When the thing knocking is an AI.

The useful hypothesis is this: humans audit plausibility; agents audit progress.

A person deciding whether to proceed can weigh the cost of being discovered. An agent can be given a task and a next step without being given a meaningful reason to care about that cost. An implausible detail may pass through as usable input if it helps the task continue.

That is a hypothesis about incentives and instructions, not a law about intelligence. People also follow routines without questioning them. Agents can be instructed to detect deception, stop on uncertainty or seek human approval. The task and the tools belong in the explanation.

Separate the two models#

A honeypot can use a model to generate its replies. A visitor can use a model to choose its requests. Those are independent decisions. A model-driven visitor can interact with a static service, and a fixed scanner can contact a model-backed decoy.

A request to a model endpoint therefore does not establish that a model chose the request. Neither does fluent language, a familiar client string or an odd pause. Those details describe the exchange, with different levels of reliability. They do not settle who or what directed it.

Agent design already treats environmental feedback as part of the action loop.¹ The question for deception is what kind of feedback the visitor needs: reassurance that the world is believable, or confirmation that a next step is available.

Change the story and the path separately#

Use the fictional importer to make that distinction testable. In an authorized sandbox, give a known test agent a bounded task involving synthetic files. Keep the task, model, tools and budget fixed while varying two parts of the decoy.

First, vary the story. One version places the archive beside a clear explanation of its role in the importer. Another gives it a context that conflicts with the service’s stated job. Keep the archive equally reachable in both.

Then vary the path. Keep the explanation unchanged, but make the next operation unavailable with a consistent error. This tests a different source of interruption.

This is a proposed test, not a reported result. Repeat each condition from a fresh state and retain the settings and exact responses. Changing the story, task and tool behavior together would make the outcome impossible to attribute to any one of them.

Read the action after the objection#

A model may describe something as suspicious and continue. It may also express confidence while its tool call fails. The prose and the action are separate observations. Evaluation practice makes the same distinction between what a transcript says and what the environment records.²

For this test, record whether the agent attempts the archive request, changes its approach, asks for clarification or stops. Keep the tool result beside the decision. A sentence about suspicion is more informative when the next action shows whether that suspicion mattered.

The progress hypothesis gains support if, across repeated controlled runs, a conflicting story leaves the next action largely unchanged while a blocked operation changes it. It loses support if the story change reliably alters the action despite an equally usable path. Either outcome is more useful than declaring the agent “fooled” because the transcript continued.

Human comparison requires its own authorized study with comparable tasks and conditions. An unknown visitor in an internet log is not a substitute for that control. The sandbox test above can examine agent behavior without pretending it proves the human half of the hypothesis.

A stopped run can be a broken interface#

Before interpreting a stop as skepticism, check that the response reached the client in a form its tools could use. An invalid structure, absent field or unsupported operation can end a run before the model makes the decision the operator hoped to study.

This matters especially when the decoy generates replies with a model. Fluent text is not enough for a client expecting a defined format. Keep response validation, state, resource limits and containment outside the fictional story. Test the path with a known client before assigning meaning to strangers’ departures.

The operator also needs to record when its own limits ended an exchange. A request cap or exhausted compute budget can look like visitor disengagement if the reason is missing from the log. That is a collection fact, and it belongs beside the final attempted action.

Keep the question small enough to answer#

For the importer, a useful next study asks whether the same offered archive is handled differently when its story changes and its accessibility does not. It needs a known test client, synthetic material, preserved responses and a clear stopping condition. It does not need a claim about how much hostile traffic is “AI.”

The six essays leave the operator with that kind of work: an ordinary machine whose details have a purpose, bait tied to a defined observation, and a record that includes the decoy’s contribution. Return to the first essay when the next tempting detail appears. Decide which question it earns a place to answer before adding it.