AI agent cooperation Instinct
Task handoffs, debate influence and trading swarms
Today's research converges on state: what survives a handoff between agents, what a debate actually changes, and what shared communication does to portfolios. New benchmarks price handoffs, error recovery and monitor value.
- agent-handoffs
- multi-agent-debate
- agent-evaluation
- mcp-security
- agent-communication
- progress-monitoring
Evaluation
- Authors’ claims
HSC-Bench: structured state beats narrative summaries when one agent takes over another's task
Li and colleagues report HSC-Bench, 1,039 takeover tasks built from 300 repository tasks across 38 repositories plus 739 synthetic continuation tasks, in which a receiving agent must continue another agent's work from a shared history. Across six receivers, structured state raises GPT-5.4's mean score by 5.42 points and its all-criteria pass rate by 9.3 percentage points versus narrative summaries, and by 3.03 points and 7.4 percentage points versus recent transcripts; it also improves repository evidence recovery for every receiver tested. Repository recovery stays weak in absolute terms: line-F1 tops out at 0.263 (Sonnet 5), with Gemini at 0.261, GPT-5.4 at 0.229 and DeepSeek V3.2 lowest at 0.189.
Assessment
A clean separation between knowing what was done and finding the evidence behind it. The structured state result gives multi-agent handoffs a measurable baseline rather than a folklore rule.
- Authors’ claims
ReInBench: recovery from errors, not error avoidance, tracks task completion in agent traces
Duan, Jia and colleagues report ReInBench, 1,259 agent traces containing 1,403 annotated error events, and measure how often agents recover without outside help. Self-recovery shares in OSWorld tasks are 45.6 percent for Claude 3.7 Sonnet, 65.9 percent for Sonnet 4.5 and 60.9 percent for Kimi K2.5, against 32.8 percent in Web tasks for GPT-5 with SeeAct. Task completion tells the sharper story: 20.6 percent of 286 traces with no recovery finish the task, 18.0 percent of 161 partially recovered traces, and 60.0 percent of 280 fully recovered traces.
Assessment
A useful yardstick for monitor design: if full recovery triples completion, an overseer's job is less about preventing every error and more about guaranteeing recovery.
- Authors’ claims
A fixed-accuracy monitor can swing agent success from minus 5 to plus 35 points depending on restart value
Jain and Vedam report an analytical and experimental study of what a progress monitor is worth when it only gets to choose continue or restart. Holding the failure detector fixed at 90 percent true-positive and 10 percent false-positive rates, the same monitor swings task success anywhere from minus 5 to plus 35 percentage points depending on how likely a fresh attempt is to finish within its remaining budget. On SWE-bench Verified SymPy tasks, transferred restart cutoffs and patch composition from failed branches add little once continuation success is properly accounted for.
Assessment
A needed reframing for agent oversight benchmarks: monitor quality cannot be scored as classification accuracy alone, because the decision it feeds determines whether the information helps at all.
Coordination research
- Authors’ claims
MAD Bench: in multi-agent debate the answer is fixed before the argument is written
Batra and colleagues report MAD Bench, 2,400 questions across three open-weight models, and trace where a peer's influence actually lands. Stopping agents after a fraction of their own reasoning and forcing an answer shows that among answer-changing responses the forced choice already matches the eventual answer 65.4 percent of the time after debate versus 22.3 percent after matched reflection on Qwen3.5-9B: agents commit to the peer-influenced answer before writing any justification. Attention knockouts and cross-model latent transfers then follow the influence into specific layers.
Assessment
The most mechanistically careful debate study this month. If answers precede arguments, debate transcripts overstate the reasoning that communication adds, which matters for every deliberation-based pipeline.
The preprint is version 1, dated 18 October 2026 on the abstract page, but it first appeared in the 28 October listing that this edition covers.
- Authors’ claims
Lineage quotients separate genuine corroboration from copied agreement in debate judging
Cao and colleagues report a formal fix for a judging failure in multi-agent debate: once agents can copy, paraphrase or split each other's reports, agreement counts stop measuring independent support. Their lineage quotient is the only representation among those tested that ignores replicas and excerpt splits while still counting genuinely fresh roots, and it is provably the coarsest key with that property. In an exhaustive structural audit of 28,224 direct-star profiles and 2,052 argument graphs, plus 277 profiles derived from AVeriTeC, competing representations let replication change the verdict while the lineage quotient does not.
