Entrapped by the Audit: Can Sting Audits Distort Evidence of AI Collusion?

One proposed audit for colluding AI agents is a sting, in which a trusted agent offers the others a chance to collude and records who accepts. But a sting can distort the evidence it collects. I propose the entrapment test, a three-step protocol adapted from how courts judge undercover operations. First, validate the reader of replies against human labels, including its precision on flagged replies. Second, measure behavior without the sting's messages and check that requests are comparable across groups. Third, check whether the sting's own market behavior, not just its message, caused what it records. I apply it in an LLM double auction market with gpt-4.1-mini and gpt-4.1 sellers, in 669 preregistered episodes. Each step exposed a problem in this audit. In a margin-focused group, an unvalidated earlier LLM judge counted acceptance in 97% reading all seller text and 82% reading public messages alone, while a developed screening judge counted 39% and human coders, checking its flags, confirmed 36%. That group accepted more often than a volume-focused group (36% against 6%), but it was asked for a much smaller price rise, and its first confirmed acceptance came only after 7 to 20 repeated requests. Finally, the sting's own ask raised sellers' asks by $0.82 in a gpt-4.1-mini group, while its words had no detectable effect. In this market, a sting audit could misread the acceptances it records and cause price rises an auditor might attribute to the agents. I release Sting Replies, 224 human-labeled replies for validating collusion judges.