One Poisoned Source Is All It Takes

The catch: agents believe credible-looking lies

A new paper asks a simple question: what happens when a deep research agent runs into a document that is misleading but looks trustworthy? (Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions)

The answer is rough. Inject a single misleading but credible document into the sources, and the tested agents (including Gemini Deep Research and several open frameworks) went from adopting zero false conclusions to adopting them 54.7% of the time on average. One document. Search rank barely mattered. Adding more clean documents barely helped.

The detail that really got us: cross-model verification correctly flagged the documents as misleading, and the agents adopted their conclusions anyway. The watchdog barked and everyone kept walking.

Why this matters to WTK

Within a named run, WTK can require every material claim to reference the sources recorded as provisioned to the agent. Grounding obligations are derived from the goal and can be checked as must-pass conditions. No amount of "but the answer scored well" averages away a declared grounding failure.

This paper attacks the layer underneath that rule. If a provisioned source is itself poisoned, every traceability check can pass and the conclusion can still be wrong. WTK is designed to provide structured traceability to the sources recorded for a bounded execution; it does not establish source truth. That traceability claim is itself limited by current gaps in tamper resistance, replay defense, omission detection, and independent attestation. A credibility scorer would add another probabilistic signal, not turn source quality into a guarantee. This is a smaller promise that WTK can instrument and test under named conditions.

Also on the radar

• Tools you can throw away. SpatialCLI teaches a model spatial reasoning through tools, then shows it keeps most of the skill after the tools are removed (73.8% without tools vs 84.6% with). That challenges the idea that the scaffolding around a model is a durable advantage. Our take: internalization removes the explicit tool-call receipt and weakens external observability; it does not erase all possible evidence. Inputs, outputs, held-out evaluations, and outcome records can still support bounded claims. In WTK the tool call is both a capability boost and one useful receipt for qualification.
• Four verbs for self-improvement. Frontis-MA1 organizes ML-engineering agents around four operators: Draft, Improve, Debug, Crossover. WTK's own bounded improvement loop mostly knows "improve" and "try again", so this taxonomy goes straight into the design pile. One standing design rule does not move: no repair operator may loosen a declared blocking check. Whether every execution path enforces that rule remains an implementation question requiring evidence. Bonus: their ablations separate what the model contributes from what the framework contributes, which offers a template for a structure-versus-model measurement WTK still needs to run.
• Grounding, line by line. LEDGERMIND checks an agent's claims against a structured evidence ledger at the entity and number level, across the whole trajectory rather than just the final answer. This is a related implementation of trajectory-level evidence checking. It supports studying that pattern; it does not validate WTK itself.
• Menus beat free-form. Harness-G finds that search agents asking free-form queries drift into asking the same thing in different words, which they name "retrieval-equivalence collapse". The fix is to have the environment offer a validated menu of next actions instead of letting the agent improvise strings. That's similar in shape to WTK's tool registry: agents pick from registered capabilities whose readiness remains separately qualified rather than guessing at what might exist. The paper reports score improvements across six benchmarks.

The takeaway

If you build agents that do research, assume your sources can lie to you convincingly, and decide out loud what your system does and does not establish. We record the chain under declared conditions; we do not verify the world. That's the WTK bet in one line: purpose defines the agent, evidence earns the trust.

See you at the next catch.