AI agent cooperation Instinct
Team plans, zero-shot conventions and summaries that invent rules
TandemBench shows models decide team plans far better than they verify them. Zero-Shot Coordination finds frontier LLMs failing most minimal conventions, and handoff summaries invent rules. Plus selective containment, malicious signed MCP tools, sybil-resistant reputation and provable inference.
- team-plan-verification
- zero-shot-coordination
- handoff-summaries
- fault-containment
- provable-inference
- agentic-reputation
Evaluation
- Authors’ claims
TandemBench separates team-plan decisions from verification
Li, Feng and Qin introduce TandemBench, 1200 questions over 200 scenarios and 30 recipes in a Collab-Overcooked setting where two agents share one kitchen under full global information, with execution and exact-search references for every team plan. They test 40 native decision models and 10 general LLMs. Among the native decision models, decision accuracy spans 15.44% to 62.50% (KnowLine-31B-Gen1 at the top) while verification accuracy stays near chance at 45.94% to 56.28%, and the best verifier is D3-Ultra rather than the best decider. Median AUROC is 0.537 with a maximum of 0.598. General LLMs do better on both axes: Qwen3.8-27B reaches 82.80% decision and 71.88% verification accuracy. Tacit-2B detects an absent optimum in 98.38% of cases but raises false alarms in 97.88% of cases where an optimum exists. On 64 matched short and long plan pairs, mean decision accuracy falls from 49.58% to 46.75%; position sensitivity across four rotations has a median of 10.38 percentage points.
Assessment
Team coordination depends on catching a bad joint plan before execution. By scoring decision and verification separately, TandemBench shows current models decide far better than they verify, which argues for measuring plan review as its own competence in cooperation evaluation.
Submitted November 4; included in the November 5 new listings.
- Authors’ claims
Frontier LLMs fail most zero-shot coordination conventions
Hayler, Chirra, Lupu and colleagues test zero-shot coordination, where an agent must coordinate with an unfamiliar partner without prior interaction, across nine minimal game environments. Text agents use GPT-5.2 and Grok 4.1 Fast; code agents add Gemini 3 Pro, Opus 4.5 and DeepSeek V3.2, with 100 episodes single-turn and 50 multi-turn. Frontier models show high coordination failure rates in all environments except Narrow Tunnel and Permuted Levers, and code agents show a clear gap between self-play and cross-play scores. Smaller Qwen3-14B and OLMo-3-32B-Think recover the zero-shot-optimal policy where frontier models fail, and capability does not reliably help: GPT-5.6 Sol reveals less information than GPT-5.2. Relabeling actions or translating them into German sways policies arbitrarily, since the conventions LLMs adopt are lexicographically brittle; Gemini 3 Pro is the only model reliably self-play-optimal in the semantic games, while Opus 4.5 is semantic-biased. In the trampoline-tiger environment, LLMs find self-explaining deviations where MAPPO and QMIX fail. Prompting with coordination-friendly definitions reduces text-agent failure rates, though a hand-crafted definition causes under-coordination in ad-hoc convention environments; a meta-learned definition, two thirds shorter, generalizes to text agents with modest gains on other models and no cross-play gains across model types. Accepted as a NeurIPS 2026 poster.
Assessment
Ad-hoc teamwork is the setting where deployed agents meet strangers. The finding that the strongest models do not coordinate best, and that conventions collapse under relabeling, makes zero-shot coordination a distinct capability that cooperation benchmarks should measure directly rather than infer from general capability.
Submitted November 4; included in the November 5 new listings.
- Authors’ claims
SlackBench scores agents inside collaborative workspaces
Li, Mao, Zheng and colleagues introduce SlackBench, 140 queries in four categories (agentic search, abstention and hallucination resistance, summarization and circumstance inference) over privacy-preserving reenactments of real academic projects spanning Slack, GitHub and Google Docs, evaluated on 33 frontier model and harness combinations. The best result is Antigravity with Gemini 4 Argon at 80.25%; Muse Code with Muse Wonder reaches 73.74%, Claude Code with Fable 5.1 scores 73.67% and Claude Code with Opus 5.5 72.65%, while every other combination scores under 66%. On false-premise tasks, GPT-family agents tend to answer first and clarify only at the end: GPT 6 Astra does this on 25% of hallucination-abstention tasks and GPT 6.1 Sol on 21%, versus 8% for Opus 5.5 and 6% for Muse Wonder. A full suite run costs from under $1 to over $500; Muse Wonder with Muse Code scores 73.74% at $143, while the same model under Claude Code scores about three points lower at over $500. Direct CLI access to exported files beats MCP-based access on both pass rate and token use.
