The short version
We fix a wrong claim, then find it alive somewhere else. This happened to us repeatedly over three weeks in August 2026. Each time, the fix was correct and the sweep was careful. The claim survived anyway.
The cause was the number of copies. Sweeping faster did not help. Cutting the copies to one did.
This matters for anyone who runs agents that write, because an agent that drafts a pitch, a resume or a ticket will reproduce whatever it finds nearest.
What happened
We had a wrong severity figure for a security finding. It was corrected on 3 August. On 5 August it was still alive in seven places. We had swept four times.
| Sweep | What it covered | What it missed |
|---|---|---|
| 3 Aug | a public post, an investor kit | ticket descriptions, the document vault |
| 4 Aug | comments, cover notes | ticket descriptions, the vault |
| 5 Aug, morning | several tickets | an investor-facing ticket, a training plan, the vault |
| 5 Aug, evening | the investor-facing ticket | the training plan, two vault copies |
Four correction sweeps between 3 and 5 August 2026: what each covered and what each missed
Fig. 1The four sweeps, and what each covered and missed, from the lab's claims register. Surfaces are described, not named.
Every sweep covered a category. The copies outside the category survived. The last two found were the worst. One was the source of an investor message. The other was a rehearsal script that did not just hold the wrong figure but had its speaker say it aloud in three separate interview rounds.
The copy that survives is the one nobody was reading at the time. It is also the one that gets pasted from later.
It happened again
On 13 August we withdrew a finding as a false positive. On 23 August a sweep found it still being claimed on six surfaces, ten days after it was struck. One was the investor kit, where it was the headline. One was the same rehearsal script as before. The rest were cover-note files. The 13 August correction had landed in our register of claims and nowhere else.
The correction went stale inside the fix
By then we had built a single register for shared facts. A claim lives there. Other surfaces link to it, or copy its approved string word for word. On 23 August we found the register carrying the same defect. A table said two findings had been filed on 17 August. The prose under it still said nothing had been filed. The table was corrected. The prose was not. For six days the page contradicted itself.
The list of places is also a copy
The register names every surface where each claim appears. That list is meant to make a sweep complete. It is a copy too. Since then we have found at least eight surfaces by inspection that were not on any list. Two patterns recur.
- A page rename moves every claim on it to a new address. The list names addresses. Nothing notices.
- A check that bans three named strings passes a page that carries five other unlisted figures. The check was correct. The rule behind it was wider than the check.
Two approved strings pasted together make a third string. It is not approved and it is not tracked.
What we do now
- One home for each shared fact. Surfaces link to it.
- Where a surface must carry the words, such as an email or a PDF, it copies the approved string unchanged.
- A correction is not done until it has walked the list of places.
- Files we cannot rewrite, such as applications already sent, get a dated banner stating what they used to say.
- We add a surface to the list before it holds the claim, not after.
- We still inspect by hand, because the list misses things.
What this does not show
This is one operator in one workspace. The counts are surfaces we found, not a rate. We did not measure how often a claim escapes, and we did not test whether the single-home rule keeps holding over time. We know it failed once inside itself. We have weeks of record, not a trial.
We have no evidence about other teams, and none about how an agent chooses which copy to reproduce. The agent point above is a worry drawn from our own pasting habits, not a measurement. The evidence is held privately and cannot be re-run by a reader. Nothing here is a benchmark result.
References
- State-Drift: the term, what the field has measured, and why it is a security problem. Botzr Research. botzr.com/research/state-drift
- Six silent memory failures. Field notes, written 4 September 2026. Botzr Research. botzr.com/research/silent-memory-failures
Originally published at botzr.com.
Top comments (0)