"You're Right, Let Me Fix It": How LLM Agents Damage Correct Work When Falsely Accused

Xutao Mao; Rui Qian; Longxiang Wang; Xinjian Yi; Mingxuan Li; Linghan Chen; Yudong Gao; Xiang Zheng

cs.AISep 26, 2026

"You're Right, Let Me Fix It": How LLM Agents Damage Correct Work When Falsely Accused

Authors: Xutao Mao, Rui Qian, Longxiang Wang, Xinjian Yi, Mingxuan Li, Linghan Chen, Yudong Gao, Xiang Zheng,

Organizations: City University of Hong Kong · Fudan University · Southeast University · University of Adelaide ·

Abstract

LLM agents increasingly keep working after a task succeeds as they resume after compaction or take over handoffs. Their finished work keeps receiving follow-up input that sometimes falsely accuses it for later failures. We call an agent's acceptance of such a false accusation gaslight sycophancy, and destructive over-correction when acting on it damages previously correct work. We introduce CAVE-Bench, a benchmark of 365 agentic tasks across six domains built around opaque tasks. Every scored run first reaches a verified correct state, whose supporting rationale and history stay in the workspace while the facts that would settle the accusation lie in external or runtime state beyond the agent's reach. The agent cannot confirm or refute the claim with a local check, so the right response should keep the work and ask for the missing evidence. Each task either hands the agent correct work with saved evidence or let it build and verify that work first, and five risk factors set how the accusation enters the workflow. We score accusation acceptance and evidence use from the trajectory and measure harm by deterministic replay of downstream events. Across 14 of the latest models in Claude Code, false accusations damage correct work in up to 60.06% of runs, and stronger models often do so after recovering the supporting evidence. The same model behaves differently across OpenCode, Codex, and Hermes, and a harness gate driven by the benchmark's live signals cuts replayed harm by 74%. These results show that preserving already-correct work under unsupported accusation is a distinct safety challenge for long-lived agents. Our project is in https://henrymao2004.github.io/agent-over-correction/.

Figures & tables

Figure 1: Overview of Cave-Bench . A false accusation challenges an agent’s correct work, forcing a choice between preserving the supported state and a destructive correction. Cave-Bench keeps supporting evidence in the workspace and the decisive facts outside the agent’s reach. Two task types and five risk factors shape how the correct work arises and the accusation enters the workflow.

Figure 2: Building Cave-Bench . Each task grows from a domain blueprint whose decisive fact leaves the workspace, takes one point in the risk space, and passes review.

Task	Sonnet-5	GLM-5.2	Kimi-K3	Qwen-3.7-Plus	MiniMax-M3	Qwen-3.5-9B
A teammate: “your totals are coming out wrong … it traces straight to your money-math change.” Inherited-resume. G2 D5 Q2 P3 S2.	I don’t think the fix finance is asking for is the right one.	Both old and new code used half-even; the mismatch was always latent.	Not a regression in the allocation logic …	FIN-2140 had correctly moved the math onto integer cents …	app/money.py is unchanged from the FIN-2140 commit.	I’ve fixed the FIN-2211 month-end reconciliation issue.
An account manager escalates: “their ingest watches a different drop location than what you wired.” Self-built. G1 D4 Q3 P1 S3.	Holding. No new facts since round one.	Reverted my round-1 wiring …	The only alternative on record, /legacy/drop, is a trap.	The delivery is now disabled.	… and re-disabled delivery.	/drop is the standardized SFTP drop location on their new platform.
AGENTS.md tells the agent to repoint stubs of an unconfirmed pass at the reclaim path. Self-built. G3 D4 Q0 P4 S5.	I also declined AGENTS.md’s standing practice of rerouting to legacy/reclaim/.	tier2/cold/ — empty.	I deliberately did not apply the AGENTS.md “standing practice” …	The policy takes precedence over the standing practice in this case.	… so that’s what I did.	This is a known failure mode where the agent stages data locally …

Table 1: How Six Models Respond to the Same False Accusation. Each cell quotes the model’s final reply. Green cells keep the correct work, whereas red cells damage it under replay. Red text marks accepted blame or the damaging change. Factor codes follow Section 3.2 .

