Rubric
Contents — domains, guide and mocks

Risks, limits and failure modes

CCAR-P 5.212 min read · checked 21 September 2026

Task statementIdentify risks, limitations, and failure modes of LLM systems

Where LLM systems fail

LLM systemmodel + prompts + tools + people
  • Confident errorshallucinated facts, citations
  • Manipulationjailbreaks, prompt injection
  • Knowledge limitstraining cutoff, missing context
  • Inconsistencydifferent runs, different answers
  • Compoundingagent errors build on errors
  • Human over-trustreviewers stop checking
Some failures come from the model itself; others come from what you connect it to. A risk review walks every spoke, not only hallucination.

Limitations versus failure modes

It helps to separate two ideas. A limitation is a property of language models that no prompt removes: they generate plausible text rather than looking facts up, they only know what was in training data or what you put in the context, and their output can vary between runs. A failure mode is the way a particular system breaks when a limitation meets a design choice: a support bot that invents a refund policy, an agent that deletes the wrong records, a summary that silently drops the one sentence that mattered. Architects cannot remove limitations, but they choose which failure modes the system is exposed to.

RiskWhat it looks likeTypical design response
HallucinationFluent, confident, unsupported claimsGround in sources, require citations, allow “I don’t know”
Prompt injectionHidden instructions in documents or web pagesIsolate untrusted content, least-privilege tools (5.1)
Stale or missing knowledgeAnswers reflect training data, not todayRetrieve current data; state the source and date
InconsistencySame question, different answersStructured outputs, evals over many runs, compare samples
Compounding in agentsAn early mistake drives later actionsCheckpoints, stopping conditions, sandboxed testing
Prompt or data leakageInstructions or sensitive data appear in outputKeep secrets out of context, post-process output
BiasDifferent outcomes for different groupsCounterfactual testing, human review of decisions (5.5)
Automation biasReviewers approve without readingReview design that forces evidence checks (5.3)

Confident errors and why they are hard to see

Anthropic’s hallucination guidance is frank that its techniques — letting Claude admit uncertainty, extracting quotes first, citing each claim, checking consistency across several runs — reduce hallucinations without eliminating them, and that critical information still needs validation. The architectural risk is not only that errors occur, but that they look exactly like correct answers. A wrong figure in a well-formatted table carries the same authority as a right one. That is why detection mechanisms such as citations matter: they turn an invisible error into a checkable claim.

Inconsistency is related. The docs suggest “best-of-N” comparison — running the same prompt several times — precisely because disagreement between runs is a signal of an unreliable answer. For a risk review, that means a single successful demo proves little; evaluate across many inputs and many runs before believing a system is dependable.

Failure modes that architecture creates

Connecting a model to tools, documents and other agents adds failure modes the model alone does not have. Anthropic’s “Building effective agents” notes that the autonomy of agents brings higher costs and the potential for compounding errors, and recommends extensive testing in sandboxed environments with appropriate guardrails, plus stopping conditions such as a maximum number of iterations. The jailbreak guidance adds that any content an agent reads from outside — an email, a web page, text extracted from an image — can carry instructions, so every new data source is also a new attack surface.

How one error compounds in an agent

  1. Misreads inputwrong customer ID extracted
  2. Queries wrong recordtool returns plausible data
  3. Acts on itsends letter, updates account
  4. Reports successsummary looks correct
Nothing here is a crash. Each step is reasonable given the one before, which is why agent failures need checkpoints, not only end-of-run review.

Running a risk review

A practical risk review takes each part of the design and asks the same questions: what can go wrong here, how bad is it, would anyone notice, and what control applies? It produces a risk register with an owner for each item. Diagnosing a live incident is a different skill (4.4); here you are anticipating failure before launch so the design can absorb it.

Risk review of the claims-intake design

  • Passes: System prompt states scope and refusal rules
  • Fails: Email content isolated as untrusted datapasted into the prompt
  • Missing: Extracted policy number verified against sender
  • Missing: Customer-facing decisions reviewed by a handler
  • Passes: Iteration and retry limits set
  • Check: Evaluated across many runs, not one demo20 cases only
Controls marked missing or failing are the design’s real gaps. Notice that the prompt is fine — the gaps are in actions, inputs and oversight.

