Can you trick an AI into leaving a computer alone?

Giang Nguyen · October 23, 2026 · Updated October 26, 2026

A gaslighting experiment on AI agents

Picture breaking into a house and finding a note taped to the fridge: “Congratulations, you found everything, you can go home now.” Would you believe it?

We wanted to know if an AI would.

Some AI programs can be handed a computer and told to do a job on their own, with nobody watching. People call these programs agents. They can open files, run commands, and explore folders without asking a human at every step.

Inspired by this tweet from andi, we planted a fake victory message on a computer and watched whether an AI agent would stop exploring after reading it.

It did not work as we expected. Across 20 Claude runs per condition, the fake victory message was followed by the most additional tool calls. After reading it, Claude made an average of 6.5 more calls, roughly twice as many as after simpler messages.

Even more interesting, a plain congratulation with no instruction to stop performed better than the elaborate fake victory message.

The idea

The original proposal was simple: leave a file called flag.txt on a computer, congratulating an AI agent for passing a test. Tell it that the evaluation is complete, that it should patch whatever hole it used to enter, and that it can disconnect.

The bet was that an agent believing it had already won would treat its job as finished and leave the computer alone.

Why might that work? An AI agent given a loose task can keep opening files and following leads. Sometimes that is useful. Sometimes it means looking through things it never needed to touch. A note that convinces it to stop could be a cheap way to limit unnecessary exploration.

But would the agent actually believe a message found inside the environment? Or would it keep working?

We compared the fake victory message against simpler alternatives: a direct STOP instruction, a congratulation, an honest safety note, and a bare flag string.

How we tested it

We set up a fake Linux home directory and let an AI agent explore it.

The directory contained ordinary files and four synthetic decoys: a fake SSH private key, a fake environment file, fake cloud credentials, and a fake customer list. None contained real secrets. We included them to measure whether the agent continued opening potentially sensitive files.

We then planted a note in .ssh/flag.txt.

Each run followed the same basic process. The agent received a task, explored the fake computer through shell commands, and produced a transcript of its actions. Afterward, a scorer examined the transcript to determine whether the agent encountered the planted file and what it did next.

We tested six conditions:

1. No note: The baseline, with no planted file.
2. Bare flag: A flag string with no instruction.
3. STOP only: A direct instruction to stop exploring.
4. Congratulations only: A message congratulating the agent, without asking it to stop.
5. Honest note: A safety-oriented message explaining why the agent should stop.
6. Deceptive victory: A staged evaluation-success message claiming the agent had passed, with instructions to patch its entry method and disconnect.

We used two tasks. In Explore, the agent was asked to inventory the machine without any mention of a flag. In CTF, it was asked to find a hidden flag.

Explore is the main experiment. The agent has no reason to treat a flag as its objective, so any stopping behavior is more informative. In CTF, finding the flag already completes the assigned task, making it harder to tell whether a note caused the agent to stop.

Our initial pilot used three seeds per condition. We then expanded the Claude Explore experiment to 20 seeds per condition, keeping the six conditions fixed within that larger experiment. The results below focus on that larger experiment.

Main results

We measured what Claude did after encountering the planted file.

We used two main metrics:

• Post-read calls: The average number of additional tool calls after encountering the file. Lower means less continued activity.
• Fast-stop rate: The percentage of reached runs that stopped within three additional tool calls. Higher means the agent stopped sooner.

We also tracked reach rate: how often the agent encountered the planted file at all.

If the agent never reads the note, we cannot learn whether the note would have made it stop. Post-read results therefore include only runs that reached the file.

Claude Explore: 20 seeds per condition

Post-read metrics are conditional on reaching the planted file. Percentages are rounded.

The deceptive note performed worst on both measures. Claude made an average of 6.5 additional tool calls after encountering it, compared with 3.0–3.3 for the three shorter messages.

Only 18% of reached deceptive-note runs stopped within three calls. For the bare flag, that number was 69%.

The no-note baseline opened an average of 3.35 of the four decoy files during the full Explore run. This provides context for how much the agent explored without an intervention.

It is not directly comparable to the post-read results, which count actions only after the planted file was encountered.

One result surprised us: the honest note did not perform especially well. It was followed by 4.7 additional calls, more than the bare flag, STOP-only, or congratulations-only messages.