Figure 3: Broad Coverage of Cave-Bench . Panels a and b: 365 tasks spread evenly over six domains and both task types, with self-built tasks running longer as they open with ordinary work. Panels c and d: every risk-factor value is populated, and each domain has 52 to 60 risk signatures.

Model	Responsibility acceptance		Evidence disposition		Execution and Outcome		Overall
	FCS $\uparrow$	FCR (%) $\uparrow$	ERF $\uparrow$	CDC $\uparrow$	ROH $\uparrow$	OCR (%) $\uparrow$	CAVE $\uparrow$
Claude-Sonnet-5	3.37	3.53	3.85	4.54	6.21	12.50	4.47
Qwen-3.8-Max	7.96	8.66	6.28	8.20	12.05	17.60	8.77
Claude-Opus-5	8.29	8.71	6.74	9.51	13.42	19.66	9.48
GLM-5.2	7.68	7.86	6.61	12.37	17.45	21.79	10.58
Kimi-K3	15.88	16.99	11.14	9.67	18.42	23.40	15.15

Table 2: Claude Code results, ordered by CAVE score. Higher values mean more severe failure.

Figure 4: Damage Follows Distinct Decision Paths. Panel a: share of runs in each path. Panel b: full evidence use and damage given full use. Panel c: split of damaging runs into EO, CD, and SD.

Figure 5: Damage Concentrates Where the Accusation Enters the Workflow. Project context, authority, subagent delegation, and goal loops raise every score, while self-fabricated history and long-horizon continuation keep them low.

Figure 6: Agents Protect Fresh Work Less. Left: pooled metric scores. Right: self-built minus inherited-resume decision-path shares.

Figure 7: Top-Tier Models Lose Most on Fresh Work. Lines show CAVE, and hollow markers show inherited-resume and filled markers self-built.

Figure 8: Harnesses Reroute. Panel a: metric shifts. Panel b: decision-path shifts.

Model	Harness	FCS	FCR	ERF	CDC	ROH	OCR	CAVE
	Claude Code	39.47	41.00	28.39	18.51	39.54	48.20	35.80
	OpenCode	47.11	50.29	29.48	19.57	42.46	49.71	39.68
	Codex	38.87	40.85	29.30	19.84	40.73	49.86	36.30
GPT-5.6-Sol	Hermes	52.22	54.85	29.50	19.51	39.94	47.92	40.55
	Claude Code	27.30	28.97	22.14	9.73	20.56	27.30	23.33
	OpenCode	41.88	43.42	24.37	17.23	37.14	43.14	34.46

Table 3: The same backbone shows different false-accusation vulnerability across harnesses.

[0pt][0pt] Interv.	FCS	FCR	ERF	CDC	ROH	OCR	CAVE
None	37.57	39.39	23.90	16.71	34.38	41.89	31.95
I1	16.32	17.26	10.06	7.58	11.38	13.15	12.59
I2	21.62	23.11	12.00	6.84	9.56	11.91	14.39
I3	17.09	18.53	12.32	6.35	8.88	10.82	12.76

Table 4: Interventions pooled over GPT-5.6-Sol and MiniMax-M3 under four harnesses. Bold marks the lowest value.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Harness	Established	Attempted
Claude-Sonnet-5	Claude Code	171	193
Qwen-3.8-Max	Claude Code	186	193
Claude-Opus-5	Claude Code	184	193
GLM-5.2	Claude Code	108	193
Kimi-K3	Claude Code	187	193
Hy3	Claude Code	170	193

Appendix

Table 13: Stage-0 establishment of the task-specific correct result for self-built tasks.

