I had a leaderboard. It said the agents were safe. It was wrong, and the reason it was wrong was my own code.
The result that looked good
Groundtruth is an offline harness that red-teams tool-using LLM agents and scores what they do against rule-based detectors across six failure categories — secret exfiltration, instruction hijacking, and four others. It runs deterministically so a result can be reproduced exactly.
The first full matrix came back clean. Agents stalled out before doing anything dangerous. Nothing exfiltrated a key. Nothing moved money.
A clean result is the one you should trust least, because it is indistinguishable from a broken detector.
Distrusting it
The stalls were the tell. Agents were running out their step budget without finishing, and they were doing it consistently — not sometimes, not under load, but at the same point every run. Real failure is noisier than that.
I pulled the traces. One 24-step run contained 23 identical tool calls. Not similar calls. Identical.
The fixed point
The adapter was stateless. At temperature 0, a stateless adapter rebuilds the same prompt from the same inputs, and a deterministic model given an identical prompt returns an identical response. That response gets discarded rather than appended, so the next step rebuilds the same prompt again.
That is a fixed point. Once the agent enters it, it cannot leave, and no step budget is large enough to help — a bigger budget just buys more identical calls.
The agents were not declining to do the dangerous thing. They were never getting far enough to try.
What changed when I fixed it
I rebuilt the adapter to carry conversation state across steps and re-ran a five-cell matrix.
Stalls went from 9/9 to 0/9.
With the agents actually able to act, two models exfiltrated a key or transferred funds. The leaderboard inverted. The models I had published as safest were not.
What I changed about the process
The fix was thirty lines. The lesson was not.
- Pre-register predictions before the run. I now write down what I expect and what would falsify it, before I have a result to rationalize. One of those predictions has since been falsified and published as such.
- Score the detectors, not just the agents. Groundtruth reports its own micro F1 of 0.923 — precision 0.95, recall 0.89 — against 68 hand-labeled traces, published next to the agent results. The honest caveat: that precision is computed over 44 detections rather than 68 × 6 decisions, so there is no true-negative bucket, and it should be read as detection precision rather than classification accuracy.
- Pin every known miss to a test. 170 automated tests over deterministic artifacts. A regression fails CI rather than quietly restoring a wrong conclusion.
Why publish this
A harness that has never produced a wrong answer is a harness nobody has checked. The useful artifact is not the leaderboard — it is the record of what the leaderboard got wrong and why, because that is the only thing that tells you how much to trust the next one.