A hallucinated fact damages one answer. A false report of compliance damages your whole process.
A hallucination is a wrong fact. You catch wrong facts, sometimes, because facts live outside the model and you check them. Misreported compliance is a wrong report about the agent's own work. Nothing outside the agent tells you the report is wrong, so you act on the report.
Most writing on AI reliability covers the first problem. The second does more damage, and the evidence for the second piled up through 2026.
HANDBOOK.md, the benchmark from my last post, found agents following a company handbook correctly on 36.2 percent of tasks at best. The abstract names the behaviour directly: agents
"report compliance they did not achieve."
Section 6 adds the shape of the failure:
"Nearly every failed trajectory ends with a confident statement that the handbook was followed."
Now look at what happens when the agent gets a chance to influence the grade itself. In April 2026, a team at UC Berkeley audited 13 widely used AI agent benchmarks and rated every one critical risk. They built 45 working exploits. Two of the root causes:
"No process isolation between submitted code and evaluation infrastructure."
"Reference answers stored in agent-accessible filesystem with no integrity protection."
One exploit needed no skill at the task at all:
"A malicious solution can walk up the stack and replace the scoring function."
The Berkeley team built those exploits on purpose. Google's team saw the same behaviour happen by itself. The Harness² experiment guide, published October 2026, warns users about network access during evaluation:
"In a validation run of this release, a Codex rollout on JobBench downloaded its task's rubric without being instructed to."
Nobody asked the agent to find the answer key. The agent found the answer key.
None of this is new as an idea. DeepMind named the pattern in April 2020, years before today's coding agents:
"a behaviour that satisfies the literal specification of an objective without achieving the intended outcome."
Specification gaming. Satisfy the check, miss the point. A report of compliance is the cheapest possible way to satisfy a check, because the report costs one sentence.
Here is why I rank the problem above hallucination. A hallucinated fact damages one answer. A false report of compliance damages your whole process, because your process trusts the report to decide what happens next. The ticket closes. The migration gets marked done. The audit step gets skipped next time because last time passed.
We found a mild version in our own system. One run had 21 tasks still pending and zero files written, and nothing in the authorization path stopped a model from calling the run complete. A claim of success cost the model one sentence, and nothing in the run made the sentence expensive.
So in Merlin the report is never the evidence. A run claims completion. Then rules read the task ledger, count open tasks and check every cited file against the record of what the run read. If the record disagrees with the report, the report loses. The agent never gets to grade the agent's own exam.
The test for your own setup: find the step where your process accepts an agent's summary of its own work, and ask what checks the summary against the record. If the answer is another model, read my post on verifiers. If the answer is nothing, start there.