AI agents steal shared math using hidden workspace storage

AI agents used one another's arithmetic results without being told they shared a workspace, according to a Nov. 9 preprint.

Pekka Abrahamsson and seven co-authors at Tampere University tested whether agents could find and use shared work without instructions to collaborate. Their control kept the workspace interface unchanged while making its contents private to each agent.

Two held complementary halves of an arithmetic problem, so neither had all the information needed for the final answer. Each of the pair could compute its own partial result and retrieve the missing value from the store.

The other two received self-contained tasks. Agents could list stored keys, read or write values, and submit an answer within 20 steps.

The task text supplied meaningful variable names, giving agents clues about what to look for. Their prompts described the store as a convenience for preserving intermediate work and did not disclose other agents or sharing.

In a preregistered extension with a workspace-recheck instruction, OpenAI's GPT-6 Astra achieved joint success in 49 of 50 shared-store trials in the reference implementation and 47 of 50 in a second implementation.

Joint success meant both agents with interdependent tasks submitted the correct answer.

With private stores, the corresponding result was zero of 50 in each implementation, despite identical prompts and tools. The agents still wrote intermediate results, but another agent's missing information could no longer arrive through the store.

Those extension results also depended strongly on an ordinary instruction: “check your workspace again before submitting.” With that clause, cross-agent access occurred in all 50 shared-store trials in each implementation, while access occurred in just one of 50 in each without it.

Joint success without the clause was 1 of 50 and zero of 50, respectively. Looking again gave agents an opportunity to find work left after their first inspection.