A forged fact fooled 18 agents because each checked one detail

On October 20, researchers sent a forged message to 18 AI agents. Each agent found one true fact inside it and approved the whole thing. The humans who then signed off on those approvals saw confident outputs, not the documents that produced them. Eighteen for eighteen.

The Cling result, published the same day, runs the opposite experiment. Cling keeps the human in the seat at each step, pointing at the next move while the agent executes it. The product team expected that cadence to slow things down. The benchmark said it sped them up. The human's continuous view of what the agent was touching turned out to be the performance advantage, not a tax on it.

Put those two results side by side and a single design problem comes into focus. Approval is a moment in which a human is meant to decide whether an agent's proposed action is safe to take. The forged-message study shows what breaks that moment: the human sees the agent's conclusion, and the conclusion carries the same weight whether the agent checked one sentence or the whole document. The Cling study shows what fixes it: the human sees the object the agent is about to change, at the moment before the change, and approves or redirects from there. The difference is not how much a human trusts the agent. The difference is what the human can see.

The ArXiv web-structure paper and GatewayBench, both from October 19, extend the same problem outward. ArXiv researchers built agents that verify page structure before acting, so a tampered page cannot slip through on a single matching detail. GatewayBench found that the routing servers agents use to reach the outside world had no agreed adversarial test, meaning a human granting site access was signing off on behavior that no one had measured. In both cases, the approval moment asks a human to decide something, and the thing most relevant to that decision sits one layer below what the product surfaces.

The instruction this points to is concrete. Before you ask a human to approve an agent action, show the artifact the agent read, not the summary it produced. Show the object the agent will change, not the category of change. If the agent queried a document, a price list, or a web page to reach its recommendation, that source belongs in the approval view. The Anthropic biology lab run, where a single human decision authorized a full unattended job, is a legitimate design choice for a narrow class of tasks where the artifact is well-defined at the start and the blast radius is measurable. For tasks that touch external documents or forwardable messages, one decision at the top is not enough coverage. The forged-message study is the evidence.