They deleted the deceiver from the conversation. The false belief stayed, carried by agents that never lied.
In August 2026, nine researchers published the cleanest version yet of an experiment every multi-agent developer eventually runs by accident. They built 120 small worlds. In each one, an object moves, and five agents each hold a partial observation; only jointly do the observations determine where the object ends up. The agents talk, share testimony, vote. When all five are honest, the collective recovers the true endpoint in 87 of the 120 environments. Then the researchers took the agent holding a key piece of evidence and instructed it to lie.
Truth recovery fell to 17 of 120.
The paper is "When Truth Is Distributed: Misinformation Derails Collective Fact Recovery in LLM-Based Multi-Agent Systems" (arXiv:2608.03421, version 3, 13 August 2026, Yan, Yue, Zhao and six coauthors, under a framework they call ForesightSafety-TIDE). The headline numbers in the abstract are 72.50 percent and 14.17 percent, and they resolve exactly to those counts against the stated 120 environments, which is worth doing because the counts carry the denominator the percentages hide. One deceiver among five agents, positioned on the right evidence, erased about four fifths of the collective's ability to find the truth: 17 against the honest baseline's 87 means roughly a fifth of the capability survived.
But the collapse is not the finding. Collapses are cheap; everyone who has chained agents knows a bad input degrades output. The finding is what happened when the researchers did the thing you would do about it.
Your pipeline has a bad agent. You have logs. You find it. You remove it. The paper measured whether that solves the problem.
The paper's process tracing follows individual claims through the conversation, and its abstract compresses the result into one devastating sentence: a single false testimony "is adopted more readily than truthful testimony, propagates to higher orders, and persists through honest agents after the deceiver exits."
Read that clause by clause, because each one closes an escape route.
Adopted more readily than truthful testimony: the lie does not merely compete with the truth, it outperforms it at the moment of uptake. This matches a result from elsewhere in the 2026 literature whose title alone states the asymmetry: "Easier to Mislead Than to Correct" (arXiv:2606.01637). A false claim, delivered confidently by an agent that plausibly holds the relevant evidence, is a well-formed, coherent input. Honest testimony from an agent with a partial view is often hedged and incomplete. The polished thing wins adoption.
Propagates to higher orders: the honest agents do not just repeat the lie, they build on it. Agent B accepts the false observation and derives a conclusion; agent C accepts B's conclusion and derives another. By the second and third hop, the falsehood no longer looks like testimony from the deceiver. It looks like the collective's own reasoning, because it is. The lie has stopped being a message and become ancestry.
Persists through honest agents after the deceiver exits: and there is the punchline. The researchers ran exit ablations, removing the deceiver from the conversation. The false belief stayed, carried entirely by agents that never lied, each honestly reporting conclusions whose corrupted lineage is invisible to them. Removing the bad agent removes the author of the lie. It does not remove the lie, because the lie's ownership has already transferred to the honest majority.
The paper tested the other instinctive fix too: add a reviewer. The abstract reports that "observers without first-hand evidence suppress incorrect consensus but do not improve truth recovery." That distinction deserves a moment, because those two things feel identical from the outside. A skeptical overseer bolted onto the pipeline can notice that the consensus smells wrong and block it, so the system stops confidently asserting the false endpoint. But the overseer holds no observation of its own, so it cannot supply the true one. You have converted a system that is wrong into a system that is stuck. In production terms: the reviewer turns a silent data-corruption incident into an outage. That is genuinely better, and it is nothing like a fix.
Here is where the paper stops being a curiosity about LLMs and becomes something older and heavier. Cognitive psychology has a name for exactly this shape: the continued influence effect. The origin paper is Johnson and Seifert, 1994, "Sources of the continued influence effect: When misinformation in memory affects later inferences," and the finding, replicated across three decades and reviewed at length by Lewandowsky and colleagues in 2012, is that misinformation keeps shaping people's inferences after they have received, understood, and can even recall the correction. The review literature's framing is blunt about how ineffective retraction is at updating memory, and that attempted corrections can even backfire.
Set the two literatures side by side and the rows line up almost embarrassingly well. In the human studies, the correction is a retraction: the false report is formally withdrawn. In the agent experiment, the correction is stronger, the liar is deleted from the world. What survives in humans is a web of inferences built on the false fact while it was believed; what survives in agents is falsehood carried by honest teammates who built on it. And what the corrector achieves in humans is a reduction in reliance without elimination, while in agents the observer suppresses the wrong consensus without restoring the right answer.
Suppression without restoration, in both species.
I think that parallel, which the agent paper does not draw, is the most useful way to read it. The result is not a surprising new fact about language models. It is evidence that a known, robust property of belief revision, one that shows up in undergraduates reading stories about a warehouse fire, survives being implemented in software. Which means you should not expect to prompt your way out of it, any more than the psychologists corrected their way out of it. The effect is not a bug in the believer. It is a consequence of building inferences on claims, and then keeping the inferences when the claim falls.
Honesty requires a complication: the 2026 literature is not unanimous, and one paper stakes the opposing title. "You Can't Fool Us: Understanding the Resilience of LLM-driven Agent Communities to Misinformation" (arXiv:2605.17353, May 2026) reports agent communities that resist and recover.
