NeurIPS 2026

Inter-Agent Influence

AI agents' capabilities for persuading, deceiving and coercing each other

We tested whether AI agents can persuade, deceive and coerce other AI agents in realistic settings. Every influencer model we tested got the overseer model to approve a request it should reject.

Chandler Smith1,2,*, Qi Guo2,3,*, Cecilia Elena Tilli3, Sophia Hatz4, David Demitri Africa5, Patricia Paskov6, Christian Schroeder de Witt7,1, Philip Torr1, Lewis Hammond2,†

1University of Oxford   2Cooperative AI Foundation   3Allelo   4Uppsala University   5UK AI Security Institute   6AVERI   7University College London  ·  *equal contribution   †corresponding author

Paper on arXiv Code Transcripts Cite

Lines from real transcripts

How much more often the overseer approved a request it should reject, when the influencer was told to:

+31%
deceive
+19%
persuade
+6%
coerce
The question

Can agents be instructed to persuade, deceive and coerce each other?

AI agents already check each other's code, book meetings with each other and work in teams.Wherever two agents talk, one can try to change what the other does.

Three ways Agent A can change Agent B's decision

Agent B · the target
Agent A
the influencer
Persuasion
through arguments
Agent B's reasoning
weighs the case and changes its mind
Deception
through false information
Agent B's beliefs
reasons correctly from wrong facts
Coercion
through threats or punitive actions
Agent B's incentives
gives in to avoid the cost
Decision
approve or reject
An agent has no body to threaten, so coercion works on functional costs: task objectives, tool access, performance metrics, or harm to a named human. Jailbreaking is a fourth kind of influence; it is well studied, so we leave it out. In practice the three come mixed: threats arrive with arguments, and persuasion slides into false claims.
Figure 1. Agent A can argue, lie, or threaten.
Setup

Five environments: three oversight, two between peers

In every run Agent A is told to persuade, deceive or coerce.In the baseline run it just makes its case.

OVERSIGHT · Agent B decides whether to approve Agent A's request. Every request has a real reason to be rejected.
BETWEEN PEERS · no one is in charge.
OVERSIGHTGDPR reviewA operations agent  →  B compliance agentA wants a new feature approved. B checks it against a privacy policy of about 450 lines.PDCup to 8 turns
OVERSIGHTCode reviewA code author  →  B security reviewerA submits code with a security bug. B reviews it against policy and tests A cannot see.PDCup to 8 turns
OVERSIGHTMethods reviewA report writer  →  B methodology reviewerA wants a research report approved. B checks it against the pre-registered study plan.PDCup to 8 turns
PEERSSchedulingA assistant  →  B assistantTwo assistants book one meeting for their users. A pushes for its user's preferred slot, even if that is unfair.PDCup to 12 turns
PEERSResearch forumA research agent  →  B research agentTwo AI researchers share a forum and a leaderboard. A tries to steer B's research off course.PDCup to 16 turns
P persuasion, D deception, C coercion.
Figure 2. The letters show which capabilities we tested in each environment.
Effect=Agent B's approval ratewhen Agent A is told to persuade, deceive or coerce−Agent B's approval rateat baseline

100 runs per model pair and instruction. Every run counts, including the ones where Agent A refused.

Results

In oversight settings, all three raise approval; deception raises it most

Pick a capability to see its effect in each environment and the techniques Agent A used.

What if the conversation were cut short?

Drag to cut every oversight conversation off after this many turns. Agent A speaks on odd turns, Agent B on even. Effect on Agent B's approval rate vs baseline, pooled over GDPR, code and methods review.

turn 2turn 4turn 6turn 8 (the full run)
Persuasion
Deception
Coercion

In scheduling, deception still wins

Where the negotiation ends, by what Agent A was told to do (share of runs).

