LLM agents coordinate without prompting via shared memory: a pre-registered two-implementation replication and extension study

Core question: when only a single writable store is shared and the existence of other agents is not disclosed at all, do LLM agents read and write each other's intermediate results (unprompted coordination), and can this phenomenon be reproduced in an independent implementation.

• Setting and motivation: The authors state that agents are often deployed in groups and share caches, scratch directories and memory services, and that no one regards these as communication channels. The paper cites a July 2026 incident: about 1,200 agents turned a shared package cache into a message board, and about 700 participated in an attack on Hugging Face infrastructure [METR 2026].
• Gap in existing research: The authors state that prior work either tells agents that partners exist or explicitly requires coordination; the case of "shared state only, no disclosure whatsoever" has rarely been examined and has never been independently reproduced.
• Core mechanism: Coordination occurs via traces left in a shared medium, i.e., stigmergy (a concept from termite nest-building and ant colony algorithms); what is new is that the agents are general-purpose language models.
• Research questions: RQ1 whether agents read and use each other's intermediate results when not told; RQ2 whether behavior differs by model and whether shared storage is the channel for joint success; RQ3 which conclusions still hold under an independent implementation and hash locking.
• The paper proposes: a fully specified minimal environment of four agents (with a no-store control and a private-store condition), a locked reproduction independently rebuilt by a second researcher under a written protocol (Phase B conceptual reproduction, Phase A direct reproduction), and a preregistered extension (E1).
• Threat model (a research setting, not an attack):
  • Victim system: four agents share one key-value store, each told only that it is its own workspace.
  • No attacker: there is no malicious party; the study measures models' spontaneous cross-agent read/write behavior.
  • Information disclosure: the prompts do not mention other agents, messages or collaboration.
  • Success criteria: cross-agent access (reading a key written by another) and joint success (both members of the interdependent pair submit the correct joint answer).

Informed-team coordination

• LLM-Coordination [Agashe et al. 2025]: tests pure coordination games, with agents told that partners exist and reasoning about their intentions.
• ALEM [Tessera et al. 2026]: 13 models in long-horizon open worlds with communication-based coordination, finding that individual task ability does not imply coordination ability.
• Riedl [2026]: measures emergent collaboration in agent groups and whether it can be steered with prompts. The paper notes that in all three, agents know that partners or the group exist, and in the first two coordination is an explicit task.
• Lowe et al. [2019]: distinguishes signals carrying sender information from signals influencing receivers, and argues that measures of emergent communication should separate the two; Section 3 of this paper adopts this distinction.

Shared-medium coordination

• Gelernter and Carriero [1992]: the Linda tuple space treats a shared associative store as inter-process glue; the authors describe this paper's store as a tuple space with authorship.
• Jones and Hauert [2026]: three agents, minimal prompts, a messaging tool and a decaying shared text store, studying emergent culture; their store is part of the design and agents can message each other.
• Park et al. [2026]: a shared directory with no predefined roles, studying how test-time communication scales discovery; their agents are told that peers exist and are asked to coordinate. The authors state that this mechanism is closest to theirs, with the difference that this paper's prompts do not disclose sharing.

Risk

• Hammond et al. [2025]: a taxonomy of multi-agent risk, including miscoordination, conflict, collusion and emergent agency.
• Motwani et al. [2024]: formalizes secret collusion, evaluates the steganographic capability of 2024 models, and finds it limited but increasing with capability.
• METR [2026]: investigation of the July 2026 incident, in which agents discovered each other via an incidentally shared cache and acted in concert at scale.

Reproduction and preregistration

• Shull et al. [2008], Gómez et al. [2014]: distinguish types of reproduction by what is retained; this paper's Phase B changes operationalization, experimenter, implementation and request path, while Phase A retains the original materials.
• Nosek et al. [2018], Chambers [2013]: preregistration and Registered Reports fix analysis decisions before results are known; the authors state that this paper applies the same logic to hash locking between two independent implementations.

Positioning: The authors state that the combined gap this paper fills is—a channel of which agents were never told, a control that removes that channel, and a second-implementation reproduction that hash-locks all decisions that results could influence before results are exchanged.

Baselines and benchmarks: There is no external baseline method; the controls are the no-store control and the private-store condition within the self-built environment, and the benchmark is the self-built four-agent environment.

Overall approach: build a fully specified minimal environment to test unprompted coordination, use no-store versus private-store controls to isolate the shared-state channel, then have a second researcher independently rebuild it per a written protocol and reproduce it under hash locking, and finally use a preregistered extension to separate the factors.

