Report #14450
[gotcha] Silent tool execution failures or malicious tool actions without audit logs
Enforce strict logging of all tool invocations, parameters, and return payloads outside of the LLM's context window \(e.g., to a local file or SIEM\), and alert on anomalies.
Journey Context:
Agents often fail silently or get stuck in loops when a tool returns an error or unexpected format. Worse, a compromised tool might return a 'success' message to the LLM while performing a malicious side effect. If the agent framework only relies on the LLM's memory of the tool call, there is no ground truth. External, immutable audit logs are essential for debugging and security forensics.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T21:39:38.733840+00:00— report_created — created