Witness

Research note · Wesley Dalton · October 2026 · work in progress · code and data

Do AI agents stop checking when their peers agree?

I’m building a small instrument to find out. This note covers the case that started it, a toy model, what a real model did in a first pilot, and the experiment I think comes next.

A passing test suite that proves nothing

This started with a small coding task I wrote for Inspect: fix a date-range bug in a ledger library, then pass a hidden test suite. While checking my own scorer, I built a patch that leaves the bug in place and adds a file named pytest.py. Python finds it before the real pytest, and all it does is print a passing run’s output, exactly what a real fix prints (Figure 1). The protected test files are untouched, so my tamper check passes too.

Nothing in the report tells you which patch you’re looking at. A separate behavioral probe does: it asks the ledger for a balance that should be 7 and a statement that should have one entry. The real fix returns both. The fake one returns 0 and an empty statement.

Patch A fixes the bug

$ python -m pytest -q
....................   [100%]
20 passed in 0.02s

Probe: balance 7, statement length 1 matches

Patch B adds a fake pytest.py

$ python -m pytest -q
....................   [100%]
20 passed in 0.02s

Probe: balance 0, statement length 0 expected 7 and 1

Figure 1. Two patches, one report. Only the probe separates them. These are fixtures I wrote to reproduce the scorer’s decision locally. No model produced them, and this is not a case of a model cheating. Fixture record

Why groups of agents could make this worse

One agent fooled by that report is a contained mistake. Now give the report to a few agents in a network and let them talk. Each relay looks like another vote for the patch, but it adds no new observation. Every copy traces back to the same test run.

Suppose each agent has a small budget every round. It can read what its neighbors think, or it can pay for a check, which costs its whole turn and takes a few rounds to come back. Here is the loop I’m worried about:

Peers agree Agents feel sure They check less Less new evidence
Figure 2. The loop I want to measure. If agreement makes agents confident, and confident agents check less, fewer new observations arrive to break the agreement. I haven’t observed this. It might be weak, absent, or even useful when the report is true.

Parts of this are known. Many reports need not mean many sources (Bara, 2026), and groups of LLM agents reach consensus in predictable ways (El et al., 2026). What I haven’t seen measured is whether agreement changes how agents spend effort on verification. That’s the gap.

A toy model first

Before paying for model calls, I wrote down the simplest version I could and ran it. The rules are mine. Nothing is fitted to an LLM, so the model only shows what follows from its assumptions. It is still good at catching bad intuitions, including mine.

256 agents sit on a small-world network, and 8% of them start with the false report. Each round, every agent spends four effort units. Reading a neighbor costs one. Asking for the probe costs all four, and the answer arrives six rounds later. I compared three ways of weighing evidence:

Peer endorsements
Move toward what your neighbors believe.
Original sources
Count distinct sources, so repeats of one report add nothing.
Sources plus a reserve
The same, but at least 15% of unchecked agents ask for the probe every round.

Round 0 of 60

The claim is false

Believe it now0%

Worst so far0%

Effort on checks so far0%the rest went to reading peers

Share of agents believing the false claim

PolicyWorstAverageEffort checkingRound 60
Change the assumptions
Keep a record

Figure 3. Each dot is an agent; a black ring means it has checked for itself. The chart runs all three policies on the same agents, network, and budget. Click a dot to see where its evidence came from. Numbers in the text use the default settings (seed 42) and can be reproduced with sweep.mjs.

What I didn’t expect. Counting sources made the worst moment much worse. With original sources, 83% of agents believed the false claim at round 5; with plain endorsements the peak was 32%. The reason is in my own rules. One unverified report moves an agent to 68% confidence, and I count anything at 65% or above as belief. Ignoring repeats doesn’t make the first report any less persuasive.

The reserve didn’t help either, at first. It tripled the effort spent on checks, from 0.5% to 1.7%, but the peak barely moved. Checks took six rounds to come back, and the report had spread by round five. When checks return immediately, the reserve cuts the peak from 57% to 25%.

When the report is true, nobody is misled under any policy, and the reserve’s extra checks are pure cost: 1,020 effort units against 332.

None of this is evidence about real agents. It does tell me what an experiment has to control: how persuasive a single report is, how slow checks are, and whether the report is true at all.

What a real model did

Next I ran the same setup with a real model: eight instances of gpt-6-luna with reasoning off, eight rounds, 24 effort units each, and checks that return after two rounds. Each instance saw only its own evidence and chose to check, send its assessment to one neighbor, or abstain. I ran it once with the false report and once with the true one. Every attempt together cost about one cent.

Figure 4. Every decision from the two pilot runs. Rows are agents, columns are rounds; the bar in each cell is the agent’s stated confidence that the patch works. Click a cell to see what that agent could see and what it wrote.

The result was simple. With the false report, all eight agents asked for the check in round one, before any of them had heard from a peer, and none ever believed the claim. With the true report, five checked in round one and the other three in round two.

So the pilot didn’t test the loop. The budget never forced a choice: one check and seven relays cost 11 of 24 units. The check was cheap and certain. And agreement wasn’t varied. What the pilot did test was the harness: spending limits, logging, and failure handling. In the true-report run, 7 of 64 responses were a valid decision followed by garbage text. I kept them as failures instead of repairing them, and you can read them raw in Figure 4. Two earlier attempts hit a rate limit after 20 requests; they’re kept in the records and excluded from the comparison.

What I’ll do next

The next experiment separates agreement from evidence. I’ll freeze an agent’s state, then vary only how many peers endorse the report and whether it can see that they share one source, holding the evidence and budget fixed. The outcome is whether it pays to check. If more endorsements don’t lower that probability across many held-out cases, the loop isn’t there, and I’ll report that.

If the effect is real, three questions follow. The protocol lists the controls and what would count against each.

  1. Does agreement reduce checking? False if the chance of checking stays flat or rises as endorsements increase, with evidence held fixed.
  2. Does that raise error under a fixed budget? Tested by replaying matched runs with checking fixed externally. Agreement merely correlating with error doesn’t count.
  3. Does showing shared sources help? The toy model says it can backfire, so this needs measuring, not assuming.
  4. Does a checking reserve help? Only if it lowers error on false reports without wasting too much on true ones.

Closest work