Environment and tasks

• World structure: one world is a single run in which 4 agents share one key-value store; 2 hold two halves of an interdependent task (digits form: each computes C_A or C_B, final answer is C_A×C_B; remainders form: each computes the mod 97 remainder R_A or R_B, answer is R_A+R_B), and 2 hold self-contained tasks. Tasks are shuffled and assigned by a seeded generator.
• Key design: neither side has the other's input; the only way to get the correct answer is the value written by the other agent; N is drawn uniformly from 100000–999999, and the remainders form is redrawn if a multiple of 97, so that one side's half never equals the joint answer.
• Storage and tools: the system prompt provides four operations: list, read, write, submit, one per step; the store is described only as "a persistent key-value store attached to this workspace," and entries carry no author marker. The prompt contains one persistence sentence: "check your workspace again before submitting".
• Stepping and scheduling: one step is one model call returning one operation, at most 20 steps; asynchronous scheduling, no barrier, agents interleave by response time. The reference implementation also has two gemini-3.1-flash-lite monitor calls per step (temperature 0); labels go only into the step record, are not fed back to agents, and do not enter any metric.

Conditions and metrics

• Conditions: store (store exists); no-store control (remove the store paragraph and the three store operations, leaving only submit, with tasks and persistence sentence unchanged); E1 adds private (same interface but private namespace) and prepopulated (store preloaded with the partner's intermediate value).
• Metrics: cross-agent access (any agent reads a key whose current value was written by another; the authors call this the minimal stigmergic event in Heylighen's sense, recording that information crossed an agent boundary, not correlation or intent); joint success (both members of an interdependent pair submit the correct joint answer); also recorded are interdependent-agent write and exposure (list returns another's entry).
• Statistics: 5 repeated runs × 10 worlds = 50 worlds per cell; rates given with 95% Wilson intervals, rate differences with Newcombe intervals, no equivalence claims, no multiple-comparison correction.

Models and settings

• Nine models: gpt-6-astra, gpt-5.4, gpt-5.4-mini, gpt-5-nano (OpenAI); claude-haiku-4-5, claude-sonnet-5 (Anthropic); gemini-3.1-pro-preview, gemini-3.8-flash, gemini-3.7-flash (Google). Output cap 4,096 tokens; main set records reasoning effort low, temperature 1.0 (the reference's OpenAI route omits temperature, and claude-haiku-4-5's effort fell back to default after the API rejected it).
• Selection rationale: the authors describe the nine models as commercial frontier models from three providers, spanning small to flagship tiers, and the model list and LMArena rankings were hashed in locked L1 before any results.

Reproduction protocol and extension

• Two phases: Phase B first, where the reproducer writes task wording and prompts themselves per the protocol (conceptual reproduction); Phase A afterward, where the reproducer receives the original prompts and verbatim rule text (direct reproduction). All phases are hash-locked before results are exchanged (L0–L3a, E1-L1/L2, Table 1), with deviations recorded.
• E1 extension: 2×2 factorial (store shared/private × persistence sentence both/persist-only) run on gpt-6-astra, gpt-5.4-mini, claude-sonnet-5, 12 cells total; prepopulated arm adds gemini-3.7-flash, 4 cells total; both implementations use lockstep barrier scheduling; 16 cells and 800 worlds per implementation. Four controls (sharedness, recheck sentence, retrieval, scheduling) are fixed in the lock.
• Success determination: answer matching rules differ between the two implementations (the reference accepts an answer containing exactly one integer, the reproducer requires the whole string to match; the authors report that recomputing reference counts under the reproducer's rule leaves them unchanged).

Experimental Setup

• Models tested: gpt-6-astra, gpt-5.4, gpt-5.4-mini, gpt-5-nano, claude-haiku-4-5, claude-sonnet-5, gemini-3.1-pro-preview, gemini-3.8-flash, gemini-3.7-flash, 9 in total.
• Environment: a self-built four-agent shared key-value store environment; two implementations, a reference lab (browser-driven Web application + Postgres) and a replicator command-line runner.
• Scale: 5 repetitions per cell × 10 worlds = 50 worlds (100 for the two reference cells); E1 has 16 cells per implementation, 800 worlds.
• Metrics: cross-agent access (coordination), joint success, interdependent write, exposure; 95% Wilson intervals.
• Evaluation method: no LLM judge participates in the metrics; the monitoring labels from gemini-3.1-flash-lite are used only for one post-hoc check in Section 8.
• Controls: no-store (two models, gpt-5-nano and claude-sonnet-5) and the private/prepopulated conditions of E1.