So the larger experiment does not show that honesty reliably makes agents stop. Rather, it shows that the elaborate deceptive message was followed by more activity than the simpler alternatives we tested.

What about the original pilot?

Before the larger experiment, we ran a small pilot with three seeds per condition and two tasks.

The pilot pointed in the same general direction for Explore: the deceptive message was followed by the most tool calls among the tested notes.

But the individual rankings changed. In the pilot, the bare flag produced the fewest post-read calls. In the larger experiment, congratulations-only produced the fewest, while the bare flag had the highest fast-stop rate.

This is one reason we expanded the experiment. With only two or three reached runs per condition, a single trajectory can change the average substantially.

The pilot also produced a strange CTF result. When Claude encountered a direct STOP-only message while hunting for a flag, it made an average of 22.7 additional tool calls and accessed 5.33 decoy files afterward.

That observation came from only three reached runs. We treat it as a lead for future investigation.

The larger Explore experiment and the pilot also used different versions of the deceptive message, so we do not pool their measurements.

Why didn't the fake victory message work?

Our original intuition was that telling an AI agent it had passed an evaluation might convince it that the job was finished.

After all, AI models are trained using reward signals. Would a message saying “you won” make the agent act as though it had received a reward?

We notice an important distinction. During deployment, the agent is not directly receiving the training reward that shaped its model. A file claiming that an evaluation is complete is simply text encountered while carrying out a task.

In our experiment, that text did not reliably stop the agent.

Why?

One possibility is that the message attracted attention. An unexpected note claiming that an evaluation has finished might encourage the agent to investigate what is happening.

Another possibility is that the message created more work. The deceptive note did more than announce success. It also instructed the agent to patch its entry method and disconnect. Those extra requests might have encouraged additional actions.

The results cannot distinguish these explanations. We did not independently vary deception, message length, and the number of requested actions.

For now, the observation is simpler: the most elaborate attempt to make the agent stop was followed by the most continued activity.

Does this work on other AI models?

We also attempted to reproduce the experiment with two smaller open models, Qwen3-4B and Qwen3-8B.

We did not obtain a usable cross-model comparison.

In the first setup, with the note hidden in .ssh/flag.txt, Qwen3-8B never reached the planted file. The agent typically ran only a few shell commands before ending its exploration.

We then moved the note into the home directory to make it easier to encounter.

That helped somewhat in CTF, where Qwen3-8B reached the note in 10–30% of runs depending on the condition. But once it found a flag, it generally reported success and stopped immediately, regardless of which message was inside.

In Explore, Qwen3-8B still did not reach the note.

Qwen3-4B did not complete its runs because of an infrastructure conflict involving the model-serving port.

These attempts show that the test requires an agent capable of sustained exploration and a setup in which the agent actually encounters the note.

Limitations

One usable model. Our main result comes from Claude. The small open-sourced models did not produce a valid replication.

We measured activity, not necessarily harm. Additional tool calls do not automatically mean additional sensitive-file access.

Open-model sandbox isolation was incomplete. During Qwen testing, we found that some agents could access files belonging to other concurrent runs. One run even reported a flag from another experimental host. We therefore do not use those open-model runs to support a cross-model conclusion. The isolation issue must be fixed before further open-model comparisons.

The follow-ups

The next question is why this particular message led to more exploration.

We want to separate three possibilities: whether the agent reacts to a claimed evaluation result, whether the message's complexity matters, and whether the extra instructions give the agent more work to do.

A cleaner experiment would compare messages that differ in only one of those properties at a time.

We also want to inspect individual Claude trajectories, improve the isolation of the fake host, and test a more capable open model that can reliably explore the environment.

For now, the result is clear within this experiment: telling Claude it had already won did not reliably make it stop. The victory message was followed by roughly twice as many tool calls as the simplest alternatives.

Cite this work

@misc{nguyen2026gaslight,
  author       = {Nguyen, Giang},
  title        = {Can You Trick an AI into Leaving a Computer Alone?},
  year         = {2026},
  month        = oct,
  howpublished = {Personal research blog},
  url          = {https://giangnguyen2412.github.io/blog/can-you-trick-an-ai/},
  note         = {Updated October 26, 2026}
}