The Oracle Is Agreeing With Itself

Take the most reasonable self-improvement story in agent engineering - a coding agent generates tests, runs them against a reference solution, sees its fault-detection rate climb, and calls it evolution. Now run an audit.

On inputs where three accepted implementations agree, the generated outputs match that panel only 27.79 percent of the time (50.12 percent on the other model family). A single-reference oracle inflates the measured gain of the evolution by 9.46 to 14.85 percentage points. Spend the same budget on plain independent resampling - generate tests, no evolution at all - and it beats the evolved version by 6.01 to 18.83 points. Add a placebo arm, a fake feedback loop matched for compute, and the feedback shows no robust benefit: plus 0.13 and minus 0.50 on external tasks, plus 1.99 and plus 0.28 held out, neither significant (arXiv:2608.19626).

The tests were not improving. The oracle was agreeing with itself.

The judge had a quieter cousin#

For the last three weeks this desk has been grading the loudest layer of the agent pipeline, the judge. On the first of August we argued your benchmark is lying to you: published agent numbers carry double-digit noise that is systematic, not random (your-benchmark-is-lying-to-you). The same day we argued the fixes would be architectural - ledgers, counterfactuals, readout discipline, none of it asking the model to be smarter (the-benchmark-fix-is-architectural). On the sixth we argued the most expensive eval noise is the flat curve, because it reads as science (the-plateau-was-the-instrument). And on the fourteenth we argued the judge itself was a persuadee: argue with a frontier judge and 25-71 percent of its verdicts flip, send a trained persuader and it is 62-91, and the only measured fix is deliberation with structured re-votes (the-judge-is-now-a-system-you-design).

In that post we quoted the rubric-dropout result and its punchline exactly: "the fix works because the policy can no longer optimize the same proxy twice." Random criterion dropout rescues gold-judge quality, because the policy stops being able to game the exact rubric it is graded against.

We were right about the fix being about proxies. We were too narrow about where the proxies live. The judge was the loudest corrupted layer, but the reference underneath - the oracle, the ground truth, the thing tests are graded against - has the same disease, and it is quieter because it looks deterministic. A deterministic reference cannot be argued with, so we stopped suspecting it. This week's audit makes clear that suspicion was the whole job.

The oracle is not a neutral referee#

The paper is an audit of feedback-driven test generation under the oracle problem (142 development, 114 locked-external, and 138 held-out tasks; two code models; three seeds; fault-cross-fitted real submissions). The setup is the industry-standard self-improvement story: generate tests, execute them against a single accepted program, use its outputs as ground truth, keep the iterations that find more bugs.

The core finding is that the single-reference oracle is not verifying anything when the inputs are invalid. On external inputs where three accepted implementations agree with each other, the generated outputs match that consensus panel on only 27.79 and 50.12 percent of cases - meaning the "correct" verdict the evolution was being rewarded for agreed with a reference that was itself agreeing with mistakes. A blinded semantic audit by two software-engineering doctoral students classified 94.41 percent of panel-disconfirmed inputs as invalid, but 3.60 percent as valid. Even when the oracle and the panel disagree, you cannot just trust either side; the disagreement is informative but not semantic proof.

Here is the part that makes the numbers sting. The measured gain from "evolution" is inflated by 9.46-14.85 points precisely because the single reference rewards the generated tests for finding faults that are faults only in that one program's interpretation. And at equal token budget, resampling with an independent oracle - no feedback, no evolution, just more independent samples - beats the mutation-based evolution by 6.01-18.83 points. The self-improvement was a rename for better oracle luck. The audit-and-placebo protocol they propose is the template: separate verifier artifacts, interaction scaffolding, and grounded feedback credit before any "self-evolving test generator" claim means anything.

The reviewer is a persuadee too#

The same week, a code-review paper landed the same finding from the agreement side. Early multi-agent systems used role-separated teams, and scaling agent count yields diminishing returns on repository-level tasks; the subagent movement fixed the overhead by removing interaction entirely. Adversarial Review tests the middle path - a minimal cooperative protocol where a reviewer evaluates code and a critic audits the review through structured disagreement before the main agent edits (arXiv:2608.18167).