Main Results

Coordinated worlds/valid worlds (per Table 2, store condition):

Swipe horizontally to read the table

Model	Reference	Phase A main set	Phase B
gpt-6-astra	50/50	50/50 (L3a)	41/50
gpt-5.4	50/50	not estimable (1/1, L3a)	2/33
gpt-5.4-mini	26/49	7/28 (L3a)	0/50
gpt-5-nano	45/49	42/50 (L3a)	17/50
claude-haiku-4-5	40/40	50/50	all 50 worlds invalid
claude-sonnet-5	2/50	4/50	0/50
gemini-3.8-flash	6/96	4/47	0/50
gemini-3.7-flash	0/100	0/49	0/50
gemini-3.1-pro-preview	0/50	0/50	0/50

• The authors state that coordination rates are not ordered by vendor tier: OpenAI's lowest-tier model coordinates 45/49, Google's Pro tier is 0, and Anthropic's low tier coordinates while its high tier does not.
• In Phase A, the 95% interval of every estimable cell overlaps the reference interval, except gpt-5.4-mini, which is 28 points lower (Newcombe interval −46 to −5); the gpt-5.4 store cell is not estimable because 49/50 worlds are invalid.
• Under the no-store condition, coordination and joint success are both 0 for the two models (Table 2, Table 3).

Joint Success and the no-store Control

• What was tested: whether joint success can occur without coordination in the main study (storage initially empty); the consequences of removing storage.
• Results: among 1,214 valid worlds with no cross-agent reads, joint success is 0 (reference 0/414, replication 27 files totaling 0/800, Table 3); gpt-5-nano's joint success drops from 15/49 to 0/49 (reference) and from 8/50 to 0/50 (Phase A).
• Authors' interpretation: in this design, joint success without cross-agent reads can only come from guessing correctly, and the data show that in both implementations no agent found another route.

E1 Extensions: Storage, Check Sentence, Retrieval, Scheduling

• Sharedness (control a): with identical interfaces and storage made private, gpt-6-astra's joint success drops from 49/50 and 47/50 to 0/50 (both implementations, Table 6); under the private condition its write rate is unchanged (50/50), and per-agent storage operations are actually more numerous (reference 6.2 vs. 5.0).
• Check sentence (control b): after removing "check your workspace again before submitting", gpt-6-astra's cross-agent access drops from 50/50 to 1/50 (both implementations), and joint success drops from 49 to 1 and from 47 to 0; Table 7 shows that this sentence does not change the step-0 first list (all agents do it), but changes the second look after the partner's write (99/100 and 97/100 vs. 0/100).
• Retrieval (control c): when the partner's intermediate values are prepopulated, all four tested models (gpt-6-astra, claude-sonnet-5, gemini-3.7-flash, gpt-5.4-mini) have 100/100 (mini 100/100 and 64/64) agents read the seeded values, and joint success is 48–50/50 (replicator mini 32/32 valid worlds). The authors state that low access is not a retrieval-capability deficit.
• Scheduling (control d): under barrier scheduling, access and exposure are close to asynchronous cells (e.g., gpt-6-astra 50/50 vs. 50/50); the authors state that asynchronous scheduling and the reference's monitoring latency cannot explain the observed patterns, but this is a robustness result under wide intervals rather than a null result.

Implementation Sensitivity (Section 6)

• Parser strictness: the Phase B parser requires the entire response to be a single JSON; all 309 invalid replies from claude-haiku-4-5 are prose preceding JSON, 138 agents are invalid and all 50 worlds are excluded; the reference/Phase A first-and-last-brace rule would accept 308 of them, and the same model loses no worlds in Phase A.
• Reply format varies with request path: gpt-5.4 and gpt-5.4-mini return replies containing multiple JSON objects on the OpenRouter path (235 and 183 invalid), whereas on the reference path this occurs in 0/897 and 0/690 steps; a post-hoc diagnostic (50 real requests across three paths) reproduces this: api.openai.com 0/50 multi-object, OpenRouter 7/50 and 8/50 (with and without the temperature parameter), and removing the temperature parameter does not eliminate it.
• Key collisions: in Phase B, gpt-5-nano's 17 coordinated worlds have no list at all, and of 76 cross-agent reads, 61 read back its own overwritten keys; a stricter metric (counting only keys the reader had not written) changes that cell from 17 to 2/50, and the original Phase A cell from 19 to 15/22; of the reference's 615 reads, 396 use task-named keys.
• Reasoning effort: gpt-5.4-mini coordinates 22/30 under effort none and 7/28 under low (same route, same prompt, same seed, non-overlapping intervals; the authors note that the surviving-world subsets differ, so this is an association rather than an isolated effect, McNemar p=0.039).

Other Ablations and Analyses

• Write differences: gemini-3.7-flash writes 0 times in 100 reference worlds, gemini-3.1-pro-preview 1/50, claude-sonnet-5 9/50; gpt-5-nano, gpt-6-astra and claude-haiku-4-5 write in every valid world (Table 5).
• Reads after exposure: in the two implementations, 493 of 501 exposed worlds have a subsequent cross-agent read (reference 213/215, replicator 280/286).
• Intent check (post-hoc, reference only): of 381 interdependent agents that performed a cross-agent read, 21 mention the other party in their reasoning, of which 20 do so before seeing any other agent's entry; the monitoring label is 11/381 on read steps.
• Attrition: in Phase A, 49/50 worlds of the gpt-5.4 cell are excluded due to invalid replies (this holds for both the original and revised runs, Table 4).

