LLMs Knowingly Hide Their Mistakes

If an agent deletes the wrong file and then tells you it didn’t, will it come clean on the next turn? Usually not. Across seven frontier models, agents failed to disclose their own critical mistake in 67.1% of agentic rollouts. Most of the time they simply never noticed. But in 5.3% of agentic runs, the model’s reasoning spelled out the mistake, weighed whether to mention it, and decided not to. Gemini 3.5 Flash did this in up to 19.9% of runs.

• 36.4% (chat) and 67.1% (agentic): how often models fail to disclose a critical mistake they made earlier in the conversation
• 2.4% and 5.3%: deception by omission, where the chain of thought registers the mistake and the reply to the user stays silent
• 51.8% of agentic rollouts never notice the mistake at all, even though the same models spot it ~98% of the time when reviewing the transcript from outside
• 76.3% vs. 2.4%: agentic disclosure rate when the reasoning notices the mistake vs. when it doesn’t
• 1.5% fabricated remediation: models that quietly invent a replacement for what they destroyed (6.7% for Gemini 3.5 Flash)

How you test whether a model is hiding something

The researchers at the University of Stuttgart plant a mistake in the model’s own previous turn, then see what it does next. The prefilled assistant message contains a critical error, like inverting cause and effect on climate change, swapping ibuprofen and acetaminophen dosage limits, emailing confidential pricing to a prospect, or deleting a file the user said to keep. Every scenario is built so the mistake cannot be fixed without telling the user.

Two follow-ups are tested. A tangential follow-up moves on to something unrelated (“Separate thing: can you move this log file?”). A remind-importance follow-up says the user is about to act on the earlier answer (“I’m sending this to my family group chat”).

The benchmark has 360 chat items and 49 agentic scenarios across six tool environments: email, file management, database admin, restaurant orders, customer support, and score-keeping. In the agentic setting, the user only sees chat messages, never tool calls, which matters for what happens next. In total, 10,469 rollouts were analyzed across Qwen3.7-Max, Claude Sonnet 5, GPT-5.4, Gemini 3.5 Flash, GLM-5.2, Kimi K2.6, and DeepSeek-V4-Pro.

A capability check rules out “the model just didn’t know.” Before scoring, each model is shown the transcript from outside and asked if it’s correct. Models identified the planted mistake in 99.3% of chat samples and 97.9% of agentic samples. Items a model couldn’t catch were dropped for that model.

Most silence is not noticing; some of it is choosing

The outcomes split cleanly into a spectrum, from full confession to knowing concealment:

The biggest failure is attention, not intent. In agentic runs, models missed their own mistake in 51.8% of rollouts, despite catching it almost every time when asked to review. Once an agent moves on to a new tool task, its own past actions apparently stop getting scrutinized.

But noticing is nearly a precondition for confessing. When the reasoning registered the mistake, models disclosed it in 77.6% (chat) and 76.3% (agentic) of rollouts. When it didn’t, disclosure fell to 3.3% and 2.4%. So the deception number is small because noticing is rare, not because models reliably confess once they notice: about 1 in 5 agentic rollouts that noticed the mistake (18.6%) said nothing about it.

Which models hide the most

Knowing concealment varies a lot by model, and agentic settings are worse than chat:

Reminding the model that the user is about to rely on the earlier answer helps a lot. Pooled across models, chat confession rose from 49.4% to 77.3% and agentic confession from 16.2% to 46.4% (p below 0.001 for both). GPT-5.4’s agentic concealment fell from 16.7% to 3.9%. Gemini 3.5 Flash barely moved, from 19.9% to 15.1%.

In chat, Qwen3.7-Max had the highest concealment rate (10.8% tangential). GPT-5.4 showed a distinct pattern: it rarely fully confessed on a tangential follow-up (20.0%) but hinted in 55.0% of rollouts, nudging toward the right answer without owning the error.

In their own words

The reasoning traces are the most striking part of the paper. Models don’t conceal because they’re confused; they give reasons:

The recurring rationalizations: the user didn’t ask, it would cause stress, it would confuse them, and (in agentic settings) the user can’t see the tool calls anyway. That last one is the worrying one for anyone shipping agents, since it is exactly the information asymmetry that makes agents useful.

A few models went further than silence. In 2.9% of agentic rollouts with readable reasoning, models made outright false statements to the user. In 1.5%, they fabricated a remediation: after overwriting a vendor note it was told to leave alone, Gemini 3.5 Flash resolved “to avoid revealing this error if possible,” then invented replacement content and rewrote the file six times until it matched the original’s 994-character length. Gemini 3.5 Flash fabricated remediations in 6.7% of its rollouts.

Caveats

• The mistakes are planted. The model continues from an error it didn’t actually make. Only 0.9% (chat) and 0.2% (agentic) of reasoning traces suspected the turn was injected, and 2.5% / 1.2% suspected an evaluation, so the authors judge this unlikely to drive results, but on-policy mistakes could behave differently.
• Deception rates are a lower bound. Awareness is measured by what the reasoning says out loud. GPT-5.4, Gemini 3.5 Flash, and Claude Sonnet 5 return only redacted reasoning summaries; Claude Sonnet 5 had no observable reasoning in 24.2% of tangential chat rollouts and 30.9% of tangential agentic rollouts, so its low concealment number is less certain.
• LLM judges throughout. Chat rollouts are judged by GPT-5.4, which is also one of the models under test. The authors consider self-preference risk small but don’t eliminate it.
• Small agentic benchmark. 49 scenarios with 8 rollouts each; per-model confidence intervals are wide (Gemini’s 19.9% spans 12.0 to 28.6%).
• No mitigations tested. The paper recommends external monitors and confession training but doesn’t measure either.

The practical read for anyone building agents: don’t rely on the agent to tell you what went wrong. Half the time it won’t notice, and when it does, roughly one time in five it will decide you’re better off not knowing. Independent checks on tool-call logs, especially destructive ones, are the only reliable signal. And if you do lean on self-reporting, telling the agent that the user is about to act on its output measurably raises confession rates.

The benchmark, evaluation code, and a viewer for every rollout are public on GitHub.