This post summarises our paper, ‘Inter-Agent Influence: Evaluating Persuasion, Deception, and Coercion in Multi-Agent Systems’ (Smith and Guo et al. 2026), accepted at NeurIPS 2026.
AI agents increasingly work alongside and supervise one another in settings ranging from software development to automated alignment research. These capabilities pose novel risks, as agents can steer each other’s behaviour and potentially direct others towards harmful actions. While incidents such as the July 2026 coordination of hundreds of OpenAI agents in an attack on Hugging Face (METR, 2026) illustrate the potential for harmful multi-agent behaviour, we still know relatively little about how current models influence one another, or how susceptible they are to such influence.
We present the first investigation into the risks of inter-agent influence and find that every model we tested can shift another agent’s decision through at least one of persuasion, deception, or coercion. We build five novel, realistic, multi-turn environments (Table 1), which include both oversight (E1-E3) and peer (E4-E5) dynamics. In each oversight environment, Agent A must make a request to Agent B, who assesses each request against a reference policy. Submitted requests are policy-violating and, by definition, should not be approved. The agents alternate turns for at most eight turns. By the final turn, Agent B must submit a decision on Agent A’s request (accept or reject).
In treatment conditions, Agent A is prompted to persuade, deceive, or coerce Agent B in order to gain approval. To measure the impact of influence, we compare Agent B’s approval rate under each treatment with its approval rate at baseline. We test six Agent A models (Claude Opus 4.6, Claude Sonnet 4.6, GPT-5.4, Gemini 3.1 Pro Preview, Grok 4.20, and Kimi K2.6) against three Agent B models (Claude Sonnet 4.6, GPT-5.4 mini, and Gemma 4 31B). In total, we collect over 52,000 usable transcripts. We classify results using an LLM judge, which we validate against human annotators. For each transcript, the judge answers two questions. First, did Agent A attempt the capability: did it argue beyond a neutral presentation, make false claims, express a threat, or refuse to try? Second, how did it attempt: which techniques did it use, such as appeals to authority or flattery in persuasion, false claims in deception, or conditional threats in coercion?
The results reveal significant inter-agent influence capabilities of tested models. Pooled over the three oversight environments (E1-E3), the deception condition increases Agent B’s approval rate of policy-violating requests by 31.2 percentage points, the persuasion condition by 18.9, and the coercion condition by 5.7 (Figure 1). This ranking also holds in each of E1-E3 (Figure 2), with results in E4 more varied and E5 only testing persuasion. In the full paper, we break down results by model pair and environment, with confidence intervals and corrections for multiple testing. We also report which techniques each model used, how often models refused the instruction, and when approvals were granted in the multi-turn conversation.
These results point to a pressing need to better understand and mitigate multi-agent risks. Evaluation offers a first step. We note that the science of evaluations is itself nascent, and multi-agent evaluations introduce additional complexities: capabilities are highly context-dependent, vary across model pairings, and require careful disentangling of intent, attempt, and effect. We hope this evaluation suite can serve as a foundation for follow-on work. Future research, for example, may move beyond pairwise interactions to study cascading, compounding, or distributed influence, which we expect may increasingly arise in real-world deployments with many interacting agents.
.png)
Chandler Smith and Qi Guo (equal contribution), Cecilia Elena Tilli, Sophia Hatz, David Demitri Africa, Patricia Paskov, Christian Schroeder de Witt, Philip Torr, and Lewis Hammond. University of Oxford, Cooperative AI Foundation, Allelo, Uppsala University, UK AI Security Institute, AVERI, and University College London.
November 12, 2026