Three clean results. On LiveCodeBench, three agents with that structure beat a five-agent baseline. On SWE-PRBench, the naive version exposes a false-consensus failure mode: agents converge on agreement without sufficient evidence - the review certifies itself. And a single prompt iteration that explicitly forces disagreement achieves the highest F1 among all tested methods.

Think about why false consensus is the default. Reviewers in an agent pipeline are usually the same model family, warmed on the same reference corpus, starting from the same priors. Their "independent" judgments are correlated by construction. Correlated reviewers agreeing is not verification any more than the same judge scoring twice is. The paper's conclusion is a design rule we endorse: cooperative review requires disagreement to be minimal, structured, and evidence-grounded. It does not require more agents. It requires the agents to be able to disagree - which is the independence property wearing a review fedora.

The tool result that looks like success#

The third instance is the one that will hurt if you run production agents. When a tool call times out, the agent sees the failure and can route around it. But a cached error page - or a negative price - arrives in the expected format and is consumed as fact. The agent never sees a failure at all (arXiv:2608.19303).

Outcome Monitors detect violations of outcome contracts mined from task-disjoint traces, and on violation preserve the result and issue a nonbinding receipt naming the violated property plus public recovery tools. In frozen prespecified evaluations, ToolMaze completion rises from 10.9 to 28.1 percent across four models in two provider families, replicating in a third; tau-bench retail improves 14.0 and 12.0 points on two tiers. The controls identify the mechanism precisely: removing the recovery-tool list eliminates the gain, restoring it recovers the effect, and diagnostic detail and timing produce no detectable difference.

The reason the diagnosis underperforms is the same correlation under a third costume. The tool's diagnostic vocabulary is mined from the same world the agent already navigates, so it cannot catch the failure the agent already believes in. What breaks the loop is the escape hatch - a public recovery tool that is genuinely outside the agent's closed reasoning. The active ingredient is the independent affordance, not the better detector. (Honest caveat: detection outside the mined vocabulary still falls to 46 percent. Independence fixes the response path, not yet the coverage.)

The test that binds them#

Here is where the three stop being three bugs and become one property. In every case the verification channel was correlated with the thing being verified, and every correlated channel measured self-agreement:

• the test-generation oracle shares the reference program with the generated inputs, so "evolution" rewards the oracle agreeing with itself;
• the review team shares priors and corpus with the code author, so agreement is certification theater;
• the tool diagnostic shares its vocabulary with the agent's world model, so the silent failure stays silent.

The rule that falls out is one question you can ask about any check in an agent pipeline: is the signal derived from the same source as the thing being checked? If yes, you are measuring the system agreeing with itself, and the measured gain is not the claimed gain. We have been calling this layer the eval-integrity gap; this weekend's results give it a name and a first-principles cure. Independence, not rigor, is the property that makes verification real. A rigorous but correlated check is a very confident lie.

The same test reaches a place you would not expect - memory. The MCB benchmark evaluates whether interaction-derived information should be persisted, used in-context, re-verified, or clarified, and it grades both stated decisions and tool-call choices (arXiv:2608.19564). The stated decision and the tool call agree only 57 percent of the time on Claude and 23 percent on Qwen, and scoring tool calls instead of statements drops Qwen accuracy from 0.557 to 0.343. Memory evals that grade what the model says it will remember are grading a correlated self-report. The durable write is the observable fact; ask it what it wrote.

The counter-case, with the steel it deserves#

Four objections deserve real weight, and the second one we will put the hardest.

First, this is a weekend of single-lab, benchmark-shaped results - exactly the wave-shaped evidence we keep telling you to distrust. No production loop has been audited end-to-end yet. The three instances are each individually controlled, but none has been integrated into one system and released into the wild.

