Hallucinated Identifiers in Agentic Tool Calls

A fabricated sentence in an agent's output can be read, weighed, and caught by anyone paying attention. A fabricated identifier buried inside a tool call cannot: the tool executes on it, the query returns zero rows or the wrong rows, and the agent reports "no issues found" with full confidence. That gap, between a failure a human can catch by reading and a failure that produces no reading surface at all, is why identifier fabrication deserves to be treated as its own category of risk, separate from hallucination in general.

The shape of the failure is specific. An agent calls a real function with a made-up ID, a made-up date, or a made-up filter value. The agent then treats that result as ground truth and builds its next action, or its final answer, on top of it. Nothing in that sequence resembles a crash. A failure that evades detection even under controlled research conditions, with full access to ground truth and annotated trajectories, is not a failure production teams should expect to catch by accident.

The mechanism: how agents arrive at identifiers they invent

Agents don't fabricate identifiers at random. They produce values that are statistically plausible given the training distribution, generated at exactly the moment the correct value is missing, ambiguous, or ungrounded in the current context. That predictability is itself informative, because it means the failure is a direct consequence of how the underlying model works, not a bug introduced somewhere in the agent's scaffolding.

Consider what a language model actually does when it hits a gap in its context. It requires being explicitly built to pause and ask for clarification, and without that, it fills the gap on its own. A model generating free text can hedge, qualify, or express uncertainty in prose. A model filling a JSON field for station_id cannot shrug; it has to put something in that field, and so it does.

Research from ICLR 2026 adds a harder finding on top of this mechanism. The result runs against the industry's working assumption that better reasoning means better reliability. As models are trained through reinforcement learning to reason more effectively, task performance climbs, and the rate of hallucinated tool calls climbs with it. The authors trace this to what they describe as reasoning RL "disproportionately collapsing tool-reliability-related representations" in the late layers of the network. If the fix cannot come from model selection, it has to come from somewhere in the architecture around the model, which makes locating exactly where these failures occur a practical question.

Where in the tool-call lifecycle identifier fabrication appears

Identifier fabrication is not a single failure mode. It appears at distinct points in an agent's tool-call lifecycle, and each point leaves a different trace, or no trace at all, which matters enormously for anyone trying to build detection around it.

The primary type is the input-specification failure. At a finer grain, ToolScan, presented at the ICLR 2025 Workshop, names this "incorrect argument value," one of seven recurring tool-use error types it catalogs alongside incorrect argument names, incorrect argument types, and incorrect function names.

A second type occurs downstream of the first: tool-response misinterpretation. Here the tool has already executed, often on a fabricated identifier, and it returns something, an empty result set or a technically valid response tied to the wrong row. A close variant of this failure appears when the agent assumes it retrieved something meaningful from a tool that returned nothing and fills that gap with confident inference.

A third type is the planning hallucination, which compounds the problem further: the agent invents an entire tool invocation, calling a function that does not exist in the runtime catalog. SimpleToolHalluBench was built specifically to probe this behavior, testing whether a model refuses a task or invents a call when no valid tool, or only distractor tools, are on offer.

Each of these three failure types leaves a different observable footprint in a trace, and in the case of the input-specification failure, often leaves none at all, which is the exact problem the next section works through concretely.

A concrete case: the bonding station that was "performing excellently"

A manufacturing analytics platform built on a digital twin simulation framework, running on Qwen3-32B in function-calling mode deployed on an enterprise AI platform, was asked about non-conformance trends at the bonding station. The agent responded with a well-structured analysis. The SQL that generated the response filtered on WHERE station_id = 'BOND-1'. The bonding station's real identifier was S4.

The query ran exactly as written and returned zero rows, because no row in the database matched a station that did not exist. The agent's summary was fluent, specific, and entirely wrong, built from a premise that had no basis in the system it claimed to describe.

What makes this case structurally representative, rather than a one-off glitch, is that the agent had everything it needed except the one value that mattered. It did not fail to reason. It reasoned correctly and fluently from a fabricated premise, which is a harder failure to catch than bad reasoning, because the chain of logic from input to output holds together perfectly. In a controlled experiment across 72 tool invocations with unconstrained parameters, a large share of identifier values were fabricated by the model in exactly this fashion, suggesting the bonding station case is not an edge case but a representative sample of what happens when identifiers aren't grounded against a real catalog. A hallucinated fact in a block of text can be checked by a reader against what they already know. A hallucinated query parameter returns data that looks like evidence, gets treated as evidence by the agent, and gets treated as evidence by whoever reads the agent's summary next. Nothing in the trace, the HTTP status, the JSON shape, the completion token, flagged any of it.

Compounding across steps: one fabricated ID becomes a trajectory failure

A single fabricated identifier in a one-step agent is bad enough. In a multi-step agent, it does not stay contained to the step where it originated. It seeds every downstream call that depends on the first call's output, and the arithmetic of compounding error rates turns a small per-step problem into a trajectory that is wrong far more often than any one step would suggest. A 5% per-step error rate becomes roughly a 23% trajectory error rate over five steps. That figure applies directly to identifier fabrication: each tool call that consumes a prior call's output inherits whatever error that prior call introduced, and the errors stack.

Multi-agent systems that share memory make the propagation worse, not just longer. Picture an HR copilot that hands work along a chain: a payroll agent, a benefits agent, a compliance agent. One fabricated employee ID introduced early in that chain does not stay with the agent that invented it. An ops team trying to reconstruct what went wrong three days after a payroll error surfaces will find a sequence of successful-looking log entries and no signal pointing at the single bad identifier that started the chain.