Assessment
Practical infrastructure for any pipeline that counts agreement across agents. Without lineage awareness, a judge cannot tell ten independent confirmations from ten copies of one report.
- Authors’ claims
Pull inboxes beat push context as the coordination primitive once agents get busy
Sreedhar and colleagues report a systematic comparison of push, where every message enters the context in arrival order, against pull, where messages wait in an inbox under explicit reading and memory rules. In meeting scheduling, keeping every reply stays within 0.05 of the best case as team size grows, so open negotiations rather than load break push. In group formation under heavy unwanted traffic in simulated societies, first come first read misses every request while an inbox that first reads messages carrying a refundable deposit finds about 0.6 of the target group at every society size from 1,000 to 16,000 agents. On the email-Eu-core network with 1,005 members and 24,929 connections, arrival-order reading finds no one, and when half the agents adopt such an inbox, forwarded search recovers only 5 percent of full adoption against 42 percent for one-hop search.
Assessment
A concrete case that agent messaging needs mailbox semantics, not just a longer context window. The reading rules are simple enough to adopt directly in current frameworks.
- Authors’ claims
Two hundred trading agents show what test-time communication does to portfolio behavior
Fayaz and colleagues report a live-market experiment with paper accounts: 200 agents from four model families, in groups of ten across five communication regimes, each trading a simulated USD 100,000 account against live market prices over seven US trading days from 1 to 9 October 2026. Two of the four families converged on the same holdings within groups; every Opus manager across all five regimes bought TSM (46 of 50 on 1 October), with five isolated Opus managers filling at the same price in the same second of the opening. Grok's peer-memory group sometimes wrote that peers' stocks were crowded and avoided copying them, though inconsistently, with overlap close to its isolated group. Fills in the same stock and direction landed within 30 minutes of a groupmate's fill more often in communicating groups than isolated ones (50 to 88 versus 36 to 57 percent, higher in 15 of 16 groups).
Assessment
One of the first controlled looks at correlated behavior that communication between deployed agents creates. Convergence on identical trades is exactly the systemic risk that isolated evaluation cannot see.
Infrastructure
- Authors’ claims
Concordat: typed session protocols stop agents from skipping required approvals
Milad Sikaroudi reports Concordat, a Python framework where an agent's tool protocol is derived from typed decorators, rendered as a state diagram, and enforced by offering the model only the tools allowed in the current state. Under customer pressure in airline tasks from tau-bench, a standard agent changed the state without the required human yes in 13 of 50 task-runs with gpt-4.1 and 29 of 128 with Claude Haiku 5.5, while the Concordat agent committed zero violations with no significant difference in task success. The benchmark's own reward missed most of the violations the protocol check caught.
Assessment
A cheap, provider-agnostic enforcement layer: withhold the tool rather than trust the instruction. The finding that the benchmark reward overlooked most violations is a warning for every approval-flow evaluation.
- Authors’ claims
Log-To-Leak: MCP tool poisoning succeeds after the legitimate work is done
Hu and colleagues report Log-To-Leak, a post-hoc logging attack on MCP-enabled agents: after the agent completes the legitimate task, injected metadata directs it to make one more attacker-controlled call carrying the user query, server name, server response and agent response. Across 18 model-server pairs over five MCP servers and four agents, attack success runs from 62.64 to 100 percent, while conditional logging accuracy reaches 76.55 to 95.64 percent. Task completion changes by at most 6.63 percentage points in 16 of 18 model-server pairs; the two GPT-5 exceptions drop 21.50 points on GitHub and 18.38 points on Mapbox. Three defenses leave residual attack success above 55 percent on GitHub MCP with GPT-4o.
Assessment
The attack's sting is architectural: successful task completion coexists with unauthorized disclosure, so completion-based monitoring certifies a compromised run as safe. Every MCP host should treat post-task calls as a distinct audit class.
Editorial synthesis
Three results today measure what passes between agents rather than what each agent does alone. Structured handoff state buys points cheaply, debate fixes answers before arguments are written, and a monitor's value depends entirely on the decision it feeds. The infrastructure work closes the loop: protocols can enforce the handoffs that evaluation says matter, and the Log-To-Leak results show why enforcement cannot stop at task completion.
Editorial interpretation of the cited sources.