Artificial Intelligence Technology Fabricates Missing Data

When an Agent's Tools Go Quiet, It Makes the Answer Up

Wire an AI agent to a tool that returns an HTTP 200 with an empty body, and the agent will usually not tell you anything went wrong. In a preprint posted to arXiv on July 21, Aarushi Singh built twelve production-adjacent tool stubs, gave each of them four ways to fail quietly, and pointed two frontier models and two open-source models at them. Fabrication was the dominant behavior, at 56.6 percent of valid responses. The agent read an empty payload as data and returned a result it had invented.

That figure describes deliberately sabotaged tools inside a controlled audit, not an incident rate anyone has measured in a live system, and the paper has not been peer reviewed. Treat it as a characterization of how agents behave when a tool goes silent rather than a frequency to expect on your own infrastructure. The behavior it characterizes shows up wherever agents write to a system of record.

A crashing tool is loud. It throws, trips a retry, fires an alert, and somebody looks at it. A tool that returns nothing produces an agent response that is indistinguishable, as prose, from a correct one. Same confidence, same formatting, same air of having consulted something. And it travels: into the next step of the workflow, into a ticket, into a customer record, into a report a person then acts on. For a software or telecom operator, this separates an agent that opens a ticket from an agent that closes one it never worked.

Singh's paper reports a second effect. Adding conventional safety language to the system prompt, an instruction to prioritize user privacy and data security, made the agent substantially more likely to invent a policy rationale for a failure it could not actually see. The agent would decline, citing privacy, when what had happened was an empty response from a stub. The instances concentrated on tools handling medical records, contracts and user profiles. The reading here is mechanical rather than ironic: safety vocabulary in the prompt primes a model to reach for policy explanations, and a silent tool failure gives it an occasion to use one. Prompt wording changed the shape of the failure.

Two ways to be confidently wrong

A second preprint, posted July 23 by Junchi Liao, describes an independent path to the same destination. Liao ran a controlled set of next-action tasks that held the task, the claim, its position in the context window and the governing policy fixed, and varied only the apparent authority of the claim's source. Trusted and untrusted versions of the same claim produced different actions more often when the evidence competed with the correct action than when it supported it. Models do register signals about where a claim came from. Registering them did not stop untrusted evidence from moving what the agent did. Liao is explicit that these are controlled stress-set rates rather than deployment prevalence, and this paper is also a preprint.

Put the two findings side by side and an agent has two independent routes to a plausible wrong action: it will improvise output when a tool goes quiet, and it will let evidence it has flagged as untrustworthy influence which tool it reaches for next. Neither route produces an error, and both produce a well-formed answer.

That is what makes this a records problem before it is a model problem. The distinguishing artifact is not the agent's output, which looks the same either way. It is the tool response the agent received. A log that captures the agent's reasoning and its final answer, which is what most agent observability amounts to today, cannot tell a real result from a fabricated one, because the fabricated one reads better. A record that captures the full request and the full response can, because the empty payload sits right there in the transcript next to the confident prose. AgentPMT's activity feed is built on that distinction: AgentPMT Audit Logs exposes every action across every agent, filterable down to complete request and response payloads, so an operator investigating a bad write can go find the moment the tool returned nothing. We have argued the general form of this before, that prompt dumps are a diary and what teams need is a flight recorder, and Singh's audit puts a mechanism underneath the argument. The related design lesson, that deterministic tools are the reliability lever when the model cannot be relied on to be careful, applies directly: a stub that returns an explicit empty-result signal instead of a bare 200 gives the agent something unambiguous to act on.

Deployment finished before verification did

The survey data published this week reads differently once the mechanism is in view. Forrester Consulting, commissioned by Boomi, polled 409 director-and-above IT decision-makers across North America, Europe and Asia-Pacific and found that 86 percent had moved past the agent pilot stage while only 34 percent said they trust the actions their agents take.

The instinct is to file that as caution, or as governance lagging adoption. It reads better as an accurate assessment. Teams cannot see across the tool-call boundary, so they decline to extend trust past it, and given what happens on the other side of that boundary when a stub goes quiet, declining is the correct call. Underneath those averages sits a wide spread. Forrester sorted respondents by operational readiness, and the top quartile reported roughly double the rate of high confidence in their agents, along with better productivity and innovation outcomes, compared with the bottom quartile. Most of that bottom quartile shipped to production anyway, carrying an average exposure of a couple of million dollars across compliance, lost customers, downtime and rework. Boomi CEO Steve Lucas put the sequencing plainly: agents can only be trusted to act on data that has been properly activated, connected and governed, and most companies deployed agents before they did that work.

Read as a distribution rather than an average, the finding is encouraging. Agents work for the quartile that instrumented them. That is a solvable position to be in, and it is the same split we found when most of the Fortune 500 could not say what their agents did yesterday despite having deployed them at scale.

Two other datasets from the same week fill in the cost. Domino Data Lab's fifth annual enterprise AI report, drawn from senior AI leaders in North America and Europe, found more organizations reporting improved production capability year over year while the share saying returns fail to outpace spend held flat for a second year. Domino COO Thomas Robinson located the gap at the far end of the pipeline: getting a model into production used to be the achievement, and it no longer is, because the value shows up only when a business user can act on what the model produced. Separately, Censuswide surveyed 1,505 CFOs and senior finance leaders at companies above ten million dollars in revenue for Avalara in June. A substantial share could manage only "somewhat confident" when asked whether they could explain an AI agent's actions to an auditor or regulator. Very few said their organization prioritizes governance over deployment speed, and roughly a quarter said accountability for a significant agent error would be unclear or would sit with nobody in particular. Both surveys are vendor-commissioned with disclosed methodology.

