A new benchmark study identifies a gap in common defenses for tool-using AI agents: models sometimes call tools that do not exist or supply arguments no registered tool accepts. Tool-selection systems choose among real options, while security gates control what valid tools may do. Neither necessarily checks whether the emitted call is real in the first place.
The researchers propose a closed-world resolver that sits before those other controls. It first checks that a requested tool appears in an approved registry, then validates the call against that tool’s argument signature. The computation is simple; the paper’s central argument is architectural, showing why this validation must happen before any policy gate that assumes it received a legitimate call.
Across ten hosted models and two ways of invoking tools, the study recorded 322 genuine hallucinations. Fabricated tool names were concentrated in unconstrained raw-JSON output, according to the paper. The authors define five classes of failure and note one unavoidable residue: borrowed arguments that happen to be indistinguishable from a valid call under the available schema. That means registry and signature checks cannot prove that an agent chose the right action, but they can stop nonexistent tools and malformed parameters from reaching later execution or authorization layers. The work is a new arXiv preprint and should be read as a measurement and reference design, not a complete agent-security system.