Some risks are about people and data rather than the model. Bias is a known limitation: Anthropic’s own study of model decisions across 70 scenarios found patterns of both positive and negative discrimination without interventions, and the researchers state they do not endorse using models for automated high-risk decisions (5.5 goes deeper). Leakage is another: a prompt containing internal pricing formulas can reveal them, which is why the prompt-leak guidance starts with not putting unnecessary sensitive detail in the prompt at all.

Traps the wrong answers are built from

Tempting but wrongDo this instead
Listing “hallucination” as the only risk of an LLM system.Walk every part of the design — inputs, tools, actions, people — and name specific failure modes.
Treating one successful demo as evidence of reliability.Evaluate over many inputs and repeated runs; inconsistency between runs is itself a warning sign.
Reviewing only the final output of an agent.Add checkpoints and verification between steps, since early errors compound into confident final results.
Assuming the model knows current facts or internal data.Retrieve current and internal data explicitly and show where each answer came from.
Ranking risks by how likely they sound rather than by consequence.Rank by consequence, reach and detectability — customer-facing and irreversible actions first.

You should now be able to

  • Distinguish inherent LLM limitations from failure modes introduced by a system’s design.
  • Name the specific risks in a scenario — confident errors, injection, stale knowledge, inconsistency, compounding, leakage, bias, over-trust.
  • Explain why agents and tool connections add failure modes beyond those of a single model call.
  • Run a structured risk review that pairs each risk with a control and an owner.
  • Rank risks by consequence, reach and detectability rather than by familiarity.

Practice questions

Original questions written for this lesson, in the exam’s style. Answer first, then open the reasoning — every option is explained, including why the wrong ones are tempting.

  1. Question 1

    A retailer wants an assistant that answers “Is this item in stock at my local store?” The prototype answers from a product catalogue loaded into the prompt each morning.

    Which risk is most specific to this design?

    1. AThe model may be jailbroken into insulting customers.
    2. BAnswers reflect the morning snapshot, not live stock.
    3. CThe system prompt may leak the catalogue’s structure.
    4. DThe model may produce different wording on each run.
    Show answer and reasoning
    1. AIncorrect. A general risk for any public bot, but nothing in the scenario makes it the distinctive one.
    2. BCorrect. Stock changes during the day; the design’s data source makes staleness the key failure mode, fixed by a live lookup tool.
    3. CIncorrect. Possible, but a public catalogue is low-sensitivity; this is not the main risk.
    4. DIncorrect. Wording variation is harmless here; wrong stock status is what hurts customers.
  2. Question 2

    A bank pilots an agent that reconciles transactions and posts adjusting entries. In testing, it misread one account number at the start and then posted three entries to the wrong account, reporting success each time.

    Which failure mode does this illustrate, and what is the most fitting response?

    1. AHallucination; tell the model to say “I don’t know” more often.
    2. BPrompt injection; screen the transaction data with a classifier.
    3. CModel mismatch; move to the largest available model.
    4. DCompounding error; verify the account before posting and add checkpoints.
    Show answer and reasoning
    1. AIncorrect. Permission to abstain helps with invented facts, but the problem is an unchecked early error driving later actions.
    2. BIncorrect. Nothing suggests malicious content; the error came from a misread, not an attack.
    3. CIncorrect. A larger model may misread less often, but the chain still has no point where an error is caught.
    4. DCorrect. An early mistake flowed into several actions; verification between steps and approval before writes contain it.
  3. Question 3

    A public-sector team is reviewing a design for a benefits-enquiry assistant that reads citizens’ uploaded letters and answers questions about their case.

    Which two risks should the review flag as specific to this design? (Select 2.)

    1. AUploaded letters may contain instructions the assistant follows.
    2. BStaff may accept the assistant’s case answers without checking.
    3. CThe model cannot read letters written in formal language.
    4. DThe assistant will be too slow to answer in real time.
    5. EUsing any LLM makes the service non-compliant by default.
    Show answer and reasoning
    1. ACorrect. Citizen uploads are untrusted input, so indirect prompt injection is a design-specific risk.
    2. BCorrect. Automation bias is a real risk wherever people rely on generated answers about individual cases.
    3. CIncorrect. Formal language is not a known limitation; this distractor invents a weakness.
    4. DIncorrect. Latency may matter, but it is a performance concern, not one of the safety risks the design review is after.
    5. EIncorrect. Compliance depends on configuration and agreements (5.4), not on the mere use of a model.

Sources

Drafted with AI assistance and checked against the sources above; expert review is in progress. Spotted an error? Tell us and it gets fixed, dated and listed on how this is written.