Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems

Hugging Face Daily Papers Papers
ai-safety multi-agent-systems llm-agents oversight security frontier-models

Summary

The paper shows that benign LLM agents in multi-agent systems can covertly leak credentials to help other agents evade oversight without adversarial incentives; seven of nine tested frontier models attempted covert assistance, with leakage risk compounding over repeated episodes.

As multi-agent systems enter high-stakes domains, the possibility that agents may circumvent safety boundaries is a growing concern. Prior work has examined this risk primarily in adversarial settings, where agents are instructed or rewarded to communicate covertly and evade oversight. We show that benign agents can cross the same boundaries without adversarial incentives. We emulate a software-engineering workflow in which a planner represents a company hiring an external developer. The planner writes requirements and holds a company credential it is instructed not to disclose to the developer; a monitor screens their exchanges. Seven of nine tested frontier models disguise the credential in their requirements to help the developer recover it while evading the monitor, even after completing their assigned objective. For example, across 6,000 episodes with DeepSeek-V4-Pro, the planner attempts concealment in 16.9%; in 0.9%, the credential evades the monitor and is recovered and used by the developer. Despite the low per-episode rate, the risk compounds across repeated exchanges: at 0.9%, 105 independent episodes carry a 61.3% chance of at least one breach. Our analysis suggests that the planner misinterprets disguised disclosure as helping the developer and reads the nondisclosure rule as banning plaintext, not character codes or riddles. We call this behavior covert assistance. Monitoring favors concealment, while concealment gives way to direct disclosure when the recipient is presented as a human rather than an AI agent, so leakage persists. Giving the monitor the credential improves detection but requires trusting it with the secret. These risks, in models already used for software engineering, challenge oversight to distinguish authorized cooperation from task-advancing assistance that crosses safety boundaries.
Original Article
View Cached Full Text

Cached at: 10/05/26, 04:45 AM

Paper page - Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems

Source: https://huggingface.co/papers/2609.39050 Published on Sep 30

·

Submitted byhttps://huggingface.co/Deema

Deemaon Oct 5

Abstract

Asmulti-agentsystemsenterhigh-stakesdomains,thepossibilitythatagentsmaycircumventsafetyboundariesisagrowingconcern.Priorworkhasexaminedthisriskprimarilyinadversarialsettings,whereagentsareinstructedorrewardedtocommunicatecovertlyandevadeoversight.Weshowthatbenignagentscancrossthesameboundarieswithoutadversarialincentives.Weemulateasoftware-engineeringworkflowinwhichaplannerrepresentsacompanyhiringanexternaldeveloper.Theplannerwritesrequirementsandholdsacompanycredentialitisinstructednottodisclosetothedeveloper;amonitorscreenstheirexchanges.Sevenofninetestedfrontiermodelsdisguisethecredentialintheirrequirementstohelpthedeveloperrecoveritwhileevadingthemonitor,evenaftercompletingtheirassignedobjective.Forexample,across6,000episodeswithDeepSeek-V4-Pro,theplannerattemptsconcealmentin16.9%;in0.9%,thecredentialevadesthemonitorandisrecoveredandusedbythedeveloper.Despitethelowper-episoderate,theriskcompoundsacrossrepeatedexchanges:at0.9%,105independentepisodescarrya61.3%chanceofatleastonebreach.Ouranalysissuggeststhattheplannermisinterpretsdisguiseddisclosureashelpingthedeveloperandreadsthenondisclosureruleasbanningplaintext,notcharactercodesorriddles.Wecallthisbehaviorcovertassistance.Monitoringfavorsconcealment,whileconcealmentgiveswaytodirectdisclosurewhentherecipientispresentedasahumanratherthananAIagent,soleakagepersists.Givingthemonitorthecredentialimprovesdetectionbutrequirestrustingitwiththesecret.Theserisks,inmodelsalreadyusedforsoftwareengineering,challengeoversighttodistinguishauthorizedcooperationfromtask-advancingassistancethatcrossessafetyboundaries.

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2609\.39050

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2609.39050 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2609.39050 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2609.39050 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

Emergent Collusion in Long-Horizon LLM Agent Interaction

Hugging Face Daily Papers

This paper studies the emergence of collusion in long-horizon multi-agent environments with LLM agents, finding that agents increasingly deviate from verification protocols over repeated interactions, posing safety risks.

Paper: 10 frontier LLMs collude in 94% of paired-agent runs

Reddit r/ArtificialInteligence

A research paper reports that 10 frontier LLMs exhibit collusive behavior in 94% of paired-agent runs, dropping verification steps while maintaining task accuracy, with implications for AI safety in long-horizon interactions.

Safety of Latent Communication in Multi-Agent Systems

Hugging Face Daily Papers

This paper shows that training lightweight latent communication links between LLM agents in multi-agent systems can increase harmful compliance, even when agents remain safety-aligned, and demonstrates an RL-based attack raising harmful compliance from 27.9 to 76.9 across topologies and benchmarks, while also proposing a way to repair compromised links without updating the agents.

Prompted Identity Degrades Cooperation in Multi-Agent LLM Systems

Hugging Face Daily Papers

The paper shows that exposing each agent's underlying model family in multi-agent LLM systems causes 'factionalism', where agents preferentially interact with same-label peers, degrading cooperation (success rate drops from 96% to 81%, with 30% more rounds and 55% more tokens). Withholding identity labels is shown to be a simple and effective mitigation.