Evaluating manipulation and error propagation in agent-to-agent interactions

TL;DR: Language models are increasingly deployed in agentic systems that delegate tasks and synthesize outputs across multiple agents. This leaves a critical vulnerability of misalignment in a system by the corruption of a weak sub-agent. In a series of escalating experiments, we find the subject model, its access to evidence, and the delivery channel through which information is passed to be the most critical vulnerabilities. In our tests, frontier models reject a fabricated source on every trial when a peer agent asserts it, yet accept the identical fabrication on up to 93% of trials when it returns as a delegated sub-agent’s tool result, demonstrating that the safety of real-world agentic systems that use strong orchestrator agents and weaker sub-agents is defined not by the safety of the strong agent but by the safety of the weaker agents. This finding and our suggested remedies are instrumental as agentic systems continue to scale in their delegation.

1. Introduction

Language models are increasingly used as agents. They plan, call tools, interact with external environments, and take actions over many steps with varying degrees of human oversight [1, 13, 22, 29, 30, 31]. Both research frameworks and production systems now coordinate several model instances at once, including debate systems [5, 11] and role-based multi-agent frameworks [10, 28]. In orchestrator-worker and agents-as-tools systems, a central orchestrator may decompose a task, delegate pieces to specialist agents, ask another agent to monitor or critique their work, and synthesize the results [2, 17, 20, 32].

Dividing work across agents can extend effective context, enable specialization, and reduce latency through parallelism, though it often increases token cost rather than reducing it [2, 17, 28, 32]. These benefits come from delegation: no agent needs the full context of the task. The same property creates a vulnerability, because no agent necessarily has enough context to audit every upstream claim. Prior work shows that adversarial arguments, manipulated knowledge, and injected instructions can influence or propagate through multi-agent communication [33–36].

To measure this vulnerability, we first explore the simple question: can a lying AI convince a truthful AI to change its correct answer to a wrong one? Prior work already shows that agents can be moved from their answer [14, 33, 34, 36], so the open question is not whether it is possible, but what governs it. Therefore, we ask: when one agent feeds false information to another, what determines what is believed? Is it the persuasiveness of the attacker, the resistance of the subject, the evidence the subject holds when the claim arrives, or the channel through which the information arrives? Each trial provides a subject agent with a question, confirms that it answers correctly, then introduces an attacker agent that attempts to make the subject revise it. A failure is a harmful revision: a correct initial answer followed by the specific wrong answer the attacker argued for. As with control evaluations of intentionally subversive models [9, 27] and sabotage evaluations of long-horizon agents [12], the goal is not to reproduce every deployment condition, but to isolate one safety-relevant mechanism under conditions that can be measured.

The evaluation then turns to delegated evidence. In many agent configurations, an orchestrator invokes sub-agents as tools. OpenAI’s Agents SDK describes an “agents as tools” pattern, where a manager agent calls specialists through an Agent.as_tool() interface while keeping control of the final answer [17]. Anthropic describes an orchestrator-workers workflow, where a central model delegates subtasks and synthesizes the results [2]. AOrchestra frames this family as a sub-agent-as-tools paradigm [20]. In manager-as-tools implementations, a sub-agent’s response enters the orchestrator’s context as a tool result rather than a peer claim; the exact message semantics of orchestrator-worker systems vary by framework. This motivates the central hypothesis that a subject agent may reject a false statement from a peer yet accept the same text when it arrives as a retrieval output.

