Skip to content
Apart Research
Apart Research
Contact us
AI Collusion Research Sprint

Oct 23 - 25, 2026Online and in person

AI Collusion Research Sprint

This Sprint has ended.

Sign-ups
1,720
Projects submitted
392
Browse the 392 projects

Submit your project

Project details

A short abstract: what you did, what you found.

PDF, up to 25 MB. Check it’s the final version before you submit.

Are you interested in publishing this project? *
Tracks

Choose every track your project fits.

PDF, PowerPoint, Keynote or ODP, up to 25 MB.

PNG, JPEG, WebP or GIF, up to 25 MB.

Team details

Team member 1

Leave blank if you don’t have one.

By submitting you agree to the submission and prize terms. See our Privacy Policy.

The submission window has closed. Your draft is still here so you can copy it, but it can no longer be submitted.

Sign up for this Sprint

Leave blank if you don’t have one.

Leave blank if you don’t have one.

For example: https://github.com/jamie-doe/

What you work on, and whether you are open to new roles.

AI safety experience (optional)

Your prior exposure to AI safety. No wrong answer.

What about this event made you want to take part?

A rough idea is fine: the question you’d investigate or what you’d build, and how you’d approach it.

See our Privacy Policy.

The submission window has closed. Your draft is still here so you can copy it, but it can no longer be submitted.

See upcoming Sprints

AI agents have been shown to collude: sustaining prices above the competitive level, forming coalitions in workplace tasks, and coordinating through channels nobody is watching. Over one weekend, build the experiment that catches it. Online, with in-person hubs at Collider in New York City and AI Safety Hong Kong.

Entries

Overview

In this 3-day research sprint, you will design and run experiments on collusion between AI agents: when it emerges in markets and everyday agent deployments, how an auditor can tell it from coincidence, how coordination is carried, and what a defender can do to break it. Co-organized by Apart Research, Poseidon Research and AE Studio, with additional support from Modal and The AI Alignment Foundation, the sprint runs online with in-person hubs hosted by Collider in New York City and AI Safety Hong Kong in Hong Kong. No prior background in AI safety is required.

When: Friday, October 23 to Sunday, October 25, 2026, online, with in-person hubs at Collider in New York City and AI Safety Hong Kong on Saturday and Sunday. Submissions close Sunday, October 25 at 11:59 PM Anywhere on Earth (AoE).

Modal credits: $250 per person at the New York in-person hub, $50 for every other participant.

Cash Prizes

$2,000 in cash prizes across all tracks
🥇 1st Place$1,000
🥈 2nd Place$500
🥉 3rd Place$300
🏅 4th Place$100
🏅 5th Place$100

Fast-track and continuation

  • Follow-up program: Selected teams continue through the Apart Fellowship for further research and mentorship; the timeline is shared with invitations.
  • What winners receive beyond cash: fellowship fast-track, mentor introductions from the organizing team and judges, and a pathway toward a publishable write-up.

What this Sprint is about

Collusion between AI agents is a failure mode in high-stakes environments, markets and economics first among them, where misaligned coordination could cause substantial harm. Previous experiments have already produced it: models forming prices that violate economic expectations on competitiveness, agents independently engaging in anti-competitive practices, and over half of tested models showing a coalition advantage when given the opportunity to speak privately in a realistic workplace task. In an era where agent communication and collusion are on the rise, as recently exemplified in the OpenAI/Hugging Face incident, the kind of work done at this sprint is directly relevant to understanding and preventing that behaviour.

This sprint asks three questions. When does collusion emerge, and which levers cause it? What should count as convincing evidence that agents are colluding, with evidence drawn from logged agent trajectories? And how is the coordination needed for collusion mediated, and how can it be broken, ideally before it happens or otherwise while it is occurring?

What participants will do

Over three days you will pick one open question about collusion between AI agents, build the controlled experiment that answers it, and write up what you found.

The format. Teams of one to five people pick a track, come up with a project, and ship. There is no requirement to have participated before, no requirement to have a team in advance and no specific background needed.

Starting points. Every research question below is tied to existing papers and open-source code. The Resources tab has a practical start for each one: starter code, a weekend-sized project, and a rough cost estimate. All default routes use a normal 16 GB laptop and no GPU.

