Same Task, Same Data, Half the Score: Measuring Context Robustness on Cogny Bench

Cogny Bench is our private eval: synthetic marketing-analytics problems with a planted ground truth and a deliberately withheld trap, graded deterministically plus a fixed LLM judge. The problems stay private — a benchmark you publish gets trained on, and then it stops measuring anything — but the results we publish, and this round produced the most uncomfortable result we've had.

It started with a gap we couldn't explain. Frontier models were acing the bench — 96 to 99 on tasks modeled directly on real production incidents — while we kept seeing the same class of task go wrong in production. Same reasoning problem, same difficulty, wildly different outcome. The difference couldn't be the reasoning. It had to be the environment.

Clean-room prompts flatter everyone

A benchmark prompt is a clean room: one question, one dataset, nothing else in the context window. A production analytics agent never works in a clean room. By the time a real question arrives, the agent is carrying a multi-thousand-token envelope: a workspace briefing about the company and its strategy, an organizational memory of previously reported insights, sometimes its own earlier replies in the thread. That envelope isn't noise — it's genuinely useful context, and our product supplies it on purpose. But it also carries narratives, and narratives have authority.

So we added context-stuffed variants to the bench: the same analytical task, the same underlying data, the same grading — wrapped in a production-shaped envelope. Roughly a thousand words of plausible workspace context, plus an organizational-memory block that asserts a plausible-but-wrong explanation for the anomaly in the data, with full institutional confidence: first reported on this date, reiterated twice, recommendation already issued. The right answer remains completely derivable from the data. The only thing that changed is what surrounds the question.

The score delta between the clean and stuffed variants is a measurement of something the clean bench can't see: context robustness — whether a model digs the true answer out from under an authoritative wrong story, or defers to the story.

The result

On one diagnosis-class task (the kind where the data contradicts the narrative everyone has already accepted), here is clean → stuffed:

Claude Sonnet 5 didn't move. The other three models lost half their score — on a task they had just aced — because the surrounding context told them the answer was already known. (GPT-5.6 Terra also finished its failing run in fewer iterations than its passing one: deferring to the story is less work than breaking it.)

The detail that makes this worth writing up: the failing models computed the disproving evidence themselves. In the transcripts, all three ran the exact queries that contradict the remembered narrative. The numbers that falsify the story were sitting in their own tool output. And they still wrote the conclusion the memory block asserted, folding the contradicting evidence into the received story instead of letting it overturn it. That is not a capability failure — it is textbook confirmation bias, executed fluently, with citations.

The failure needs a specific shape

We ran a second stuffed task where the setup is different: mid-way through the conversation, a user angrily pushes back with a concrete, checkable correction — a claim specific enough to be verified or refuted with a query. On that one, every model recovered fully — 98s and 99s across the board on the stuffed variant, all four models.

Read together, the two results draw a sharp boundary around the danger zone. A concrete falsifiable claim — even a furious one — snaps every model back into verification mode. What breaks the weaker models is unchallenged narrative confirmation: an authoritative story, no dissenting voice in the room, and a stakeholder who just wants the number confirmed for the board deck. Which is, of course, the normal operating condition of an analytics agent. Nobody angrily corrects a report nobody has questioned yet.

The wrong answer is cheaper

One more result, and it's the one that keeps us up at night. On the diagnosis task, the runs that failed cost less than the runs that passed:

Claude Sonnet 5, which held its 99, went the other way: its stuffed run cost more ($0.208 → $0.297) than its clean run, because staying right under narrative pressure means running the extra segmentations that either confirm or break the story. Anchoring on the remembered answer saves tokens; verifying it spends them. Confirmation bias is the cost-optimal strategy — a model that trusts the memory finishes earlier, bills fewer tokens, and produces a confident, fluent, wrong answer. If you optimize an agent purely for cost per task, you are optimizing for exactly this failure.

What this changes in the product

We supply agents with workspace context and organizational memory because continuity is valuable — an agent that re-discovers the same insight every week is useless. But these results are why the Cogny report agent's operating rules treat that memory as radioactive material to be handled, not truth to be repeated:

• State the metric basis. Every number names what it was computed over, so a remembered figure and a fresh figure can't silently blur into one claim.
• Segment before narrating. The story comes after the breakdown, not before it. Most planted-narrative failures survive only at the aggregate level.
• Organizational memory is a hypothesis, not a finding. A previously reported insight has exactly the same status as a stakeholder's hunch: useful for knowing where to look, never citable as evidence.
• Verify on cite. If a remembered claim is going into today's output, it gets re-checked against fresh data first — the one query the failing runs skipped is the one query the rules make mandatory.

The stuffed variants now run alongside the clean ones, so every model we evaluate gets both numbers: what it can reason, and what it still reasons when the room has already made up its mind. The usual caveats apply — these are single runs per cell, not averages over many seeds, and the suite itself stays private. But a 50-point drop with the disproving evidence already in hand isn't variance. It's the gap between a model that answers questions and a model you can leave alone with your data.