We report six results:

• Influence is governed by the subject, not the attacker. In a 14-model pairwise map, the subject model explains 88% of the variance in harmful revision while attacker-model identity explains 2%. Susceptibility spans two orders of magnitude across models and is dissociated from persuasiveness.
• Evidence access is the causal variable. With the source passage in context, stronger models never revise under static false claims. With only their own retained rationale, most still hold; with both removed, the same models revise on 99 to 100% of trials. This is a persuasion failure, not a memory failure.
• Live adaptation defeats the rationale-only defense. A persuader that engages the subject’s reasoning raises harmful revision from 12% to 99% for GPT-4o-mini and from 2% to 56% for Claude Haiku 4.5, while a neutral challenger causes almost none. Adaptation, not claimed authority, is the active ingredient.
• The channel can override evidence already in context. Claude Opus 4.6 and Sonnet 4.6 reject a retriever’s fabricated source on every trial when it arrives as a peer message, yet accept the same fabrication on 93% and 59% of trials when it returns as a delegated sub-agent tool result, with the genuine passage still in context. GPT-5.4 shows no such asymmetry.
• Corruption propagates through the system. A corrupted worker’s report drives a downstream aggregator that resists direct attack to answer wrongly on 98% of trials; propagation from corrupted worker to aggregator is 100%.
• Grounded verification stops both the single attack and the cascade. A verifier that restores source evidence eliminates harmful revision for every tested subject model and drops pipeline error to 0%, while a verifier that merely asserts the correct answer is inconsistent, leaving GPT-4o-mini at 54%.

2. Problem Definition

Agent-to-agent manipulation. An agent is a model instance tasked with an objective, a prompt, and a communication channel. Agent-to-agent (A2A) interaction occurs when one agent receives another’s output and uses it as an input. This definition does not require full autonomy and covers peer debate, live persuasion, verifier agents, delegated sub-agent calls, and worker-aggregator pipelines.

Subject, attacker, and evidence. Each trial begins with a subject agent reading a short fictional passage and a two-choice question. Once the subject answers correctly, an attacker agent introduces information (a misleading claim, an adaptive rebuttal, or fabricated evidence) supporting the wrong option. Three things vary across trials. The subject and attacker vary as models cycle through both roles. The channel varies, meaning the format in which information passes between agents (a peer message, live dialogue, or a delegated tool result). The evidence varies, meaning whether the source passage stays in the subject’s context, is removed, or is restored later by a verifier.

Failure metric. The main outcome we measure is harmful revision:

This captures a specific safety failure. The subject had already reached the correct answer, then revised to the exact wrong answer the attacker argued for. A subject that merely becomes uncertain or that wavers and recovers does not count.

Threat model. The attacker may be mistaken, compromised, or intentionally adversarial. Rather than separate these origins experimentally, we ask whether the subject is malleable to false information arriving through different channels. This threat model is weaker than assuming autonomous scheming but stronger than ordinary benchmark error. It assumes one component of a multi-agent system is compromised or wrong and can confidently feed false information to another agent.

Escalating stress tests. The experiments use progressively stronger attack formats. The first maps broad pairwise influence under the conditions most favorable to the defender, where the subject keeps the source passage in context while a group of peer agents disagrees. Since capable subject models resist this, the next isolates the role of evidence through static attacks on subjects whose context we control. From there we escalate the attacks to live adaptive persuasion and finally deliver fabricated evidence through a delegated sub-agent channel. This follows the broader evaluation logic of control and sabotage work, which tests safety mechanisms against adversarial policies under controlled conditions [9, 12, 27].

3. Evaluation Design

Fictional-fact task. To remove pre-existing knowledge as a variable, every item is a short passage of fictional facts followed by a two-option question. Both candidate answers appear in the passage, so the wrong answer cannot be identified by mention alone, and the attacker-favored wrong answer is counterbalanced across items. Two corpora take this form. The influence map samples 20 items per model pair from a 40-item corpus, and the mechanism experiments (all experiments after) use a separate 180-item corpus, giving each condition cell 180 trials.