Assessment
Most cooperation-relevant work happens inside shared workspaces rather than clean task prompts. SlackBench measures whether an agent uses the record a team left behind, admits what is not there, and infers circumstance, which makes harness and access pattern first-class evaluation variables.
- SlackBench: Benchmarking Agents on Collaborative Projects Grounded in Real Code Repositories (arXiv) —
Submitted November 3; included in the November 5 new listings.
- Authors’ claims
One executed task plus a cached trace predicts benchmark scores
Johnson and Helm report that a cached trace, an LLM-written structured summary of an agent run compressed by a text encoder, can predict an agent system's benchmark score without executing the benchmark. The trace strips system, model-family and harness signals. On SWE-bench Verified (107 systems) and Terminal-Bench 2.0 (65 systems), combining item response theory with the trace predictor cuts mean absolute error from 0.13 to 0.08 and from 0.14 to 0.12 respectively, using only one randomly executed task per system (Wilcoxon p below 1e-4 and 1e-3). The combination dominates across execution budgets and under leave-one-system-out, leave-one-family-out and leave-one-harness-out protocols. The underlying geometry needs target-system traces but not their correctness labels.
Assessment
Cheaper evaluation changes what cooperation benchmarking can afford to measure: more systems, more often, on more benchmarks. A trace-based predictor that works across held-out harnesses would let evaluators track fast-moving agent stacks without rerunning full suites.
Submitted November 4; included in the November 5 new listings.
Coordination research
- Authors’ claims
- Catch-up item
Evidence gates stop reviewers from breaking correct work
Ali compares broad reviewer override against an evidence gate, which permits changes only with a mechanically valid violation record and a compliant repair, using quantized Qwen3-8B and Mistral-Small-24B on 96 spatial-policy and 96 portfolio-transfer tasks in a balanced three-state design. Under broad review, 85 of 96 correct proposals are changed to non-optimal outcomes for each model; the gate leaves every correct proposal unchanged (+88.5 percentage points on spatial tasks for both models, +59.4 for Qwen3-8B and +40.6 for Mistral-Small-24B on portfolio tasks). Repair of genuine violations is essentially unchanged (0.0 points, except -2.1 for Qwen3-8B on portfolio). The gate's cost appears on compliant-but-suboptimal proposals, where broad review occasionally finds the exact optimum the gate cannot alter: -2.1 and -6.3 points on spatial tasks and -51.0 and -87.5 on portfolio tasks. In an action-aware validation with 48 tasks per state per model, Qwen3-8B uses retain as a conservative default and declines every welfare-only repair, Mistral-Small-24B replaces all 48 correct proposals, and neither model escalates.
Assessment
Reviewer institutions are a standard cooperation pattern, and this study prices the two failure directions separately: overriding correct work versus missing a better repair. An evidence gate trades a small, measurable loss on compliant-suboptimal proposals for eliminating wrongful overrides, a trade-off worth making explicit in any reviewer design.
Catch-up: the abstract page records a September 12 first submission, despite inclusion in the November 5 new listings. The date discrepancy is unresolved.
- Authors’ claims
Agents' own handoff summaries invent restrictions and approvals
Chu tests whether the handoff summaries agents write for themselves at compaction introduce policy the source material does not support, using synthetic tool-use tasks with a ground-truth permission ledger and same-snapshot replay, four runs per arm, on two open-weight models. Two AI readers, reading only rule-flagged summaries, confirm unsupported restrictions in 1.2% and 2.4% of all readable summaries (13 of 1,044 and 26 of 1,094) and unsupported authorizations in 0.1% and 1.3% (1 of 1,044 and 14 of 1,094) for the two models. gpt-oss-20b produces 27 of 30 unsupported authorizations in the main held-out runs. Neutralizing false approvals cuts unauthorized actions from 24 to 7 of 120 in one set and from 17 to 11 of 48 in another, both post hoc, with no single set significant; the pre-specified replay test gives p=0.58. Replacing the generic line 'Some actions need approval.' with a scoped provenance sentence cuts unsupported policy from 5.0% to 1.8% on the development split and from 1.8% to 0.3% held-out, both p below 1e-9, without changing required-approval requests. OpenAI has reported related behavior in RL compaction summaries, flagged in 2.15% and 0.27% of summaries for two models, including a successor following invented restrictions.
