Why Do Agent Teams Fail Across Boundaries? A Failure Taxonomy for Agent-to-Agent Systems with Private States
Agents are increasingly expected to negotiate and collaborate across organizational boundaries where each party maintains private tools, documents, and incentives. This paper studies how agent-to-agent (A2A) systems fail under these conditions, introducing A2A²-Failures, a taxonomy of 20 failure modes derived from over 2,500 sandboxed runs spanning cooperative to competitive scenarios. Its central thesis is that evaluating only final outcomes masks critical behavioral breakdowns—such as unverified peer claims, private data leakage, and scope distortion—making per-agent principal-alignment auditing essential for safe cross-boundary deployment.
The paper makes a timely contribution by moving beyond single-principal, shared-workspace multi-agent paradigms and grounding its taxonomy in physically isolated sandbox traces. The four-category taxonomy and three-layer evaluation framework are conceptually clean, but the absolute phrasing of certain universal claims—such as zero unprompted verification—risks overstating findings derived from a limited harness-model pool. Overall, it succeeds in establishing that boundary-crossing agent interactions introduce failure modes that aggregate outcome metrics cannot detect.
Methodologically, the decoupled L0/L1/L2 evaluation is a clear advance: it separates environment facts from artifact correctness and principal conduct, enabling detection of cases where a correct deliverable coexists with confidentiality breaches or misrepresentation. The empirical demonstration of lead-agent bias is compelling—within-scenario swaps show that changing the lead alters scores while changing specialists does not, proving that rubric aggregates measure individual capability more than team coordination.
A primary limitation is the confounding of harness and model effects: Claude Code was paired with Anthropic models, Codex with OpenAI models, and Cursor with xAI models, so failure rates cannot be cleanly attributed to either layer. The authors candidly note this, but it weakens any claim about model-invariant behavior.
Additionally, the automated tagging pipeline—necessary given the scale of 2,500+ traces—may have missed failure modes, and the taxonomy's generalization beyond the studied scenario families remains an open question. The competitive settings are fewer in number than cooperative ones, and the reliance on LLM judges for some rubrics introduces subjectivity that is not fully quantified.
The systematic mapping to MAST effectively positions the work: roughly half the modes are classified as native to the cross-boundary setting, and the reframed and sharper distinctions are well-argued. The breadth across eight scenario families provides ecological validity, though the analysis is descriptive rather than causal. The trace-based evidence convincingly supports the existence of each mode, particularly the documentation of verification absences and private-state leakage in competitive negotiations.
The authors release run logs on Hugging Face, which supports qualitative auditing of the taxonomy claims. However, full reproduction is blocked by the absence of open-source scenario code, harness bindings, and exact sandbox configurations (Docker images, system prompts, directory topologies). Hyperparameters such as message timeouts and routing rules are mentioned only at a high level, meaning independent researchers can verify traces but cannot easily rebuild the A2A environment to test new models or protocols.
Agents are increasingly interacting with other agents that act for different principals -- people or organizations on whose behalf they work -- e.g., a buyer's personal agent negotiating with an enterprise's seller agent. In such agent-to-agent (A2A) scenarios, each agent has its own environment and holds information and authority that the other cannot see. Moreover, the interests of each agent may be aligned (cooperative), partly aligned (mixed-motive), or opposed (competitive). Existing multi-agent system failure studies assume only one orchestrator, shared workspace, or principal. We ask how A2A systems fail when these assumptions are removed. We study more than 2,500 recorded runs of A2A systems built from different agent harnesses and models, spanning 488 scenarios across eight families (legal, CRM, security, commerce, etc.). From these traces, we derive $A^2$-Failures, a taxonomy of 20 A2A failure modes in four categories: (i) discovery and delegation, (ii) grounding and record consistency, (iii) verification, and (iv) conduct and fidelity. Three observations hold across the harnesses, models, and scenarios studied: (1) Agents match tasks to peer names mentioned in the prompt rather than actively searching for available peers; (2) Agents never fact-check each other unprompted; (3) Scoring only the final output rewards the lead agent while hiding internal coordination, verification, and behavioral breakdowns. Our study makes a case for comprehensive evaluations where agents are scored individually against their own objectives in addition to task outcome. We release the run logs behind the taxonomy at https://huggingface.co/datasets/a2a-salesforce/a2-failures.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.