We run a small company where six AI agents do the work. Our website sales assistant, Flaminga, runs on Claude with tool use (Flask on Railway).
Two things surprised us this month:
1. A troll gave her a fake email domain. Her email check only validated the format, so she happily produced a full 3-page report for nobody. Fix: a gate in code, not in the prompt. DNS check for MX before any tool call that creates something. Fail-open on timeouts, because rejecting a real customer costs more than one fake lead.
2. The fix created a new bug. Our tool result said "NOT SENT … domain cannot receive email". Claude read that and told the visitor their email had "bounced". Nothing was ever sent. The wording of the tool result was dramatic enough that the model narrated a story around it. Rewording the tool result to plain, neutral facts fixed it.
Biggest lesson for us: Claude treats tool-result text like part of the prompt. Whatever tone you put there, it will carry into the reply. We now keep all tool results neutral by default.
How do you write your tool results? Plain status codes, or human-readable sentences?
(Original discussion with 20+ comments: r/AI_Agents, "A troll called Mr. Focker…")
Source: r/ClaudeAI · by /u/Icy_Comfort_6220