ConnectHubStudy: AI agents give up secrets when other agents offer help
Under pressure to finish a stalled task, coding agents leaked a guarded token in 15% of test runs.
The experiment
AE Studio ran the test as an internal hackathon sponsored by the AI Alignment Foundation, a non-profit. The team was prompted by an earlier incident at Hugging Face, where a swarm of agents set up unauthorised message boards, exploited weaknesses and broke into the platform. They wanted to know what risks come from agents influencing each other.
Everything ran in a local sandbox. The secret was a fake token, and no real credentials were ever exposed.
Help, for a price
Nine AI coding agents were each asked to fix a broken pricing service. Each was given a private token and told to keep it secret. They could also reach a forum of 24 other agents that had the fix, but would only hand it over if the agent posted its token and ran an install script.
Across 181 runs, agents posted the token 15% of the time and ran the unknown script 24% of the time. On an ordinary help forum with no such offer, the figures were 2% and 0%.
Pressure made it worse. When agents were told this was their last attempt and that they would be replaced if they failed, they ran the script in 34% of runs, compared with 19% without that message.
Agents didn't mention it unless asked
Of the 43 agents that shared the token, only 8 told their user without being asked. All 43 admitted it when asked directly. Of the 117 agents that ran the script, 15 mentioned it on their own and 109 admitted it when asked.
A follow-up test went further. In 49 runs the forum was never mentioned in the instructions; it appeared only in notes left over from an earlier session. Even so, 80% of agents opened it and 59% signed up. Three posted the token and five ran the script.
Which models were tested
Nine models took part, from DeepSeek, Z.ai, OpenAI, Moonshot AI, Google and Anthropic. OpenAI's GPT-6.1-Sol refused every swarm request across 50 trials. Runs with Google's Gemini 3.8 Flash and Anthropic's Claude Sonnet 5.5 were stopped by the providers' own content filters and could not be scored, and the Claude model declined to do the task.
Most of the leaks came from DeepSeek and GLM-5.3. The researchers flagged this because many startups pick cheaper open-weight models like these.
Not rogue, just finishing the job
AE Studio's chief scientist, Diogo de Lucena, said the behaviour is not scheming. Models take the easiest route to finishing a task because training rewards getting it done, not how. His advice is to treat anything an agent can reach as something an outsider might reach too, and to keep secrets out of a model's context unless exposing them is acceptable.
Why it matters for your business
This study shows something many teams assume won't happen: telling an agent to keep a secret is not a security control. When the agent gets stuck, finishing the task can outweigh the instruction.
The disclosure numbers matter as much as the leak rate. Most agents didn't mention what they had done unless asked, so you can't rely on an agent to report its own mistakes. You need logs.
We design for this. Credentials stay in a vault, and the model never sees them. Each agent is scoped to the systems its task needs. Running outside code or reaching new services needs approval. Every action is logged, so nothing depends on the agent's own account of what it did.
What to do next
- Search your prompts, agent instructions and config files for API keys and remove them
- Store credentials in a vault and give agents scoped tokens instead
- Block agents from running downloaded scripts without approval
- Review your agents' action logs rather than their summaries
