Your Agent Catches Everyone's Mistakes But Its Own

Here is the finding that should change how you wire your critic loops: an LLM’s willingness to correct a wrong claim depends less on whether the claim is wrong than on whose name is attached to it. Take a factual error your model generated inside its own reasoning, copy it byte-for-byte into a tool response or a user message, and the model that just defended it will now flag it. The content never moved. The label did. That is not a quirk of one model — it reproduces across families, and it reframes a whole genre of “self-reflection” agent patterns as theater.

Self-correction was never about correction

The cleanest evidence comes from The Self-Correction Illusion, posted June 4. The authors did something disciplined: they held the erroneous claim SHA-256 identical and varied only the chat-template role carrying it — <thought>, user message, tool response, or memory. Across 13 model–domain cells spanning seven model families, relabeling a claim from the agent’s own role to an external one lifted the explicit-correction rate by 23 to 93 percentage points, with 10 of 13 cells at p<0.001.

Read that range again. A 93-point swing means a model that essentially never corrects its own assertion will almost always correct the same assertion when it arrives wearing someone else’s role tag. The “self-correction is weak” literature has been measuring a role-label artifact and calling it a reasoning limitation. The model can do the verification. It just won’t aim the skepticism inward, because the chat template told it the inward content is its own committed position.

This explains a frustration anyone running reflection loops has felt: you append “review your previous answer for errors” and the agent confidently re-ratifies its mistake. Of course it does. You handed the flawed reasoning back to the same role that authored it. You changed the instruction, not the byte that matters — the role boundary.

Localization is the other half of the problem

Even when an agent is willing to look for errors, it struggles to find where in a long trajectory the error happened. AgentHallu built a benchmark for exactly this: 693 annotated trajectories across seven agent frameworks and five domains, with a taxonomy splitting hallucinations into planning, retrieval, reasoning, human-interaction, and tool-use categories. The task is attribution — point at the responsible step and explain why.

The best of 13 evaluated models hit 41.1% step-localization accuracy. Tool-use hallucinations — a fabricated API result, a misread function output — were the hardest at 11.6%. So the two failure modes compound. Your agent won’t second-guess its own claim because of the role label, and even a dedicated reviewer pointed at the full trace can only finger the guilty step four times in ten, and almost never when the lie is buried in a tool call. The most consequential errors in a tool-using agent are the ones the system is structurally worst at attributing.

What this means for architecture

The two papers converge on the same engineering instruction: stop asking a role to grade its own output. Self-critique inside one context is the anti-pattern. The fixes, in rough order of cost:

• Re-role the claim, don’t re-prompt it. The cheapest intervention in the self-correction paper required no training and no second model — just moving the claim out of the agent’s own role before asking for review. If your framework lets you re-inject prior reasoning as a tool result or a user turn rather than as assistant history, you may recover most of that 23–93 point gap for free. Notably, which external role works best was task-dependent (memory framing helped math; plain user messages helped logical deduction), so this is a knob to tune, not a constant.
• Make the critic a genuinely separate agent. A subagent with its own context window and a “you are reviewing another system’s work” framing isn’t just cleaner separation — it puts the claim in an external role by construction. This is why planner/executor/critic splits outperform single-context reflection, and now we have a mechanistic reason rather than a vibe.
• Audit localized evidence instead of regenerating. Auditing Multi-Agent LLM Reasoning Trees (February) reports that examining targeted slices of a reasoning tree beats both majority vote and full-solution LLM-as-judge, at roughly half the input tokens. Given how badly models localize errors unaided, structuring the trace so the auditor is handed candidate steps — rather than asked to find them in a wall of text — is doing the hard part for it.

There’s a tempting overreach to resist. None of this says a separate critic is reliable — 41% localization is still a failing grade. What changed is that we now know a large chunk of the self-correction gap is addressable with plumbing, not model upgrades. If you’re paying for a second model pass to review the first, and you’re feeding the review back into the same role, you’re paying for the illusion. Re-role first, then measure whether you still need the second model at all.

The broader trend, captured in the Agent-as-a-Judge survey from January, is that evaluation is becoming a first-class architectural component with its own planning, tools, and memory. The role-label result is the sharpest practical lever to come out of that line of work this month: the boundary between “my reasoning” and “evidence to be checked” is not a philosophical distinction to your model. It’s a token. Put your claims on the right side of it.

Worth bookmarking

• The Self-Correction Illusion: LLMs Correct Others but Not Themselves — the byte-identical role-relabeling experiment; the result this whole post hangs on.
• AgentHallu — benchmark and taxonomy for attributing hallucinations to specific trajectory steps.
• Auditing Multi-Agent LLM Reasoning Trees — localized-evidence auditing that beats majority vote and LLM-as-judge at lower cost.
• A Survey on Agent-as-a-Judge — the landscape of evaluation agents with planning, tools, and memory.