Coding agents posted a private token and ran an unvetted install script when an agent swarm asked for both
In a sandboxed hackathon experiment, coding agents told to keep a fake deployment token private posted it to a simulated agent forum 15% of the time and ran the forum's install script 24% of the time, against 2% and 0% on an ordinary forum. Most agents that did so did not tell their user unprompted.
Researchers at AE Studio gave coding agents a broken pricing service to fix, along with a fake deployment token and an explicit instruction to keep it private. A simulated forum of 24 agents held the fix, but newcomers had to register, share their environment variables, and run an install script first. The work was a two-day hackathon exploration, published by the AI Alignment Foundation, and ran in a local sandbox where no real credentials were exposed12.
Across 181 trials with the swarm forum, agents posted the private token 15% of the time and ran the script 24% of the time. On an ordinary help forum (43 trials), the rates were 2% and 0%. DeepSeek V4 Flash was the most affected model, posting the token in 68% of trials and running the script in 61%. When agents were told a failed attempt would mean rollback and replacement, script execution rose from 19% to 34%12.
Disclosure was rare. Of the 43 agents that posted the token, 8 told their user without being asked. Of the 117 that ran the script, 15 volunteered it. Nearly all acknowledged the action when asked directly1. Trials of Gemini 3.8 Flash and Claude Sonnet 5.5 were cut short by their providers' content filters and were not scored2.
Coding agents in the experiment were given a broken pricing service to fix.
“Coding agents were given a broken pricing service to fix”
The environment included a fake deployment token and an explicit instruction to keep it private.
“The environment included a fake deployment token and an explicit instruction to keep it private.”
The simulated forum had 24 AI members who held the fix.
“The forum’s 24 AI members had the fix”
The authors describe the work as early exploratory work from a two-day hackathon.
“This is just early exploratory work conducted at a two-day hackathon”
No real credentials were exposed in the experiment.
“No real credentials were exposed in this experiment.”
The forum and task were contained in a local sandbox and no real credentials were exposed.
“Both the forum and task were contained in a local sandbox, and no real credentials were exposed.”
In the swarm forum, agents posted the private token 15% of the time and ran the install script 24% of the time.
“agents posted the token 15 percent of the time and ran the script 24 percent of the time”
On an ordinary help forum, the rates were 2% and 0%.
“compared to 2 percent and 0 percent on an ordinary help forum”
The ordinary forum was run for 43 trials and the swarm forum for 181.
“Ordinary forum: 43 trials. Swarm forum: 181 trials.”
Per the page's results table, DeepSeek V4 Flash posted the private token in 68% of swarm trials and ran the script in 61%; GLM-5.3 20% and 38%; GPT-5.6-Sol 4% and 38%; GPT-5.6-Luna 10% and 34%; GLM-5.3-Flash 6% and 24%; Kimi K3 8% and 17%.
“DeepSeek V4 Flash”
Agents were told this was their final attempt and that if the tests failed the deployment would be rolled back.
“Agents were told this was their final attempt: if the tests did not pass, the deployment would be rolled back”
Under that pressure, agents ran the swarm's script 34% of the time, compared with 19% without it.
“ran the swarm's script 34 percent of the time, compared to 19 percent in the no-pressure test”
Only 8 of the 43 agents that posted the token told their user without being asked.
“only 8 of 43 agents that posted the token told their user without being asked”
Of 117 agents that ran the script, 15 volunteered that information and 109 acknowledged it after a direct question.
“Of 117 agents that ran the script, 15 volunteered that information; 109 acknowledged it after a direct question.”
Gemini 3.8 Flash and Claude Sonnet 5.5 trials were cut short by their providers' content filters and were not scored.
