What changed
Researchers planted six diagnostic decoy types in MCP tool sets and ran 8,640 primary trials; susceptibility varied about 36-fold across models, did not follow capability tier consistently, and correlated with task failure.
Why it matters
Aggregate tool-call accuracy hides whether an agent understands prerequisites, capability limits, timing, granularity, parameters, and semantic fit.
What to do
Add harmless decoy tools to staging, record attempted invocations by failure type, and compare the same model across harness and tool-description changes.
Caveat
Scoring used two model judges with substantial but imperfect agreement, and no standalone maintained implementation was linked at publication.