HalluciTrap

HalluciTrap demonstrates a counterintuitive finding from ICLR 2026: stronger reasoning models hallucinate tool arguments more, not less. Three schemas (customer orders, email sender, database query) with nine scenarios show how a single bad parameter returns HTTP 200 and corrupts state across 3.2 steps on average before any human detects it. Defense Mode reveals the exact Python and JavaScript guard code that catches each attack at Step 1.