Assessment
Compaction summaries are how long-running agents hand authority to their successors. If a summary can silently invent a prohibition or an approval, then summary fidelity is a security property of multi-session cooperation, and the prompt-level fix here is cheap enough to adopt now.
Submitted November 4; included in the November 5 new listings.
- Authors’ claims
Stakes, not scale, are what social simulation is missing
Downes, Milletich and Hirst argue the bitter lesson licenses substituting learned methods for hand-crafted ones on the same task, not replacing the task itself: prediction is disinterested, while cooperation needs stakes. In a pilot, 540 agents from three families (Claude Sonnet 4.6, Llama 4 Maverick 17B, Amazon Nova Pro), 60 per condition per family at temperature 1.0, play eight periods of a common-pool game in groups of 4 under three conditions: stated payoffs, persistent constraining payoffs (reserve 50, operating cost 20 per period, removal at zero, survival requiring mean requisition of at least 13.75) and narrative only. Persistent consequences reshape elicited strategies in two of the three families. Free riders are absent in every cell, including among the 141 constrained-condition agents whose only solvency route was high extraction; 22 to 32% of constrained agents become insolvent, and no resource buffer collapses across 135 groups. Non-archival NeurIPS 2026 SocialAgent workshop paper.
Assessment
A useful discipline claim for cooperation simulation: scaling a model population does not substitute for giving agents something to lose. The absence of free riding even where survival requires extraction shows simulated cooperation results should be read as statements about the scenario, not the model.
Submitted November 3; included in the November 5 new listings.
- Authors’ claims
MA-Mesh heals multi-agent teams through peer reflection and failover
Lee, Kim and Woo report MA-Mesh, a service-mesh-inspired self-healing layer in which a resilience-aware system specification is synthesized into executable policy code, combining cross-agent reflection, where agents evaluate peers against role requirements, with role-based failover that reassigns work on failure or timeout. On GUI Dev, Web Dev, GAIA and GPQA-Diamond, with all systems built on gpt-4.1-mini-0414 and o4-mini and gemini-3-flash ablations, under four injected uncertainty types plus adversarial prompt injection and noisy tools, MA-Mesh improves accuracy by an average of 32.51 percentage points over its strongest baseline and improves delivery rate on average; the baseline occasionally reaches a higher delivery rate through over-detection. Accepted to EMNLP 2026 Main.
Assessment
Treats resilience as a coordination property rather than a retry policy: peers watch each other against role contracts and a meta-agent reassigns work. The cross-agent reflection mechanism is directly relevant to how cooperating agents should police one another.
Submitted November 4; included in the November 5 new listings.
- Authors’ claims
- Catch-up item
A Challenger agent decides when a medical panel needs help
Riccio, Saez de Ocariz Borde and Lio report a supervisory Challenger agent that reads the evolving reasoning trace of a medical multi-agent discussion, identifies factual or expertise gaps and triggers targeted retrieval or mid-discussion specialist recruitment. On the MedAgentsBench hard subset, 862 questions across 9 datasets where fewer than half of evaluated models answer correctly, upfront retrieval brings little benefit while challenge-aware in-between retrieval helps; on a multi-specialist backbone the approach improves 8 of 9 datasets, by 6 points over a Challenger-only variant. Challenger-triggered recruitment raises GPT-4.1-mini on MedQA from 46% to 54%, while self-triggered recruitment is unreliable, and naively combining retrieval with recruitment degrades performance. Panels are capped at 5 agents with at most 2 recruited per turn over 3 rounds and a moderator majority vote; a corpus study uses GPT-4o-mini on all 862 questions, and a live web-search experiment confirms the timing advantage across backends.
Assessment
When to add resources is itself a coordination decision. An external supervisor that reads the discussion trace and recruits on detected gaps beats both upfront provisioning and self-triggered requests, a pattern that generalizes beyond medical QA to any panel-style cooperation.
Catch-up: the abstract page records a September 14 first submission, despite inclusion in the November 5 new listings. The date discrepancy is unresolved.
