Why Do Agent Teams Fail Across Boundaries? A Failure Taxonomy for Agent-to-Agent Systems with Private States

Sarath Shekkizhar; Prathyusha Jwalapuram; Zixuan Ke; Vaidehi Patil; Jiayu Wang; Srijan Bansal; Trong Huy Nguyen; Dingfeng Jiang

cs.MAOct 14, 2026

Why Do Agent Teams Fail Across Boundaries? A Failure Taxonomy for Agent-to-Agent Systems with Private States

Authors: Sarath Shekkizhar, Prathyusha Jwalapuram, Zixuan Ke, Vaidehi Patil, Jiayu Wang, Srijan Bansal, Trong Huy Nguyen, Dingfeng Jiang,

Organizations: Salesforce · UNC Chapel Hill · Singapore University of Technology and Design · Nanyang Technological University ·

Abstract

Agents are increasingly interacting with other agents that act for different principals (people or organizations on whose behalf they work), such as a buyer's personal agent negotiating with an enterprise's seller agent. In such agent-to-agent (A2A) scenarios, each agent has its own environment and holds information and authority that the other cannot see. Moreover, the interests of each agent may be aligned (cooperative), partly aligned (mixed-motive), or opposed (competitive). Existing multi-agent system failure studies assume one orchestrator, shared workspace, or single principal. We ask how A2A systems fail when these assumptions are removed. We study more than 2,500 recorded runs of A2A systems built from different agent harnesses and models, spanning 488 scenarios across eight families (legal, CRM, security, commerce, etc.). From these traces, we derive $A^2$ -Failures, a taxonomy of 20 A2A failure modes in four categories: (i) discovery and delegation, (ii) grounding and record consistency, (iii) verification, and (iv) conduct and fidelity. Three findings hold across every harness, model, and scenario studied: (1) discovery and interaction are driven by the phrasing of the task rather than the availability of peer agents; (2) no agent verifies a peer's factual claim on its own initiative, so an A2A system inherits the reliability of its least reliable participant unless the protocol or mechanism performs the check; and (3) the aggregate outcome score credits the agent completing the task while staying blind to the coordination, verification, and conduct failures beneath it, so A2A systems must be evaluated per agent, against each agent's own principal. We release the run logs behind the taxonomy at https://huggingface.co/datasets/a2a-salesforce/a2-failures.

Figures & tables

Panel of Figure 1 — Figure 1: An agent-to-agent (A2A) setup with two agents serving different principals. Left: Each agent runs in its own container with private documents, tools, credentials, and network reach, acting for a separate principal whose interests may be cooperative, mixed, or competitive. The only path between agents is a message protocol the host relays. Each run is recorded and scored at three layers: what the environment did ( L0 ), whether the outcome artifact is correct ( L1 ), and how each agent behaved in its A2A messages ( L2 ). From the traces we derive $A^{2}$ -Failures, 20 failure modes in four categories: D iscovery, G rounding, V erification, and C onduct & fidelity. Right: The flow of one A2A exchange: an agent discovers its peers ( a2a_list_agents ), initiates a conversation ( a2a_send_message ), the peer does its own work and responds, and the initiator files a deliverable ( a2a_task_complete ).

interest	family	roles	what is private	L0 and L1 evals	scenarios
cooperative	legal	2–5 agents	documents per role	rubric, LLM judge	$224$
	CRM	5 agents	records per role	deterministic checks	$48$
	risk management	2–4 agents	egress or credential	exact / DB state	$19$
	evolving enterprise	growing team	context per agent	SQL execution	$83$
mixed-motive	software engineering	2–5 agents	shards, rules, policies	deterministic tests	$46$
mixed-motive	security	2–4 agents	evidence vs. memo	coverage checks	$10$

Table 1: Scenario families organized by their position on the interest-alignment axis (cooperative, mixed-motive, competitive). Each family is a work vertical realized through an A2A mechanism and scored with the corresponding criteria. The scenarios column counts distinct scenarios; each is run under multiple protocol, harness, and model configurations. Harnesses and models evaluated include Claude Code (Opus-5, Sonnet-5), Codex (GPT-5.6-Sol, GPT-5.6-Terra), and Cursor (Grok-4.6).

Figure 2:

A^{2}

-Failures: A2A failure modes across four categories (rows), mapped across the interaction lifecycle (columns): pre-exchange , in-exchange , and post-exchange filing/execution. Modes spanning multiple columns can manifest at any of those stages. Every failure is defined relative to individual principal mandates.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

	failure mode	suggested intervention
D. Discovery and Delegation
D1	Silent lead. Never contacts a listed counterpart that holds material the task needs	model, harness
D2	Wording-driven discovery. Contacts a peer only when the task names what the peer holds, not because the directory lists it	protocol, model
D3	Undiscovered capability. A holder concludes it lacks a capability it has, because one tool path is refused	harness
D4	Delegation without integration. Routes a request to the right peer but does not integrate the reply, or does not re-route when the peer cannot supply it, and never reaches the end state	model
D5	Scope distortion. A downstream delegation or filing omits, changes, or broadens a material constraint inherited from its parent authority	protocol, model

Appendix

Table 2:

A^{2}

-Failures: 20 A2A failure modes grouped by the interaction function that breaks, with the layer of the A2A stack at which we suggest an intervention would most directly mitigate each. Every mode is defined relative to the agent’s own principal and the scenario’s mechanism.

