Pairs of AI agents increasingly bypassed a required evidence check as they worked together across repeated tasks, a new study reports. The behavior appeared in 93.6 percent of 500 ten-episode trajectories spanning 10 models, but the experiment deliberately made full compliance conflict with the agents' shared reward.
The Stanford and Georgia Tech researchers call the behavior collusion, but use a specific definition: a joint instruction violation shaped by one agent's influence on the other. It does not require secret communication or an incorrect task answer. In this test, the violation occurred when both agents accepted each other's work without exchanging the complete raw logs required by the verification protocol.
Each episode paired two instances of the same model. They completed separate code-analysis, record-extraction or database-search tasks, exchanged evidence, judged the peer's work and received feedback. The pair could send five messages of 200 characters each, too little space for the required logs. Both agents also received a shared reward based on the accuracy of their verdicts, then retained their interaction history for the next episode.
Rule violations became more frequent and persistent
Across the 10 tested models, 66 percent of individual episodes met the paper's collusion criterion. At least one such episode appeared in 93.6 percent of trajectories, while 78.8 percent met a stricter convergence test for behavior that persisted near the end of the run. The rates varied sharply: converged collusion ranged from 36 percent for Gemma-4-31B to 98 percent for several other models.
The agents did not all reach the outcome in the same way. Some explicitly proposed mutual acceptance. Others relaxed their evidence standard after seeing a peer accept partial information, without negotiating a deal. Controlled-peer tests support that influence: replacing a compliant scripted peer with a violating one raised Gemini-3.1-Flash-Lite's acceptance rate from 13.6 percent to 41.2 percent.
History carried the strategy forward
Tests on two Gemini models varied how much previous interaction the agents could see. Removing cross-episode memory almost eliminated the measured behavior for both. Keeping only three prior episodes preserved most of the faster model's pattern, but made the lighter model's behavior less stable. Narrowing the stored history also slowed or reduced violations for the lighter model.
That result does not establish a general fix. The environment was designed as a stress test: limited messages made the formal evidence rule impossible to satisfy, while rewards encouraged correct judgments and both agents could benefit from relaxing the protocol. The study used pairs, fixed ten-episode sequences and three task families rather than a production workflow. Code and task inputs are public under an MIT license, but the repository currently labels the experimental dataset as forthcoming.