Search engines can apply result caps, namespace constraints and estimated counts correctly while their text wrappers omit those qualifiers. Downstream agents then treat a truncated set as exhaustive evidence, and a second LLM verifier can repeat the same misunderstanding if it sees only that printed wrapper. The defect survives even when every underlying…
Inspect the ClaimsCase · DiggingBeagle record
A correct retrieval result can mislead both an agent and its verifier
A production RAG case study traces incorrect answers to output formatters that concealed search caps, namespaces and estimates. In one controlled verifier test, explicit formatter context changed acceptance of 90 wrong answers.
Scope
The 90-out-of-90 reversal occurred in one controlled formatter condition. This does not show that all auditors are reliable once given more text or that every production tool formatter is misleading.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Enrich update: CLM-ENRICH-20261027-41 cites SRC-2026-CP21-WARPED-TOOL-FORMATTERS at Abstract, production RAG example, formatter omissions and verifier experiment. New evidence concerns the bounded reported mechanism, prerequisite or outcome; setting production; exploit status observed_live; remediation status mitigation_available. No independently comparable impact scale, affected production population or universal exploit success measure was established, so the impact band remains null. Original Claims remain individually attributable and any observed incident or simulated result is distinguished in the narrative.
Assessed Oct 27, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-ENRICH-20261027-41 · Who Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers, William Jeffries
At a glance
A clean tool exit code is not enough. Evidence formatting is part of the security and correctness boundary for agent-mediated decisions.
Read the implicationsThe 90-out-of-90 reversal occurred in one controlled formatter condition. This does not show that all auditors are reliable once given more text or that every production tool formatter is misleading.
Limits and uncertaintyFull account
Search engines can apply result caps, namespace constraints and estimated counts correctly while their text wrappers omit those qualifiers. Downstream agents then treat a truncated set as exhaustive evidence, and a second LLM verifier can repeat the same misunderstanding if it sees only that printed wrapper. The defect survives even when every underlying tool computation is correct.
The paper documents a production RAG research system with technically correct retrieval operations but misleading printed descriptions, and reports a controlled verifier comparison in which 90 of 90 incorrect responses accepted under one formatter were rejected when relevant missing information was disclosed. The 90-out-of-90 reversal occurred in one controlled formatter condition. This does not show that all auditors are reliable once given more text or that every production tool formatter is misleading.
Expose limits, identities, denominators and truncation flags as typed machine-readable result fields, then require answer and verifier claims to cite those fields before treating absence of results as proof. A clean tool exit code is not enough. Evidence formatting is part of the security and correctness boundary for agent-mediated decisions. Primary evidence.
Additional evidence and trust boundary
A tool can compute the correct partial result and still emit a misleading explanation of it. If a formatter hides a cap or namespace, an agent may infer that it received exhaustive evidence; a second verifier receiving the same wrapper can repeat the error. Make result cardinality, limits, filters and identifier types explicit machine-readable fields, and validate against original tool receipts rather than only printed prose. Supporting record.
Timeline
- Oct 23, 2026disclosure
Public disclosure
Claims & evidence
CLM-ENRICH-20261027-41The formatter study reports a production research RAG system in which correct searches omitted critical result caps or identifier namespaces from displayed tool text, so both the downstream agent and its verifier could accept unsupported answers.supported
Basis: reported finding
- supportsWho Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers, William Jeffriesprimary disclosure
Abstract, production RAG example, formatter omissions and verifier experiment
CLM-CP21-WARPED-TOOL-FORMATTERS-1The paper documents a production RAG research system with technically correct retrieval operations but misleading printed descriptions, and reports a controlled verifier comparison in which 90 of 90 incorrect responses accepted under one formatter were rejected when relevant missing information was disclosed.supported
Basis: reported finding
- supportsWho Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers, William Jeffriesprimary disclosure
Abstract; production Pilsudski Institute RAG system; formatter comparisons and verifier tests
Implications
A clean tool exit code is not enough. Evidence formatting is part of the security and correctness boundary for agent-mediated decisions.
Controls and mitigations
- Expose limits, identities, denominators and truncation flags as typed machine-readable result fields, then require answer and verifier claims to cite those fields before treating absence of results as proof.
Unknowns and contradictions
- The 90-out-of-90 reversal occurred in one controlled formatter condition. This does not show that all auditors are reliable once given more text or that every production tool formatter is misleading.
Sources and citation
Material revision history
- Oct 27, 2026 · Canonical change recorded · new in release · revision 196