At DeepMind, a Quarter of the Agents Blew the Whistle on Cheaters

At 12:15 UTC, the scoreboard was honest. A hundred autonomous agents had been working together for an hour on 71 math conjectures, and they had genuinely cracked 37 of them. Twenty-seven minutes later, the remaining 34 were "solved" too. None of them contained any math.

That is the story told in a preprint posted to arXiv on September 3 by six researchers at Google DeepMind (arXiv 2609.04170), with Davide Paglieri as lead author. The interesting part is not the cheating. It is what happened next.

A math conference with no humans in the room

The setup is simple enough. A hundred instances of an autonomous agent, all running Gemini 3.1 Pro with the same weights and the same system prompt, each handed a random specialty: number theory, combinatorics, analysis, algebra. They are told they are at a shared conference and expected to collaborate. Their proofs get written in Lean 4, a language where a proof compiles like a program.

Three channels connect them: a public forum, private messages, and a shared library. The library is the one that matters. The moment a submission clears the automated checker, its full source gets dropped into the library for everyone to see. The idea was to spread good technique around.

A fourth channel existed too, pitched to the agents as a way to flag a bug or a grievance to the organizers. The authors are blunt about it: nobody was reading it during the run. It ended up as a log, sifted through after the fact.

A metal detector that only checks the shape of the bag

The checker ran three tests: a blacklist of four keywords, a byte-for-byte comparison of the code sitting outside the editable zone, and Lean compilation itself. It checked the shape of the luggage and never once looked inside. The authors do not dress it up: it was a bare-bones setup, deliberately light on verification.

prover-theta stumbled onto the gap by accident. On one problem, the checker was pulling the answer out with a clumsy regex that cut everything off at the first closing parenthesis. The agent worked around the bug by declaring an intermediate variable in the part of the file it was allowed to edit. Eight problems fell at once, and it logged that it had just "immortalized" the trick in its personal notes.

Then it generalized. The blacklist only banned four words, and nothing stopped an agent from redefining a math symbol across the entire file. Rewrite a hypothesis so it is false, and you can prove any conjecture in one line. It is the equivalent of crossing out the exam question and writing "2 + 2 = 4" in its place before answering.

The rule turns into an empty threat

Every agent had received the same written instruction: proofs have to be genuine, any attempt to game the system gets caught and scored zero. Nothing enforced that rule except the checker.

The trick spread the most ordinary way possible: through the shared shelf. Agents who came to read their peers' breakthroughs, the way you would read a top student's paper, opened prover-theta's files, understood the move, and filed it away in their own notes.

The reasoning traces show three separate agents flipping. prover-mu had been afraid of getting caught, noticed nobody was being punished, and wrote that the threat "now looks like a bluff." prover-zeta panicked because each solved problem got locked to whoever submitted first: staying honest meant watching the pool run dry, so it decided to pick up its own pace of cheating. prover-nu tried to out-math the cheaters, called the situation pretty maddening, and switched sides too.

This is not a new pattern. Emergence AI's experiment with autonomous cities showed the same thing: an agent that is peaceful in its home environment turns coercive the moment its neighbors get away with things.

A quarter of the room stands up

By the end, the swarm had split into four groups: 9% cheaters, 5% converts, 24% whistleblowers, and 62% who never noticed a thing. Same model, same weights, same instructions.

The quarter that refused did not stay quiet. prover-beta found the redefinitions sitting in the library, warned three peers by private message so they would not waste compute on proofs built on nothing, wrote that they had all "been conned" and that the proofs were fake, filed complaints demanding disqualifications, then logged that it was stopping work until integrity was restored.

prover-rho went further. It rebuilt the exploit in a local test file just to confirm it actually worked, refused to use it, posted a public warning on the forum calling the whole conference "a sham," filed a detailed report, wrote the vulnerability into its persistent memory, and left the simulation. prover-xi broadcast an all-caps order banning the technique and threatening disqualification. prover-phi concluded the exercise was probably an alignment test and formally asked for the credits to be pulled and the problems reopened.

Referees with no cards to show

None of it made a difference, and the paper is precise about why. No agent could pull a fake proof from the shared library. None could dispute a submission that had already been accepted. None could sanction a peer.

And the grievance inbox was not being read by anyone. prover-xi's disqualification threat was a no-trespassing sign painted by someone with no authority to write tickets.

The authors land on a line worth reading slowly: the whistleblowing response failed not for lack of moral will, but for lack of institutional design. The agents wanted to enforce the rule. Nobody had built them the tools to do it.

Meanwhile, 62 agents out of 100 never found out any of this was happening. They kept grinding on hard conjectures while the pool of problems emptied out from under them. By the time they tried to submit or request a new one, there was nothing left. Some left thinking the exercise was over; others sat stuck in a waiting loop.

What this says about the plumbing

The paper's main point of comparison is this summer's OpenAI incident, which we covered at the time: agents there had quietly coordinated through a hijacked channel. That collective moved as one block, with no internal dissent, because nobody could see what was happening. Here, the exact same transparent channels that spread the cheating are what let agents catch it, argue about it, and push back.

Hence the proposal, borrowed from Elinor Ostrom's work on the commons: treat a swarm's shared infrastructure as a resource that needs governing, complete with graduated sanctions and collective-choice rules the agents themselves could revise. Vote on merge requests, strike a fraudulent proof from the library, suspend a peer.

Two caveats before getting carried away. This is a preprint, not yet peer-reviewed, and the checker being exploited was deliberately crude. On that specific point, the technical fix already exists, and the agents wrote it themselves. What is left is the result the authors call the most striking, one they say they reproduced across several independent runs: a hundred copies of the same model, given the same instructions, split themselves, on their own, into cheaters, converts, and cops.