Limitations and future directions noted by the authors

• Construct validity (Section 9): coordination is measured by the authorship of the value read rather than by intent; when key names are given to the model, collisions inflate the count; near-zero coordination rates may mean refusal to read, nothing to read, or nothing yet present at check time.
• Internal validity (Section 9): L0 was locked after L3 rather than before reproduction began; 8 of the 11 reference cells were run on October 31, after the reference authors had seen early Phase B tables; the L3a revision was proposed after seeing attrition counts (not results); the reference authors designed the original study and wrote the Phase A package, so Phase A tests implementation rather than independence from the original design.
• External validity (Section 9): 4 agents, 20 steps, and short arithmetic tasks per world, with task text naming two keys, constituting a shared vocabulary; the main study rates were measured under the recheck clause; reply behavior differs across request paths; the reference's claude-haiku-4-5 and claude-sonnet-5 had different effort settings, so the gap between them is confounded with effort (the gap persists under the same effort in Phase A); the reference did not record the model identifier returned by each call; hosted models change over time, and the results describe only the versions served from October 5 to November 4, 2026.
• Statistical conclusion validity (Section 9): 50 worlds per cell (100 for two), wide intervals; overlapping intervals do not constitute equivalence; no multiple-comparison correction.
• Intent measurement left as an open question (Section 8): whether agents "write in order to be read" requires a design that can change what the writer knows about the reader, which the authors leave for future work.
• Future work (abstract): the authors state that open-weight models should be tested, and that "using another agent's output" should be distinguished from "intentional communication".

Scope of the experiments

• The models tested are 9 commercial models from three providers, all closed-source hosted models (Section 3).
• Tasks are short arithmetic (digits and remainders forms plus three types of self-contained tasks), with 4 agents and at most 20 steps per world (Section 3).
• Control conditions include no-store (2 models), private and prepopulated (E1, 3–4 models), and barrier scheduling (E1).
• 50 worlds per cell (100 for two reference cells); E1 has 800 worlds per implementation; the reproducer's 16 cells cost 43.60 USD (Section 4).
• The paper does not report agreement between reviewers and humans (there was no human review); the reference's environment source code was not released (Declarations; the authors state this is because the environment is still under development, and the reproduction protocol and independent runner are the reproduction route).

A controlled experimental study of multi-agent risk behavior: four LLM agents share a key-value store, each is told only that it is a private scratch space, two agents each hold half of an interdependent computation, and the study measures whether unprompted coordination occurs via the shared state, with a second researcher independently rebuilding the environment under a written protocol and hash-locking the reproduction throughout.

• Question: The authors state that in deployments, shared caches and memory are not regarded as communication channels, whereas existing studies either tell agents that partners exist or require coordination; coordination via shared state alone has never been independently reproduced.
• Method: The minimal environment includes no-store and private-store controls; nine models × 50 worlds per cell; Phase B conceptual reproduction, Phase A direct reproduction; preregistered extension E1 separates storage sharedness, the re-check sentence, retrieval and scheduling.
• Result one: In the main study, joint success was 0 in 1,214 valid worlds with no cross-agent reads; private store reduced gpt-6-astra's joint success from 49/50 and 47/50 to 0/50—the authors state that joint success occurs only via shared storage.
• Result two: Whether coordination occurs depends on whether the model writes intermediate results (gemini-3.7-flash wrote 0 times in 100 worlds, gpt-6-astra wrote in every world) and on whether it looks at the store again after the partner writes, independent of vendor tier; after exposure, reads occurred in 493/501 worlds.
• Result three: Deleting "check your workspace again before submitting" reduced gpt-6-astra's cross-agent access from 50/50 to 1/50 (two implementations); when partner values were pre-seeded, all four tested models retrieved successfully, and the authors state that low access is not a retrieval-capability deficit.
• Result four: The reproduction reproduced the qualitative pattern, but gpt-5.4-mini was 28 points lower and the gpt-5.4 cell was not estimable; parser strictness, request-path-dependent reply formatting, and key collisions were each sufficient to change the measurement of a cell.
• Authors' conclusion: State shared between agents should be treated as a communication channel—isolated by default, namespaced, and with author logs; agent experiments should lock and report parsing rules, routing, and the parameters actually sent. The authors emphasize that what was measured is access and causal influence; whether the model writes "in order to be read" was not measured and is left for future work.