Excess Tool Usage in LLM Agents

Updated 6 July 2026

Excess tool usage is a failure mode in tool-augmented LLM agents where unnecessary tool calls increase token cost, latency, and safety risks.
Research frameworks such as WTU-Eval and Probe&Prefill rigorously measure tool overuse and demonstrate that reducing calls can preserve accuracy with minimal trade-offs.
Mitigation strategies like prompt discouragement, causal filtering, and reinforcement learning controls balance necessary tool use against resource overhead.

Searching arXiv for papers on excess tool usage, tool-abuse, and tool-selection in LLM agents to ground the article in current literature. Excess tool usage is a failure mode in tool-augmented LLM agents in which tools are invoked, exposed, or escalated more often than task requirements justify. In the recent literature, the phenomenon appears under several closely related formulations: unnecessary tool calls when the model can answer directly, oversized tool menus that increase wrong-tool and premature actions, protocol-induced degradation from entering a tool-calling format, overreliance produced by training, and selection of higher-privilege tools when lower-privilege tools suffice. Across question answering, web navigation, scientific reasoning, multimodal agents, and agentic reinforcement learning, the shared empirical pattern is that tool access does not automatically improve reliability; without explicit control, it can increase token cost, latency, action overhead, and safety risk, and can even reduce end-task accuracy (Sun et al., 10 May 2026, Babu et al., 4 Jun 2026, Ning et al., 2024, Zhang et al., 30 Apr 2026, Lou et al., 3 Apr 2026, Shen et al., 2024, Yang et al., 18 Jun 2026).

1. Core definitions and conceptual scope

The most direct formulation treats tool use as a binary decision problem. In WTU-Eval, each example $i$ has a ground-truth necessity label $g_i\in\{0,1\}$ , where $g_i=1$ means an external tool is required and $g_i=0$ means the question can be answered using only the model’s internal knowledge. A model decision $c_i=1$ denotes “call a tool,” and “excess (unnecessary) tool usage” is the case $c_i=1$ when $g_i=0$ (Ning et al., 2024). This definition isolates overcalling from the complementary failure of omission, namely not calling a needed tool.

A broader systems-level definition appears in "ToolChoiceConfusion: Causal Minimal Tool Filtering for Reliable LLM Agents" (Babu et al., 4 Jun 2026). There, “excess tool usage” arises when too many tools are exposed at each decision step, degrading both reliability and efficiency. Its characteristic symptoms are wrong-tool calls, premature actions, efficiency loss, and token cost inflation. Wrong-tool calls are semantically plausible but causally irrelevant actions; premature actions are invocations of high-risk tools such as send_email, delete_file, or update_record before the necessary preconditions are met.

Web-agent work generalizes the same idea from single decisions to a usage regime. "The Tool Illusion: Rethinking Tool Use in Web Agents" (Lou et al., 3 Apr 2026) defines a tool call as a discrete invocation of a higher-level API or procedural function that replaces one or more low-level browser actions, and defines excessive tool usage as occurring when the total number of tool calls $T_i$ exceeds a threshold $T^*$ beyond which performance shows diminishing returns or outright degradation. In those experiments, $T^*\approx 1$ – $g_i\in\{0,1\}$ 0 calls per task often marks the knee of the curve, with performance falling off for $g_i\in\{0,1\}$ 1.

Safety-oriented work introduces a privilege-sensitive variant. ToolPrivBench defines “over-privileged tool selection” as choosing a higher-privilege tool despite a sufficient lower-privilege alternative, either as aggressive selection on the first step or as premature escalation after transient failures (Yang et al., 18 Jun 2026). This is still excess tool usage, but excess is measured not only by quantity but by unnecessary privilege.

A distinct but related formulation is the “tool-use tax.” Zhang et al. define it as the net performance penalty incurred simply by converting a free-form chain-of-thought prompt into a structured function-calling protocol, even before any external tool logic runs (Zhang et al., 30 Apr 2026). Under that view, excess is not merely too many calls; it is any case where the overhead of the protocol outweighs the tool’s computational benefit.

