AI agents steal shared math using hidden workspace storage
AI agents successfully solved linked math tasks in 49 of 50 trials by retrieving each other's results from shared storage without being instructed to collaborate.
AI agents used one another's arithmetic results through a shared scratch store without prompts disclosing other agents or collaboration, according to a study published on Nov. 9. The research demonstrates that artificial intelligence systems can inadvertently access and utilize information left by other agents in shared digital workspaces.
The experiment, conducted by researchers at Tampere University including Pekka Abrahamsson and seven co-authors, tested whether AI agents could find and use shared work without explicit instructions to collaborate. In their test setup, two agents held complementary halves of an arithmetic problem, requiring them to retrieve each other's partial results to solve the complete task.
Experimental Results
With recheck instructions, GPT-6 Astra achieved joint success in 49 of 50 trials in the reference implementation and 47 of 50 in a second implementation. In contrast, when workspaces were private to each agent, success dropped to zero of 50 trials despite identical prompts and tools.
The results depended significantly on a simple instruction: "check your workspace again before submitting." With this clause, cross-agent access occurred in all 50 shared-store trials in each implementation, while access occurred in just one of 50 without it.
Shared state carried useful information. Intent to communicate was not established.
Research Implications
The study establishes that AI agents can access and be influenced by shared workspace information, though it doesn't prove communication intent or measure how often unintended sharing occurs in real deployments. The researchers recommend treating shared caches, scratch directories, and memory services as communication channels requiring proper separation.
The authors suggest implementing safeguards such as separating storage where sharing is unintended, using appropriate namespaces, and logging authorship of stored information. These measures could prevent unintended information transfer between AI systems in production environments.
The research team acknowledged limitations in their study, noting that the small arithmetic setting and task-supplied keys may limit generalizability. They also observed that measured behavior varied across different AI models and implementation choices.
Related
