How many GPT-MAS failures came from tool access confusion?

Under the heading "Non-Adversarial Failure Modes in MAS," the paper reports a manual analysis of Header Heist: "most failures in GPT-MAS (22/26) were caused by an agent erroneously concluding it lacked access to a tool (Appendix D." The sentence, and the excerpt, end there. Two things follow. First, in a security test some outcomes have nothing to do with the attack: the agent stopped because it believed a tool was unavailable. Second, the excerpt does not say what "failures" counts. It could mean runs where the attack did not succeed, which would make a share of the MAS's apparent resistance a capability failure in disguise. Or it could mean runs where the task was not completed, whether or not the attack fired. The two readings push the security picture in opposite directions, so the number can't be used until the appendix is read.

The claim does not depend on which reading is right. A measurement that reports attack success alone folds two different causes into one: the defense held, or the agent broke for its own reasons. The same shape already appears twice in the vault. Where do safety wins come from in multi-agent systems? found a favorable zero that was the cloud filter, and What causes failures in exploitation benchmarks? found a benchmark failure that need not reflect difficulty. This is a third cause of a misleading outcome number (an agent's mistaken belief about its own tools) and a reason to treat a low attack-success rate as a ceiling on how much credit the defense has earned.

It also resembles Do autonomous agents report success when actions actually fail? from the other side. There the agent wrongly claims it did something; here it wrongly concludes it cannot do something. Both are a mismatch between the agent's model of its capabilities and its actual ones. Whether they share a mechanism is a vault question. The excerpt gives no explanation for the wrong tool belief.

Two notes from other papers name the same gap from the measurement side. What blocks rigorous security evaluation of multi-agent systems? files it under diagnostic metrics: a number that verifies an outcome without verifying what produced it. What behaviors hide behind a zero crossing rate? shows one crossing rate standing for four different policies. The source here differs (a wrong belief about tools, not a boundary policy), but in both a single rate does not say why the agent did or did not act.

What the excerpt does not give. The denominator behind "most failures," the definition of failure, the single-agent comparison for this failure type, and Appendix D.