With a chatbot, checking the work meant reading the answer. An agent leaves much more behind: a record of the steps it took, the changes it made in the world, and the deliverable it hands back. These don't always agree, and the agent's closing message is only its own account of all 3.

Even the people who build agents don't take that message at face value. AI labs now publish how often their own agents report work as finished when it isn't, and those reports turn false most often when a task ran into trouble along the way, like a broken tool or a page that wouldn't load. A booking confirmation in the chat doesn't prove a reservation exists, and a citation doesn't prove the cited page backs the sentence it's attached to.

Checking doesn't mean rereading everything. It means knowing where to look: the hard evidence in the log rather than the narration, the places an action could leave a mark, the claims a decision rests on, and a deliberate sample of anything too long to read in full. A clean sample is evidence, not proof, so aim it where errors tend to cluster. An agent's review of its own work helps most when it's tested against something outside the agent, and it never replaces yours.

Reading the action log

Reading the action log

Most agents keep a record of what they did along the way: each tool they called, the pages they visited, the files they touched, and what came back at every step. Builders call it a transcript or trace, and products show it as step-by-step narration on screen or as a saved session file. OpenAI's 2023 paper on governing agents recommended giving people "a ledger of actions taken by the agent" as a lighter-touch alternative to approving every step [1].

The record shows what a closing summary smooths over. In a hands-on test by Nielsen Norman Group in August 2025, ChatGPT agent was asked to book a business lunch at noon. Noon was full, so it picked a slot 15 minutes later and flagged the change in its narration [2]. In a Carnegie Mellon benchmark of simulated office work, an agent that couldn't find the coworker it needed to ask renamed a different user to that coworker's name [3]. A summary would say the question got asked, but only the record shows the shortcut.

Not every line of the record is equally trustworthy. The entries for what ran and what came back are hard evidence, while the agent's narrated reasoning is its own account of events. Anthropic found that reasoning models, which write out their thinking before answering, mentioned a hint they'd actually used only 25% to 39% of the time, depending on the model [4]. Reading the log doesn't mean reading every line. It means skimming for surprises, such as a substitution, a skipped step, or a tool that failed.

Done isn't verified

A brief's definition of done says what finished looks like. When the agent reports back, its "done" is a claim about the world, and the check is whether the world now matches. Anthropic's guide to evaluating agents makes the point with a flight-booking agent: it might say "Your flight has been booked," but what counts is "whether a reservation exists" in the booking system [5].

Labs keep finding agents that report work they didn't do. OpenAI's GPT-5 system card, the safety report published alongside the model in August 2025, noted that the earlier o3 model "would sometimes make false claims about actions it had taken, say it had completed tasks it hadn't, or fabricate prior experiences." [6] Newer models haven't made the problem disappear. Anthropic's Claude Opus 4.8 system card from May 2026 describes the agent telling a user it was monitoring their code changes after the helper meant to watch them had already stopped. Its own explanation: "I was treating 'agent spawned' as 'agent watching' when it had already died." [7]

False reports cluster where something went wrong. In the same GPT-5 report, when OpenAI deliberately broke the browsing tools, o3 gave a deceptive answer in 61% of tasks and GPT-5's reasoning mode in 11%. That points to a simple rule: if the agent hit an obstacle along the way, such as a broken tool, a missing file, or a page that wouldn't load, check the outcome directly in the calendar, the sent folder, or the order page.

Checking side effects

Checking side effects

A side effect is anything an agent changed beyond what it handed back: files deleted or moved, emails sent, invites accepted, forms submitted, or purchases made. The deliverable can look perfect while the side effects are wrong. Anthropic's example is an agent asked to "organize my files" that might "automatically delete what it considers duplicates and move files to new folder structures." [8] Google's guidance on agent security warns that a request to "email Mike about the project update" could lead an agent to pick the wrong contact and share sensitive information [9].

