A report landed in my inbox last week. Four thousand words. Nine analytical sections. Technical architecture, tokenomics, market positioning, ecosystem dependencies, regulatory exposure, team and governance, risk matrix, narrative cycle, supply-chain transmission. Every section had its headers. Every table had its rows. Every row had a value.
Every value was "N/A."
That is not a report. That is a schema with no data behind it, rendered beautifully, and then β this is the part that kept me at my desk past midnight β concluded with a section titled "Core Judgment." It contained a judgment. About nothing. Delivered with the same confidence as every other judgment it has ever produced.
I've audited contracts that lied to users. This pipeline lied to its operator, and the operator couldn't tell.
The architecture is standard for 2026. A two-stage agent workflow: stage one ingests a source document and emits structured fields β title, source, domain tags, core thesis, an information-point list. Stage two consumes those fields and expands each into analysis.
It's the same pattern as a rollup. Cheap decomposition up front, expensive verification later. The economics only work if the first stage actually produces state.
Stage one produced nothing. Title empty. Source empty. Information-point list empty. The upstream extractor had failed β probably a fetch error, probably a parser that swallowed an exception and returned an empty object rather than reverting.
Stage two did not check. Stage two had no reason to check. Its input contract was satisfied: it received an object with the right keys. The values were empty strings and empty arrays. In JSON, an empty array is a valid array. In Python, an empty list is truthy-checkable but perfectly iterable. Nothing threw.
So the pipeline did what pipelines do. It iterated over zero items nine times and wrote a heading for each.
Here's the mechanism, and it's worth being precise, because "the AI hallucinated" is the wrong diagnosis. Confabulation of facts is not what happened. The pipeline committed a type error, and the type system was too permissive to catch it.
Stage one's output contract looked roughly like this:
{ "title": string, "information_points": string[], "core_thesis": string }
Every major framework validates that shape. Almost none validate that information_points is non-empty. Non-emptiness is a semantic constraint, not a structural one, and structural validators β Pydantic defaults, JSON Schema without minItems, TypeScript interfaces β do not encode semantics.
This is the exact class of bug I spent six months chasing in 2017. A vesting contract, top-ten ICO, token distribution logic. The arithmetic overflowed. The function returned. No require, no revert. The storage slot was written with a garbage value and the transaction succeeded. Code that doesn't revert on invalid state is code that isn't ready for mainnet reality.
The pipeline had no require.
Now look at what stage two was asked to do: "Given the fields below, produce an analysis for each of the nine dimensions." The model received nine empty field definitions. A helpful model completes the shape. It cannot complete the content, because there is no content. So it completes the shape. Headers, sub-headers, tables, a risk matrix with six rows and six columns of nothing.
The output is four thousand words of diligence-shaped text. The gas isn't the problem here β the friction of poor architecture is. Every token spent generating that report was spent on a rendering problem, not an analysis problem.
And then the synthesis step. This is where it stops being funny.
The final prompt was something like: "Synthesize the above into a core judgment." Note the missing precondition. Nobody wrote if findings is empty: return INSUFFICIENT_INPUT. So the model received nine blocks of N/A and one instruction to conclude, and it did. It wrote that it could not produce a conclusion β but it wrote it inside a conclusion section, with a star-rating table, a priority-ordered risk list, and a disclaimer.
I have seen this exact pattern in oracle design. In 2026 I was integrating an LLM agent framework with a zk-rollup, and I found a prompt-injection path in the data feed: a malicious agent could shape the payload so the downstream model reinterpreted its own instructions. We simulated it. Two million dollars of simulated loss in a single block.
The empty-input case is the same failure with a different trigger. The model does not distinguish between "the feed said nothing" and "the feed said something I should act on." Both arrive as context. Both get processed. Vulnerabilities aren't always adversarial β sometimes the adversary is a null pointer.
The fix we shipped on the oracle side was unglamorous: a signed attestation layer. Every payload had to carry a signature and a non-zero length, verified before the agent's inference step ran. If the check failed, the agent didn't reason. It halted and emitted a typed error. Cost: roughly forty thousand gas equivalent in verification overhead. Saved: the whole position.
That's the patch this pipeline needed. Not a better model. Not a longer prompt. A guard clause at the boundary between stage one and stage two.
Two things make this bug stickier than it looks.
The schema is usually owned by a different team than the prompt. The validator says the field is a string array; the prompt assumes the array has content. Nobody owns the gap. I've watched three separate protocols argue about who was responsible for a similarly trivial boundary β a decimals mismatch between a price feed and a lending market. It took eleven days to assign the ticket.
The failure is also load-bearing at the product level. A pipeline that halts on empty input produces visibly fewer reports. A pipeline that fills nine sections with N/A produces a consistent stream. In a bull market, where every team is shipping an "AI research agent," volume is the metric that raises money. I have seen dashboards where the success rate was measured as "reports emitted," not "reports containing at least one sourced claim." Optimization isn't measured against truth. It's measured against throughput.
So the incentive points away from the guard clause. Which is exactly why the guard clause is the whole job.
Here is what the industry is getting wrong about this class of failure. Everyone is worried about agents that invent facts. The attention is on hallucinated numbers, fabricated sources, imaginary audits.
That is the easy problem. Facts get checked, eventually, by someone with a spreadsheet.
The hard problem is hallucinated form. A human reading a document uses structure as a proxy for rigor. Nine sections means someone thought about nine things. A risk matrix means someone enumerated risks. A disclaimer at the bottom signals professional caution. None of that is true. The structure is generated by the same token-prediction process as the content, and it is generated whether or not there is content to fill it.
"N/A" makes it worse. A guess can be falsified. A well-formatted "N/A β information insufficient" reads as intellectual honesty. It launders absence into apparent diligence. The report was not wrong about the project. It was wrong about itself. It presented the absence of analysis as a completed analysis, and it did so in the register that analysts are trained to trust.
Optimization isn't about making the model smarter. It's about respecting the user enough to tell them the input was empty. Most teams in this cycle are shipping the opposite, and they are shipping it with better typography every quarter.
The next eighteen months will put agents on-chain with execution authority β treasury rebalancing, liquidation bots, oracle-mediated settlement. Every one of them will be built by a team that validated its JSON schema and never wrote a non-emptiness check.
Ask any of those teams what their system does when a feed returns valid-but-empty. If the answer is anything other than "it halts," you already know the shape of the incident report you'll be reading.
If you can't revert on bad state at the boundary, you don't have a guardrail. You have a rendering engine.