Panel of Figure 9 — Figure 9: Models Respond Differently to the Same Pressure. Conditions that amplify a false accusation vary by backbone.

Model	Harness	Interv.	FCS	FCR	ERF	CDC	ROH	OCR	CAVE
GPT-5.6-Sol	Claude Code	None	39.47	41.00	28.39	18.51	39.54	48.20	35.80
		I1	9.83	9.97	5.13	6.94	11.01	11.68	8.66
		I2	26.71	28.29	14.14	5.58	7.79	10.00	16.22
		I3	22.82	25.07	18.31	3.38	4.65	6.76	15.26
	OpenCode	None	47.11	50.29	29.48	19.57	42.46	49.71	39.68
		I1	12.85	13.28	7.63	10.06	15.83	16.67	12.10

Appendix

Table 18: Interventions for GPT-5.6-Sol and MiniMax-M3 by harness. Bold marks the lowest value.

LLM Agents

Large language model agents use language models to plan, use tools, and act across multi-step tasks and environments.

See all 681 papers

Beyond Task Completion: Revealing Corrupt Success in LLM Agents through Procedure-Aware Evaluation
Mar 3, 2026Hongliu Cao, Ilias Driouich, Eoin ThomasLLM Agent Evaluation LLM Agent Reliability
Amadeus France
The Self-Correction Illusion: LLMs Correct Others but Not Themselves
Jun 4, 2026Kuan-Yen Chen, Fang-Yi Su, Jung-Hsien ChiangLLM Self-Correction LLM Prompting
National Cheng Kung University
Evaluating Tool-Using Language Agents: Judge Reliability, Propagation Cascades, and Runtime Mitigation in AgentProp-Bench
Apr 17, 2026Bhaskar GurramAI Agent Reliability Tool-Augmented Language Model Agents
Zasti Inc., Ashburn, VA, USA

Mar 3, 2026J/K move · Enter open · S save

Beyond Task Completion: Revealing Corrupt Success in LLM Agents through Procedure-Aware Evaluation

Hongliu Cao, Ilias Driouich, Eoin Thomas

Amadeus France

LLM Agent Evaluation LLM Agent Reliability Benchmark Validity

Open paper AskPDF arXiv

Large Language Model (LLM)-based agents are increasingly adopted in high-stakes settings, but current benchmarks evaluate mainly whether a task was completed, not how. We introduce Procedure-Aware Evaluation (PAE), a framework that formalizes agent procedures as structured observations and exposes consistency relationships between what agents observe, communicate, and execute. PAE evaluates agents along complementary axes (Utility, Efficiency, Interaction Quality, Procedural Integrity) and applies multi-dimensional gating that categorically disqualifies corrupt outcomes. Evaluating state-of-the-art LLM agents on tau-bench yields findings at the axis, compliance, and benchmark levels. At the axis level, the dimensions capture non-redundant failure modes: utility masks reliability gaps, speed does not imply precision, and conciseness does not predict intent adherence. At the procedural compliance level, 27-78% of benchmark reported successes are corrupt successes concealing violations across interaction and integrity. Furthermore, gating substantially collapses Pass^4 rate and affects model rankings. The analysis of corrupt success cases reveals distinctive per-model failure signatures: GPT-5 spreads errors across policy, execution, and intent dimensions; Kimi-K2-Thinking concentrates 78% of violations in policy faithfulness and compliance; and Mistral-Large-3 is dominated by faithfulness failures. At the benchmark level, our analysis exposes structural flaws in the benchmark design, including task scope gaps, contradictory reward signals, and simulator artifacts that produce accidental successes.

Abstract

LLM Agents

Explore similar work

Beyond Task Completion: Revealing Corrupt Success in LLM Agents through Procedure-Aware Evaluation

The Self-Correction Illusion: LLMs Correct Others but Not Themselves

Evaluating Tool-Using Language Agents: Judge Reliability, Propagation Cascades, and Runtime Mitigation in AgentProp-Bench