Agent-Reflex trains an 8B agent to recover when its MCP tools fail, and it gets derailed half as often

Agent-Reflex teaches a small open model to notice when an MCP tool fails or a user corrects it, and to recover. It comes from Renmin University of China and the National University of Singapore.

Slide text

Agent-Reflex trains an 8B agent to recover when its MCP tools fail, and it gets derailed half as often

Guanting Dong, Xinyu Yang, Jiajie Jin and colleagues, with Zhicheng Dou · Renmin University of China, National University of Singapore

Dong et al. · Agent-Reflex · arXiv 2610.17953v1 · submitted 13 Oct 2026 · Appendix E.1

Real tools fail all the time. Replaying agents on nine public benchmarks, about one tool result in seven was an error. A third were services that were down, followed by permission failures and timeouts.

Slide text

01 02 03 The problem

About one tool result in seven came back as an error

24,510 errors in 177,700 tool returns · agents replayed on 9 public benchmarks

Dong et al. · Agent-Reflex · arXiv 2610.17953v1 · submitted 13 Oct 2026 · §3.1, Appendix D.2 · Figure 1d, Table 4

Frontier models stumble too. On the airline, retail and telecom tasks of τ²-Bench, GPT-5.2 drops from about 80 to about 60 percent success once tool results turn faulty. Claude 4.5 Sonnet loses about 16 points.

The recipe builds 557 simulated services from popular MCP servers and injects real error types into one tool result in five. Nine models attempt each task, and the difference between runs that recovered and runs that failed becomes a written rule.

Slide text

01 02 03 The recipe

557 simulated MCP services, and 1,170 recovery rules mined from their failures

Failures injected into 1 tool result in 5 · 9 models from 4B to 284B attempt each task

Dong et al. · Agent-Reflex · arXiv 2610.17953v1 · submitted 13 Oct 2026 · §3.1, Appendix D.2 · Figure 2, Table 5

Here is one rule, for a service modeled on Airtable. Failing agents acted on a search result that only looked right. The rule says to confirm every identifier, write only on an exact match, then read the record back.

Qwen3-8B fine-tunes on about 54,000 runs where it fixed its own mistakes, with the rule text stripped out and some user corrections wrong on purpose. Reinforcement learning follows, with a quarter of runs hitting failures. The finished model carries no rule library.

AgentNoiseBench injects its faults differently from the training setup. There, noise throws the base Qwen model off course in more than half its runs. Agent-Reflex goes off course in just over a quarter.

The biggest tool-side gain is on results that pass every format check but point the wrong way or leave data out. The agent only catches those by reading the content. It beats the base model on all thirteen kinds of noise.

The recipe also helps when tools behave. Averaged over five tool-use benchmarks, Qwen3-8B goes from about 40 to almost 60, ahead of the other 8B training recipes. On τ²-Bench its score more than doubles.

It is still an 8B model. GPT-5.2 and Claude 4.5 Sonnet score higher on every test here. The rules come from one fixed snapshot of services, so changed tools need new mining, and the recipe has only been tried at 8B.

The checkpoint, both training sets, the rule library and the code are public under the MIT license. Retraining it takes sixteen 80-gigabyte GPUs for fine-tuning and eight for reinforcement learning.