Last week an analytics pipeline burned six hours of GPU time and produced a 4,000-word research report. Nine analytical dimensions. Confidence ratings. Risk matrices. Supply schedules. Every substantive field β blank. The upstream parser had failed silently. The system never stopped. It never flagged the void. It filled the void with language.
That's the moment I stopped worrying about AI agents hallucinating price targets and started worrying about them hallucinating methodology. A wrong number is a bug. A confidently fabricated analytical framework is a disease. One is fixable. The other ships.
I have spent the last year wiring LLM-based agents into on-chain data feeds. I have watched them do genuinely useful work β summarizing governance proposals, flagging anomalous wallet clusters, pre-screening contracts for reentrancy patterns. I have also watched them invent a token distribution table, complete with cliff schedules and vesting percentages, for a protocol that does not exist. The second behavior is not a model failure. It's an architecture failure, and it's about to get much worse.
The pipeline that produced that empty report is not exotic. It is the new default. Stage one parses a source article into structured fields: title, claims, named projects, hard numbers, timestamps. Stage two reasons over those fields and emits analysis. In between sits a schema β a contract, in the literal sense, between two systems that never met. When the parse fails, stage one hands stage two an empty struct. A well-built consumer rejects it. A language model does not. It treats absence as a prompt, not a constraint.
The scale is the problem. Every team I know shipping an "AI research agent" has rebuilt the same three-stage parser-reasoner-emitter pipeline in the last twelve months. Most of them wrote the reasoner first, because that's the fun part, and the schema last, because that's the boring part. The boring part is where the money leaks.
This is the same class of bug I audited in 2017, when I reverse-engineered a top-10 ICO's vesting contracts and found an integer overflow in the distribution logic β a silent wrap that would have drained $12 million. The contract compiled. The tests passed. The failure lived in the gap between what the code assumed and what the input actually contained. I reported it privately, through encrypted channels, and got no public credit. Code speaks louder than whitepapers; it also keeps secrets better.
The difference today is the failure mode. Solidity reverts on a failed require. An LLM completes. That asymmetry β revert versus complete β is the single most under-modeled risk in the current AI-agent wave. Everyone is auditing the smart contracts. Almost nobody is auditing the data contract that feeds the agent. And in a bull market, when capital chases anything with an "AI" prefix, nobody wants to.
Let me get mechanical, because the failure is mechanical.
An LLM is a completion engine. Given an empty context, it does not output "insufficient data." It outputs the most probable continuation of the tokens it did receive β which, inside a research prompt, is the shape of research. Headers. Tables. Hedged conclusions. Confidence intervals pulled from nowhere. The output is fluent precisely because fluency is the objective function. Truth was never in the loss function.
Fix this at the boundary, not the model. Three layers.
Schema enforcement with hard nulls. Every required field carries a sentinel. If the information-point array is empty, the pipeline must throw, not continue. This is a single require statement β the cheapest line of code in the system, and the one that would have saved those six hours and four thousand words of fiction.
Provenance binding. Every claim in the output must trace to a source span. If a sentence cannot be linked to an extracted fact, it gets deleted, not softened. I rebuilt a yield aggregator this way in 2020 β refactoring state-variable packing and cutting redundant storage reads to shave 22% off gas β and the discipline that saved users roughly $50,000 in a month is the same discipline: touch only what you can point to. A claim without a citation is a storage write without a refund.
Adversarial input simulation. Before deployment, feed the agent deliberately empty, contradictory, and poisoned inputs. Watch what it emits. This is not optional. In 2026 I integrated an LLM agent framework with a privacy-preserving zk-rollup and found a prompt-injection vector in the oracle feed β malicious data steered transaction outputs, a simulated $2 million loss. The patch wasn't in the model. It was in the oracle boundary, where untrusted text became trusted state. The empty input and the poisoned input are the same bug wearing different masks: both are the boundary failing to reject.
And note what the six-hour report proves: the pipeline had no test for the empty case. Not because the engineers were lazy, but because the empty case is invisible in a demo. Demos always have input. Production sometimes doesn't.
Here is the counterintuitive part, and it is the part that should worry you most.
The empty-input problem is not primarily a technical bug. It is an incentive bug wearing a technical costume.
Research pipelines are rewarded for output volume, not output correctness. A report that says "N/A β insufficient information" is scored as a failure. A report that fabricates nine dimensions is scored as a success. So the system learns β through prompt engineering, through reinforcement learning, through the humans quietly tuning it β that filling the void pays. The blank field is the enemy. Fluency is the product.
Vulnerabilities aren't deviations. They're incentives that survived review. The token layer makes this acute. When agents are paid per inference, per word, per "insight generated," you have built a machine that monetizes invention. I have seen this before. In 2022, I simulated a 15% validator dropout on a Layer 1 that claimed to solve the trilemma and found a finality lag that would have frozen assets for 40 minutes. The consensus didn't fail under load. The incentives failed first; the consensus just reported it, faithfully, all the way to the freeze.
Optimization isn't about throughput. It's about respecting the user enough to say three words: I don't know.
The next wave of AI agents will not fail loudly. They will fail fluently β producing the exact shape of analysis, with none of the substance, because nothing in the system was ever built to prefer silence over noise. Code that doesn't refuse to run on empty input isn't ready for mainnet reality. If you cannot trace every sentence to a source, you do not have research. You have autocomplete wearing a Bloomberg terminal skin, and it is very good at sounding like it knows.
The question for 2026 is not whether your agent can analyze. It is whether it can stop.