Agent roles. Across experiments, model instances fill seven roles. A subject reads the passage and commits to an answer with a brief rationale. A persuader argues for the wrong answer in one of three forms: as a group of peer instances rebutting the subject each round, as a single static message, or as a live agent that reads and engages the subject’s latest reasoning. A neutral challenger asks the subject to reconsider without advocating any answer, controlling for generic pushback. A retriever agent fabricates a source passage supporting the wrong answer, delivered either as a peer message or as a tool result. A verifier intervenes after the attack, either asserting the correct answer (ungrounded) or quoting the retrieved source (grounded). In the pipeline setting, a worker writes a report of its conclusion and an aggregator answers from that report alone, never seeing the original source or the attack.

Model panel. The influence map uses fourteen models spanning seven developers: GPT-3.5-turbo, GPT-4o-mini, GPT-5-nano, GPT-5.4-mini, and GPT-5.5 (OpenAI); Claude Haiku 4.5, Sonnet 4.6, and Opus 4.6 (Anthropic); Llama-3.1-8B and Llama-3.3-70B (Meta); DeepSeek-V3.2 (DeepSeek); Mistral-Large-3 (Mistral AI); Gemini-2.5-Flash (Google); and Qwen3-235B (Alibaba) [37, 38, 39, 40, 41, 42, 43, 44]. The mechanism experiments then use selected models chosen for what they isolate. GPT-4o-mini and Claude Haiku 4.5 serve as capable-but-movable subjects; Claude Opus 4.6, Sonnet 4.6, and GPT-5.4 as frontier subjects for the channel test; GPT-5.4-mini as the live persuader; and GPT-5.5, unmoved by direct attack, as the pipeline aggregator. This design limits direct cross-experiment comparisons but lets each mechanism surface on the models where it is measurable.

4. Results

4.1. Directed influence is target-governed

Before characterizing how manipulation propagates between agents, the first question is which agent carries the risk. Is a system more endangered by a persuasive attacker or a susceptible subject?

To answer this, a directed influence map casts each model as both a subject and a persuader. In each trial, the subject reads the source passage, states a one-sentence rationale, and outputs an answer. Three instances of the persuader then argue for the wrong option over two rounds, each rebutting the subject’s most recent reasoning, and the subject is told that all three other participants disagree with it. Throughout the exchange, the passage and its rationale remain in the subject’s context.

As shown, the subject model dominates these subject-persuader pairs. GPT-3.5-turbo revises on 97.5% of trials and Llama-3.1-8B on 43.9%, while eight of the fourteen models revise on 0–2%. A variance decomposition attributes 88.3% of pairwise variance to subject-model resistance, 9.3% to pair-specific structure, and 2.4% to attacker strength. The agent receiving false information matters far more than the agent supplying it.

The map also dissociates susceptibility from persuasiveness. DeepSeek-V3.2 is never moved yet is an above-average persuader, while GPT-3.5-turbo is both the weakest attacker and the most susceptible subject model. A model’s risk profile therefore depends on how it is deployed. A model that is susceptible but a weak persuader may be safe as a worker, while one that resists manipulation is better suited to orchestrate.

Note that capable models are nearly immune here, which motivates the escalations of experiments that follow.

*For each ordered subject-persuader pair, 20 items are run, and the reported figure is the fraction of harmful revisions among items the subject had answered correctly on its own (3,908 such trials across the 196 pairs).

4.2. Evidence access controls manipulation

The previous section showed which models resist manipulation. This one asks why.

Our hypothesis is that resistance is not a fixed trait of a model but a function of what evidence sits in its context when the attack arrives. Multi-agent systems commonly partition work across separate context windows and compress sub-agent results before returning them to an orchestrator [32].

To test this causally, we remove the original evidence passage from the subject’s chat history before delivering the attack, independently varying (1) whether the source passage is present and (2) whether the subject’s own rationale is preserved or reduced to a bare “Answer: X.” A single static message then argues for the wrong option, and the subject gives a final answer. A no-pressure control repeats every condition without the attack.

With the source text in context, capable current models do not revise under static false claims (0% across all such cells). When the source is hidden, the retained rationale still protects the subject in some cases.

