A new benchmark shows AI agents routinely invent tools that do not exist, then hand them arguments no schema ever defined.
The paper, posted to arXiv, introduces a five-class taxonomy of tool hallucination and a training-free 'Resolution Rung' resolver that checks whether a called tool is registered and whether its arguments match a declared signature. Testing ten hosted models across two ways of invoking tools, the authors logged 322 genuine hallucinations. Fabricated-tool calls clustered heavily on unconstrained raw-JSON interfaces, 34 cases versus just 3 on a more structured surface, and a 675-billion-parameter model hallucinated about as often as one with 7 to 8 billion parameters. The team then tested the Model Context Protocol, where merging multiple tool servers into one namespace produced a second, distinct taxonomy of failures and 154 more hallucinations, some from frontier models that had been clean on the single-registry test.
This matters because most tool-security work assumes an agent's call refers to something real, then argues about whether it should be allowed to run. The paper's point is structural: a hallucinated call was never a decision any permission system made, so no amount of gating catches it before the fact. That is a real gap in how agentic systems are secured today, not just a benchmark curiosity.
The team released the underlying Hallucinated-Tools Benchmark so other resolvers can be tested against the same numbers, which at minimum ends the era of vague claims that an agent 'doesn't really' call fake tools.