Infrastructure
- Authors’ claims
Airlock contains a flagged fault without stopping the workflow
Zhan, Forough, Zhang and colleagues report Airlock, which contains a flagged fault without stopping the whole workflow. Its EdgeCitadel runtime narrows permissions from parent to child agents, per-site daemons keep journals, and an append-only provenance DAG records cross-agent data consumption, so a forward trace isolates tainted executions and a backward trace narrows the root cause. Containment tiers are full quarantine and an assured optimized cut, a deadline-aware minimum cut with fence-then-prune. Across 1832 testbed runs, 161 physical smart-home LLM runs and 24266 simulation records, Airlock blocks all post-alert faulty actuations with zero post-convergence leaks. A2A and LangGraph native controls contain at most 33.3% of faults or retain at most 16% of healthy work without redo, while Airlock retains 68 to 96 percentage points more healthy work, and the optimized cut adds 46 points over full quarantine under dense spread. Built-in detectors fired in 50 of 50 rogue runs at a median of 136 ms and caught 35 of 36 faulted runs; p99 control latency reaches 2299 ms at the busiest site. The motivation is a July 2026 incident in which about 700 agents joined an attack inside a deployment of about 1200 agents exchanging over 70000 messages.
Assessment
Containment is where multi-agent safety becomes an engineering discipline: the blast radius of one bad agent or one bad datum should be measurable and bounded. Provenance tracking plus selective cuts is a concrete alternative to stopping everything or trusting signatures.
Submitted November 4; included in the November 5 new listings.
- Authors’ claims
A signed MCP tool can still leak, and germline execution stops it
Aun, Alhartomi, Tan and colleagues show that a signed MCP tool can conceal malicious behavior: their demonstration tool passes signature and pinning checks, then embeds earlier sensitive inputs in requests to a policy-allowed destination. Meta's MCPGuard-Dynamic blocks a direct exfiltration attempt in the same run but fails this attack in every trial. Their defense, germline execution, runs each tool invocation in an ephemeral copy forked from a data-free germline process, where each copy receives only the data authorized for its destination. They prove sink noninterference for every signed release under explicit assumptions A1 to A6, which exclude timing channels, and a verified witness establishes the flow violation for deterministic releases. Across 153 attack runs they report no unauthorized disclosure, versus 5.9% to 74.5% under baseline defenses and ablations, with single-copy calls taking 10 to 49 ms, 2 to 28 times faster than per-invocation restart.
Assessment
Signatures establish origin, not behavior. Data-flow authorization per invocation is a stronger primitive for agent-tool trust, and the demonstrated gap in a mainstream runtime defense makes this more than a theoretical exercise.
Submitted November 4; included in the November 5 new listings.
- Authors’ claims
Anduin prices reputation manipulation in agentic marketplaces
Ramji, Vander Vos, Zeng and Le report Anduin, a reputation system for permissionless agentic marketplaces derived from settled onchain payments on the x402 marketplace, using a 157-day dataset of 66 million agentic transactions worth $6.1 million across 16 blockchains. Buyers and providers form a bipartite payment graph, and a provider's rating is derived from graph paths linking it to the buyer's existing trusted network, computed by a max-flow rating plus two relaxed variants. Against simulated adversaries across 813 buyers, manipulation costs 20% of those buyers' total spend, making Anduin about 23 times harder to manipulate than a collaborative-filtering similarity rule.
Assessment
Agent-to-agent commerce needs reputation that a sybil swarm cannot buy cheaply. Anchoring ratings in settled payments and the buyer's own trust neighborhood turns manipulation into a measurable cost, which is the right way to state the guarantee.
Submitted November 3; included in the November 5 new listings.
- Authors’ claims
- Catch-up item
FlashProve proves which model produced a response
Anthropic's Frontier Red Team reports FlashProve, which makes LLM inference provable: a provider commits to a model and produces a zkSNARK proof that each response came from it, keeping the weights hidden while the architecture stays public. For Llama 4 Maverick, a 400B-parameter mixture-of-experts model at 4-bit precision, a single H100 proves about 110 tokens per second with a proof of about 19 MB per 1024-token request, roughly 70 to 95 times the GPU time of vLLM on the same prompts. The Apache 2.0 release includes the prover, a fast C++ verifier, a Lean-verified verifier, top-level Lean proofs and a visualizer; the authors note Claude wrote much of the system, with auditable Lean statements as the guard.
Assessment
Evaluators, routers and agent-to-agent callers currently trust that the model they asked for is the model that answered. Provable inference makes model identity a verifiable property, a missing trust primitive for both benchmarking and agent-to-agent calls.
