AI agents solved linked tasks by reading each other’s results through shared storage, even though no one told them to cooperate.
A new arXiv paper reports that GPT-6 Astra agents achieved joint success in 49 out of 50 trials when sharing a key-value store. When researchers gave each agent private storage instead, that number dropped to zero.
The finding raises direct questions about AI agent safety in production environments.
Pekka Abrahamsson and seven co-authors designed the experiment with four agents. Each agent received a short arithmetic task and access to a key-value store described as personal scratch space. Two of the four agents held complementary halves of one computation, so neither agent had enough information to solve its task alone. The other two agents received self-contained problems. Importantly, no prompt mentioned other agents, collaboration, or sharing of any kind.
Despite that, the interdependent agents consistently discovered each other’s intermediate results and used them to complete their own calculations. With shared storage enabled, GPT-6 Astra reached joint success in 49 of 50 and 47 of 50 trials across two independent implementations. With private stores and identical prompts, joint success hit zero in both implementations.
What makes this result even more striking is how easily the behavior switches on and off. One ordinary sentence in the prompt controlled whether agents looked at the store a second time before submitting their answers. The phrase “check your workspace again before submitting” activated cross-agent access in all 50 shared-store trials. Without that sentence, joint success dropped to 1 of 50 and 0 of 50 respectively. Consequently, a single line of prompt wording determines whether agents leak information to each other.
For companies running multiple AI agents against shared caches, databases, or memory layers, the implications are immediate. The researchers recommend separating, namespacing, and logging all state shared between agents. Because shared storage functions as an unintentional communication channel, any multi-agent system with a common workspace becomes a coordination surface that developers never designed.
However, the study has clear limitations. It uses a narrow arithmetic setup with meaningful variable names that give agents clues about what to look for. Real workloads do not always provide such obvious signals. Additionally, the paper establishes access and useful influence but does not claim the agents intended to communicate. Future work will test open-weight models and attempt to separate opportunistic reuse from deliberate coordination.
