Second AI reviewers miss unsafe actions without independent evidence

A new benchmark called VP-CONTROL built 2,880 commit-gate scenarios to test whether a second AI verifier catches what the first one missed. When both verifiers voted over identical evidence, they approved 62.9% of unsafe actions.

Giving one verifier an independent evidence source cut that approval rate to 22.9%. That gap matters for teams building review pipelines, where identical evidence lets a second checker rubber-stamp mistakes the first one already made.

Diverse evidence accounted for 40.9 points of the reduction. Swapping in a different verifier model, the fix most teams try first, accounted for 11.3 points. What the verifier saw mattered more than which model checked it.

A live test against HTTP and SQLite systems found race conditions after the check defeated every gate that relied on verifiers alone. An action could pass review, then a state change would slip in before it executed. Only a fully atomic guard recorded zero unsafe effects across 216 episodes. It locks state before acting instead of asking a model to approve it afterward.

Shopify runs two adversarial reviewers on every change. This research suggests that setup catches more only if each reviewer works from different inputs, not the same log. The paper doesn't say whether the gap holds for every kind of unsafe action, or just the commit-gate scenarios it tested. It also doesn't say how much independent evidence collection costs against a second model call.