← Back to feed

Teams debugging AI agent failures typically work backwards from the output: the agent hallucinated, ignored a policy, or misused a tool. A new paper — arxiv 2607.14275, published July 15 — argues the causal chain usually starts earlier, in the context the agent was given before it did anything at all.

The finding has a practical edge: context quality can be scored and used as a preflight diagnostic, before running a full adversarial evaluation.

The Study

Researchers built ProofAgent-Harness, an open-source infrastructure for adversarial agent evaluation, and ran 300 multi-turn evaluations across regulated agent domains — 7,500 turns total. The critical design choice was isolation: the context-quality score does not enter the behavioral score, the final grade, or the release decision. This prevents the validation from being circular. If context quality predicts behavioral outcomes while remaining independent of those outcomes, the relationship is real.

Contexts were varied across three levels while holding the model fixed:

Level	Characteristics
Poor (C1)	Vague role definition, weak tool guidance, minimal grounding, little injection protection
Structured (C2)	Clear role boundaries, typed tool schemas, grounding documents, organized instructions
Hardened (C3)	C2 plus explicit refusal conditions, escalation thresholds, injection separation, confirm-before-mutate patterns

The behavioral scores tracked hallucination resistance, manipulation resistance, instruction following, tool use accuracy, and deliverable reliability.

What the Data Shows

Context criteria predicted their corresponding behavioral outcomes consistently across all 300 evaluations:

• Grounding sufficiency predicts hallucination resistance. Agents given grounding documents produced fewer unsupported facts. More factual support correlated with fewer hallucinations.
• Guardrail coverage predicts manipulation resistance. Hardened contexts produced agents that resisted adversarial inputs and social engineering attacks.
• Instruction consistency predicts instruction following. Conflicting or ambiguous instructions caused agents to drift or ignore policies; consistent instructions fixed this.
• Tool schema quality predicts tool use. Well-specified tool schemas reduced tool misuse. Underspecified schemas produced incorrect or unsafe tool calls.

Structured context (C2) produced the largest single behavioral improvement. Moving from poor to structured context was more impactful than the additional hardening in C3 — which sometimes introduced excessive caution in non-adversarial tasks, exposing a real cost-safety tradeoff at the margin.

The Cost Inversion

The study’s sharpest finding: the weakest context is often the cheapest per call and the most dangerous.

Systems running on minimal prompts burn fewer tokens. But those same systems produce the most critical failures — policy violations, injection successes, hallucinated facts presented as confirmed. Optimizing on cost-per-call without measuring context quality will systematically select for the failure-prone configuration.

The paper positions context scoring as a “preflight signal”: run it before deploying the agent in production, before running the full adversarial suite. A low context score should not automatically fail an agent, but it should flag that the operating environment is poorly engineered.

Seven Criteria

ProofAgent-Harness scores context across seven dimensions:

1. Role clarity — Is the agent’s scope, authority, and expected behavior defined precisely?
2. Guardrail coverage — Are refusal conditions, escalation thresholds, and policy limits specified?
3. Instruction consistency — Do the instructions contradict each other?
4. Tool schema quality — Are tool names, parameters, and expected outputs fully specified?
5. Grounding sufficiency — Does the context include factual support for claims the agent needs to make?
6. Injection hardening — Is untrusted input separated from trusted instructions?
7. Token efficiency — Does the context waste tokens on irrelevant information?

The harness is open-source at github.com/ProofAgent-ai/proofagent-harness.

Why This Matters

The framing in most agent evaluation treats failure as a model property. If GPT-5.6 or Fable 5 hallucinates or breaks a guardrail, the inference is about the model. This paper shifts the framing: the same model can produce reliable or unreliable behavior depending on whether the context engineering is sound. Swapping to a better model without fixing the context will not fix the failure.

That has consequences for benchmarks. If benchmark evaluations don’t control for context quality, they may be measuring the difference in default prompting strategies between organizations, not the underlying model capabilities.

The practical case: build the context-scoring step into your deployment pipeline before building the adversarial test suite.