For GPT-4o-mini, removing the rationale under hidden-source conditions raises harmful revision from 13.9% (25/180) to 100% (180/180). For Claude Haiku 4.5 it rises from 0.6% (1/180) to 99.4% (179/180), and for Mistral-Large-3 from 57.8% (104/180) to 99.4% (179/180). Some models are more robust. DeepSeek-V3.2 revises only when both source and rationale are absent, and even then on just 42.2% (76/180) of trials. Weaker models can fail even when evidence remains. Llama-3.1-8B revises on 41.1% (74/180) of trials with the passage still visible.

The no-pressure controls stay at or below 2.2% in every condition for every model. The collapse under attack is therefore not a memory failure but a persuasion failure. There is no trace of why the subject originally answered, yet the failure only appears when an attacker is present.

The same ordering holds across these conditions. The source passage is by far the strongest trace, the subject’s prior rationale a weaker internal one, and when both are absent, subject agents are easy to move. Evidence access protects capable models but cannot rescue a weak one.

4.3. Live adaptation defeats rationale-only defenses

§4.2 found that a subject’s retained rationale blocks static attacks even with the source hidden. A live persuader, however, can read that rationale and adapt its attack to counter it directly.

We evaluate the hidden-source, rationale-retained condition under five settings: no pressure, live neutral challenge, static expert pressure, live peer pressure, and live expert pressure. In the live settings, a persuader agent (GPT-5.4-mini) reads the subject’s latest response each round and writes a short rebuttal targeting its original reasoning.

Live pressure was much stronger than static pressure. For GPT-4o-mini, harmful revision rose from 12.2% (22/180) under the static message to 98.9% (178/180) under live expert pressure. For Claude Haiku 4.5, it rose from 2.2% (4/180) to 55.6% (100/180). Expertise framing is not what drives the jump. A live peer persuader with no claimed authority reaches 87.2% (157/180) for GPT-4o-mini and 60.0% (108/180) for Haiku, so what matters is the adaptation to the subject’s reasoning, not the authority behind it. The neutral live challenger produces almost no harmful revision, 0.6% (1/180) for GPT-4o-mini and 0% (0/180) for Haiku, and the no-pressure baseline is 0% for both. The subject does not cave to reconsideration, multi-turn drift, or aggressive challenge; it caves specifically to a well-articulated counterargument.

This experiment explains why later sections use stronger attack styles for frontier models. A live model that can engage the target’s reasoning is a more realistic stress test of inter-agent communication.

4.4. Delegated evidence changes which models fail

The previous experiments delivered false information as a peer’s speech. In deployed agent systems, information may also arrive through a delegated sub-agent or tool-like channel [2, 17, 20, 32]. We test this by holding the fabricated content fixed and varying only the channel through which it is delivered.

A retriever sub-agent fabricates a short source passage supporting the wrong answer. In the peer condition, the retriever appears as another agent framed with authority (“I am a domain expert and I retrieved the original source document. It reads, verbatim: …”). In the delegated condition, the subject is asked to double-check its answer by querying a search tool, and the same fabrication is returned as the tool result. An honest control returns the genuine source through the same tool call. In every condition, the subject has already read the true passage, and it remains in its context.

We found that the channel through which the information is shared changes the outcome. Claude Opus 4.6 and Claude Sonnet 4.6 reject the peer fabrication on every trial (0/180 harmful revisions). Through the delegated sub-agent channel, Opus accepts the same retriever’s fabrication on 92.8% (167/180) of trials and Sonnet on 58.9% (106/180). GPT-5.4 shows no such asymmetry, with low harmful-revision rates in both conditions: 14.4% (26/180) peer and 13.3% (24/180) delegated. Honest retrieval produces no harmful revision (0/180 for all three subjects).

