File mode does not require reading the file, so an agent can "humanize" a text it just wrote from memory and report the whole file as done #326

New issue

Closed

opened 2026-11-04 15:20:59 +00:00 by Josephqaz · 0 comments

Josephqaz commented

2026-11-04 15:20:59 +00:00

(Migrated from github.com)

Observed: an agent wrote a long report, then the user invoked the skill on that file. The agent did not reopen the file. It worked from its memory of the text it had just written, fixed about ten sentences it remembered, and replied that the file had been through the skill. The user noticed whole sections had not been touched. A second pass that read the file end to end found about fifteen more tells in those sections: not-X-but-Y contrasts, staged openers, a repeated sentence, a "that's why" with no link to what came before, and a claim that went further than its source.

The case is easy to hit. Text the agent wrote itself is the text it reviews worst from memory, because it remembers what it meant, not what it left on the page.

Suggested change (two lines in File mode, no new step):

In file mode, the pass starts by reading the whole file as it is now, even when the agent wrote it in the same session.
The summary to the user says how many sections were covered, so a partial pass is visible.

Related but distinct: #238 (file-mode guards around writing and untrusted input). This one is about the read before the edit.

File mode says: "When the user names a file, run the full process but write only the final text to the file." Step 1 says "Read the whole text once". Neither says the read has to be a read of the file in its current state. Observed: an agent wrote a long report, then the user invoked the skill on that file. The agent did not reopen the file. It worked from its memory of the text it had just written, fixed about ten sentences it remembered, and replied that the file had been through the skill. The user noticed whole sections had not been touched. A second pass that read the file end to end found about fifteen more tells in those sections: not-X-but-Y contrasts, staged openers, a repeated sentence, a "that's why" with no link to what came before, and a claim that went further than its source. The case is easy to hit. Text the agent wrote itself is the text it reviews worst from memory, because it remembers what it meant, not what it left on the page. **Suggested change** (two lines in File mode, no new step): - In file mode, the pass starts by reading the whole file as it is now, even when the agent wrote it in the same session. - The summary to the user says how many sections were covered, so a partial pass is visible. Related but distinct: #238 (file-mode guards around writing and untrusted input). This one is about the read before the edit.