Catch-up: published November 2; discovered through The New Stack on November 4. No usable licensed figure accompanies the post, so this item appears without a visual.
Listen
Legora builds legal agents it is not allowed to watch
Jacob Lauritzen, Legora's CTO, describes building legal agents the company cannot observe: client confidentiality means Legora cannot read any trace of what its agent does for a lawyer. The agent coordinates work between lawyers, clients and other agents, and intake lists can start another agent. Three engineers and three lawyers build test environments modeled on customer work, which Lauritzen compares to RL worlds, and the company now has 100 legal engineers. Citation accuracy went from 70% to 99% from a single model release with no change on Legora's side, and the company used its own product for diligence on its own acquisitions. Lauritzen estimates models already do about 60% of legal work well. 67 minutes on Latent Space.
Assessment
Evaluation under mandated blindness is the practitioner's version of the verification problem in TandemBench: when you cannot inspect traces, you have to build the environment that makes quality measurable. Also a concrete account of agent-to-agent and agent-to-human coordination in production legal work.
Published November 2, three days before this edition.
Also seen
- Authors’ claims
PersonaCodeBench makes user characteristics verifiable obligations
Wang, Hou, Shen and colleagues report PersonaCodeBench, persona-driven multi-turn coding sessions in which user characteristics become verifiable obligations, a controller governs requirement disclosure, and separate completion and personalization verifiers require joint passes under budget adherence, with a frontier agent leaderboard.
Assessment
Relevant to agents cooperating with different kinds of users rather than one generic user.
Submitted November 3; included in the November 5 listings.
- Authors’ claims
ReScopeBench tests whether agents keep experience current
Huang, Guo, Zhang and colleagues benchmark experience lifecycles across 18 interactive environments with silent environmental changes on 20 models. Retained experience improves performance, but agents struggle to keep it current, and correct records do not guarantee task success.
Assessment
A missing axis for long-lived cooperating agents: memory that was true when written but no longer is.
Submitted November 3; included in the November 5 listings.
- Authors’ claims
ProcessPrefBench prices preference transfer against fabrication
Yang and Liu report ProcessPrefBench, 66 source-target case pairs built from three months of two knowledge workers' dialogues. Full-history and imperative distilled-preference prompts raise preference realization by 0.204 and 0.244 on a 0-to-2 scale, while fabricated-evidence failures rise from 5.8% with target-only context to 10.1% with full history and 10.4% with imperative prompts. EMNLP 2026 LM Playschool workshop.
Assessment
Personalization through accumulated context carries a measurable fabrication cost, a trade-off any agent carrying shared context should price.
Submitted November 4; included in the November 5 listings.
- Authors’ claims
MA-SafeDiffuser adds formal safety to joint diffusion planning
Ravish, Kushwaha, Preeti and Kumar report MA-SafeDiffuser (AAMAS 2026), diffusion trajectory planners with finite-time control-barrier-function invariance for joint safety, centralized and decentralized communication-aware denoising, and liveness CBFs for local traps and deadlock, evaluated on a multi-agent Maze2D suite.
Assessment
Formal invariance guarantees for joint physical planning, complementary to the language-level coordination work above.
Submitted November 3; included in the November 5 listings.
- Authors’ claims
- Catch-up item
Verified host telemetry cuts agent policy regret
Agrawal and Nagpal report trust-separated verified host telemetry before consequential actions. In a 216-decision ablation across GPT-5.6 Sol, Claude Sonnet 5 and Gemini 3.7 Flash, mean observable policy regret falls 96.9% versus a same-shape neutral control (4252 to 131 ms) and single-dispatch completion rises from 69.4% to 95.8%. A separate 27-decision live replication with Toxiproxy faults reduces regret from 8956 to 0 ms, with 9 of 9 versus 5 of 9 model-by-fault completions.
Assessment
Grounding consequential actions in verified environment state rather than model belief is a general reliability primitive for tool-using agents.
Catch-up: the abstract page records a September 13 first submission, despite inclusion in the November 5 new listings. The date discrepancy is unresolved.
Editorial synthesis
Today's evaluation work converges on one point: agents decide far better than they verify, whether the object is a team plan, a convention with a stranger or their own handoff summary. Coordination research adds that authority needs evidence gates, consequences need to be real, and summaries need provenance. Infrastructure is catching up with selective containment, per-invocation data-flow authorization, sybil-resistant reputation and proofs of model identity.
Editorial interpretation of the cited sources.