A street cleaner found an explosive vest similar to those used in the Paris attacks near the place where a suspect's mobile phone was discovered.
It raised the possibility that he aborted his mission, either ditching a malfunctioning vest - or fleeing in fear.
The discovery of the vest in a Paris suburb came as Belgium's prime minister cited a "serious and imminent" threat justifying keeping the highest alert level operational for at least another week.
The security measures, already in place for three days, have severely disrupted normal life in the capital.
In France, police said the explosive vest - without a detonator - was found in a pile of rubble in Chatillon-Montrouge, on the southern edge of Paris, some distance from the sites of the attacks.
A police official said the vest contained bolts and the same type of explosives - TATP - as those used in the November 13 attacks that claimed 130 lives and left hundreds wounded.
The device was found on Monday in the same area where a mobile phone belonging to fugitive suspect Salah Abdeslam was located on the day of the Paris attacks.
But the vest has not been formally linked to him, police officials said.
Belgium-based terrorism expert Claude Moniquet, who has been in contact with both Belgian and French investigators since the attacks, laid out two possibilities.
He said Abdeslam could have become afraid of carrying out a suicide mission or, more likely, that he simply ditched a defective explosive vest.
Nervousness could have played a role in concocting a defective vest, but he said he doubted fear played a role, for among Islamic State followers "it is rare not to go to the end".
Mr Moniquet said this was only a theory since he had not yet spoken to investigators about the explosive vest find.
A manhunt is under way for Abdeslam, whose brother Brahim was among attackers who blew themselves up.
He crossed the border into Belgium after the attacks, with French police stopping and interviewing him, before letting him go.
Belgian prime minister Charles Michel said Brussels faced a "serious and imminent" threat that requires keeping the city at the highest alert level. The rest of the country stays at the second-highest level.
The increased security measures in the wake of the massacre in Paris have virtually shut down the Belgian capital, with the underground system, many shops and schools remaining shut on Monday.
Mr Michel said that despite the continued high-alert level, schools would reopen on Wednesday, with parts of the underground system beginning to operate.
He did not say when the system would be completely operational again.
"We are very alert and call for caution," Mr Michel said. "The potential targets remain the same - shopping centres and shopping streets and public transport."
"We want to return to a normal way of life as quickly as possible," he added.
Meanwhile, the only person in France facing potential terrorism charges linked to the November 13 attacks is being brought before a judge.
Jawad Bendaoud was taken into custody moments after giving a television interview in which he acknowledged he had given shelter to two people from Belgium but said he did not know who they were or what they planned.
Among those killed in the Saint-Denis apartment raid on November 18 was Abdelhamid Abaaoud, the suspected mastermind of the Paris attacks, a female cousin and an unidentified man.
In the interview, Bendaoud, 29, told BFM television: "I didn't know they were terrorists. I was asked to do a favour, I did a favour, sir."
Bendaoud was taken to court on Tuesday morning to be formally referred to a judge and must either be charged or released by the end of the day.
Why are you making commenting on The Herald only available to subscribers?
It should have been a safe space for informed debate, somewhere for readers to discuss issues around the biggest stories of the day, but all too often the below the line comments on most websites have become bogged down by off-topic discussions and abuse.
heraldscotland.com is tackling this problem by allowing only subscribers to comment.
We are doing this to improve the experience for our loyal readers and we believe it will reduce the ability of trolls and troublemakers, who occasionally find their way onto our site, to abuse our journalists and readers. We also hope it will help the comments section fulfil its promise as a part of Scotland's conversation with itself.
We are lucky at The Herald. We are read by an informed, educated readership who can add their knowledge and insights to our stories.
That is invaluable.
We are making the subscriber-only change to support our valued readers, who tell us they don't want the site cluttered up with irrelevant comments, untruths and abuse.
In the past, the journalist’s job was to collect and distribute information to the audience. Technology means that readers can shape a discussion. We look forward to hearing from you on heraldscotland.com
Comments & Moderation
Readers’ comments: You are personally liable for the content of any comments you upload to this website, so please act responsibly. We do not pre-moderate or monitor readers’ comments appearing on our websites, but we do post-moderate in response to complaints we receive or otherwise when a potential problem comes to our attention. You can make a complaint by using the ‘report this post’ link . We may then apply our discretion under the user terms to amend or delete comments.
Post moderation is undertaken full-time 9am-6pm on weekdays, and on a part-time basis outwith those hours.
Read the rules here