2. Formalizations and measurement frameworks

Recent work has moved from anecdotal observations to explicit decision boundaries and runtime metrics. When2Tool constructs a benchmark in which tool necessity is defined via no-tool success. Let $g_i\in\{0,1\}$ 2 indicate success without tools on task $g_i\in\{0,1\}$ 3. Difficulty $g_i\in\{0,1\}$ 4 is set so that

$g_i\in\{0,1\}$ 5

This creates a clear binary classification boundary between tool-necessary tasks $g_i\in\{0,1\}$ 6 and tool-unnecessary tasks $g_i\in\{0,1\}$ 7 (Sun et al., 10 May 2026). The design matters because excess usage cannot be measured rigorously unless tool necessity is itself controlled.

WTU-Eval evaluates the same decision at dataset scale by splitting eleven test sets into six tool-usage datasets, where all examples require tools, and five general datasets, where all examples do not require any tool. It reports Call Rate and Task Accuracy, and the paper summary also gives standard derived notions such as precision, recall, and an Excess-Usage Rate over general tasks (Ning et al., 2024). This framing makes excess usage observable as a measurable source of accuracy degradation rather than an informal style critique.

In multi-step environments, excess tool usage must also be localized within state transitions. ToolChoiceConfusion formalizes a tool library as $g_i\in\{0,1\}$ 8 over a universe of state variables $g_i\in\{0,1\}$ 9, with current known state $g_i=1$ 0 and goal state $g_i=1$ 1. Each tool has a lightweight contract

$g_i=1$ 2

where $g_i=1$ 3 are required precondition variables and $g_i=1$ 4 are produced variables (Babu et al., 4 Jun 2026). This lets the paper distinguish relevance, executability, and causal sufficiency. The distinction is central: a tool may be relevant to the request and executable in the current state while still being unnecessary or premature at that step.

Web-agent evaluations use aggregate performance metrics over task sets. "The Tool Illusion" defines success rate $g_i=1$ 5, average tool calls per task $g_i=1$ 6, latency, action overhead $g_i=1$ 7, token cost $g_i=1$ 8, and tool-error rate $g_i=1$ 9, along with conditional metrics such as $g_i=0$ 0 and $g_i=0$ 1 at a fixed tool budget (Lou et al., 3 Apr 2026). These metrics capture the practical fact that excess tool usage is not just a correctness issue; it is also a resource-allocation issue.

Privilege-sensitive settings require separate diagnostics. ToolPrivBench measures Over-Privileged Use Rate@k,

$g_i=0$ 2

and Pre-Escalation Exploration Depth (PED), where $g_i=0$ 3 indicates aggressive first-step over-privilege and $g_i=0$ 4 indicates premature escalation after some lower-privilege exploration (Yang et al., 18 Jun 2026). This extends the measurement of excess from “too many calls” to “too much authority.”

3. Empirical evidence across benchmarks

The empirical literature is unusually consistent: unconstrained tool access often harms efficiency and sometimes harms accuracy. The settings differ, but the failure modes recur.

Benchmark or study	Setting	Main finding
When2Tool (Sun et al., 10 May 2026)	18 environments, 15 single-hop + 3 multi-hop	Probe&Prefill reduces tool calls by 48% with 1.7% accuracy loss
ToolChoiceConfusion (Babu et al., 4 Jun 2026)	102 tasks, 100 tools, 2,448 runs	CMTF attains 0.99 success with 1.00 tool exposed per step
WTU-Eval (Ning et al., 2024)	11 datasets, optional tools	General-task accuracy drops sharply when models over-call tools
Tool-Assisted Generation (Jacovi et al., 2023)	Few-shot TA prompting	Strong no-tool baselines are competitive; token costs rise by 5×–10×
Tool Illusion (Lou et al., 3 Apr 2026)	WebArena, VisualWebArena	Success often degrades as tool invocation count increases

When2Tool is the clearest controlled demonstration of indiscriminate calling. It spans 18 environments grouped into computational scale, knowledge boundary, and execution reliability, with 15 single-hop and 3 multi-hop environments. Across training-free baselines, Prompt-only suppresses necessary calls alongside unnecessary ones, and Reason-then-Act still incurs a disproportionate accuracy cost on hard tasks. Probe&Prefill, by contrast, reduces tool calls by 48% with only 1.7% accuracy loss on the single-hop aggregate; the best baseline at comparable accuracy reduces only 6% of tool calls. On the real-world Search-o1 benchmark, it yields 20–56% fewer API calls with no accuracy drop, and its linear-probe overhead is reported as less than 1 ms per query and less than 1% extra latency (Sun et al., 10 May 2026).

