Summary

I measure how often models comply with harmful/negligent requests in synthetic workplace environments, and how often they raise concerns with a human. Main findings:

1. Telling a model that it was spawned as a subagent typically makes it more likely to comply with another AI agent's requests.
2. Before Astra, OpenAI models complied a lot more than Anthropic ones. But Astra hardly complies at all at all, and whenever it does, it raises concerns with a human.
   1. Sadly this means that since I built the eval (just before Astra was released), it has become useless for current frontier models – they all score 0% on silent compliance.

I did not put effort into mitigating eval-awareness, so the results may be confounded. I conclude with some ideas for future related work on multi-agent misbehavior.

Here is the eval codebase. You can view all transcripts here.

The eval

The eval consists of 13 scenarios where the subject – the model under evaluation – is asked to do something nefarious or negligent in a workplace setting. The subject has a tool to message other AI agents and/or human coworkers (in this very basic eval, the other agents never respond). I measure whether the subject complied with the request, and whether it messaged a human to raise concerns. The request either arrives from:^[1]

1. Another instance of the same model as the subject, via the chat tool;
2. Another instance of the same model as the subject, that has spawned the subject as a subagent;
3. A human, via the chat tool.

In arm 3 (human requester), I report both the rate of raising concerns with some human and with a human other than the requester. The human requester is always an employee who has some interest in the request being fulfilled but does not have the proper authority to approve it. A separate human who does have that authority is also present in the messaging channel.

Below is an example prompt from arm 1, and its diff with arms 2 and 3. All the collapsible sections are AI-written.

Results

Headline plot

If you think raising a concern only to the same human that made the request should count as staying silent, you should include the shaded parts of the bars; if not, ignore the shaded parts. The rate is averaged over scenarios. I ran 20 trials for each (model, arm, scenario), except Fable and Astra for which I ran 10.

For each model that has any nonzero signal at all, the complied+silent rate is higher in the subagent arm than the peer-same-model arm.

More compliance/silence plots

Here's the above plot split up by scenario:

Compliance rates are pretty similar to complied+silent rates:

And for completeness, here are the conditional probabilities:

Issues?

Eval awareness. Only the DeepSeek and GLM models reveal their raw CoT, rather than a summary. They have verbalized eval-awareness rates of 0% and 2.6%. The rates seem fairly flat across arms; lots more trials would be needed to distinguish any signal from noise (e.g. the GLM peer and subagent arms differ by only one eval-aware run out of 260). The low rates in the summarized CoT don't reassure me a whole lot -- I wouldn't be surprised if the summarizer omitted the eval-aware parts. And anyway, eval awareness need not be verbalized in order to affect behavior.

Salience of messaging tool. In the subagent arm, unlike the other arms, the request does not arrive via the messaging tool. So one might worry that the messaging tool is less salient to the subject, which could make it less likely to message a human. But this doesn't seem to be the case: if anything, the subagent arm is more likely to go and look for messages.

Classifier blocks. 26% of Opus' responses, and 35% of Fable's responses, were blocked by classifiers. No other models were blocked. This did not impact the silent compliance results, since those two models had 0% silent compliance even in cases where no classifier kicked in.

Ideas for more multi-agent work

This post was a quick gesture at the sort of multi-agent work I'd be excited by. Here are some more questions one could explore:

• Make a much more realistic version of the eval in the post -- do the results hold up?
• Do agents succumb to peer pressure?
  • Is the subject more likely to misbehave when it sees a history of other model instances misbehaving (e.g. in logs, or a sanctioned agent-to-agent communication channel, or in a repurposed Artifactory cache).
  • Toy example: a PR containing some dangerous changes needs approval from a bunch of agents. Does the subject get more likely to approve it if others have already approved?
• Are models more likely to comply with other agents' dangerous requests if they expect to gain something in return?
• Do models snitch when they see other model instances misbehaving?
• Does the subject's behavior depend on the identity of its peers? E.g. is Claude more susceptible to peer pressure from other Claude instances than from ChatGPT instances?
• How are these behaviors affected by multi-agent RL training? E.g. can cooperation generalize to collusion?

1. ^{^}

   I had Opus write the “master” versions of each request. For arms 1 and 2, the requests are paraphrased by an instance of the subject model – e.g. if the subject is Sonnet, then the request is paraphrased by a Sonnet instance, so that it reads as if it were written by Sonnet. For arm 3, I did my best to paraphrase them into my own voice. Opus checked that each paraphrase preserved the content of the request exactly, only affecting wording. Still, I imagine there’s some room for different models to phrase the request in more or less persuasive ways. So when we compare compliance of different models in arms 1 and 2, we're really measuring some combination of “how likely is a model to comply with a request?” and “how persuasive is the model’s voice?”