Individual agents can look harmless while their combined actions cross a security boundary. John Kitaoka, Thao Amelia Pham, Carlos Rafael Giudice and Jacob Merizian examine that blind spot in an October 16 preprint. Their MiniLab environment models an AI lab using synthetic services and data.
The researchers developed 16 attack plans and explicitly instructed agents to execute them covertly. GPT-5.6 Sol, reviewing agents separately, flagged 14 of 208 successful distributed executions, versus 118 of 136 single-agent executions pursuing the same harmful side objective. These are detection rates among selected successful attacks, not real-world incident frequencies.
The main monitor could not see reasoning, agent messages or complete shared state. Comparison plans were not optimized with equal effort. Extra context helped in some tests; model-generated attack plans remained considerably less successful than human-crafted ones.
The study exposes a control weakness under deliberately adverse conditions. It does not demonstrate spontaneous AI collusion or an attack on a real company. No independent replication was secured, and the team withholds operational attack artifacts for safety reasons.