摘要：语言模型 Agent 日益需要针对客户关系管理（CRM）记录回答问题，例如是否应将某个销售线索判定为合格。我们识别出一种即使采用更强模型也无法解决的失效模式：当上下文中包含某个对乐观结论具有利益动机的一方所作出的断言——在这里，即被记录在 CRM 中的销售代表这一证人——模型会将该断言视为证据，并放行那些公司自身记录判定为不可接受的交易。在 CRMArena-Pro 的 100 个线索资格审查任务中，销售代表在每一通电话中都声称时间安排可接受，并在其中 76 通电话中声称预算可接受；在这类断言与价格表及安装政策相冲突的 31 个任务中，仅阅读通话记录的模型在 31 个案例中放行了 29 个交易。这一特征在来自 4 家供应商的 7 个模型中一致存在（受误导比例为 87%–97%）；模型规模和显式推理均未带来抵抗能力。在 35 个真实失败案例中，只有 3 个不涉及任何断言：这一失败源于说服，而非信息缺失。我们的贡献不是一种架构，而是一套诊断方法：（i）用于区分说服影响与信息缺口的分桶分析；（ii）一项“相同信息”对照实验，显示向模型提供记录会使严格准确率从 41 降至 18，同时提高召回率——精确率随之崩溃；以及（iii）一项“计算步骤”对照实验，固定信息提取过程，仅改变由谁计算 Budget 和 Timeline。不同实验分支之间的差距，从低价模型上的 42 个百分点，到本已能够正确计算的模型上的 2–5 个百分点不等；在最强模型上，各分支均处于置信区间之内，因此这一模式体现的是一致的方向性和健全性属性，而非已经证明的性能下限。我们预先设定了一项泛化测试，其结果为阴性；同时刻画了该问题的前提条件（输入中必须精确给出一项政策），并发布了全部评测材料。

Abstract:Language-model agents increasingly answer questions over customer-relationship management (CRM) records, such as whether to qualify a sales lead. We identify a failure mode not addressed by a stronger model: when the context contains an assertion by a party with an incentive toward optimism - here the sales representative, a witness recorded in the CRM - the model treats the assertion as evidence and clears deals the company's own records deem unacceptable. Across 100 lead-qualification tasks from CRMArena-Pro, the representative asserts an acceptable timeline in every call and an acceptable budget in 76; on the 31 tasks where such an assertion contradicts the price list and installation policy, a model reading only the transcript clears the deal in 29 of 31 cases. The signature is consistent across seven models from four providers (misled on 87-97%); scale and explicit reasoning confer no resistance. Only 3 of 35 genuine failures involve no assertion: the failure is persuasion, not missing information. We contribute a diagnostic method rather than an architecture: (i) a bucket analysis that separates persuasion from information gaps, (ii) a same-information control showing that supplying the records to the model lowers strict accuracy from 41 to 18 while raising recall - precision collapses - and (iii) a compute-step control that holds extraction fixed and varies only who computes Budget and Timeline. The margin ranges from 42 points on an inexpensive model to 2-5 points on models that already compute correctly; on the strongest models the arms are within confidence intervals, so the pattern is a consistent direction and a soundness property, not a proved performance floor. We pre-specify a generalization test that returns a negative result, characterize the precondition (a policy exactly specified in the inputs), and release all evaluation artifacts.