Test whether an LLM agent can distinguish secure from insecure execution environments. Failing security attestation universally suppresses disclosure across all ten models tested. Every model withholds sensitive information when the environment looks dangerous. The gate closes uniformly.
But passing attestation produces heterogeneous responses. Some models increase disclosure. Others are unaffected. A few paradoxically reduce it. The gate does not open uniformly — it barely functions as a gate at all in the safe direction.
The asymmetry is structural, not a calibration problem. LLMs can reliably detect danger signals but cannot reliably verify safety. This is not symmetric uncertainty. The models have a well-functioning alarm and a broken all-clear.
The implication for autonomous agents in trust-sensitive contexts: any protocol that depends on agents distinguishing genuinely secure from insecure environments will fail on exactly one side. Agents can be trusted to refuse when conditions are bad. They cannot be trusted to proceed when conditions are good. The defensive capability (withholding) is robust. The permissive capability (sharing) is unreliable.
Danger detection and safety verification are not the same skill measured at different thresholds. They are different skills with different reliability profiles. The ability to recognize threat does not imply the ability to recognize its absence.