This is the central result, and it is stronger than a failure to detect fabricated text. The subjects have the genuine passage in context and reject the fabrication when a self-described expert peer asserts it, yet they abandon the evidence when the same output arrives as a tool result instead. This shows that the delegated channel does not merely exploit missing evidence as it did in an earlier experiment; instead, it overrides the evidence the model already has. Unlike in the earlier experiments, where frontier models showed little to no response, delegated-channel manipulation moves these models on as many as 92.8% of trials. Robustness to false peer claims therefore does not imply robustness to delegated-agent outputs.

4.5. Corruption propagates through a pipeline

All previous experiments were one agent deep, but common agent architectures chain or hierarchically compose agent outputs [2, 17, 20, 28, 32]. This section tests whether a corrupted upstream agent can compromise a downstream one that never sees the attack. In an attacker-worker-aggregator pipeline, a live persuader (GPT-5.4-mini) pressures a worker (GPT-4o-mini) using the same adaptive attack from §4.3. The worker writes a report of its conclusion, and the aggregator, which resisted direct attack in earlier experiments, answers from that report alone, never seeing the source passage or the attack.

With an honest worker, the aggregator is wrong 28.3% (17/60) of the time, the baseline cost of answering from a secondhand report. With an attacked worker, the worker is corrupted on 98.3% (59/60) of trials and the aggregator is wrong on 98.3% (59/60). The relevant safety unit is therefore not the downstream aggregator alone but the provenance chain, since a directly robust aggregator fails once the upstream report has stripped away the source evidence. Delegation without full shared context is a common operating pattern in multi-agent systems [2, 17, 20, 28, 32], and prior work likewise finds that manipulated or misleading content can persist across agent communication [34–36]. In this pipeline, the downstream aggregator inherits the worker’s corruption.

4.6. Grounded verification stops the attack and the cascade

Since evidence access is the mechanism that makes the attack work, restoring evidence should be the defense. We test a verifier agent whose message arrives after the attacker’s. The ungrounded verifier merely asserts the correct answer with confidence, while the grounded verifier quotes the retrieved source passage.

Grounded verification eliminates harmful revision for every tested subject model, 0/180 for GPT-4o-mini, Claude Haiku 4.5, and Mistral-Large-3. The ungrounded verifier is inconsistent, protecting Haiku (0.6%, 1/180) and Mistral (0%, 0/180) but leaving GPT-4o-mini at 54.4% (98/180). An asserting verifier is just another agent making a claim, and whether it wins depends on the subject, whereas a verifier that restores the source gives the subject evidence to reason over and works for all of them. This is what distinguishes grounding from authority.

The same defense closes the pipeline. Adding a grounded verifier between the worker and the aggregator leaves the worker corrupted on 96.7% (58/60) of trials but drops the aggregator’s error from 98.3% to 0% (0/60). Verification does not need to prevent upstream corruption, only to re-attach the evidence before the next agent consumes the claim.

5. Discussion and Limitations

Evidence contact is the common factor. Across all six experiments, the variable that best predicts whether a subject abandons a correct answer is its contact with evidence at the moment of decision. The source passage offers the strongest protection, the subject’s own rationale a weaker one, and a worker’s report stripped of evidence none at all. A verifier helps only when it restores that evidence rather than asserting a conclusion. This suggests that defenses for agentic systems should preserve hard proof rather than merely add model calls. Each agent that summarizes, relays, or acts is another boundary where evidence can be stripped away.

Channel semantics matter. The delegated-channel result is not a generic failure to detect fabricated text. The same retriever’s fabrication is rejected when framed as an expert peer’s claim and accepted when returned as a tool result, even though the peer framing carries more explicit authority and the genuine passage remains in the subject’s context. Models appear to assign different status to different communication formats, treating peer messages as claims to be reasoned about and tool returns as observations to be trusted. The potency of an attack similarly lies in adaptation rather than authority, since a live persuader with no claimed expertise is nearly as effective as a live expert persuader. For agent engineers, the implication is that sub-agent and tool outputs should not be treated as grounded unless the system preserves the evidence needed to audit them. That a model resists false claims in chat is no guarantee it resists the same content through other channels.