Figure 3: Whether the lead contacts every specialist, by lead harness and by whether the assignment names the specialists’ documents.

Figure 4: Filing with a request still outstanding (G2). The share of messaging runs that file before a contacted peer has replied rises with team size, so the failure is structural: more peers mean more outstanding requests when the lead files.

Figure 5: Reaching every specialist co-varies with the outcome score, but the effect flows through the lead: the within-scenario difference between fully activated and under-activated runs stays positive, yet holding the lead harness fixed shrinks it, showing that the lead—not the specialists—carries it. Referenced from § 4 .

Task	Capability holder	$S$
Web (2–3)	None / One / All	0 / 1 / 1
Web (4)	None	0.33
	Codex only	1.00
	Cursor only	0.67
	All	1.00
ERP write	None / Executor	0.12 / 0.95

Appendix

Table 3: Deterministic outcomes by capability holder. Web (4) with no holder had one escape.

Figure 6: Contract-negotiation performance by team size and model assignment. L1 is the mean fraction of six contract checks passed by the buyer and seller; points average 30 runs and bars show the standard deviation across three trial means. Model labels follow buyer/seller order. Higher is better; comparisons are descriptive. Referenced from § 4 .

Figure 7: Paired within-scenario score differences. Swapping the lead moves the score; swapping the specialists does not. Referenced from § 4 .

$A^{2}$ -Failures mode	nearest MAST mode	relation
D. Discovery and Delegation
D1 Silent lead	FM-2.2 Fail to ask for clarification	sharper
D2 Wording-driven discovery	—	native
D3 Undiscovered capability	—	native
D4 Delegation without integration	FM-2.5 Ignored other agent’s input	shared
D5 Scope distortion	FM-1.1 Disobey task specification	sharper

Appendix

Table 4: Each

A^{2}

-Failures failure mode mapped to its nearest MAST mode ( Cemri et al., 2025 ) . shared : occurs in both regimes; sharper : a MAST analog made more acute by the boundary; reframed : the MAST mode changes meaning when scored against a principal; native : no MAST analog, as the mode needs separate principals, private state, or a sandbox to arise. MAST modes that presuppose a shared process (FM-1.3, FM-1.4, FM-2.1) have no

A^{2}

-Failures counterpart.

Agent Failure Analysis

Agent failure analysis studies how and why AI agents make errors, traces causes through execution, and helps detect or prevent recurrence.

See all 154 papers

Model or Harness? An Interaction-Centric Taxonomy for Localizing Agent Failures
Jul 30, 2026Harsh Raj, Vipul Gupta, Anas Mahmoud +4Agent Failure Analysis LLM Agent Evaluation
Scale AI
AgentRx: Diagnosing AI Agent Failures from Execution Trajectories
Feb 2, 2026Shraddha Barke, Arnav Goyal, Alind Khare +3Fault Diagnosis AI Agent Reliability
1Microsoft Research · 2Microsoft · 3UIUC
Understanding Communication Failures in Multi-Agent LLM Systems
Oct 23, 2026Priya Pitre, Jun Hou, Yi Fang +2Multi-Agent LLM Systems Multi-Agent Communication
Virginia Tech, Blacksburg, VA 24061, USA

Jul 30, 2026J/K move · Enter open · S save

Model or Harness? An Interaction-Centric Taxonomy for Localizing Agent Failures

Harsh Raj, Vipul Gupta, Anas Mahmoud, Razvan-Gabriel Dumitru+3

Scale AI

Agent Failure Analysis LLM Agent Evaluation AI Agent Benchmarks LLM Agent Reliability

Open paper AskPDF arXiv

Existing evaluations often reduce agent failures to system-level outcomes, obscuring where the fault originated and which intervention would improve the agent system. This creates a repair-assignment problem: the same visible failure may call for model post-training, harness engineering, environment redesign, or benchmark repair depending on its source. Because agent behavior emerges from interactions among models, harnesses, users, tools, memory, and environments, outcome-level labels are often insufficient for improvement. Most failure taxonomies do little to resolve this problem because they are benchmark-specific and lack a shared structure. We introduce an interaction-centric taxonomy that localizes failures to the interactions in which they originate and identifies the responsible component. It organizes 41 failure modes by assigning each to an edge between two components and a fault side indicating where the repair belongs. This makes the taxonomy actionable: model-side failures identify targets for post-training, harness-side failures point to scaffolding and tool-integration fixes, and environment or grader failures reveal evaluation conditions requiring redesign. The schema applies across agent architectures, from coding assistants to long-horizon personal assistants and multi-agent systems. We ground the taxonomy in worked examples from public benchmarks, model system cards, published reports, and logged agent trajectories, and evaluate its reproducibility using independent reasoning agents as judges. Across four frontier models, the strongest judge reaches Cohen's

κ=0.76

against human category labels, suggesting that the categories capture shared structure rather than annotator-specific preferences.

Abstract

Agent Failure Analysis

Explore similar work

Model or Harness? An Interaction-Centric Taxonomy for Localizing Agent Failures

AgentRx: Diagnosing AI Agent Failures from Execution Trajectories

Understanding Communication Failures in Multi-Agent LLM Systems