alef
··

ALEF Pattern Catalog · v2.9.0-alpha · 2026-05-25T17:03:47.480Z

patterns

The periodic table of agentic AI failures. 68 named patterns across 7 lifecycle stages × 6 state pathologies = 42 cells (68 populated · -26 predicted-undiscovered).

Each pattern carries: stable ID · observable signature (regex / behavior) · verified instances (linked to GitHub issues / commits) · 1-3 fix archetypes · severity · compounds-with. Cite as ALEF-PAT-XXX in any PR / issue / RFC.

machine query

  • GET /api/patterns — full catalog (JSON-LD)
  • GET /api/patterns/001 — single pattern by id / slug
  • GET /api/patterns?stage=execute&pathology=orphan — filter
  • GET /api/patterns?severity_min=7 — high-severity only

orphan

half-written pair · one side missing

poison

own write contaminates own read

drift

cache ≠ canonical source

collapse

many sources fold to one

shadow

side-channel · invisible to caller

ghost

exists in metadata · not invoked

pathology \ stagedesignbinddispatchexecuteobservepersistrecover
orphan·······
poison·······
drift·······
collapse·······
shadow·······
ghost·······

all 68 patterns

  • ALEF-FIN-009compiler-version-trust-vyperdetect × unspecified · sev 5

    compiler version trust vyper — pattern flagged by ALEF internal observation, needs production replication.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-FIN-010self-liquidation-donation-to-reservesdetect × unspecified · sev 5

    self liquidation donation to reserves — pattern flagged by ALEF internal observation, needs production replication.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-FIN-011oracle-single-source-no-twapdetect × unspecified · sev 5

    oracle single source no twap — pattern flagged by ALEF internal observation, needs production replication.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-FIN-012signature-verification-deprecated-syscalldetect × unspecified · sev 5

    signature verification deprecated syscall — pattern flagged by ALEF internal observation, needs production replication.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-FIN-013flash-loan-governance-no-snapshotdetect × unspecified · sev 5

    flash loan governance no snapshot — pattern flagged by ALEF internal observation, needs production replication.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-FIN-014delegatecall-attacker-controlled-selectordetect × unspecified · sev 5

    delegatecall attacker controlled selector — pattern flagged by ALEF internal observation, needs production replication.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-FIN-015phantom-defended-rust-wild--orphan-tool-useguard × wild-evidence-cluster · sev 5

    Wild-evidence cluster surfaced by F4 intersector for language=rust. Parent pattern: ALEF-PAT-001. 3+ distinct repos triggered; per-repo verification still pending.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-001orphan-tool-useexecute × tool-call-without-result-consumption · sev 6

    Agent calls a tool, ignores or discards the result, then continues as if the call succeeded with default values. Side effects happen; verification does not.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-002schema-validation-bypassreceive × unchecked-input · sev 8

    Input schema is declared but never enforced — agent accepts malformed payloads and proceeds, often crashing downstream consumers that DO validate.

    confidence index: 0.92 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-003seed-verdict-poisoningevolve × feedback-loop-contamination · sev 8

    Operator/seed verdicts are mixed into the trust-loop denominator alongside agent verdicts. Operator commands count as data, polluting the agent's self-model.

    confidence index: 0.91 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-004verifier-source-mismatchverify × reads-wrong-state-file · sev 7

    A verifier agent declares pass/fail based on State File A, while the actual decisions are made against State File B. The verifier becomes decorative — never catches real failures.

    confidence index: 0.88 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-005agent-self-prompt-resumerecover × self-referential-restart-loop · sev 7

    On crash or interrupt, agent restarts by reading its OWN last output and feeding it back as the new input. Over time, drift compounds and grounding is lost.

    confidence index: 0.87 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-006stale-cache-on-restartbootstrap × persistence-survives-config-change · sev 6

    Agent restarts and reads cached data without invalidating against current source-of-truth. Cache reflects old config; production reflects new.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-007uniform-sampling-monocropsurvey × biased-coverage-from-flat-sampling · sev 5

    Scanner samples N repos uniformly from popularity-sorted list — gets N variants of the same top codebases. Coverage feels broad but is structurally narrow.

    confidence index: 0.83 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-008empty-args-dispatchexecute × missing-argument-fall-through · sev 6

    Tool/function dispatched with empty or undefined arguments because of an upstream null path that was not asserted. Side effect: tool runs with defaults, producing wrong output silently.

