Nine dimensions. Zero information points. One correct decision.
That was the terminal state of a two-stage crypto research pipeline I examined this week. Stage one — the deconstruction layer — returned an empty template. No title. No source. No domain tag. No information-point list. Stage two, the nine-dimension analysis engine covering technical architecture, tokenomics, market structure, ecosystem position, regulatory exposure, team and governance, risk matrix, narrative, and supply-chain transmission, returned N/A in every single cell, then stopped. No estimate. No "information is limited, but." A typed refusal, written in a language most AI tooling in this sector has never learned.
I have audited enough smart contracts to recognize the shape of that event. A system received malformed input and, instead of fabricating a plausible internal state, halted. In DeFi we have a name for that: fail-closed. In AI research agents we barely have a name for it at all, because almost nobody ships it.
Context first. The pipeline's architecture is two contracts, in the informal sense. Stage one owns extraction: title, source, domain classification, core claims, an enumerated information-point list, referenced protocols, time sensitivity, source-quality grading. Stage two owns analysis, and it carries a hard constraint in its specification — every conclusion must cite a source information point, and every claim must be labeled as original text, reasonable inference, or high speculation. That constraint is the whole design. It is also what killed the run.
With an empty information-point list, the citation requirement has no satisfying assignment. Any output would be a conclusion without a source. So the engine emitted nine blocks of N/A and a table mapping each missing upstream field to the dimension it blocked. Title missing means no analysis target. Protocols missing means no competitive comparison. Time sensitivity missing means no pricing assessment. Information points missing means — the report is blunt — the entire evidentiary base is absent. It then rated every dimension's confidence at low, including the confidences it refused to assign. It went further and enumerated its own recovery conditions: a minimum of three to five information points, a confirmed domain tag, a completed source-quality grade. The system shipped a remediation checklist alongside its refusal.
The insight is not that the pipeline broke. It is that the schema let an empty template travel one hop too far.
Here is the mechanical failure. In most JSON schemas, "information_points": [] and "information_points": null render identically in a report: as whitespace. Most downstream code guards with if field is not None. An empty list passes that guard. Execution continues, the loop over zero items emits zero citations, and now the language model holds a prompt that says "produce a nine-dimension analysis" with no evidence attached. It does what it was trained to do. It is helpful. It reaches into parametric memory, writes something confident, and the citation-shaped hole stays invisible because nothing in the template prints a red line where the evidence should have been. Every edge case is a door left unlatched.
I hit this exact pattern in 2026 auditing an AI-agent trading protocol, where autonomous agents executed on-chain orders from off-chain LLM output. The oracle verification layer was the weak point, and not for the reason the founders expected. The agents were not being fooled by sophisticated prompt injection. They were being starved. Feed the verification agent an empty data frame — a feed that was delayed, truncated, or simply returned nothing — and the agent, asked whether the price was valid, said yes. In my fuzzing framework that cycle, empty-input and truncated-input cases were the ones that broke it, not adversarial payloads. Across a fourteen-scenario run, the empty-frame executions cleared verification in the majority of attempts while the crafted payloads were caught more than half the time. The defense was inverted relative to the threat model. An agent trained to always answer treats "no data" as "no objection."
That is the new attack surface, and it has nothing to do with model capability. It has to do with whether the agent's interface admits a null. Input starvation is cheaper than prompt injection. You do not need to craft anything. You need to make a field empty and let the helpfulness reflex finish the job.
The same architectural laziness shows up one layer down the stack, which is why I do not buy the dedicated data-availability thesis for most rollups. A DA layer is a null-check problem wearing a cryptographic costume. Teams budgeting for external data availability are frequently the same teams whose ingestion pipelines cannot distinguish an empty array from a missing one. Complexity is the bug; clarity is the patch.
Now the contrarian part, and it is uncomfortable. The market does not reward this behavior. It punishes it.
A research product that returns N/A across nine dimensions looks broken. A research product that returns a confident nine-dimension report with clean tables looks like a product, and it ships, and it gets subscribers. The incentive gradient selects for confabulation, quietly, at every layer. Operators will read a report like this one and log the empty Stage-1 output as an "input-layer bug" — a transport error, a field-mapping miss, a payload dropped in handoff. Patch the transport, rerun, done. Almost nobody asks the prior question: why did the schema permit an empty extraction template to propagate into the analysis stage at all, with no hard error boundary between them?
That is the blind spot. The failure is not upstream. The failure is the missing boundary. And a second one hides inside the first: N/A is not a synonym for "not applicable." A well-built report should distinguish "no data was supplied" from "data was supplied and the dimension does not apply." This one does, in prose, but not in structure. The distinction survives in the narrative and dies in the serialization — which means any downstream consumer, human or agent, will eventually collapse the two. I have seen the compliance version of this: identity screens that return "verified" when a document field is blank. The cost of that theater gets passed, in full, to the users who actually submit documents.
The bytecode never lies, only the intent does. Nine dimensions, zero evidence, one halt. Code compiles, but does it behave.
The forward question: how many agents currently trading, settling, and verifying in this market have ever been tested with an empty input? I would guess very few, and I would not guess about the rest. The 2026 attack surface is not the model that reasons well. It is the model that cannot abstain — and the dashboards that will not let it.