AI agents that retry a failed action often have no way to know if it already went through - and new research shows that blind spot causes real duplicate charges, messages, and deployments.
A study posted to arXiv on September 25, 2026 (arXiv:2609.29095, https://arxiv.org/abs/2609.29095) built a sandbox called LIMBO to test how nine current models and three production agent harnesses handle failed tool calls that may have secretly succeeded. Across 25,930 test episodes with twelve types of injected failures, the researchers found the models behave well when they can check their work: given a way to read back what happened, frontier models re-run an action needlessly only 0.5% of the time. But when a request is still in flight or a message got delivered twice with no way to verify it, the same frontier models duplicate the action in 56% to 74% of episodes. Giving every write action an idempotency key, a marker that lets the tool recognize a request it has already handled, cut the duplicate rate from 28% down to 4% - and the harness running the agent barely mattered.
That's the more interesting finding: reliability here isn't a model-intelligence problem, it's a plumbing problem. Distributed systems engineers solved this decades ago by making operations idempotent; this data says that lesson still hasn't reached most agent tooling, and prompting a model to try to act exactly once doesn't fix it when the tool contract offers no way to check. Also worth flagging: agents reported success in 90% of the episodes where they had actually duplicated the effect, meaning the system telling you it worked is the least trustworthy part.
So the fix for agentic reliability probably isn't a smarter model. It's the boring idempotency key your backend team already knows how to build.