    confidence index: 0.88 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-009success-string-no-actual-effectverify × reports-pass-without-doing · sev 9

    Function returns "ok" or "success" string before — or instead of — actually performing the operation. The caller proceeds confidently; the operation never happened.

    confidence index: 0.94 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-010tool-call-saturationexecute × rate-limit-not-honored · sev 7

    Agent calls a tool in a tight loop until rate-limit hits, then retries instantly. Wastes quota; can blacklist the entire API key.

    confidence index: 0.89 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-011dag-migrated-no-callerevolve × orphan-after-refactor · sev 6

    Agent file refactored to new location/signature, but DAG/scheduler still references old path. Node never fires; functionality vanishes silently.

    confidence index: 0.86 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-012smoke-test-self-attestingverify × test-only-checks-itself · sev 7

    Smoke test passes by checking its own output rather than the production behavior. Test is green; production is broken. Coverage metric lies.

    confidence index: 0.90 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-013atomic-write-pair-violationpersist × partial-state-after-crash · sev 8

    Two files must be written atomically together (state.json + index.json) but are written sequentially. Crash between writes leaves inconsistent state.

    confidence index: 0.92 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-014compaction-retrigger-no-tail-idmaintain × unbounded-retrigger · sev 6

    Compaction job processes log entries 1..N, then retriggers without recording tail-id N. Next run reprocesses 1..N+M, doing the same work twice.

    confidence index: 0.86 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-015schema-versionless-receiptcommunicate × undated-payload · sev 5

    Inter-process receipts (e.g., JSON payloads in queue) lack schemaVersion field. Producer updates schema; consumer parses old format, silently mis-interprets new fields.

    confidence index: 0.84 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-016silent-protocol-conversionintegrate × lossy-translation-no-warning · sev 7

    Bridge between two protocols (e.g., gRPC ↔ REST, OpenAPI ↔ Zod) silently drops fields the target doesn't support. Consumer thinks data is complete; it isn't.

    confidence index: 0.88 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-017tier-permission-mask-mismatchauthorize × permission-tier-not-enforced · sev 8

    Tier-restricted resource (e.g., browser tier="read") accepts operations beyond its tier because the permission check is at action-name not action-effect.

    confidence index: 0.90 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-018stub-recursive-learninglearn × placeholder-output-claims-success · sev 6

    Recursive-learning file is created at the end of a round but contains only "todo" or copies of the input. Reports "learned" while learning nothing.

    confidence index: 0.87 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-019zero-as-falsy-idguard × identifier-truthiness-conflation · sev 5

    JavaScript/TypeScript guards like `if (!id)` reject the legitimate value `0` because zero is falsy. Affects any code path where id=0 is a valid record identifier.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

    3 instance(s): johanohly/AirTrail# · ixahmedxi/orbitkit# · nikolovlazar/nextjs-clean-architecture#

  • ALEF-PAT-020self-feedback-loop-tighteningevolve × recursive-self-reinforcement · sev 7

    Agent's output is fed back as input on each iteration without external grounding. Outputs converge to a stable but ungrounded fixed point.

    confidence index: 0.86 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-021output-schema-no-loop-exitexecute × no-termination-criterion · sev 6

    Agent loop has a schema for partial outputs but no schema for "done". Iteration continues indefinitely or until quota; "done" is never expressible.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-022bot-counted-as-humanclassify × identity-confusion · sev 7

    Engagement metric (reply rate, star count) inflated because bots are counted alongside humans. Trust signal becomes a vanity metric.

    confidence index: 0.88 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-023cache-prefix-nondeterministic-tool-listcache × unstable-prefix-defeats-cache · sev 6

    LLM prompt cache prefix includes tool list rendered with nondeterministic order (e.g., from a Set). Cache key mismatches on every call.

    confidence index: 0.84 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-024tool-desc-cache-breakcache × invisible-prompt-edit · sev 6

    Updating a tool description (a minor wording change) silently invalidates the LLM prompt cache, causing latency spike and cost increase.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-025cache-checkpoint-uafcache × use-after-free-on-rotation · sev 7

    Anthropic cache checkpoint TTL expires mid-conversation; agent continues with stale checkpoint reference. API returns 404 on cache_control.

    confidence index: 0.87 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-026pulse-noop-commitpersist × commits-without-change · sev 5

