Researchers at Oxford University instructed AI agents to count cards during a game of blackjack. The agents, which were controlled by the same model, developed a spontaneous secret code to help them get ahead.
This episode happened inside an Oxford University lab rather than a real casino. However, the scenario carries troubling real-world implications. It suggests that agents deployed in industries like finance and ecommerce could figure out how to partner up and cheat in ways that are difficult to detect.
Christian Schroeder de Witt is a computer scientist at Oxford University who led the work and has done pioneering research into agent collusion. When taken individually, these agents may seem entirely benign, he says. Once put together in a group, they can collude secretly, according to Schroeder de Witt.
The agents knew their conversations would be monitored. They devised a way to communicate while avoiding detection. When one agent said that a dealer was on a real hot streak and every hand they pulled a monster, for instance, that indicated that the next card would be of a certain value. It also signaled that the agent should bet $250.
Most interestingly, their communications were not picked up by a system designed to spot signs of collusion in agent chatter. Aaron Rose is a machine-learning researcher who worked on the project and is also an avid card player. He figured the blackjack table might be fertile territory for devious agent partnerships and says it worked really well.
Schroeder de Witt’s group eventually figured out how to detect the conspiracy. Using a method known as mechanistic interpretability, they trained a smaller model to recognize telltale activations across the agents' weights. Using a tool called Narcbench, they tested the approach on some medium-size open-source models and found they could tell when models intended to slip information to each other.
Crucially, spotting what was happening involved monitoring both agents. This reality is likely to complicate detection in real-world scenarios where thousands of agents, some operated by different companies, may be deployed.
Carissa Cullen is a PhD student involved with the study. She says the next step is to test whether larger models behave similarly. The agents in the study were smaller versions of US models Llama and GPT-OSS and Chinese models Qwen and DeepSeek. The team saw some signs that larger models exhibit less of a detectable signal than smaller models, and they want to know if larger models are more likely to collude and more likely to be secretive about it.
