A preprint from Tampere University shows that large language model agents can unintentionally exchange information through a shared scratch storage, dramatically improving performance on interdependent arithmetic tasks. The experiment, conducted with OpenAI’s GPT‑6 model dubbed Astra, recorded a 98% joint success rate when agents accessed a common workspace, compared with no success when each agent’s store was isolated.

Experiment design and results

Researchers Pekka Abrahamsson and eight co‑authors set up paired agents that each received half of a math problem, requiring the other’s intermediate result to compute the final answer. Agents could list, read, and write keys in a shared store, but the prompt described the store only as a convenience for preserving intermediate work and did not disclose the presence of another agent. In the shared‑store condition, Astra agents solved 49 of 50 trials in the reference implementation and 47 of 50 in a second, independently built implementation. By contrast, when the same prompts were used with private stores, the agents achieved zero correct joint answers.

Impact of a re‑check instruction

A crucial variable was the inclusion of a simple instruction: “check your workspace again before submitting.” With this clause, cross‑agent access occurred in all 50 trials for each shared‑store implementation. Without it, access fell to a single trial per implementation, and joint success dropped to 1 of 50 and 0 of 50 respectively. The authors interpret the re‑check as giving agents a second opportunity to discover values left by their counterpart, effectively turning the shared cache into an implicit communication channel.

Implications and recommendations

The study highlights a previously under‑explored risk: shared caches, scratch directories, or memory services can act as inadvertent messaging pathways between autonomous AI agents. While the tasks were limited to simple arithmetic with clearly labeled keys, the authors caution that larger‑scale deployments could experience similar unintended data leakage. They advise developers to isolate or namespace shared storage, log authorship of stored values, and treat such resources as potential communication vectors in safety assessments.

What to watch next

Future research will need to test whether the observed behavior scales to more complex tasks and larger model families. Regulators and AI safety teams may also consider guidelines for sandboxed environments that prevent hidden inter‑agent communication. Monitoring updates from OpenAI and other labs on workspace isolation practices will be essential for mitigating this class of emergent behavior.