Blog

AI agent hallucination: why your bot invents client facts

Aperisa ยท 7 min read

A September 2025 paper, "Why Language Models Hallucinate," puts it plainly: language models are "optimized to be good test-takers, and guessing when uncertain improves test performance." Your Telegram agent took the same test. Ask it a client's notice period it has never seen, and a confident guess is the behavior it was trained toward.

That is why AI agent hallucination about client facts is mostly a retrieval and grounding problem, not a model problem. The fact wasn't in context, or a stale version was, and nothing in the setup made "I don't know" the right answer. Four patterns reduce it and make what's left checkable: give the agent a lookup tool, put the source in the reply, refuse when there's no source, and use placeholders for sensitive fields.

Why does an always-on agent make up client facts?

There are three common gaps.

The fact was never in context. Harness memory holds what got written down, and it's small on purpose. Hermes Agent's memory docs cap MEMORY.md at 2,200 characters and USER.md at 1,375, injected "as a frozen snapshot at session start." OpenClaw's memory docs say "The model only remembers what gets saved to disk." Your client's signed amendment is in Drive, not in either file.

A stale version was in context. In OpenClaw's memory search, dated daily notes decay with a 30-day half-life while MEMORY.md is evergreen, so last spring's summary can outrank last month's correction. Long sessions get compacted, and OpenClaw's compaction docs call the fallback summary "deliberately lossy." We cover that in detail in OpenClaw memory.

Retrieval returned a near miss. A vector search for "Harbor Lane notice period" can return a chunk about Harbor Line, a different client with a similar name and a different contract. The model gets text that looks relevant and answers from it.

In all three cases the model did what it does: it produced the most plausible answer from what it had.

Is AI agent hallucination a model problem?

Partly, and not the part you can fix fastest. Model choice matters a lot for prompt injection, and OpenClaw's security docs recommend the best-tier model for agents that can run tools. But no model upgrade puts a contract into context that was never retrieved. If the input is missing or wrong, a stronger model guesses more fluently.

Anthropic's own guide to reducing hallucinations is mostly about the input and the output contract, not the model: allow the model to say "I don't know," ground answers in direct quotes, and "Verify with citations," where a claim without a supporting quote gets retracted. The same page ends with a line worth keeping: "although these techniques significantly reduce hallucinations, they don't eliminate them entirely."

So the job is to change what the agent sees and what it is allowed to say.

Pattern 1: Give the agent a lookup tool for client facts

Stop asking the model to remember. Give it a tool that searches the record and returns the value with where it came from, or an explicit miss. With made-up data, a good response shape looks like this:

{
  "client": "Harbor Lane",
  "field": "notice_period",
  "value": "60 days",
  "source": {
    "title": "Harbor Lane MSA, Amendment 2",
    "date": "2026-08-14",
    "url": "https://docs.example.com/harbor-lane-amendment-2"
  }
}

and for a miss:

{ "client": "Harbor Lane", "field": "billing_contact", "value": null, "source": null }

The miss matters as much as the hit. A tool that returns nothing gives the model room to fill the gap. A tool that returns null with no source gives the model something true to report.

Then restrict what the agent can reach. In Hermes, the MCP docs let you register only the tools you want per server, in ~/.hermes/config.yaml. With a placeholder server and tool names:

mcp_servers:
  records:
    url: "https://records.example.com/mcp"
    tools:
      include: [search_records, get_record]

OpenClaw does the same with toolFilter.include under mcp.servers, and in n8n the tools are the sub-nodes you connect to the AI Agent node. Fewer tools means fewer paths to a plausible wrong answer.

Pattern 2: Put the source in the reply

A fact in a Telegram or Slack message should carry a pointer you can open from your phone. With made-up data:

Harbor Lane needs 60 days notice.
Source: Harbor Lane MSA, Amendment 2 (2026-08-14)
https://docs.example.com/harbor-lane-amendment-2

You can check the answer in one tap. If the agent names a document that doesn't exist, the link fails and you know. If it cites a document you know was superseded, the date tells you before the client does.

Write the format into the agent's instructions (AGENTS.md, the agent's prompt in n8n, or wherever your harness reads them), and keep it short enough that the model follows it under a long context.

Pattern 3: Refuse when there's no source

Make "I couldn't find that in the records" a correct answer, then check for it outside the model.