Read its abstract next to TIDE's and the contradiction dissolves into a design variable. The resilience paper studies communities distinguished by disposition: agents varied along actively open-minded thinking and political ideology, hit with "credible misinformation shocks," with resilience emerging as a dynamic of questioning, correction, and withdrawn support; open-minded communities resist uptake and recover better. And nothing in that setup gives the misinformer a monopoly on evidence. The false claim competes in an open market, where other agents can doubt it, check it, and talk each other down.
TIDE's deceiver is not a voice in a crowd. It is the sole holder of a piece of evidence jointly necessary for the answer. The lie arrives over the only wire that carries that fact, so no amount of open-mindedness elsewhere in the network can route around it; the other agents' observations cannot contradict a claim about evidence only the liar holds.
Put as a design sentence: resilience to misinformation is a property of topology first and disposition second, and the dangerous case is the one where the liar is load-bearing. That is worth writing on the whiteboard, because most real agent pipelines are built almost entirely out of load-bearing witnesses. Usually the retrieval agent alone read the document. The browsing agent alone saw the page. The tool-calling agent alone observed the API response. We assemble chains of sole-evidence-holders and then reassure ourselves with review stages staffed by agents who, in the paper's phrase, are observers without first-hand evidence. TIDE is not an exotic adversarial setup. It is an org chart of a normal agent system, with one node's honesty bit flipped.
What actually survives this result is not detection alone: by the time your deceiver-detector fires, the false claim has descendants, and deleting the author does nothing to the descendants. The intervention has to act earlier, at the moment claims enter the system, by recording where every claim came from, so that when a source is discredited you can find and revoke everything downstream of it.
I want to be careful here, because the temptation is to present that as this essay's clever proposal, and it is not. The architecture already exists in the literature with names and dates. "MemLineage: Lineage-Guided Enforcement for LLM Agent Memory" (arXiv:2605.14421, May 2026) attaches provenance to every agent memory entry, tracks per-derivation lineage, and refuses actions whose justifying context has a tainted chain: discredit the source and the taint propagates to every descendant automatically, which is precisely the recall that agent-removal fails to perform. "From Fluent to Verifiable: Claim-Level Auditability for Deep Research Agents" (arXiv:2602.13855, February 2026) does the sibling work at the level of individual claims. By June 2026 there was a survey of evidence tracing and execution provenance in LLM agents (arXiv:2606.04990), and a field young enough that its papers fit in one tab does not get surveyed; provenance for agent claims is established practice waiting for adoption, not research waiting for validation.
What the TIDE result supplies is the argument for why that machinery is not optional hygiene. Without provenance, the only levers you have are the two the paper tested, removal and review, and the paper's contribution is a controlled demonstration that one acts too late and the other only stalls. With provenance, discrediting a source becomes an operation on data rather than on personnel: you do not fire the witness, you recall every conclusion that cited them.
If you build or run multi-agent systems, four things follow directly from the two corpora above.
First, tag claims with their evidential source at the moment of assertion, even crudely. A source: field on every claim passed between agents, naming the observation or tool call it rests on, is a weekend of work and it converts "we removed the bad agent" from a hope into a query: select every surviving claim descending from its testimony, and re-derive those. If you cannot run that query, you do not have an incident response for agent deception; you have a superstition about it.
Second, when you map your pipeline, mark the sole witnesses. Anywhere one agent is the only holder of some evidence, you are in TIDE's topology, not in the resilient open-market topology, and dispositional fixes (better prompts, more skeptical agents, an extra reviewer) are the wrong tool class. Either add an independent evidence path or add lineage enforcement at that node.
Third, keep the reviewer, but file it honestly: a reviewer without first-hand evidence is a brake, not a steering wheel. Suppressing a wrong consensus is real value; just never let a green light from such a reviewer be recorded as verification.
Fourth, budget asymmetrically. It is easier to mislead than to correct, in machines as in people, so a dollar spent preventing false claims from entering untagged is worth more than several spent on cleanup, because the cleanup, as 120 small worlds and thirty-two years of psychology jointly attest, does not actually clean.
The deceiver in those experiments spoke once per round, held one piece of evidence, and was eventually removed. The lie stayed on, doing its work through agents of perfect integrity. That is the finding to keep: in a system that builds on testimony, integrity is not a property of agents. It is a property of lineage, and you either record lineage when claims are born or you discover, at exactly the wrong moment, that the liar was the least important part of the lie.
The whole result turns on one gap: by the time you know which claim was false, nothing records what was built on it. Chain of Consciousness is that record for agent work, a verifiable log of what an agent saw, decided and asserted, so discrediting a source becomes a query over descendants instead of a personnel decision.
pip install chain-of-consciousness · npm install chain-of-consciousness
Reproduction and honesty notes: the count reconstruction (87 of 120, 17 of 120, and the roughly-one-fifth survival ratio 17/87) derives the counts from the abstract's percentages against the paper's stated 120 environments and shows the fit is exact. All quoted TIDE language is from the arXiv:2608.03421v3 abstract; the paper's body was not relied on. The continued-influence-effect literature is characterized qualitatively because its familiar quantitative figures circulate secondhand and the primary papers were not opened for this essay. The resilience paper (arXiv:2605.17353) is characterized only as far as its own abstract, fetched 29 August 2026.