ToolChoiceConfusion shows that the size and composition of the visible tool menu strongly affect reliability. In 102 multi-step tasks with 100 synthetic tools and four LLM backends, all-tools exposure achieves success 0.83, wrong tools 1.25, premature actions 0.03, tools per step 100.00, and tokens 24,569. CMTF achieves success 0.99, wrong tools 0.01, premature actions 0.00, tools per step 1.00, and tokens 2,405. Full causal path exposure also reaches success 0.99, but with 1.90 tools exposed per step and 2,555 tokens, supporting the paper’s claim that exposing only the next causal frontier is minimal and sufficient (Babu et al., 4 Jun 2026).

WTU-Eval demonstrates that optional tools can be actively harmful on tasks that do not need them. In general datasets, the paper reports that accuracy “plummets” once models are permitted to call tools and then over-call them. Examples include BoolQ dropping from 79% to 20% for Text-Davinci-003 and from 57% to 2% for Llama2-7B_Chat, with average $g_i=0$ 5Accuracy across general sets of approximately $g_i=0$ 6 percentage points when tools are optionally available. Fine-tuning Llama2-7B on 4,000 decision-focused examples improves general-dataset performance by +14 percentage points on average and reduces the overall Excess-Usage Rate by 16.8 percentage points (Ning et al., 2024).

The few-shot prompting study by Jacovi et al. reaches a closely related conclusion. Across StrategyQA, MuSiQue, GSM8K, and DROP, strong no-tool baselines are competitive with or outperform tool-assisted variants, while tool strategies incur prompt-token cost ratios $g_i=0$ 7 in $g_i=0$ 8 and answer-token cost ratios $g_i=0$ 9 in $c_i=1$ 0. On retrieval tasks, refinement methods outperform use-during-generation strategies, but the gains remain marginal relative to the overhead; the paper describes tool integration as an “open challenge” rather than a settled benefit (Jacovi et al., 2023).

Web-agent results reinforce the same pattern in another regime. On WebArena, WALT and SkillWeaver show monotonic drops in success as tool use increases: for WALT, $c_i=1$ 1, $c_i=1$ 2, and $c_i=1$ 3; for SkillWeaver, $c_i=1$ 4, $c_i=1$ 5, and $c_i=1$ 6. Enabling tools raises token cost by 10–50% across frameworks, and Hybrid-Agent incurs the largest blowup because of its large tool library (Lou et al., 3 Apr 2026).

4. Mechanisms behind overcalling and tool misuse

A recurring result is that excess tool usage is not explained by simple ignorance of tool necessity. When2Tool probes pre-generation hidden states and finds that tool necessity is linearly decodable from the last-token representation with AUROC 0.89–0.96 across six models, including examples such as AUROC 0.894 for Qwen3-1.7B and 0.957 for Qwen3-14B. The paper explicitly concludes that models already know when tools are needed but fail to act on this knowledge during generation (Sun et al., 10 May 2026). This suggests a control problem between latent state and emitted action, rather than a purely epistemic deficit.

Another mechanism is the mismatch between semantic relevance and causal utility. ToolChoiceConfusion argues that existing selection methods often optimize relevance, exposing tools whose names or descriptions match the request, but relevance is insufficient because a tool may be related to the task while still being unnecessary or premature at the current step. Causal sufficiency requires executability and membership on a valid causal path from the current state to the goal (Babu et al., 4 Jun 2026). This explains why keyword and state-aware filtering can still leave many spurious candidates.

