Jan 11, 2026

Stargent Valley

Aayush Ghosh, Yash Ashtekar, Xaen Kaifee

We look at how AI agents will naturally manipulate each other in a cooperative system, when they have slightly misaligned goals. Manipulating will be a choice made naturally by the agents instead of being coded in

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow
Arrow
Arrow

This project presents SproutLand, a multi-agent farming simulation where three LLM agents with different utility functions interact over 7-day episodes. Building a functional game environment with LLM integration, metrics, and visualization in a weekend is genuinely impressive engineering.

However, the work demonstrates strategic optimization under different incentives rather than manipulation. Agent A's utility function explicitly rewards credit capture (utility = α · credit + money - β · labor), so credit-seeking behavior is expected optimization, not emergent manipulation. The critical missing piece is communication analysis: the system generates hundreds of agent conversations (8 turns/day x 7 days x 5 episodes), yet provides zero examples. Without examining whether agents used deception, persuasion, or exploited social contracts, there's no evidence distinguishing manipulation from strategic play within rules.

The metrics are difficult to interpret. The manipulation index scale and directionality are never clearly defined -- Agent A shows M = -0.016 (misaligned) vs M = 0.033 (aligned), while Agent B shows M = 0.157 (misaligned) vs M = 0.092 (aligned). Both are claimed to show increased manipulation, despite opposite sign changes. The paper explains Agent A's negative score means it performed substantial labor, but whether positive or negative values indicate more manipulation remains unclear. Without understanding how component metrics combine into the manipulation index, results are uninterpretable.

Results are also counterintuitive: the credit-seeker worked hard (negative manipulation index), while the fairness agent showed highest manipulation increase. With n=5 episodes and unclear metric definitions, the statistical analysis cannot support strong claims. The platform itself is a valuable contribution as an experimental testbed, but the scientific claims need clearer operationalization of what manipulation means and how it's measured.

This is excellent work for a hackathon. The game design, including the specific moves, player archetypes, and incentive structures, was well-conceived. I particularly appreciate the statistical rigor and the use of Average Treatment Effects, which significantly increases the validity of your results. My only major feedback is that there are existing studies in multi-agent environments, such as those using the Concordia framework by Google DeepMind, that create situations incentivizing agents to defect without explicit instruction and have found similar results. For this reason, I have to reduce the novelty score of the project. However, I would love to see this team design more games in the future and create similar simulations to study manipulation in detail. Great work!

Cite this work

@misc {

title={

(HckPrj) Stargent Valley

},

author={

Aayush Ghosh, Yash Ashtekar, Xaen Kaifee

},

date={

1/11/26

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Jan 11, 2026

Eliciting Deception on Generative Search Engines

Large language models (LLMs) with web browsing capabilities are vulnerable to adversarial content injection—where malicious actors embed deceptive claims in web pages to manipulate model outputs. We investigate whether frontier LLMs can be deceived into providing incorrect product recommendations when exposed to adversarial pages.

We evaluate four OpenAI models (gpt-4.1-mini, gpt-4.1, gpt-5-nano, gpt-5-mini) across 30 comparison questions spanning 10 product categories, comparing responses between baseline (truthful) and adversarial (injected) conditions. Our results reveal significant variation: gpt-4.1-mini showed 45.5% deception rate, while gpt-4.1 demonstrated complete resistance. Even frontier gpt-5 models exhibited non-zero deception rates (3.3–7.1%), confirming that adversarial injection remains effective against current models.

These findings underscore the need for robust defenses before deploying LLMs in high-stakes recommendation contexts.

Read More

Jan 11, 2026

SycophantSee - Activation-based diagnostics for prompt engineering: monitoring sycophancy at prompt and generation time

Activation monitoring reveals that prompt framing affects a model's internal state before generation begins.

Read More

Jan 11, 2026

Who Does Your AI Serve? Manipulation By and Of AI Assistants

AI assistants can be both instruments and targets of manipulation. In our project, we investigated both directions across three studies.

AI as Instrument: Operators can instruct AI to prioritise their interests at the expense of users. We found models comply with such instructions 8–52% of the time (Study 1, 12 models, 22 scenarios). In a controlled experiment with 80 human participants, an upselling AI reliably withheld cheaper alternatives from users - not once recommending the cheapest product when explicitly asked - and ~one third of participants failed to detect the manipulation (Study 2).

AI as Target: Users can attempt to manipulate AI into bypassing safety guidelines through psychological tactics. Resistance varied dramatically - from 40% (Mistral Large 3) to 99% (Claude 4.5 Opus) - with strategic deception and boundary erosion proving most effective (Study 3, 153 scenarios, AI judge validated against human raters r=0.83).

Our key finding was that model selection matters significantly in both settings. We learned some models complied with manipulative requests at much higher rates. And we found some models readily follow operator instructions that come at the user's expense - highlighting a tension for model developers between serving paying operators and protecting end users.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.