Why do autonomous agents continue to fail when interacting with external tools, APIs, and enterprise databases? Enterprise roadmaps increasingly depend on delegating operational workflows to large language models operating through the Model Context Protocol (MCP), an open architecture allowing systems to dynamically discover and call tools across diverse servers at runtime. Yet, as corporate spending on automated tool execution increases, production deployments face severe breakdowns when workflows confront practical limits.
Automating business workflows through MCP environments currently stalls against the inability of autonomous agents to recognize dead-end execution paths. Researchers Yizhen Jiang, Haowei Guo, and Wentao Zhang from Peking University, alongside collaborators from Zhongguancun Academy, Meituan, and The Hong Kong University of Science and Technology, evaluated this landscape in a preprint paper presenting MCPHallu. The diagnostic benchmark includes 358 tasks spanning five capability domains and executes on 36 production MCP servers isolated inside containers, measuring performance across reasoning, execution, and memory failure axes.
Across 5,012 trajectories evaluating 14 frontier LLM agents from eight commercial vendors, current MCP systems achieved an aggregate score of 0.642 on a zero-to-one scale. While that number might suggest moderate operational competence, the aggregate hides severe structural vulnerabilities that emerge under real-world conditions.
The Anatomy of Execution Breakdowns
How do these operational disruptions manifest inside active software environments?
They occur when agents encounter task architectures configured around four distinct failure triggers: Branch Collapse, Unreachable Goal, Tool Misuse, and Context Forgetting. In an evaluated financial case involving GPT-5, an agent acted as a quantitative analyst generating daily briefings. The prompt required fetching real-time market quotes for AAPL and MSFT, evaluating percentage changes against independent conditional thresholds, pulling specific technical indicators like RSI or Bollinger Bands, and ordering the final briefing by absolute percentage change.
"Current MCP agents remain vulnerable to hallucination-inducing tool environments, achieving an average score of 0.642 on a scale (higher is better)."
Although the model executed the tool calls correctly, it collapsed during branch ordering by listing AAPL ahead of MSFT despite MSFT showing a larger absolute move. This failure to retain independent state logic demonstrates how multi-step protocol actions break down during execution even when the underlying API connections work.
The Cost of Unreachable Goals
A common assumption among technology teams holds that overall benchmark success reflects real-world readiness, treating goal failures as rare edge cases that do not affect standard operations. In fact, when systems encounter tasks where an objective cannot be completed, agent reliability deteriorates.
On Unreachable Goal tasks inside MCPHallu, the average agent score dropped to 0.458, and only 23.2% of runs passed. Rather than recognizing that an objective was impossible and halting execution, agents continuously issued unnecessary tool calls or reported false task completion.
"Failures concentrate on Unreachable Goal tasks, where the average score drops to 0.458 and 23.2% of runs pass, indicating that agents often continue issuing tool calls or claim successful completion rather than recognizing infeasible goals."
This behavior exposes infrastructure to runaway computational loops and inaccurate status reports, generating token expenses for completely fabricated results.
This fragility matches earlier protocol stress tests. Research into function hijacking showed that Attack Success Rates on the BFCL dataset ranged from 70% to 100% across five models, demonstrating that integrating these systems into critical operations effectively hands infrastructure access to mechanisms that break down under stress. The MCPHallu results prove that operational fragility persists even without adversarial attacks.
Model performance also defies simple leaderboard comparisons. Subtype rankings shifted by an average of 6.9 out of 13 positions across failure categories. Furthermore, performance on Branch Collapse showed no correlation with Unreachable Goal handling, recording an r of -0.12. A system that excels at tracking complex decision branches can fail completely when tasked with stopping at an infeasible objective.
Enterprise reliance on autonomous tool orchestration requires monitoring mechanisms specifically engineered to catch infinite execution loops and false completion reports. As Model Context Protocol adoption grows across software stacks, systems that cannot recognize their own operational boundaries will generate mounting compute expenses while returning unverified results. Quantifying model reliability across isolated failure modes will decide which agent architectures survive in mission-critical environments.
What’s behind it
A score of 0.458 on unreachable goals exposes the core illusion around the MCP protocol: autonomy breaks not on connecting external tools, but on the basic logic of halting execution. Models reliably call external interfaces and retrieve stock tickers, yet fail to maintain conditional branching. Faced with an impossible objective, agents completed just 23.2% of evaluation runs.
Our stories: MCP Protocol Security: Function Hijacking Risks for AI Agents (April 25).