    Periodic pulse commit fires even when nothing changed. Git history fills with empty commits; echo_chamber metric inflates.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-027shell-true-cmd-flashexecute × silent-shell-injection · sev 9

    shell:true exec invocation accepts unescaped variable interpolation. Adversary-controlled string becomes shell command.

    confidence index: 0.93 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-028banned-but-listed-agentauthorize × skip-list-not-respected · sev 8

    Agent declares a skip-list of forbidden targets but iterates the full list anyway, only checking ban AFTER side effect.

    confidence index: 0.91 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-029maintainer-bot-as-amplifierengage × bot-as-megaphone · sev 6

    Maintainer-bot replies with templated CTAs become amplifiers for spam/promo, not engagement. Each bot reply triggers another bot reply, runaway.

    confidence index: 0.84 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-030engagement-saturationengage × all-channels-respond-once · sev 5

    Agent designed to respond to every signal saturates when signals arrive in burst — every channel returns canned acknowledgment, no real engagement.

    confidence index: 0.82 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-031thread-aging-past-engagement-windowengage × stale-reply-to-dead-thread · sev 5

    Reply queued days after thread originated — maintainer has moved on, reply feels noisy.

    confidence index: 0.83 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-035sync-auth-in-embedded-hot-pathauthorize × auth-blocks-render · sev 7

    Hot path (page render, every-request) makes synchronous auth lookup. p99 latency dominated by token refresh.

    confidence index: 0.88 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-038prompt-injection-via-issue-commentreceive × instruction-source-confusion · sev 8

    GitHub/GitLab issue comments parsed by LLM-driven agents can carry adversarial instructions that the agent treats as operator directives. Defense is strict source-tagging: comments are DATA, never INSTRUCTIONS.

    confidence index: 0.90 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-039safety-mechanism-without-unlock-criteriaguard × paranoia-cannot-relax · sev 6

    Safety guard fires once and locks permanently; no documented criteria for lifting it. System ossifies in degraded mode.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-040bounded-iteration-without-progressive-state-preservationexecute × restart-from-scratch · sev 6

    Loop hits iteration cap, restarts from initial state. All intermediate work lost; no checkpoint.

    confidence index: 0.86 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-041self-metric-calibration-lag-blinds-to-successmeasure × measurement-lag · sev 5

    Metric updates on a delay; agent makes decisions on stale metric and misses recent wins. Looks like failure when it isn't.

    confidence index: 0.83 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-042operation-without-undo-criteriaexecute × irreversible-default · sev 7

    High-impact operation lacks documented undo. After firing, no path back; operator stuck explaining.

    confidence index: 0.87 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-043host-context-borrow-conflates-actor-with-hostauthorize × identity-confusion · sev 7

    Embedded agent borrows host's identity to call APIs. Audit log attributes actions to the host, not the agent that initiated them. Forensic trail breaks.

    confidence index: 0.86 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-044deferral-without-named-missing-informationdecide × silent-postponement · sev 5

    Decision deferred but no field declares what info is missing. Caller doesn't know what to gather; deferral becomes indefinite.

    confidence index: 0.84 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-045async-callback-after-sync-commit-loses-enrichmentpersist × race-loses-late-data · sev 6

    Sync commit writes partial record; async callback arrives later with enrichment but record is already finalized. Enrichment lost to history.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-049bot-detection-and-non-engagementengage × decoy · sev 6

    Maintainer-planted out-of-context phrases (easter-egg bait) AND promo/spray-bot signatures both pull LLM-driven agents into self-outing. The defense is non-engagement: detect and skip rather than respond.

    confidence index: 0.93 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

    3 instance(s): gbrlcustodio/pipefy-mcp-server#128 · langchain-ai/langchain#36233 · TexasCoding/kalshi-python-sdk#178

  • ALEF-PAT-050phantom-defended-memory-phantom-file-m1guard × phantom-defense · sev 5

    Phantom defense pattern: a file is referenced everywhere but never actually written. Code looks defended; check is on empty data.

    confidence index: 0.80 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-051phantom-defended-state-phantom-value-m1guard × phantom-defense · sev 5

    Defense checks a state value that is hard-coded to safe default. Defense never fires against real adversary input.

    confidence index: 0.80 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-052phantom-defended-latency-phantom-probe-m1measure × phantom-probe · sev 4