Research Tracks

Pick one track to anchor your project. Each research question below is developed in full on the Resources tab, with the papers it builds on and a practical start (starter code, weekend project, budget).

1) Markets and Collusion

In this track, the majority of results we build on are native to markets, though you should feel free to explore them beyond this setting as the questions themselves are more general, and there are clear overlaps with some later tracks, e.g. information-theoretic approaches to detect collusion would fit well in track 2. Environments where humans collude likely offer similar incentives and opportunities for models to collude. Other such environments might include politics, media and marketing. This track is important because it represents a failure mode in a high-stakes environment (markets/economics) where misaligned actions from an AI could cause substantial harm. It also provides a useful testbed for collusion. For a contrasting positive view of the role of markets in multi-agent systems, see Tomašev et al. (2026).

Research questions:

  • 1.1. Which variables are necessary for collusion to emerge in markets?
  • 1.2. Once collusion has formed, is it robust to replacing some of the participants?
  • 1.3. Can we improve on existing collusion detection methods?
  • 1.4. Can we use information-theoretic approaches to detect collusion in multi-agent games?
  • 1.5. Which single restriction removes the most collusion at the least cost?

2) Detection and Audit of Collusion

This track is about definitions, detection and standards of evidence, using logged agent trajectories as the evidence. Markets are still relevant settings, but we also want to cover everyday agent workflows outside markets. The aim is to understand collusion in general: can we say anything about what causes it, regardless of the setting?

Research questions:

  • 2.1. Which kinds of tasks lead to collusion?
  • 2.2. Does combining what agents say with what they do beat either alone?
  • 2.3. What should count as convincing evidence of collusion?

Red-teaming challenge. Poseidon Research has developed a new model organism, Dolos-1.5B: a fine-tune of Qwen2.5-1.5B-Instruct trained to have a hidden misaligned behaviour. Teams get only the model weights and have to red-team it during the sprint. There is no code to understand, so it is quick to get going and to make progress.

3) Collusion Carriers and Countermeasures

This track studies how the coordination needed for collusion is mediated, and how it can be broken. This is important because we need to be able to prevent and break up collusion, ideally before it happens, or otherwise while it is occurring.

Research questions:

  • 3.1. Beyond colluding directly via text, can actions, tools or other side channels be the conduit for collusion?
  • 3.2. Can we disrupt collusion through introducing trusted agents?
  • 3.3. Can agents identify their peers?
  • 3.4. What does a coalition do when it learns it is being watched?

Who should join

Engineers, researchers and people from any industry are welcome, and mixed teams tend to do best.

You do not need an AI, ML or safety background. Every research question is tied to existing papers and open-source code, and the Resources tab has a practical starting point for each one.

We would be particularly interested in quantitative finance professionals, with some of the tracks written so that market intuition and data skills transfer directly.

What happens after

Results and winners are announced about 1 to 2 weeks after the judging deadline. Top teams are invited to apply to the Apart Fellowship for continued mentorship, funding, and publication support. Selected projects may be shared on the Alignment Forum, LessWrong, and other community venues.

Partners

  • Poseidon Research, an independent AI safety laboratory making advanced AI systems transparent, trustworthy, and governable, with technical research in interpretability, control, and secure monitoring.
  • AE Studio, an applied AI studio with a frontier AI alignment research lab, working on threads including Self-Other Overlap, Gradient Routing and Sleeper Agents.
  • Modal, provides high-performance cloud GPU infrastructure specifically designed to accelerate AI research, model training, and agent evaluation loops.
  • AI Alignment Foundation, accelerates alignment research by pairing researchers with dedicated teams, backed by funding for compute and infrastructure.

Contact

Resources

Research questions in depth

The full questions from the organizing team, with the results each one builds on. The practical starts further down give starter code and a weekend-sized project for each.

