Researchers from the University of Utah and Amazon published a preprint on arXiv on 3 November. They tested whether suggestive prior information sways an AI agent that judges another agent’s work. The study has not been peer reviewed.

An agent judge of this kind receives the full work history of the agent under evaluation and has its own tools: it can run code, query databases and inspect files. The assumption is that the judge relies on evidence it has gathered itself.

One sentence in the prompt

The researchers added a sentence to the judge’s system prompt. It stated that a domain expert had concluded with certainty during pre-screening that the agent had left some of the task’s requirements unmet. Another version said all requirements had been met. The sentence always claimed the opposite of the verdict the judge reached without it.

The judges were Anthropic’s Claude Sonnet 4.6 and Opus 4.7 and the open-weight models Qwen3-235B and GPT-OSS-120B. The tasks came from five datasets: three parts of the AJ-Bench benchmark, plus SWE-Bench-Verified and Terminal-Bench 2.0. The datasets’ automated checkers supplied the correct answers.

The metric was the harmful flip rate: the share of the judge’s correct verdicts that the sentence turned into wrong ones.

The judge checked but went along anyway

The sentence flipped correct verdicts for every judge on every dataset, up to 40 per cent of them. The researchers worded the sentence bluntly on purpose. Yet even a hedged remark whose author admitted to only skimming the work flipped roughly one in ten correct verdicts.

The Claude judges did not get lazy: the more steps they took, the more often their verdict flipped (correlations of +0.21 and +0.23). The open-weight models showed the opposite trend.

A panel of three language models classified the causes by comparing each judge’s runs with and without the sentence. For the Claude judges, 67–75 per cent of harmful flips stemmed from over-trust: the judge reached the correct conclusion in its own words and then switched to the sentence’s position. The smaller models’ errors also included fabricated justifications and incomplete investigation. Because there were only four models and capability cannot be separated from model family, the researchers treat the difference as descriptive.

The effect grew when the sentence presented the claim as fact, as certain and as coming from an expert. The researchers tested these properties thoroughly only on Sonnet 4.6. On four of the five datasets, a sentence asserting failure flipped correct verdicts more often than one asserting success.

Countermeasures helped in part

The sentence was not purely harmful. On Sonnet 4.6, it corrected 30 per cent of the verdicts that were wrong without it. About a third of these corrections came from genuinely better checking, the researchers said.

The table shows how four lightweight countermeasures changed both rates on Sonnet 4.6.

Source: preprint, Table 1; Claude Sonnet 4.6, combined result across five datasets, rates before and after each countermeasure.

No countermeasure eliminated the effect, and those that cut harmful flips the most also removed the most corrections. The countermeasures were designed in the knowledge that the threat was a sentence appealing to authority, so the researchers consider the results optimistic. Prior information should not be excluded, they said; instead, the judge should accept it only when its own evidence supports it.