A paper says agent tool access outpaces trustworthy execution

A review through August 31 finds agent tool access expanding faster than reliable task completion. That gap matters for anyone deciding how much unsupervised authority to hand an agent. The tools to reach more systems are proven; the evidence that agents finish tasks, recover from errors, or get checked independently mostly isn't.

The arXiv review sorts the evidence three ways: delegated authority, time before human review, and coupling to the environment. That splits responsibility for failure between the model, the harness running it, and the environment it acts in.

Action-interface expansion is documented far more convincingly than whether agents finish the job. MCP and Agent2Agent widen what agents can reach, but the review finds weaker evidence for recovery, authorization, and independent verification of agent actions.

The sharper claim is about multi-agent systems specifically. Splitting work across several agents buys specialization, each one narrower and presumably better at its slice. But the review says that comes at the cost of correlated failure. If agents share a model family, a harness bug, or a bad assumption about the environment, they can fail on the same input together. A team of five isn't automatically five times safer than one agent; it can be one failure mode with five copies.

The review doesn't say how often correlated failure shows up in production, only that interoperability work has outrun the verification work needed to catch it.