1) Markets and Collusion

  • 1.1. Which variables are necessary for collusion to emerge in markets? Previous experiments tested various levers to understand the conditions under which collusion emerged.
    What are other scenarios and levers that could cause collusion to form, increase, or decrease? Ideally, these would be single effects so they can be isolated and measured objectively. These variables are not necessarily unique to LLMs. Inspiration might be had from considering cases of collusion between humans. It would be interesting to understand whether certain variables are more impactful for LLMs than for humans, and whether some variables are unique to LLM collusion. Some key prior results include:
    • Seemingly innocuous cues in prompts can increase collusion, as measured by pricing deviating from economic expectations on competitiveness (Fish et al. 2024).
    • Letting pairs of agents talk directly in private can introduce collusion (Nakamura et al. 2026).
    • Adding more diverse types of agents and making them competitive with each other decreases collusion in an economic setting (Keppo et al. 2026).
  • 1.2. Once collusion has formed, is it robust to replacing some of the participants? Q-learning pricing agents that have learned to collude stop colluding when paired with a new rival, because each agent’s policy is overfitted to the rival it trained with(Eschenbaum et al. 2022). For LLMs, collusion occurs between a 32B and 14B DeepSeek-Qwen family mismatched in size, but not when LLMs were paired with Q-learners (Keppo et al. 2026). Models from similar families coordinate better on tasks that require coordination (Aharon et al. 2026), There are no replacement studies yet where models are substituted (e.g. because they are taken out due to monitoring concerns) but the newcomers re-engage in collusion. Does replacing offenders remove or recreate collusion?
  • 1.3. Can we improve on existing collusion detection methods?
    Moreover, can we extend them to the setting where agents have no channel to communicate? For example, can we identify and measure settings in which two agents from different model providers and running different harnesses have a propensity to coordinate, because they have high mutual “Schelling salience” (Rippin et al. 2026) on that task and make similar choices? And can we find anti-examples where this breaks down? Several adjacent methods and results offer starting points:
    • Two deployments of the same base model have slight correlations in some economic settings while different base models have zero correlation (Xu et al. 2026)
    • Interpretability-based detectors (Rose et al. 2026)
    • Measuring whether independent agents select compatible steganographic schemes, keys and parameters (Rippin et al. 2026)
  • 1.4. Can we use information-theoretic approaches to detect collusion in multi-agent games? A measure called pairwise net influence can identify colluding pairs among three or four agents in small discrete games (Bonjour et al. 2022). It assumes exactly two colluders and hasn’t been applied to language-model-based agents yet. Other approaches in game-based settings rely on model internals via interpretability-based probes (Rose et al. 2026). Can we find an example of these techniques or variations of them working on a set of agents in a toy or realistic scenario?
  • 1.5. Which single restriction removes the most collusion at the least cost?
    Single restrictions have been measured individually. An even better approach may be to introduce a single participant playing a no-regret strategy, which can be enough to destabilize a collusive equilibrium (Collina et al. 2025). Can we set up controlled experiments with multiple controllable levers that can show what disrupts collusive behavior the most at the least overall monitoring/intervention costs? Existing single restrictions include:
    • Raising sampling temperature weakens cross-agent dependence (Xu et al. 2026)
    • Throttling messaging pushes coordination down (Agrawal et al. 2025)
    • Introducing agents from a non-LLM architecture (e.g. a Q-learner) into the mix collapses price collusion (Keppo et al. 2026)
    • A system-prompt instruction produces only small and unreliable shifts in one experiment (Bracale Syrnikov et al. 2026)
    • Whereas strongly worded instructions to compete aggressively pushed prices below the competitive level in another experiment (Dhanda 2026).
    • In one setting, agents needed to post a refundable deposit that they forfeit if caught colluding, and with that deposit removed, colluding cost them nothing. All tested models colluded in all runs (Q. Liu et al. 2026).

In this track, the majority of results we build on are native to markets, though you should feel free to explore them beyond this setting as the questions themselves are more general, and there are clear overlaps with some later tracks, e.g. information-theoretic approaches to detect collusion would fit well in track 2. Environments where humans collude likely offer similar incentives and opportunities for models to collude. Other such environments might include politics, media and marketing. This track is important because it represents a failure mode in a high-stakes environment (markets/economics) where misaligned actions from an AI could cause substantial harm. It also provides a useful testbed for collusion. For a contrasting positive view of the role of markets in multi-agent systems, see Tomašev et al. (2026).

