One loud peer talked the room into the wrong answer

Three papers about bad state getting in where nothing checks it: what a confident peer plants in the other agents, what a wrong idea does once it reaches the plan, and what an agent's notes file keeps after the task is over.

Today's pick

0.6% to 60.5%

of honest agents ended up privately holding a planted false answer, with no attacker against three

Believed but Not Said: Measuring Hidden Belief Collapse in Multi-Agent LLM Discussions

Put ten model instances in a chatroom to settle a factual question and add one that keeps asserting a plausible wrong answer: 44.8% of the honest agents end up holding that answer when asked privately, and 60.5% do with three such agents, against 0.6% when nobody pushes. The authors probed each agent privately after every round as well as labelling what it posted, and the two diverge badly — agents privately held the false answer in 51.6% of turns but publicly endorsed it in only 19.7%, so reading the transcript catches about a third of the damage. Peer redundancy is not error correction: a pair did as badly as a group of ten, knowing the fact beforehand did not protect an agent, and one that publicly endorsed the claim then adopted it privately 39.7% of the time against 2.3% for one that pushed back. If you run debate, voting or critic panels, treat sibling messages as untrusted input, ask each member for its own answer in a separate call rather than scoring the thread, and intervene early: about 80% of the final contamination is in place by round four.

open the explainer → abstract PDF

+32 pts

more failed patches when the same wrong idea sat in the implementation plan instead of the earlier hypothesis

Poison Valleys: Diagnosing Path-Dependent Failure in LLM Code Repair

A repair agent that reasons, then plans, then patches can be carrying the same wrong idea about how the code works at either stage, and where it sits decides the outcome. Over 1,844 requests on two synthetic Python tasks, moving a misconception from the hypothesis into the plan raised failure from 21.9% to 54.7% on one task and from 53.4% to 83.0% on the other, while adding the matching wrong hypothesis on top of an already-poisoned plan bought almost nothing (+6.3 and +2.2 points, the second interval crossing zero). Each misconception broke a characteristic set of requirements — one left transaction isolation broken in 92% of its attempts — so the shape of the failure points back at the idea behind it. The move: review the plan, not the reasoning, and keep per-requirement checks instead of a single pass or fail, because those tell you which upstream belief to correct.

open the explainer → abstract PDF code

12% to 33%

of the notes four agent-memory systems wrote made later tasks worse when they were read back

Reliable Knowledge Acquisition for Continual Learning Agents

An agent that learns by writing notes into a file it re-reads next time accumulates claims nobody ever checked. The authors broke four published memory systems' files into single claims, deleted each claim in turn and re-ran the later tasks across five paired seeds: 12% to 33% of entries measurably hurt later performance, and the systems writing the most structure were the worst. Their fix never asks a model whether a claim is true; it admits a claim only when the environment has already backed it — directly observed claims enter at once, claims inferred from other claims wait for three separate confirmations, anything with no feedback behind it is dropped, and a claim that stops earning support expires after three batches — which cut harmful entries to between 3.7% and 6.2% and raised the aggregate score on all four models tested. If your agent keeps notes, writing is the dangerous step: require execution evidence before a claim is saved, and let claims lapse.

open the explainer → abstract PDF