TL;DR
- A new arXiv study tests five open-weight models on tool-use tasks ranging from one step to eight.
- By depth six, agents lose roughly 70% of their clean-context capability, corrupted by their own earlier mistakes.
- Standard exact-match scoring recorded 0 of 869 poisoned steps as correct and 0 of 580 as recovered, making recovery look mathematically impossible.
- The authors’ fix, conditional-on-state scoring, pulls those severity estimates off the boundary to +0.149 and +0.316 without any extra compute cost.
Five Models, Eight Steps, and a Silent Collapse
The paper, posted to arXiv under the title “Invocation-Level Reliability of Tool-Using Agents,” puts five open-weight models through multi-step tasks stretched across depths one through eight. Each step asks an agent to pick a tool and fill in the right arguments. Simple enough, until step three or four goes sideways and nobody notices.
The researchers frame the core failure bluntly. “Tool-using agents fail two ways: choosing the wrong tool, or forming wrong arguments, and an early failure of either kind can silently corrupt everything downstream,” they write. That’s the whole paper in one sentence, really. The rest is measurement.
And the measurement is rough. By depth six, the study finds that roughly 70% of a model’s own clean-context capability has been eaten by its own earlier mistakes. Not by a harder task. Not by a trickier tool. By context the model itself poisoned three or four steps earlier and never revisited.
Then there’s the scoring problem, which is arguably the more uncomfortable finding. Under standard exact-match scoring against gold trajectories, the paper reports 0 of 869 poisoned steps scored as correct, and 0 of 580 poisoned steps scored as returning on-track. Zero. Not a low number.
The Recovery Illusion
Here’s the question that should bother anyone shipping agentic products: if zero out of 869 poisoned steps ever registered as correct, does that mean these models genuinely never recover from a mistake, or does it mean the test itself can’t detect recovery even when it happens?
The paper’s answer is the second one, and it’s a sharper indictment of benchmarking than of the models themselves. Exact-match scoring compares a model’s output at each step against a single gold trajectory generated ahead of time. Once a model deviates from that trajectory, every subsequent gold value depends on tool constants the model never sees again. The model isn’t failing to recover. It’s being scored against a script it can no longer read.
Think of it like grading a cover band on how exactly they reproduce a studio recording, note for note, after they’ve already improvised a fill in bar four. Everything after that fill will sound wrong by the letter of the score even if the band nails a perfectly competent version of the song. The exact-match metric doesn’t ask whether the music holds together. It asks whether every note matches a script that stopped being relevant the moment the fill happened.
Fix that, and the picture changes. Applying conditional-on-state scoring retrospectively, the same data yields interior severity estimates of +0.149 and +0.316, rather than the boundary value that exact-match scoring forced. The researchers note this comes at zero additional cost, meaning nobody needs new runs, new data, or new compute. Just a smarter question asked of data that already existed.
I’ve sat through enough agent demos to know how easily a smooth top-level result hides a shaky middle. This paper is the first I’ve seen that puts a number on exactly how shaky, and shows the industry’s own scoring conventions have been quietly hiding it rather than revealing it.
The competitive stakes here aren’t about one lab beating another. They’re about whose benchmark numbers anyone should trust once agents start chaining six, seven, eight tool calls in production. A vendor quoting a headline accuracy figure derived from exact-match scoring against a gold trajectory is, per this paper, quoting a number that structurally cannot see recovery. That’s not a small asterisk.
Why the Old Scoring Method Couldn’t See Recovery
This isn’t the first paper to notice that long tool chains get harder to evaluate as they get longer. But most prior work assumed the difficulty was in the task, not the scoring. The background context matters here: evaluating multi-step LLM tool usage has typically leaned on exact-match comparison against a single gold trajectory, generated once, in advance, by running the correct sequence of tool calls.
That approach works fine when nothing goes wrong. The moment a model picks the wrong tool or supplies a malformed argument on step two, the entire downstream trajectory the gold standard expects becomes unreachable, because later gold values depend on tool constants the model can no longer see. From that point forward, the model is being asked to guess values it has no path to deriving, and exact-match scoring marks every subsequent step wrong regardless of how sensible the model’s actual behavior is.
The paper’s proposed conditional-on-state scoring asks a narrower, fairer question: given where the model actually is right now, is this next action reasonable? That reframing is what surfaces the 0.92 and 0.73 fit values and the interior severity estimates the authors report, numbers that simply don’t exist under the old method because the old method forces everything to a boundary.
Three Things Worth Watching
Whether other benchmark maintainers adopt conditional-on-state scoring, or something like it, is the first thing to watch. It’s a free upgrade in the strictest sense: same data, same runs, better signal. That kind of low-cost fix tends to spread fast once someone notices it, or it gets ignored for years because nobody wants to admit the old numbers were misleading.
The second is whether this 70% degradation pattern holds for closed, frontier-scale models, since this study only covers five open-weight systems. If proprietary agents show the same depth-six cliff, that’s a story about the fundamental difficulty of tool chains rather than about model scale or training data.
The third is what agent builders actually do with this. Do teams start instrumenting for state-conditional checks mid-chain, catching corruption at step three instead of discovering it at step eight? Or does the industry keep shipping longer tool chains anyway, betting that users won’t notice the silent 70% until something expensive breaks?
Editor's Note
What gets me about this paper isn't the 70% number, it's that zero. Zero out of 869 poisoned steps scored correct under the old method. I've reviewed enough agent benchmarks to know that a zero like that usually means the test is broken, not the product. My prediction: within a year, every serious agent benchmark quietly rewrites its scoring to something closer to conditional-on-state, and nobody will admit the old numbers were inflated failures.
– Sanket Chaukiyal, founder, SmartChunks
FAQ
What did the study actually test?
Five open-weight language models performing multi-step tool-use tasks across depths one through eight, measuring whether each individual tool call picked the right tool and the right arguments.
What does the "70% capability lost by depth six" figure mean in practice?
By the sixth step in a tool chain, models perform at only about 30% of the accuracy they'd show with a clean, uncorrupted context at that same step, because earlier mistakes have poisoned what the model is working from.
Why did exact-match scoring find zero recoveries?
Because exact-match scoring checks outputs against a single gold trajectory generated in advance, and once a model deviates, later gold values depend on tool constants it can no longer see, making any measured recovery structurally impossible under that method.
What is conditional-on-state scoring?
It's the alternative scoring method the paper proposes, which judges each step against the model's actual current state rather than a fixed gold trajectory, producing interior severity estimates instead of forcing every post-error step to the same worst-case score.
Source: arXiv