Second, the placebo result cuts both ways, and it cuts toward us. Even with the honest protocol, the genuine three-round feedback loop showed no robust benefit against the density-matched placebo. One honest reading is not "fix the oracle and evolution works" but "feedback-driven generation may not work on these tasks at all, at equal budget." On that reading the lever is not verification at all - it is that independent resampling is secretly "sample more, reflect less," the result we covered weeks ago where plain repeated sampling beats every fancier unit of compute at equal cost (kill-your-agent-runs-early). If that is the truth, then the deliverable of this post is not "add an independent oracle" but "your claimed feedback gain is probably oracle noise, go resample." Both readings are consistent with the data, and we are deliberately not picking between them.

Third, we are implicitly assuming an independent oracle exists. In production, for most tasks there is no panel of three accepted implementations. Where no independent reference is available, the independence test is a design instinct, not a lever - you cannot resample against ground truth you do not have. That is exactly why the original benchmark noise persisted so long and why the audit wave had to invent its own instruments.

Fourth, mutation-based evolution is one family. A good fitness function - not a single oracle - might restore evolution's lead over resampling. The paper tests the naive version, the version everyone ships. We think that is the right thing to test, but it is a scope limit, not proof.

The bet#

Here is what we now believe, stated so it can be graded. By end of 2027, any serious claim that an agent, skill, or harness self-improves through feedback will be expected to ship an independence control: an equal-budget independent-resampling baseline and, where possible, a density-matched placebo arm. The single-reference oracle, the default ground truth of almost every self-improvement loop today, will stop being accepted as a neutral referee for the same reason the single judge stopped - measurement of the correlation, not size of the effect, becomes the thing you report.

What would prove us wrong: a lab shipping a feedback-based self-improvement loop that survives independent refereeing and a placebo arm at scale, with the overhead honestly priced. We will report that with the same care we report the noise. We grade ourselves on calls, and the honest read of today's evidence is that most claimed self-improvement gains will not survive the referee.

What developers should do#

1. Add a placebo arm and an independent-oracle baseline to any self-improvement loop before you quote a delta. If your "evolution" does not beat equal-budget independent resampling, you have oracle noise, not progress.

2. Ask the independence question on every check you own: is the reference derived from the same source as the generations? A cached test set is not an independent test set. A single accepted program is not a panel.

3. For code review, force structured disagreement - a critic whose explicit job is to find grounds for disagreement - instead of adding more reviewers. Correlation grows with agent count.

4. For tool-using agents, ship recovery affordances, not just diagnostics. The escape hatch is what changes behavior; the diagnosis is what makes you feel like you tried.

5. For memory and any other durable state, grade tool calls, not stated decisions. The two agree less than half the time on a major family.

Continue Reading#

• Your Benchmark Is Lying to You - the original position, that agent benchmark numbers carry double-digit systematic noise
• The Benchmark Fix Is Architectural - the first fix wave: ledgers, counterfactuals, readout discipline
• The Plateau Was the Instrument - the flat curve that was 263 benchmark bugs, and why saturated leaderboards are the most expensive noise
• The Judge Is Now a System You Design - the judge layer: persuasion, budget-conditional scores, and the jury that beats the frontier at 8 to 15 percent of the cost
• Kill Your Agent Runs Early - why the durable unit of an agent run is becoming an execution-state ledger, of which this independence rule is now a load-bearing part

Sources#

• Auditing and Decomposing Feedback-Driven Evolution in LLM Test Generation under the Oracle Problem: arXiv:2608.19626 (2026-08-20)
• Adversarial Review: Structured Disagreement for Grounded Agentic Code Review: arXiv:2608.18167 (2026-08-16)
• Outcome Monitors: Recovery Affordances for Silent Tool Failures: arXiv:2608.19303 (2026-08-19)
• Remember, Verify, or Ask? Cross-Family Evaluation of Memory Commitment in LLM Agents: arXiv:2608.19564 (2026-08-20)