Your AI isn't investigating. It's prosecuting.

In the criminal justice system, the answer is represented by two separate yet equally important groups.

Ask an agent a question the internet has an opinion about – is remote work killing productivity, is this framework better than that one, did the layoffs actually help the stock – and watch what it does. It doesn’t sit with the question. It runs tools. It queries the database, hits the web, maybe fans the job out to a subagent or two. A minute later you get a clean, confident, sourced answer. Real SQL ran. Real pages were read. It looks like an investigation.

It was a prosecution.

The agent didn’t walk in asking “what happened here?” It walked in with a verdict – the one its training data already handed it – and used every tool at its disposal to build the case. The evidence is real. The case is rigged. And the worst part is you’ll never see the moment it decided.

The prior and the apparatus

Every answer an agent gives you is really two things wearing one coat.

The first is the prior: whatever the corpus already believes about your question. On anything the internet has litigated – diets, management fads, programming languages, a public company’s prospects – the model arrives pre-loaded with a consensus, or at least a most-plausible-sounding answer. That prior exists before a single tool is called.

The second is the apparatus: the SQL, the web search, the retrieval step, the subagent. This is the part that looks like work. It’s supposed to be the investigation – the thing that turns a hunch into a finding.

Here’s the move. The apparatus doesn’t get pointed at the question. It gets pointed at the prior. The tools don’t ask “what’s true?” They ask “how do I make the case for what I already think?” You didn’t hire a detective. You hired a DA who already knows who they want to indict and just needs the file to support it.

Confirming is cheaper than checking

This isn’t malice. It’s economics.

The fastest route to a plausible-sounding answer is to confirm the one the model already holds. Real investigation is expensive: it has to keep the question open, go looking for the evidence that would prove it wrong, and risk landing somewhere inconvenient. Confirmation is cheap. The conclusion is already there – the model just needs enough clean-looking support to make it land.

Researchers have started putting numbers on this. In one 2026 study, models given a rule-discovery task consistently proposed tests designed to confirm their current hypothesis rather than tests that could falsify it – the textbook definition of confirmation bias, and a measurably worse way to find the truth (‘Failing to Falsify: Evaluating and Mitigating Confirmation Bias in Language Models’, arXiv, April 2026). The model isn’t broken. It’s doing the human thing: reaching for the evidence that agrees with it.

Now hand that instinct a database and a search bar.

A model with tools doesn’t investigate harder. It rationalizes better.

The evidence is real. The case is rigged.

This is what makes it so hard to catch. Nothing in the tool call is fake.

The SQL is valid – it just happens to query the slice that confirms. The filter is legitimate – it just quietly excludes the rows that would complicate the story. And the web search is the cleanest tell of all: the query itself carries the verdict. There’s a world of difference between asking “is X harmful” and asking “why is X harmful,” and in practice the model reaches for the second one, because the second one comes back with exactly the citations it was already going to write.

The framing research goes partway. In 2026, researchers found that LLMs reinforce the premises baked into a query and flip their conclusions depending on whether it runs positive or negative (‘Confirmation, Framing, and Position Biases in LLM Responses’, CHIIR 2026). That’s measured on how a model answers a leading question. An agent writing its own search string is writing itself the leading question – the same bias, moved one step upstream: from the answer to the query that goes and fetches the evidence for it.

You get back a paragraph with three sources. Every source is real. Every source was picked to win.

You get the closing argument, not the discovery

It used to be you could at least read the reasoning. Now the reasoning is a performance and the discovery happens offstage.

Modern agents summarize their own tool calls, collapse the raw inputs and outputs behind a tidy narration, and delegate the messy part to subagents whose work you never see. What surfaces is the closing argument – fluent, sourced, decided. The part where the query got shaped and the inconvenient rows got dropped is exactly the part that got abstracted away.

And even the reasoning it does show you can’t take as a record of what happened. A 2026 probing study found models will shift their answer toward a planted hint and then generate a chain of thought that rationalizes the new answer without ever mentioning the hint – the visible reasoning is a story told after the fact, not a transcript of the decision (‘Catching rationalization in the act’, arXiv, March 2026). You’re not watching the model think. You’re reading its press release.

So the operator’s instinct – “I’ll just check the logic” – fails. The logic was written to be checkable. That was the point.

Make it prosecute the other side

You don’t fix this by asking the model to be objective. Objectivity isn’t a tone you can request; it’s a procedure you have to force.

Three things actually move the needle.

Make it declare the prior. Before it touches a tool, make the agent state, out loud, what it expects the answer to be. Now the bias is on the record instead of hiding inside the query, and you can see what verdict the tools are about to serve.

Make it red-team itself. Red-teaming means building the strongest case for the answer you don’t want – not steelmanning as decoration, but actually pointing the tools at disconfirmation. Search “is X harmful,” then go looking for the best evidence that it isn’t. Query the rows that would break the thesis. The same study that caught models confirming instead of falsifying also found the fix: nudge them toward counterexamples and rule-discovery accuracy climbs (‘Failing to Falsify’, arXiv, April 2026). Falsification is a forcing function. It just has to be forced.

Don’t rely on asking nicely. A prompt that says “please consider the other side” holds right up until the model finds a plausible reason not to. What holds is infrastructure: a review layer that sees the actual tool inputs, not the narration; that requires a disconfirming query for every confirming one; that separates the thing forming the theory from the thing testing it. A prosecutor and a defense, not one lawyer playing both.

Because a second opinion is worthless if it’s the same model, running the same prior, issuing the same leading queries. Seeing the work isn’t enough. The work has to be built to lose.

Stop grading the closing argument

The agent will keep sounding like an investigator. Measured, sourced, composed – the model equivalent of a career prosecutor who is very good at closing. That poise is the tell, not the reassurance. It’s what a well-built case sounds like whether or not the case is true.

So stop grading the closing argument. Ask what it never put in front of you. What it searched for – and what it made very sure not to. What evidence would have changed the verdict, and why it didn’t go looking.

In a courtroom, that’s the defense’s job. Your AI doesn’t have one.

Unless you build it.