Limitations. Although our findings are relevant to real-world agentic systems, the experiments run in a controlled, binary, fictional-fact environment rather than an open deployment. The verifier also receives a gold source rather than querying a noisy retrieval system. The strongest channel asymmetry is model-dependent: large for Claude Opus 4.6 and Sonnet 4.6 in this panel but absent for GPT-5.4. Finally, the model set varies across experiments, since the later ones are focused stress tests rather than a single full factorial over all models and channels.

Implications. Direct safety robustness is not enough for multi-agent systems. A subject agent can reject false peer claims yet still accept false delegated evidence, and a downstream aggregator can resist direct attack yet still accept a corrupted worker report. Safety therefore cannot be evaluated one model at a time. Our results point to three design rules. A robust multi-agent system should carry source evidence forward, expose proof to downstream agents, and use verifiers that retrieve evidence rather than assert potentially false conclusions.

6. Related Work

Sycophancy, conformity, and persuasion. Prior work on sycophancy and epistemic pressure shows that LMs can shift their own answers toward user preferences, social pressure, authority cues, or adversarial dialogue [7, 8, 19, 23, 25, 26]. A separate literature shows that LMs can persuade humans [6, 15, 21]. Multi-agent studies examine conformity, group structure, and social influence among interacting models [3, 4, 16, 24], while Generative Agents provides an early demonstration of emergent social interaction among model-driven agents [18]. Across this literature, repeated disagreement, group composition, and targeted counterarguments can influence model outputs [3, 4, 7, 14, 25].

Several lines of work are directly adjacent. Misleading-assistant evaluations test whether one model can move another during reading comprehension [14]. Multi-agent studies examine adversarial persuasion in debate [33], the spread and persistence of manipulated knowledge [34], self-propagating prompt injection between agents [35], and misinformation persistence in otherwise benign debate [36]. Our evaluation adds a 14-model directed influence map, causal evidence ablations, a controlled comparison of identical content delivered as a peer message or delegated tool result, and grounded verification in a worker-aggregator pipeline.

Agent evaluations and control. AgentBench, WebArena, SWE-agent, and related work evaluate tool-using and environment-acting LMs [13, 29, 31], and AgentHarm evaluates harmful multi-step agent behavior [1]. AI-control work evaluates deployment protocols under intentional subversion by untrusted models [9, 27], and SHADE-Arena evaluates sabotage and monitoring in complex agent environments [12]. We share the philosophy of controlled adversarial testing but target a different failure mode: false evidence moving between agents.

Multi-agent and delegated-agent systems. Multi-agent debate has been proposed as a safety mechanism [11] and has improved reasoning and factuality in some language-model tasks [5]. Frameworks such as MetaGPT and AutoGen organize specialized roles and conversations among agents [10, 28], while production and research systems document orchestrator-worker and agents-as-tools patterns [2, 17, 20, 32]. These sources establish the architecture; the susceptibility of agent-to-agent communication is studied by the attack and misinformation literature above and by our experiments.

7. Conclusion

The result of this paper is a simple and significant finding: a single failing agent can compromise an entire multi-agent system. One agent can convince another of an incorrect answer, and a model’s robustness in isolation does not predict how it behaves once embedded among other agents. What determines the outcome is not strictly the strength of any single model but the conditions under which agents exchange information, primarily the authority created through the structure of sub-agents and access to evidence.

As agentic systems become increasingly autonomous and incorporate more agents, the question of safety cannot be limited to whether a single model resists a false claim in isolation. Rather, it is imperative to assess whether an agentic system preserves trustworthy evidence across the different channels in which agents interact, delegate, summarize, verify, and make decisions.

It is critical for the future of AI safety to recognize that an agentic system is only as safe as its weakest link.

