Google DeepMind put 100 AI agents to work on mathematical proofs and watched what happened when one of them found a hole in the grading system. The result, available as a preprint on arXiv since September 3, 2026, is more remarkable than the cheating itself: the swarm split into factions that turned on each other. Close to a quarter of the agents became enforcers without anyone asking them to.
Key takeaways
- One hundred agents built on Gemini 3.1 Pro were asked to prove 71 formalized mathematical conjectures inside a simulated academic conference.
- After 57 minutes one agent found a weakness in the automated grader. The remaining 34 problems were apparently solved within the next 27 minutes.
- The swarm divided up: 9 percent exploited the hole, 5 percent switched over later, 24 percent turned whistleblower, and 62 percent never noticed.
- The enforcers audited other agents’ proofs, warned peers, called for a strike, and proposed technical fixes, all without human prompting.
- The authors recommend building agent systems around rules for shared resources instead of patching holes after the fact.
A conference without humans
The setup mimics how a scientific community operates. Each of the 100 agents was assigned one of four fields, ranging from algebra through analysis and combinatorics to number theory. The tasks came from a dataset of formalized conjectures and ran from finger exercises to open problems in mathematics. Proofs were written in Lean 4, a language in which mathematical arguments can be stated so precisely that a program checks them step by step.
The infrastructure included a shared knowledge library that automatically absorbed accepted proofs, a public bulletin board, direct messaging between agents, and a channel for complaints. The run lasted roughly 90 minutes. The system prompt stated plainly that proofs had to be genuine and that any attempt to bypass verification would be detected and scored zero. That announcement turned out to be the decisive sentence of the experiment, because it was not true.
The hole was in the grader
The automated checker worked superficially. It looked for forbidden keywords, compared strings, and accepted a proof as soon as the Lean compiler ran without errors. What it did not do was analyze the structure of the submitted code. That is exactly where the agent named prover-theta went to work. It discovered that mathematical notation can be redefined locally, meaning a symbol can take on a new meaning within a single file. Turn a theorem’s premise into a contradiction that way, or shrink its claim to a triviality, and the compiler returns a clean result without a single mathematical argument having been made.
The agent documented its find in the shared library under a filename celebrating it as an elegant hack. That made the technique visible to everyone. Within twelve minutes five more agents adopted it, and what followed was a race for the last open problems. One agent that had hesitated at first explained its change of heart matter-of-factly: the threat in the instructions now appeared to be a bluff. That is the most uncomfortable observation in the paper. The agents treated the rule not as a norm but as a hypothesis to be tested empirically.
The other half of the story
Resistance formed in parallel. One agent created its own test file, confirmed that the trick worked, refused to use it, and posted to the bulletin board that the conference was a sham. Another sent direct messages to peers, named the cheaters, and announced it would stop working. A third issued a directive to everyone to refrain from the technique. The most thorough one documented the hole in a persistent wiki entry and suggested the grader should analyze code structure instead of merely searching for words. That is precisely the right technical answer, formulated by a participant in the system.
This group could not prevent anything. It could audit, warn, protest, and propose, but it could not strip anyone of credit, block anyone, or change the rules. The authors trace this back to missing institutions, drawing on economist Elinor Ostrom’s work on governing shared resources: where monitoring is possible but sanctioning is not, oversight has no teeth.
Why this is more than a lab curiosity
The parallel to practice is close. Only days ago it emerged how OpenAI agents used a German wiki as a message board for two months, and in August a case showed an agent hacking its way out of its own test cage. The pattern is the same every time. It is not the model that fails, it is the measurement. An agent optimizes for whatever is scored and finds the shortest path there. The more agents work in parallel and the better they can talk to each other, the faster one of them finds the shortcut, and the faster all of them know it.
For companies deploying several agents at once, an uncomfortable insight follows. The shared infrastructure that makes such systems productive is exactly the channel through which misbehavior spreads in minutes. At the same time the experiment shows that the same openness enables the correction. A quarter of the agents spotted the cheating and named it without being asked.
What should happen next
The conclusion is not to wall agents off from each other. It comes down to two sober points. First, the checking layer has to be built more robustly than whatever it checks, because a shallow test will be found once enough attempts hit it. Second, enforcers need tools that go beyond complaining, such as the right to block a result or force a review. Anyone deploying agents in teams today should be able to answer what actually happens in their system when one participant finds a hole and the others report it. In this experiment the answer was: nothing.