The instruction is the easy half: "If the lookup tool returns no source, say you couldn't find it and ask where it might be. Never estimate." The check is the half that holds. After the agent step, look at the reply before it ships: if it states a client fact and carries no source line, replace it with the refusal and log it. In n8n that's an IF node after the AI Agent node. In OpenClaw or Hermes it's a wrapper around the send, or a reviewer agent with no tools that reads the draft reply and the tool result together.

OpenClaw's memory docs already state the principle for their own recall: "Partial, stale, or unavailable recall still requires disclosure." Apply the same rule to client facts.

Pattern 4: Use placeholders for sensitive fields

An agent in a shared Slack channel doesn't need a client's real tax ID or bank account number to draft an invoice email. Give it placeholders such as [CLIENT_TAX_ID] and fill them in at the last step, where a person or a narrow script handles the real value.

This cuts two risks. Fewer real values in context means fewer real values to get wrong. And an inbound message that tries to talk the agent into posting a client's bank details gets a placeholder, which is the point. OpenClaw's prompt injection docs note that untrusted content can steer an agent "even if only you can message the bot," because emails, docs and attachments carry text too.

How do you test whether the fixes work?

Build a small question set from your own records, with made-up client names if you share it. Include questions whose answer exists, questions whose answer changed recently, two clients with similar names, and questions whose answer isn't in the records at all.

Run it through the agent and score three things per question: right value, source present and correct, and a clean refusal where nothing exists. Rerun it whenever you change the model, the prompt or the tool.

Where does Aperisa fit?

Aperisa is one example of the record behind Pattern 1. It reads Gmail, Drive, Calendar and Contacts with read-only Google access, plus the bank accounts you link, and keeps a searchable copy to answer from. It maps those records into one structured record and serves it through a read-only remote MCP server with no send, write or delete tools. It looks up your records instead of asking a model to recall them, and answers come with the email or document they came from.

Pattern 4 maps to keys. Give each agent its own key and set what it can reach: which data areas, work or personal, and how much detail, from full records down to totals only. Aperisa enforces those limits on the server. Revoke a key and it stops working within 2 minutes.

Look it up, cite it, or say so

Your agent invents client facts when it has to guess and nothing stops it. Give it a lookup tool with an honest miss, ask for the source in the reply, enforce the refusal outside the model, and keep sensitive values as placeholders. The wrong answers that remain are easier to catch, because you can check the source.

For the inbox side of an always-on agent, see OpenClaw Gmail read-only. For documents, see OpenClaw and Google Drive.

Aperisa connects as a remote MCP server over Streamable HTTP with a Bearer key, and each key can be limited by data area and level of detail. Try it out.

FAQ

Why does my AI agent make up facts about clients? Usually because the fact was never in its context, or an old version was, and nothing in the setup made "I don't know" the right answer. A 2025 paper on why language models hallucinate argues that training and evaluation reward guessing over acknowledging uncertainty.

Will a better model stop an AI agent from hallucinating? It helps at the margins. It doesn't put a missing contract into context. For facts about your clients, retrieval and grounding matter more than model choice.

How do I reduce hallucinations in an n8n AI agent? Connect a tool that looks up the record and returns its source, instruct the agent to answer only from that tool, and add a check after the AI Agent node that blocks replies with a fact but no source.

Do these patterns eliminate hallucination? No. They reduce it and make the rest checkable. Anthropic's own guidance on reducing hallucinations says the techniques significantly reduce hallucinations but don't eliminate them entirely.

Sources

Questions

Why does my AI agent make up facts about clients?

Usually because the fact was never in its context, or an old version was, and nothing in the setup made 'I don't know' the right answer. A 2025 paper on why language models hallucinate argues that training and evaluation reward guessing over acknowledging uncertainty.

Will a better model stop an AI agent from hallucinating?

It helps at the margins. It doesn't put a missing contract into context. For facts about your clients, retrieval and grounding matter more than model choice.

How do I reduce hallucinations in an n8n AI agent?

Connect a tool that looks up the record and returns its source, instruct the agent to answer only from that tool, and add a check after the AI Agent node that blocks replies with a fact but no source.

Do these patterns eliminate hallucination?

No. They reduce it and make the rest checkable. Anthropic's own guidance on reducing hallucinations says the techniques significantly reduce hallucinations but don't eliminate them entirely.

Published

Keep reading