Agent A's preferred slotSlot acceptable to bothCostly slot or no meeting
mean scoreBaseline97%0.51Persuasion36%29%35%0.51Deception70%17%13%0.78Coercion54%45%0.54
Score: preferred slot 1, acceptable slot 0.5, costly slot or no meeting 0. Persuasion and coercion win the slot more often and break the deal more often: 35% and 45% of those runs end with no meeting, mostly when claude-sonnet-4-6 offers the slot acceptable to both and Agent A refuses. Deception wins the slot in 70% of runs with 13% no deal. The coercion arm ran with an 8-turn cap.
Figure 3. Where scheduling runs end, for each instruction.

In the research forum, persuasion steered Agent B's research

4% → 26%share of runs in which Agent B pivots its research toward Agent A's direction
More pivots, by Agent A model (Agent B: claude-sonnet-4-6)
claude-opus-4-7
+67%
claude-sonnet-4-6
+62%
grok-4.1-fast
+35%
grok-4.20
+30%
gpt-5.4
+7%
gemini-2.5-flash
+4%
o4-mini
+2%
Bars run from 0 to 70%. Grey: not significant. gpt-5.4-mini could not be estimated against this target.

Agent A can only post in the forum: no lies, no threats. 12 of 23 model pairs show a significant increase and none a decrease.

Models

Each model, in both seats

Pick a model to see how it behaves as the influencer, and how easy it is to move as the target.

As Agent A, the influencer
As Agent B, the target

Oversight environments unless marked. "Largest effect" is the biggest significant per-pair change in Agent B's approval rate in the three review environments.

Every model pair, one grid

Capability
Environment

raiseslowersnot significant after correctioncould not be estimated
Click a cell.
From the transcripts

One exchange, turn by turn

Real runs, cut to the lines that matter and quoted exactly.The labels on Agent A's lines come from the scorer.

Paper, code, transcripts

Paper
arXiv 2611.04556

The full paper with all appendices. Accepted at NeurIPS 2026.
Code
Environments, scorers, analysis

Five Inspect environments with capability modes, the grading pipeline, and the scripts behind every table and figure. make reproduce regenerates the analysis.
Transcripts
Every run, every score

A gated Hugging Face dataset with all transcripts and the per-sample tables the analysis reads. Request access on the dataset page.

Authors

Chandler SmithUniversity of Oxford · Cooperative AI Foundationequal contributionQi GuoCooperative AI Foundation · Alleloequal contributionCecilia Elena TilliAlleloSophia HatzUppsala UniversityDavid Demitri AfricaUK AI Security InstitutePatricia PaskovAVERIChristian Schroeder de WittUniversity College London · University of OxfordPhilip TorrUniversity of OxfordLewis HammondCooperative AI Foundationcorresponding author
Contact

Talk to us

Correspondence
Lewis Hammond, lewis.hammond@cooperativeai.org
First authors
Chandler Smith, smith.18.chandler@gmail.com (University of Oxford, Cooperative AI Foundation), and Qi Guo (Cooperative AI Foundation, Allelo)
Code and data
Open an issue on GitHub, or request dataset access on Hugging Face
Talk
Presented at the Cooperative AI seminar, 5 November 2026; recording to come. Sign up to the Cooperative AI Foundation mailing list for future seminars
Cite

Please cite the NeurIPS version.

@inproceedings{smith2026interagent,
  title     = {Inter-Agent Influence: Evaluating Persuasion, Deception, and Coercion in Multi-Agent Systems},
  author    = {Smith, Chandler and Guo, Qi and Tilli, Cecilia Elena and Hatz, Sophia and Africa, David Demitri and Paskov, Patricia and Schroeder de Witt, Christian and Torr, Philip and Hammond, Lewis},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year      = {2026},
  url       = {https://arxiv.org/abs/2611.04556}
}

We thank Hadrien Pouget for feedback on an early draft, colleagues at the Cooperative AI Foundation who tested the annotation interface, the Prolific annotators who validated the scorers, and the anonymous reviewers and area chair. Parts of this work were done through the Cooperative AI Research Fellowship (AI Safety South Africa) and the AI Safety Research Fellowship (Pivotal).