There isn't one version of this failure, there are three distinct patterns, and they cause different kinds of damage.
Calling a tool that doesn't exist. The agent invokes a function name that was never registered, sometimes because it was described in an earlier turn, sometimes because the model generalizes from a similar tool it has genuinely used before. If the orchestration layer doesn't validate the tool name before execution, this can crash the pipeline outright — or worse, silently no-op.
Inventing arguments that don't match a schema. The tool exists, but the agent passes parameters that were never defined, get the wrong type, or omit something required. This is less catastrophic when strict schema validation rejects the call immediately, but if validation is loose, malformed arguments can execute against a real system with unpredictable effects.
Fabricating a result when a call fails silently. The tool call goes out, something goes wrong on the way, for instance: a timeout, a dropped connection, a malformed response, and instead of surfacing an error, the agent generates a plausible-sounding result and continues as though the action succeeded.
The Third Pattern Is the Real Problem