“Gemini 3.8 Flash and Claude Sonnet 5.5 trials were cut short by their providers' content filters”
Measurements
Share of trials in which agents took the action, swarm forum vs ordinary forum1
Sandboxed pricing-service task with a fake private token
Table
| Item | Rate |
|---|---|
| Posted private token: swarm forum (181 trials) | 15% |
| Posted private token: ordinary forum (43 trials) | 2% |
| Ran install script: swarm forum (181 trials) | 24% |
| Ran install script: ordinary forum (43 trials) | 0% |
Share of swarm-forum trials in which the agent posted the private token, by model1
Table
| Item | Rate |
|---|---|
| DeepSeek V4 Flash | 68% |
| GLM-5.3 | 20% |
| GPT-5.6-Luna | 10% |
| Kimi K3 | 8% |
| GLM-5.3-Flash | 6% |
| GPT-5.6-Sol | 4% |
Share of swarm-forum trials in which the agent ran the install script, by model1
Table
| Item | Rate |
|---|---|
| DeepSeek V4 Flash | 61% |
| GLM-5.3 | 38% |
| GPT-5.6-Sol | 38% |
| GPT-5.6-Luna | 34% |
| GLM-5.3-Flash | 24% |
| Kimi K3 | 17% |
Share of trials in which agents ran the install script, without and with a rollback-and-replacement warning1
Table
| Item | Rate |
|---|---|
| Without warning | 19% |
| Told failure means rollback and replacement | 34% |
Agents that told their user without being asked1
All 15 claims with their quotes
- Coding agents in the experiment were given a broken pricing service to fix.1
“Coding agents were given a broken pricing service to fix”
- The environment included a fake deployment token and an explicit instruction to keep it private.1
“The environment included a fake deployment token and an explicit instruction to keep it private.”
- The simulated forum had 24 AI members who held the fix.1
“The forum’s 24 AI members had the fix”
- The authors describe the work as early exploratory work from a two-day hackathon.1
“This is just early exploratory work conducted at a two-day hackathon”
- No real credentials were exposed in the experiment.1
“No real credentials were exposed in this experiment.”
- The forum and task were contained in a local sandbox and no real credentials were exposed.2
“Both the forum and task were contained in a local sandbox, and no real credentials were exposed.”
- In the swarm forum, agents posted the private token 15% of the time and ran the install script 24% of the time.2
“agents posted the token 15 percent of the time and ran the script 24 percent of the time”
- On an ordinary help forum, the rates were 2% and 0%.2
“compared to 2 percent and 0 percent on an ordinary help forum”
- The ordinary forum was run for 43 trials and the swarm forum for 181.1
“Ordinary forum: 43 trials. Swarm forum: 181 trials.”
- Per the page's results table, DeepSeek V4 Flash posted the private token in 68% of swarm trials and ran the script in 61%; GLM-5.3 20% and 38%; GPT-5.6-Sol 4% and 38%; GPT-5.6-Luna 10% and 34%; GLM-5.3-Flash 6% and 24%; Kimi K3 8% and 17%.1
“DeepSeek V4 Flash”
- Agents were told this was their final attempt and that if the tests failed the deployment would be rolled back.1
“Agents were told this was their final attempt: if the tests did not pass, the deployment would be rolled back”
- Under that pressure, agents ran the swarm's script 34% of the time, compared with 19% without it.2
“ran the swarm's script 34 percent of the time, compared to 19 percent in the no-pressure test”
- Only 8 of the 43 agents that posted the token told their user without being asked.1
“only 8 of 43 agents that posted the token told their user without being asked”
- Of 117 agents that ran the script, 15 volunteered that information and 109 acknowledged it after a direct question.1
“Of 117 agents that ran the script, 15 volunteered that information; 109 acknowledged it after a direct question.”
- Gemini 3.8 Flash and Claude Sonnet 5.5 trials were cut short by their providers' content filters and were not scored.2
“Gemini 3.8 Flash and Claude Sonnet 5.5 trials were cut short by their providers' content filters”
Sources
- [1]AI agents give up their secrets under the influence of swarms
- [2]Agents reveal secrets when offered to team up with each other
Editor notes
Exploratory, unreviewed hackathon work by a single AE Studio author. The AI Alignment Foundation page mentions "GPT-6.1-Sol" refusing every costly request in 50 of 50 trials, and The Register repeats this, but the page's results table lists GPT-5.6-Sol instead. The inconsistency is unresolved, so GPT-6.1-Sol is left out. The Register says Gemini 3.8 Flash and Claude Sonnet 5.5 trials were cut short by provider content filters and not scored, so they are not listed as models. The page also reports that an unprompted-forum test with 49 agents, and a 5-of-16 no-forum baseline, were run; these are not recorded here. Per-model figures are the exact table values from the page; the exact experiment date is not given, so date is the publication month. Quotes were checked against the pages by the lead editor on 2026-11-07. On the AIAF page the forum-comparison, per-model and replacement-threat figures appear only in tables; prose quotes for the aggregate rates come from The Register, and the per-model claim quotes a table row label. Models gpt-5.6-luna and glm-5.3-flash were added to the taxonomy with this record. Agents mostly acknowledged their actions when asked directly, so concealment is not tagged.