reliability Failure Attribution for LLM Agents Multi-Agent Consensus

Ask PDF

Abstract

Agent Failure Analysis

Explore similar work

Model or Harness? An Interaction-Centric Taxonomy for Localizing Agent Failures

AgentRx: Diagnosing AI Agent Failures from Execution Trajectories

Understanding Communication Failures in Multi-Agent LLM Systems