An unexplainable agent action and a fabricated tool result are the same event seen from two ends. Someone in finance discovers a number they cannot source, and upstream of that discovery, weeks earlier, a tool returned an empty body and an agent filled the space.

The credential version of this reads sharper still. Writing for The Hacker News on July 20, BeyondTrust solutions architect Len Noe described the credentials agents typically run on: an API key, an OAuth token, a certificate, often long-lived, broadly scoped, and attached to no lifecycle at all. Nobody offboards a service account when a project ends. Give an agent broad standing privilege so it does not get blocked mid-task, Noe argues, and the result is an actor with permanent access and no instinct to question its instructions. It is the same missing boundary as the observability finding, expressed in credentials instead of logs.

For the people who own automation and technology budgets, that turns three separate purchases into one design question. AgentPMT handles the credential half by keeping every secret in an encrypted vault and injecting it server-side at the moment of use, so the agent never holds a key, token or password, and the scope belongs to the connection rather than to the agent. The returns half is a measurement question before it is a spending question, which is why every run itemizes per-token and per-tool-call cost, budgets cap what an agent may spend per connection with tool, workflow, credential and vendor restrictions, and the same workflow can be re-run on a different model for an even comparison on cost against output quality. Buyers of enterprise artificial intelligence technology have spent two years unable to answer what a given agent run cost and what it returned. That is answerable with instrumentation, and we have written a longer treatment of how to get from pilots to measured profit for teams working through it. The broader diagnosis, that most agent failures are systems failures rather than intelligence failures, is what the two preprints just supplied evidence for.

Where agents are already holding up

Verizon gave the counter-example on its second-quarter earnings call on July 24. The company told analysts that AI models had cut network issue resolution from hours to minutes, folded into a broader cost-reduction program, with revenue from its AI infrastructure work expected to start contributing next year. Company-stated numbers on an earnings call are not independently verified, and should be read that way.

The result is still instructive, because network fault remediation has a property that most agent deployments lack. The fault either clears or it does not. Ground truth arrives in minutes, it is objective, and checking costs almost nothing. An agent that fabricates a diagnosis in that environment gets caught on the next poll. Automation in telecommunications sits unusually well with current agent reliability for that reason, and it is not alone: manufacturing automation and industrial automation systems share the same property, where a machine runs to spec or it does not, and the verification loop closes on its own.

That yields a placement heuristic an operator can apply this quarter. Agents are trustworthy roughly in proportion to how fast and how cheaply their work can be checked. Start where verification is close to free. Where it is not, the check has to be built rather than assumed, either as a recorded artifact you can go back to or as a human approval before the write lands.

Verizon has taken the second route deliberately. In its network automation work, the company has described a model where agents run routine and complex workflows on their own while human experts retain oversight of high-stakes decisions, with humans setting the guardrails and scope, and it has pushed the industry toward a common framework covering security, trust, handoffs and context sharing between agents, on the grounds that a decision an operator cannot trace is a decision an operator cannot own. That posture is available as a primitive rather than a policy. Human-in-the-loop checkpoints drop anywhere in an AgentPMT workflow, pause the run, and send a push notification the operator approves or denies with biometric auth on their phone before the agent proceeds. Where automatic verification is unavailable, an approval gate is what stands in for ground truth. Designing those gates so they catch the writes worth catching without burying the team in notifications is its own discipline, and the approval workflow is the piece most teams put off.

The demand side explains why carriers care about any of this. On AT&T's July 22 call, John Stankey cited industry research indicating that AI agents generate several times more total traffic per task than a person doing the same work, with agentic adoption projected to drive large multiples of growth in enterprise and consumer traffic over the next decade. Those are his characterizations of third-party research rather than AT&T measurements. His operational point stands on its own: networks now have to sense, decide and act in near real time, which means the wireless telecommunications companies carrying agent traffic are also running agents inside their own operations, and are subject to the same failure mode as everyone else. On the vendor side, enterprise content platforms shipped agent guardrails, prompt-injection detection, audit trails and approval gates this month, which at least confirms the control primitives are becoming standard equipment.

What an operator does next follows from the mechanism rather than from the survey percentages. Record tool responses, not just agent outputs, because the empty payload is the only artifact that distinguishes a real result from an invented one. Put an approval gate in front of any write to a system of record where verification is slow or expensive. Scope credentials to the action instead of to the agent, and give them a lifecycle. Measure cost per outcome so returns are a number rather than an assertion. None of that requires waiting for better models, and the readiness data says the teams that did it are already collecting the productivity gains everyone else is still projecting. The work in front of builders now is instrumentation, and it is ordinary engineering.

---

Sources

• Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents, arXiv
• Auditing Provenance Sensitivity in LLM Agent Action Selection, arXiv
• Study finds 86% of enterprises have deployed AI agents, but just 34% trust them, FutureCIO
• New Research Finds That Despite Improved Productivity, AI ROI Fails to Outpace Spend, Carrier Management
• Avalara Survey: Finance Leaders are Racing to Deploy AI Agents Before Governance is Ready, Avalara Newsroom
• Verizon Communications Inc. Q2 2026 Earnings Call Summary, Yahoo Finance
• AT&T Q2 2026 Earnings Call: Complete Transcript, Benzinga
• Verizon Unleashes AI Agents in the Network, But Keeps Humans in the Loop, Light Reading
• The New Insider Has No Pulse: Securing Privilege When the Actor Is an AI Agent, The Hacker News
• Box expands enterprise AI governance with new agent security features, Help Net Security