More Capable ≠ Safer: A New Test Probes How AI Agents Choose Tools

An AI coding agent has fifty tools in front of it and picks the wrong one. The user has no way to know whether the toolset was ambiguous, the prompt was underspecified, or the model simply reasoned poorly about which tool fit.

The paper "Diagnosing Tool-Selection Reasoning in LLM Agents with Canary Tools" plants diagnostic probes directly inside an agent's toolbox and watches what gets picked. Each probe is engineered to test one specific kind of tool-selection failure. Run the framework, and a model shows not just whether it got the right tool, but which trap it fell into when it didn't (arXiv:2608.04719).

The probes come in six types, mapped to six failure modes. Semantic decoys use names that look right but match a different intent. Parameter traps accept a call that should have been rejected. Capability mirages offer tools that pretend to do something they don't. Prerequisite blindness hides a needed step. Temporal decoys imply recency that isn't there. Granularity traps push the model toward an over- or under-precise answer. Together they form a taxonomy that turns "the agent picked wrong" into a typed diagnosis.

The experiment runs the framework across eight models, six hosted and two open-weight 8B variants, at three capability tiers, over 120 tasks, under three canary-density conditions, with three seeds. That is 8,640 graded runs, plus a 2,880-run follow-up that softens each probe's giveaway phrase to make sure the diagnostic still fires. Two independent judges scored the outcomes with a Cohen's kappa of 0.75, which the authors treat as solid inter-rater agreement for a subjective judgment task (HTML version).

The headline number is the per-task canary susceptibility rate, or CSR: how often a model falls for the planted trap when it is presented. CSR spans roughly 36-fold across the eight models tested. Claude Opus 4.8 sat at the bottom of the range; the open-weight Llama 3.1 8B sat at the top. The spread is the point. A single CSR score lets a buyer compare agents on tool-selection reasoning rather than on a vendor's own pass rate (summary).

Capability tier did not predict safety. The most susceptible hosted model in the test was a mid-tier offering, not a frontier one. Inside a single provider, the cheaper model sometimes scored safer than its bigger sibling. The pattern, the authors write, is "capability-stratified" tool-selection failure: capability mirages are the trap that most reliably catches frontier models, while the other five types are largely inert on strong models but fire often on small open ones.

The frontier models' CSR barely moved. The framework, the paper argues, is measuring reasoning about the tool, not pattern-matching against a planted signal. That distinction matters for anyone trying to build agents that won't be fooled by a renamed decoy in production.

The most robust models were not significantly degraded by canary pressure, and the correlation between susceptibility and outright task failure was modest (Spearman rho = -0.34). Canary tools catch reasoning slips; they are not a full task-failure oracle. The authors release the framework, schemas, tasks, and run logs alongside the paper, which is what makes the instrument usable for auditors and procurement teams today.

Three limits are worth flagging. The paper is an arXiv preprint, not peer-reviewed. The eight models are the authors' own selection. No independent lab has yet replicated the 36-fold spread or the capability-stratified finding. The framework, like any benchmark, can be gamed once vendors optimize for it. The watch item for the field is whether follow-up work reproduces the capability-doesn't-predict-safety result on a wider model set, and whether CSR becomes a routine column on agent evaluation cards the way MMLU once did for general language benchmarks.

For now, the paper offers the field something it did not have: a shared instrument for asking, type by type, why an agent picked the tool it picked. The answer is not always "because it was the most capable."