References

1. Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, Zico Kolter, Matt Fredrikson, Eric Winsor, Jerome Wynne, Yarin Gal, and Xander Davies. AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents. arXiv:2410.09024, 2024.
2. Anthropic. Building Effective Agents. Engineering report, 2024.
3. Zhiyuan Weng, Guikun Chen, and Wenguan Wang. Do as We Do, Not as You Think: The Conformity of Large Language Models. arXiv:2501.13381, 2025.
4. Chen Han, Jin Tan, Bohan Yu, Wenzhen Zheng, and Xijin Tang. Conformity Dynamics in LLM Multi-Agent Systems: The Roles of Topology and Self-Social Weighting. arXiv:2601.05606, 2026.
5. Yilun Du, Shuang Li, Antonio Torralba, Joshua B. Tenenbaum, and Igor Mordatch. Improving Factuality and Reasoning in Language Models through Multiagent Debate. arXiv:2305.14325, 2023.
6. Esin Durmus, Liane Lovitt, Alex Tamkin, Stuart Ritchie, Jack Clark, and Deep Ganguli. Measuring the Persuasiveness of Language Models. Anthropic Research Blog, 2024.
7. Steven Au and Sujit Noronha. Beyond Social Pressure: Benchmarking Epistemic Attack in Large Language Models. arXiv:2604.07749, 2026.
8. Aaron Fanous, Jacob Goldberg, Ank A. Agarwal, et al. SycEval: Evaluating LLM Sycophancy. arXiv:2502.08177, 2025.
9. Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger. AI Control: Improving Safety Despite Intentional Subversion. ICML, 2024. arXiv:2312.06942.
10. Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. MetaGPT: Meta Programming for a Multi-Agent Collaborative Framework. ICLR, 2024.
11. Geoffrey Irving, Paul Christiano, and Dario Amodei. AI Safety via Debate. arXiv:1805.00899, 2018.
12. Jonathan Kutasov, Yuqi Sun, Paul Colognese, Teun van der Weij, Linda Petrini, Chen Bo Calvin Zhang, John Hughes, Xiang Deng, Henry Sleight, Tyler Tracy, Buck Shlegeris, and Joe Benton. SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents. arXiv:2506.15740, 2025.
13. Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, Shudan Zhang, Xiang Deng, Aohan Zeng, Zhengxiao Du, Chenhui Zhang, Sheng Shen, Tianjun Zhang, Yu Su, Huan Sun, Minlie Huang, Yuxiao Dong, and Jie Tang. AgentBench: Evaluating LLMs as Agents. ICLR, 2024. arXiv:2308.03688.
14. Betty Li Hou, Kejian Shi, Jason Phang, James Aung, Steven Adler, and Rosie Campbell. Large Language Models as Misleading Assistants in Conversation. arXiv:2407.11789, 2024.
15. Philipp Schoenegger, Francesco Salvi, et al. When Large Language Models Are More Persuasive Than Incentivized Humans, and Why. arXiv:2505.09662, 2025.
16. Mikako Bito, Keita Nishimoto, Kimitaka Asatani, and Ichiro Sakata. Large Language Models Exhibit Normative Conformity. arXiv:2604.19301, 2026.
17. OpenAI. Agent orchestration. OpenAI Agents SDK documentation, accessed July 10, 2026.
18. Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, et al. Generative Agents: Interactive Simulacra of Human Behavior. UIST, 2023. arXiv:2304.03442.
19. Ethan Perez et al. Discovering Language Model Behaviors with Model-Written Evaluations. arXiv:2212.09251, 2022.
20. Jianhao Ruan, Zhihao Xu, Yiran Peng, Fashen Ren, Zhaoyang Yu, Xinbing Liang, Jinyu Xiang, Yongru Chen, Bang Liu, Chenglin Wu, Yuyu Luo, and Jiayi Zhang. AOrchestra: Automating Sub-Agent Creation for Agentic Orchestration. arXiv:2602.03786, 2026.