Research on hallucination propagation has started to formalize exactly this dynamic. The CHARM framework addresses cascading hallucination specifically in agentic retrieval-augmented generation, the scenario where a retrieval result built on a fabricated identifier feeds directly into subsequent reasoning steps. A separate benchmark, AgentProp-Bench, released in April 2026, asks a related but distinct question using controlled injection: given an error introduced at a specific point, what is the probability it propagates to a later point in the trajectory? Where AgentHallu asks where a hallucination originated through step-level attribution on human-annotated trajectories, AgentProp-Bench asks how far a known error spreads once it's deliberately introduced. Together, the two lines of work point at the same practical consequence. A team that evaluates only the final answer of a five-step agent is checking the last node of a graph where every prior node may already be corrupted, and a clean-looking final answer tells that team almost nothing about whether the four steps that produced it were sound.

Why conventional monitoring cannot see this failure

Traditional error monitoring is built to catch failures that announce themselves, and a fabricated identifier produces no announcement. The tool executes successfully. The response is well-formed. The model emits a completion token with no error code attached. None of the instrumentation most teams already have in place is built to ask the one question that matters here.

Walk through what a standard monitoring stack actually observes on a call like the bonding station example. Every signal a conventional system is built to watch for comes back green. What none of that tooling can see is whether the identifier the agent used corresponds to anything real in the system it queried, and answering that question requires knowing what the agent was supposed to retrieve, not just logging what it did retrieve.

The same blind spot occurs in a related security context. A hallucinated bulk delete issued by an otherwise authorized agent carries no sensitive-data pattern that a content-inspection tool would flag, because the harm sits in what the call does inside the target system, not in any content the call carries. Identifier fabrication works the same way: the danger lives in the mismatch between a fabricated parameter and reality, and no syntactic or format check is built to detect a mismatch of that kind. Logging what happened and knowing whether what happened was correct are two different exercises, and conventional monitoring only does the first.

What effective detection of identifier fabrication requires

Catching a fabricated identifier means evaluating what the agent was supposed to do at each step, not simply recording what it did. That requires grounding every tool-argument check against the agent's actual instructions and against the valid identifier space for the domain it's operating in, rather than trusting that a successful tool call implies a correct one.

A trajectory evaluator worth the name has to cover four dimensions at once. A step-level evaluator built around tool arguments cannot function without a reference for what a valid identifier looks like in that domain, whether that reference is an enumerated allowlist, a formal ontology, or a live check against the target system's own catalog.

The instinct many teams reach for first is tighter schema constraints: enumerated identifiers, strictly typed parameters, allowlists tied to an ontology. Schema constraints belong in the stack as a necessary first layer. Schema constraints are not sufficient on their own; monitoring built to understand what the agent was actually trying to do catches what schema constraints cannot.

What this looks like at the model level is visible in how BFCL v4 evaluates function-calling models. Released in July 2025 and presented at ICML 2025, BFCL v4 moved to a holistic agentic evaluation model, adding new agentic categories covering web search and memory management, and weighting Hallucination Measurement at 10% of the total score, testing specifically whether a model correctly declines to call any function when the user's query doesn't match the available tool set. The volume at a MyOperator deployment, running more than 300 AI voice agents across millions of monthly calls, makes manual review of hallucination and persona drift a physical impossibility at that scale. Automated, continuous, step-level evaluation is the only mechanism that can function at that volume.

Fitting identifier-fabrication monitoring into the developer workflow

Detection that requires a team to leave their existing tools and open a separate console will get skipped the moment a release deadline applies pressure. The teams most likely to actually catch fabricated identifiers in production are the ones whose monitoring lives inside the frameworks and alert channels they already use every day.

The Model Context Protocol is a useful place to see both the risk and the opportunity side by side. MCP standardizes how agents discover and invoke tools, and that same standardization means it also standardizes the interface point where identifier fabrication can be observed and intercepted before it reaches a production system. The risk side of that same standardization surfaced publicly: Microsoft Incident Response and its Defender security research team disclosed on June 30, 2026, that the natural-language descriptions attached to MCP tools can be quietly altered to redirect an agent's behavior, a finding that rules out treating the MCP layer as trusted infrastructure by default and requires it be monitored like any other attack surface. Practitioner tooling has started to respond to exactly this gap. MCP-Scan, from Invariant Labs, scans MCP server configurations for tool-poisoning vulnerabilities. Microsoft's Agent Governance Toolkit, open-sourced under the MIT license on April 2, 2026, covers the OWASP Agentic Top 10 risks and offers a concrete reference point for what governance at the tool-interface layer should include.

In practice, integration into the existing workflow means a few specific things. Support for the frameworks teams are already building on, Vercel AI, OpenAI Agents, LangGraph, Azure, means this kind of instrumentation can sit on top of an existing agent rather than demanding the agent's infrastructure be rebuilt around a new monitoring layer.

The ICLR 2026 finding that stronger reasoning amplifies tool hallucination settles the question of whether this problem improves on its own as models get better: it does not, and in some respects it gets worse. The teams that ship agents reliably over time are the ones that treat production monitoring for identifier fabrication as a permanent fixture of the stack, running continuously against every tool call, rather than a checklist item cleared once before launch and never revisited.