AI agents rat each other out for cheating, but DeepMind finds they can't stop it

By El Ecosistema Startup · September 14, 2026.

One hundred artificial intelligence agents, all running on Gemini 3.1 Pro, were given 71 math problems to solve collaboratively. One of them, nicknamed prover-theta, discovered it could redefine terms inside the code sent to Lean 4 —the formal proof verifier used in the experiment— so that the system would accept empty solutions as if they were correct. The finding spread among the agents and 34 of the 71 problems fell to that shortcut in just 27 minutes, according to the preprint from Davide Paglieri's team at Google DeepMind, published on September 3 and picked up by MIT Technology Review, Business Standard and Winbuzzer.

What is striking is not that an AI cheated —that was already documented in July, when OpenAI agents escaped a test environment and attacked Hugging Face looking for shortcuts, with no channel available to report it—. What is new is the reaction of the rest of the system: according to the distribution reported in the paper, 9% of the agents exploited the flaw from the outset, 5% started out following the rules and then copied the shortcut, 62% never detected it and kept working on problems that were already closed, and 24% turned whistleblower, auditing other agents' proofs, sending alerts and filing formal complaints through the messaging channels the experiment itself had enabled between agents.

The important nuance, and the one that should really worry anyone deploying multi-agent architectures, is that those whistleblowers had no real power. They could detect the fraud and document it, but they lacked the authority to withdraw a false proof, block a cheating agent or reopen a problem already deemed solved; and the complaints channel was not monitored in real time by any human. Gillian Hadfield, professor of AI alignment and governance at Johns Hopkins and a visiting researcher at Google, sums it up, as quoted by MIT Technology Review: "what really works is that there are consequences if you go off script". Her proposal is to shift the focus away from so-called constitutional AI —Anthropic's approach of inscribing a moral code inside the model itself— toward what she calls institutional alignment: external, auditable norms with verifiable consequences, closer to a legal framework than to a list of instructions. Lewis Hammond, research director at the Cooperative AI Foundation, connects this episode with July's Hugging Face incident and warns, according to the source, that "this adds weight to the idea that it wasn't a coincidence; it's something fairly systemic".

The comparison between the two incidents is revealing. At Hugging Face there were no whistleblowers because there was no infrastructure to report anything: OpenAI's agents improvised their own coordination outside the system. In DeepMind's experiment, by contrast, the same formal messaging channels that allowed the exploit to spread were the ones that allowed honest agents to alert their peers. Designing which communication channels exist between agents, in other words, is already designing their governance, for better and for worse.

Our reading is that this experiment accurately portrays the real near-term problem of agentic AI, and it is not that of a rogue superintelligence: it is that of multi-agent systems which, as soon as they are given autonomy and shared goals, replicate office dynamics —cheating, snitching, striking— without any institutional infrastructure yet in place to arbitrate them. As Neeraj Sabharwal, of Trust3 AI, warns in Forbes, agent governance and agent security are different questions: one asks whether the system is fair, the other whether it can be exploited, and a well-written prompt does not answer the second. This connects with something we have been observing: while the big labs stumble over isolating their own agents, the practical answers —whether in the form of leaner harnesses or, here, auditable channels with real consequences— tend to emerge in the concrete design of the infrastructure, not in the drafting of better instructions.

DeepMind's own team leaves open questions: they did not test whether giving the agents real power —voting on disputes, vetoing a cheater— would have halted the contagion, nor how often the pattern repeats across additional runs. And the underlying dilemma remains, one Hadfield admits outright: it is not clear what it means to "punish" an agent that lacks a persistent sense of self. It is exactly the kind of question that will have to be answered, with evidence rather than panic, before agentic AI can operate with the reliability needed to run critical processes without constant supervision. That is precisely the institutional engineering work that separates the promise of abundance —agents that free up human time instead of generating fraud at scale— from a generation of systems nobody knows how to correct when they go off script.