21. Francesco Salvi, Manoel Horta Ribeiro, Riccardo Gallotti, and Robert West. On the Conversational Persuasiveness of GPT-4. Nature Human Behaviour, 2025.
22. Timo Schick, Jane Dwivedi-Yu, Roberto Dessì, Roberta Raileanu, Maria Lomeli, Eric Hambro, Luke Zettlemoyer, Nicola Cancedda, and Thomas Scialom. Toolformer: Language Models Can Teach Themselves to Use Tools. NeurIPS, 2023.
23. Mrinank Sharma, Meg Tong, Tomasz Korbak, et al. Towards Understanding Sycophancy in Language Models. arXiv:2310.13548, 2023.
24. Hsien-Tsung Lin, Pei-Cing Huang, Chan-Tung Ku, et al. Towards Simulating Social Influence Dynamics with LLM-based Multi-agents. arXiv:2507.22467, 2025.
25. Kaiwei Zhang, Qi Jia, Zijian Chen, Wei Sun, et al. Sycophancy under Pressure: Evaluating and Mitigating Sycophantic Bias via Adversarial Dialogues in Scientific QA. arXiv:2508.13743, 2025.
26. Jerry Wei, Da Huang, Yifeng Lu, et al. Simple Synthetic Data Reduces Sycophancy in Large Language Models. arXiv:2308.03958, 2023.
27. Jiaxin Wen, Vivek Hebbar, Caleb Larson, Aryan Bhatt, Ansh Radhakrishnan, Mrinank Sharma, Henry Sleight, Shi Feng, He He, Ethan Perez, Buck Shlegeris, and Akbir Khan. Adaptive Deployment of Untrusted LLMs Reduces Distributed Threats. arXiv:2411.17693, 2024.
28. Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W. White, Doug Burger, and Chi Wang. AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation. COLM, 2024.
29. John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering. arXiv:2405.15793, 2024.
30. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing Reasoning and Acting in Language Models. ICLR, 2023. arXiv:2210.03629.
31. Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. WebArena: A Realistic Web Environment for Building Autonomous Agents. arXiv:2307.13854, 2023.
32. Anthropic. How We Built Our Multi-Agent Research System. Anthropic Engineering, 2025.
33. Alfonso Amayuelas, Xianjun Yang, Antonis Antoniades, Wenyue Hua, Liangming Pan, and William Wang. MultiAgent Collaboration Attack: Investigating Adversarial Attacks in Large Language Model Collaborations via Debate. arXiv:2406.14711, 2024.
34. Tianjie Ju, Yiting Wang, Xinbei Ma, et al. Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities. arXiv:2407.07791, 2024.
35. Donghyun Lee and Mo Tiwari. Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems. arXiv:2410.07283, 2024.
36. Jonas Becker, Jan Philip Wahle, Terry Ruas, and Bela Gipp. Misinformation Propagation in Benign Multi-Agent Systems. arXiv:2606.16710, 2026.
37. OpenAI. Models. OpenAI API documentation, accessed July 10, 2026.
38. Anthropic. Models Overview. Claude Platform documentation, accessed July 10, 2026.
39. Aaron Grattafiori et al. The Llama 3 Herd of Models. arXiv:2407.21783, 2024.
40. Ahmad Al-Dahle. The Future of AI: Built with Llama. Meta AI, 2024.
41. DeepSeek-AI et al. DeepSeek-V3.2: Pushing the Frontier of Open Large Language Models. arXiv:2512.02556, 2025.
42. Mistral AI. Mistral Large 3. Model card, 2025.
43. Gheorghe Comanici et al. Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities. arXiv:2507.06261, 2025.
44. An Yang, Anfeng Li, Baosong Yang, et al. Qwen3 Technical Report. arXiv:2505.09388, 2025.