    Latency probe runs on cached fast-path only. Real slow path never measured; SLO appears green while users complain.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-053phantom-defended-ui-phantom-marker-m1verify × phantom-defense · sev 4

    UI test passes by checking a hidden marker element that always exists. Test green; users see broken UI.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-054phantom-defended-typescript-wild--zero-as-falsy-idguard × wild-instance-of-pat-019 · sev 5

    TypeScript wild-evidence variant of PAT-019. 218 repos triggered scanner; verification needed per-repo.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-055phantom-defended-javascript-wild--zero-as-falsy-idguard × wild-instance · sev 5

    Wild-evidence variant — scanner flagged but verification per-repo needed. See parent pattern for canonical detection.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-056phantom-defended-unknown-wild--orphan-tool-useguard × wild-instance · sev 5

    Wild-evidence variant — scanner flagged but verification per-repo needed. See parent pattern for canonical detection.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-057phantom-defended-unknown-wild--verifier-source-mismatchguard × wild-instance · sev 5

    Wild-evidence variant — scanner flagged but verification per-repo needed. See parent pattern for canonical detection.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-060phantom-defended-unknown-wild--orphan-tool-useguard × wild-instance · sev 5

    Wild-evidence variant — scanner flagged but verification per-repo needed. See parent pattern for canonical detection.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-061phantom-defended-unknown-wild--verifier-source-mismatchguard × wild-instance · sev 5

    Wild-evidence variant — scanner flagged but verification per-repo needed. See parent pattern for canonical detection.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-062phantom-defended-javascript-wild--wild-prevalenceguard × wild-instance · sev 5

    Wild-evidence variant — scanner flagged but verification per-repo needed. See parent pattern for canonical detection.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-063phantom-defended-javascript-wild--wild-prevalenceguard × wild-evidence-cluster · sev 5

    Wild-evidence cluster surfaced by F4 intersector for language=javascript. Parent pattern: (wild prevalence). 3+ distinct repos triggered; per-repo verification still pending.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-064phantom-defended-typescript-wild--orphan-tool-useguard × wild-evidence-cluster · sev 5

    Wild-evidence cluster surfaced by F4 intersector for language=typescript. Parent pattern: ALEF-PAT-001. 3+ distinct repos triggered; per-repo verification still pending.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-065phantom-defended-go-wild--orphan-tool-useguard × wild-evidence-cluster · sev 5

    Wild-evidence cluster surfaced by F4 intersector for language=go. Parent pattern: ALEF-PAT-001. 3+ distinct repos triggered; per-repo verification still pending.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-066phantom-defended-python-wild--orphan-tool-useguard × wild-evidence-cluster · sev 5

    Wild-evidence cluster surfaced by F4 intersector for language=python. Parent pattern: ALEF-PAT-001. 3+ distinct repos triggered; per-repo verification still pending.

    confidence index: 0.78 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-067classifier-emits-undefined-null-floorclassify × silent-degradation · sev 7

    Classifier output for kind/category falls back to undefined when no rule matches, masking real event kinds. Downstream consumers receive 7+ rows/day labeled "undefined (undefined)" with no telemetry that classification failed.

    confidence index: 0.91 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

    1 instance(s):

  • ALEF-PAT-068role-specification-disobedienceexecute × role-boundary-violation · sev 7

    Multi-agent system assigns each agent a role (planner, executor, verifier) but agents step outside their declared role — a verifier starts making decisions, an executor invents new requirements.

    confidence index: 0.86 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-069conversation-reset-mid-taskcommunicate × context-loss-restart · sev 7

    Multi-agent dialogue is unexpectedly restarted mid-task. Previous context is dropped, agents re-introduce themselves, the task either restarts or continues with degraded shared state.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-070information-withholding-between-agentscommunicate × asymmetric-knowledge-state · sev 6

    Agent A has information relevant to Agent B but does not share it. B proceeds without the missing context and produces wrong output. A had no incentive or pathway to share.

    confidence index: 0.83 — evidence-weighted (instances · distinct repos · industry ref · atomicity)

  • ALEF-PAT-071peer-input-ignoreddecide × monologue-decision-against-evidence · sev 7

    Agent A makes a decision while in a conversation with Agent B who has explicitly recommended otherwise. A neither acknowledges nor refutes B; A simply proceeds as if B did not speak.

    confidence index: 0.85 — evidence-weighted (instances · distinct repos · industry ref · atomicity)