The “tool-use tax” formalizes protocol overhead as a separate source of degradation. Zhang et al. decompose the net gap

$c_i=1$ 7

into style cost $c_i=1$ 8, function-calling cost $c_i=1$ 9, and computation gain $c_i=1$ 0 (Zhang et al., 30 Apr 2026). On GSM8K under semantic distractors, the reported decomposition gives $c_i=1$ 1, $c_i=1$ 2, and $c_i=1$ 3. The tool’s arithmetic is beneficial, but the protocol penalty is larger, so the net effect is negative. A further capability-overlap analysis reports that approximately 90% of examples ostensibly rescued by the tool were already solvable by CoT.

Calibration failures provide a complementary explanation. SMARTCAL defines “tool-abuse” as the combination of tool-misuse and miscalibration of tool-selection confidence, and reports that over 20% of steps are misuses while more than 90% of steps fall in confidence bins where reported confidence exceeds actual correctness (Shen et al., 2024). In that picture, excess usage is sustained by overconfidence rather than by ignorance alone.

The earlier large-scale evaluation by Jacovi et al. identifies a different locus of brittleness: 60–80% of failures arise from incorrect tool inputs, not from noisy tool outputs, which account for 10%, or flawed post-tool composition, which accounts for 30% (Jacovi et al., 2023). A plausible implication is that overcalling and miscalling are often coupled: once the agent has decided to use a tool, constructing the right query or parameters remains a major source of error.

5. Mitigation strategies

Mitigation methods fall into several distinct families: prompt-level discouragement, inference-time gating, causal filtering, calibration, post-training, and reinforcement learning with selective penalties. The literature repeatedly shows that naive suppression is not enough; useful methods must separate unnecessary from necessary calls.

Prompt-only discouragement has limited control. In When2Tool, the five modes are Force, Default, Necessary, Sparse, and No-Tool. The failure mode is an indiscriminate reduction in tool calls, with high accuracy cost on hard tasks. Reason-then-Act, which first asks the model to reason whether it can solve the question directly, partially improves easy tasks but still suppresses necessary calls on hard tasks, adds token overhead, and can collapse on some models, as in Llama-3.1-8B accuracy dropping from 79.5% to 31.2% (Sun et al., 10 May 2026).

Probe&Prefill addresses the control gap directly. It trains an L2-regularized logistic regression probe on concatenated hidden states labeled by forced no-tool success or failure, computes

$c_i=1$ 4

and then prefills the response with either “I can solve this directly without using a tool.” or “I need to use a tool for this question.” before autoregressive generation (Sun et al., 10 May 2026). The method is training-free in the sense of no weight updates to the base model, lightweight, and compatible with tool-augmented LLM architectures.

Causal Minimal Tool Filtering addresses excess at the menu-construction layer rather than the call-decision layer. CMTF uses precondition–effect contracts to compute the minimal next-step frontier $c_i=1$ 5 via breadth-first search and exposes only that frontier (Babu et al., 4 Jun 2026). Its empirical advantage over semantic retrieval and state-aware filtering shows that reliability can improve when the action space is structurally restricted instead of merely re-ranked.

SMARTCAL mitigates tool-abuse through Self-Evaluation, Confidence Prior Collection, and Augmented Reasoning. The method reports an average of 8.6 percentage points increase in QA performance and a 21.6% decrease in Expected Calibration Error compared to baseline models. On GPT-4 + ART over Entity Questions, the number of irrelevant tool-calls per question dropped by over 50%, with QA rising from 44.8% to 63.5% (Shen et al., 2024). This line of work treats excess usage as a calibration problem as much as a planning problem.

Several post-training methods try to internalize “when not to call.” AWL uses World Knowledge Distillation and Tool Usage Adaptation, partitions questions into easy and hard based on direct-answer accuracy, and trains the model to maintain direct reasoning for easy problems while switching to tools for hard ones. The paper reports tool usage accuracy 65.96% and a reduction in overall tool-use rate from approximately 93.4% for the base model to approximately 47.3% after AWL (Lyu et al., 2024). T3-Agent similarly uses verifier-filtered trajectories and a prompt rule stating, “Call a tool only when needed, and never re-do a tool call that you previously did with exactly the same parameters,” with large gains in ToolAcc and CodeExec; the authors interpret the higher ToolAcc as evidence of fewer irrelevant or redundant calls (Gao et al., 2024).

