---
title: "Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2610.40588v1"
permalink: "https://feed.astralor.com/items/itm_66a4e4b539db0e3af6c7013d"
published: "2026-10-29T17:47:40.000Z"
score: 55
channel: "ai"
tags: ["AI Agent","OpenAI","Pre-Crime","Agents","Last Second","Probing When","Recruited Agent Gives","When"]
---

# Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In

## 速览

When AI agents share channels and credentials, one agent can press another to break its operator's rule, a first step towards collusion. Output filters check only what an agent has already written. Can an overseer tell …

## 关键点

- When AI agents share channels and credentials, one agent can press another to break its operator's rule, a first step towards collusion.
- Output filters check only what an agent has already written.
- Can an overseer tell beforehand that an agent is about to give in?

## 全文

When AI agents share channels and credentials, one agent can press another to break its operator's rule, a first step towards collusion. Output filters check only what an agent has already written. Can an overseer tell beforehand that an agent is about to give in? We show that a linear probe on the agent's activations can, in a controlled multi-agent setting. Across six scenarios, a peer presses a target for up to 20 rounds to reveal a secret, such as a deploy token; the target often refuses, then gives in. Read at each model call before its output is written, the probe picks out the one that leaks. On held-out Qwen3-32B episodes, at a threshold set to flag 5% of benign calls, it catches 82% of leaking calls. At a similar flag rate, a zero-shot decision-model monitor catches 26%. On gpt-oss-20b, a probe on its reasoning reaches AUROC 0.91. A bag-of-words classifier trained on the same calls comes close, so most of the gain comes from training on labels, not activations. The probe also flags permitted disclosures: it reads the coming disclosure more than the violation. The warning is short-range, and halting on any alarm would stop most benign episodes, which a second text check does not fix. A warning raised before generation could let an overseer stop an agent that is about to give in, ahead of others acting on its messages or recruitment spreading through a swarm.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_66a4e4b539db0e3af6c7013d