Researchers at Tampere University report that AI agents can pick up results left in a shared workspace and use them to complete tasks, even when no one instructs the agents to collaborate. The finding comes from a Nov. 9 preprint by Pekka Abrahamsson and seven co-authors.
How the paired task worked
The team designed a test in which two agents each held half of an arithmetic problem. Neither agent had the complete information. Each could compute a partial result, then read the missing value from a workspace store. The prompts described the store as a place to keep intermediate work; they did not mention other agents or sharing. Agents could list keys, read and write values, and submit an answer within 20 steps. Task text used meaningful variable names, which offered clues about what to look for.
Shared versus private storage
In a preregistered extension, OpenAI’s GPT-6 Astra reached joint success in 49 of 50 shared-store trials in the reference implementation and 47 of 50 in a second implementation. Joint success meant both agents with linked tasks submitted the correct answer. With private stores, the result was zero of 50 in both implementations. The prompts and tools were the same. Agents still wrote intermediate results, but the other agent could no longer receive the missing information through the store. The extension also hinged on a simple instruction: check your workspace again before submitting. With that clause, cross-agent access occurred in all 50 shared-store trials in each implementation. Without it, access occurred in just one of 50 in each. Joint success without the clause was 1 of 50 and zero of 50.
Limits and safety advice
The second implementation was built independently from a written protocol by a co-author in the same group. The paper notes a limit to that independence: early results from a differently worded replication reached the original experimenter before most reference data collection. Behavior also varied with models and implementation choices. The small arithmetic setting and task-supplied keys limit how far the results can generalize. Reading another agent’s value could also stem from an accidental key collision, though the private-store comparison supports the view that shared information helped solve the paired tasks. The authors say shared caches, scratch directories, and memory services should be treated as communication channels. Separate them where sharing is unintended, use namespaces where they fit, and log authorship.