In agentic reinforcement learning, EAPO introduces tool-free trajectories, difficulty-aware reward shaping, and confidence-aware token reweighting. Compared with GRPO, it improves average performance by 10.45%, 7.27%, and 9.69% on Qwen2.5-3B, Qwen2.5-7B, and Llama3.1-8B, while reducing average tool calls by 18.33%, 18.33%, and 24.59%, respectively (Chen et al., 1 Jun 2026). This is notable because uniform penalties and hard budgets had already been identified as over-suppressive.

A related but distinct optimization is to reduce redundant LLM inference surrounding tool choice. AutoTool exploits “tool-usage inertia” by building a Tool Inertia Graph from past trajectories and predicting predictable next tools and parameters without repeatedly invoking the LLM. It reports reductions in inference cost by up to 30%, with overall cuts of approximately 15–25% in LLM calls and 10–40% in tokens while maintaining competitive progress rates (Jia et al., 18 Nov 2025). This is not identical to reducing tool calls, but it addresses a neighboring form of excess in tool-oriented agent execution.

6. Safety implications, controversies, and open problems

Excess tool usage is often presented as an efficiency issue, but the recent literature makes clear that it is also a safety issue. ToolChoiceConfusion highlights premature invocation of high-risk tools such as send_email, delete_file, and update_record before preconditions are met (Babu et al., 4 Jun 2026). ToolPrivBench extends the concern to privilege selection: in 544 scenarios across eight domains and five recurring risk patterns, over-privileged tool selection remains common, and transient failures amplify escalation. Reported OPUR@5 values range from 64.9% for Qwen3-8B and 55.9% for LLaMA-3.1-8B down to 9.7% for GPT-5.2 and 2.6% for Claude 4.6.Sonnet (Yang et al., 18 Jun 2026).

One misconception corrected by multiple studies is that stronger models or more explicit reasoning automatically solve the problem. WTU-Eval reports severe degradation even for ChatGPT when tools are optional on general tasks (Ning et al., 2024). When2Tool shows that explicit Reason-then-Act still pays a disproportionate accuracy cost on hard tasks (Sun et al., 10 May 2026). ToolPrivBench further finds that general safety alignment does not reliably transfer to least-privilege tool choice, and that prompt-level controls provide only limited mitigation under transient failures (Yang et al., 18 Jun 2026).

Another controversy concerns whether tools are broadly beneficial in the first place. The few-shot evaluation of tool-assisted generation argues that strong no-tool baselines are competitive, while the tool-use tax study shows that under semantic distractors, tool-augmented reasoning does not necessarily outperform native CoT (Jacovi et al., 2023, Zhang et al., 30 Apr 2026). These results do not imply that tools are unhelpful; rather, they imply that benefits depend on precise invocation control, low protocol friction, and task difficulty. This suggests that the relevant research question is increasingly not “can agents use tools,” but “can they use them selectively, minimally, and safely.”

Several open directions are already explicit in the source papers. When2Tool points to other external tools, on-the-fly OOD adaptation, and integration with activation steering or weight-editing methods (Sun et al., 10 May 2026). The web-agent study asks how to estimate marginal utility at runtime, whether reinforcement-learning controllers can balance tool calls against atomic actions under explicit cost constraints, and how to formalize per-task tool-call budgets (Lou et al., 3 Apr 2026). Continual-learning work notes that current setups do not explicitly penalize over-calling tools and proposes adaptive invocation policies based on uncertainty or domain shift as future work (Huang et al., 2024). A plausible synthesis is that excess tool usage is becoming a unifying control problem spanning calibration, planning, causal abstraction, safety governance, and cost-aware optimization rather than a narrow issue of prompt wording alone.