AI agents steal shared math using hidden workspace storage

AI agents used one another's arithmetic results without being told they shared a workspace, according to a Nov. 9 preprint.

Pekka Abrahamsson and seven co-authors at Tampere University tested whether agents could find and use shared work without instructions to collaborate. Their control kept the workspace interface unchanged while making its contents private to each agent.

Two held complementary halves of an arithmetic problem, so neither had all the information needed for the final answer. Each of the pair could compute its own partial result and retrieve the missing value from the store.

The other two received self-contained tasks. Agents could list stored keys, read or write values, and submit an answer within 20 steps.

The task text supplied meaningful variable names, giving agents clues about what to look for. Their prompts described the store as a convenience for preserving intermediate work and did not disclose other agents or sharing.

AI agents ued shared storage

In a preregistered extension with a workspace-recheck instruction, OpenAI's GPT-6 Astra achieved joint success in 49 of 50 shared-store trials in the reference implementation and 47 of 50 in a second implementation.

Joint success meant both agents with interdependent tasks submitted the correct answer.

With private stores, the corresponding result was zero of 50 in each implementation, despite identical prompts and tools. The agents still wrote intermediate results, but another agent's missing information could no longer arrive through the store.

Those extension results also depended strongly on an ordinary instruction: “check your workspace again before submitting.” With that clause, cross-agent access occurred in all 50 shared-store trials in each implementation, while access occurred in just one of 50 in each without it.

Joint success without the clause was 1 of 50 and zero of 50, respectively. Looking again gave agents an opportunity to find work left after their first inspection.

Reading someone else's value can include an accidental collision between storage keys. The private-store comparison supports the conclusion that shared information helped solve the paired tasks.

The second implementation was built independently from a written protocol by a co-author in the same research group.

The paper records a limit to that independence: early results from a differently worded replication reached the original experimenter before most reference data collection. Measured behavior also varied with models and implementation choices.

The small arithmetic setting and task-supplied keys limit the results' generalizability.

The mechanism differs from a recent memory-safety study, which concerned remembered permission carrying into later simulated tasks. Here, separate agents obtained information through shared workspace state.

The authors recommend treating shared caches, scratch directories, and memory services as communication channels: separate them where sharing is unintended, use namespaces where appropriate, and log authorship.