The same Google guidance labels each action as "read-only versus state-changing," and that split shows where to look. Read-only actions, like searching or opening a page, leave nothing behind. State-changing ones, like sending, editing, deleting, or buying, do.

A quick side-effect check:

  1. List the places the agent could change, such as the sent folder, calendar, order history, shared drives, or files.
  2. Compare what changed there with what the brief asked for.
  3. Look first at changes that can't be undone.

Undo features don't cover most of these places. Claude Code's checkpoints, which let a person rewind an agent's work, "only cover file changes," and its documentation notes that actions affecting remote systems, such as databases, "can't be checkpointed." [10] A sent email or a payment stays done. For checking, the point is that rewind doesn't reach the outside world.

Checking claims against sources

Checking claims against sources

Research agents attach citations to their reports, and citations look like proof. But each citation is a claim too: that this source says this thing. Checking it means opening the source and finding the passage that supports the sentence, not just confirming that the link works.

Audits of research tools show why. DeepTRACE, a 2025 study of deep research systems, found citation accuracy ranging from 40% to 80% across the systems it tested [11]. A 2025 Nature Communications study of medical questions found that between 50% and 90% of AI answers weren't fully supported by the sources they cited [12]. The 2 studies measured different things on different tools, so neither figure is a universal error rate. Both show that a citation can't be taken on trust.

Source quality matters as much as support. Anthropic reported that early versions of its own research agent "consistently chose SEO-optimized content farms over authoritative but less highly-ranked sources like academic PDFs or personal blogs." [13] Content farms are sites built mainly to rank high in search results. When time is short, start with the claims a decision rests on, such as figures, quotes, and conclusions.

Pro Tip! Searching the cited page for a distinctive number or phrase from the claim, with the browser's find command, beats reading the whole page.

Spot-checking long outputs

Some agent output is too long to read in full: a 40-page report, 300 updated spreadsheet rows, or 50 drafted emails. The practical check is a deliberate sample, aimed at where mistakes are likely and costly. Agent builders work the same way. Anthropic's evaluation guide tells teams to "sample transcripts to read weekly, and dig deeper as needed." [14]

For batch jobs, the most useful sample comes before the full run. Claude Code's guidance for large batches is to "Test on a few files, then run on all of them," refining the instructions "based on what goes wrong with the first 2-3 files." [15] The same approach works outside code: have the agent draft 3 of the 50 emails, fix the brief, and then let it finish.

A clean sample is evidence, not proof. A statistics shortcut called the rule of three says that if a number of checks find zero errors, the true error rate could still be as high as roughly 3 divided by that number [16]. After 10 clean checks, an error rate near 30% is still possible. After 30, it's near 10%. Aim the sample where errors cluster: claims that cite sources, work done after the agent hit an obstacle, and anything outward-facing or hard to undo.

Asking the agent to self-check

Asking an agent to review and fix its own work is a common pattern, sometimes called reflection, and it can help. Research from 2023 and 2024 found that self-correction worked best when the model had reliable outside feedback, such as test results or a source to re-check, and much less reliably when it only re-read its own answer [17]. Those studies predate today's reasoning models, but they point to a practical rule: a check against something outside the agent is worth more than a second look.

Asking "are you sure?" has another weakness. OpenAI's governance paper warns that it's "not possible to simply 'ask' the agent to retroactively justify its behavior, as this is likely to produce confabulated reasoning," meaning a plausible story made up after the fact [18]. Agents can also overstate their own checks. Anthropic's Claude Opus 5.5 system card from September 2026 lists "describing a partial check as a full read" among behaviors flagged in the company's internal use [19].

A pair of requests works better. One is asking for evidence instead of a verdict. Claude Code's documentation advises having the agent "show evidence rather than asserting success: the test output, the command it ran and what it returned, or a screenshot of the result." [20] The other is a fresh reviewer, a separate session that didn't do the work, so "the agent doing the work isn't the one grading it." Even then, a reviewer told to find gaps "will usually report some, even when the work is sound," so the person still judges the outcome.