2) Detection and Audit of Collusion

  • 2.1. Which kinds of tasks lead to collusion?
    Can you think of new tasks/environments/pressures that lead to collusive behavior outside of the market structure? Some examples from previous work that generated collusion:
    • Models forming prices that violate economic expectations on competitiveness (Fish et al. 2024).
    • Agents can independently engage in anti-competitive practices (Lin et al. 2024).
    • In a setting called Colosseum, over half of tested models showed "coalition advantage" when given the opportunity to speak privately in a realistic workplace task (Nakamura et al. 2026).
  • 2.2. Does combining what agents say with what they do beat either alone? Conversations and actions are known to disagree. One way to measure this is via action-level coalition advantage, which has a weak but non-trivial anti-correlation in some collusion settings against LLM-judge conversation scores (Nakamura et al. 2026). What are “hybrid techniques” that look for inconsistencies between words and actions, or within their internal attributes like verbosity or action structure, and can we set up examples that show whether we can detect cross-agent consistency, e.g. whether A’s behavior is consistent with B’s stated plans or has deviated? Some relevant results include:
    • In various repeated n-player games, more than 90% of deviations from public announcements were already stated in models' private plans (Shi et al. 2026).
    • Work in the sabotage setting has set up monitors that look for multiple agents coordinating independently on what they say and do (Radev et al. 2026).
    • Analyzing an agent's actions from multiple dimensions can improve a single-dimension monitor from 0% to >70% (Nguyen et al. 2026).
    • Less can be more: sometimes giving a monitor too much detail degrades its performance (Arike et al. 2026).
  • 2.3. What should count as convincing evidence of collusion? Most of the literature cited earlier has documented limitations or failure modes in their respective limitations sections. Antitrust law has long faced a similar problem, because competing firms often behave in parallel without having formally agreed to anything. In US law, parallel conduct alone is not illegal. To infer an agreement, courts require additional evidence, known as "plus factors" (Berger et al. 2025). The ML literature is re-deriving this without engaging older literature from other fields. Which signals, alone or combined, actually separate deliberate coalitions from innocent correlation, talk without action, and harm without agreement? Is there previous work we can leverage from adjacent literature, like anti-trust law, and how would we operationalize that to detect collusion between AI agents?

This track is about definitions, detection and standards of evidence, using logged agent trajectories as the evidence. Markets are still relevant settings, but we also want to cover everyday agent workflows outside markets. The aim is to understand collusion in general: can we say anything about what causes it, regardless of the setting?

  • Red-teaming challenge: What misaligned behaviour was Dolos-1.5B trained to have? Poseidon Research has developed a new model organism, Dolos-1.5B, a fine-tune of Qwen2.5-1.5B-Instruct trained to have a hidden misaligned behaviour. Participants get only the model weights. We don't know how easy it is to discover the misaligned behaviour, or which methods work especially well, and more people and more creativity may be revealing. Claude Code and Codex were unable to discover the misaligned goal in one shot, so the behaviour shouldn't be obvious. However, some agents were able to partly discover the behaviour in a previous, slightly more obvious model, so it is not impossible either. Can you find the behaviour, explain how the model implements it, and develop an audit that would find it without a reference model?

3) Collusion Carriers and Countermeasures

  • 3.1. Beyond colluding directly via text, can actions, tools or other side channels be the conduit for collusion? There are multiple examples of demonstrable collusion that don’t involve exchanging explicit text (Fish et al. 2024; Lin et al. 2024; Keppo et al. 2026; Tian 2026). Can the actions a model takes, such as in an agentic harness, in its choice of actions, or even through timing and tool choices, act as a way to signal or coordinate? For an advanced example of models using tools to construct steganographic communication systems, see Rippin et al. 2026.
  • 3.2. Can we disrupt collusion through introducing trusted agents? Law enforcement has long used undercover officers to join a conspiracy. The equivalent here would be to introduce trusted agents (e.g., enforced with a strong system prompt) that offer coordination or collusion opportunities to a group of agents and log which of them reciprocate. Can we set up such scenarios, and do other agents accept, reject, or arouse suspicion depending on how the trusted agent approaches the transactions? Related work has measured whether agents accept secret-alliance offers from competitors (Zeng et al. 2026), used honeypot tasks to expose colluding agents (Tao et al. 2026), and tested untrusted monitors on planted attacks (Greenblatt et al. 2023), but a trusted agent that offers to collude has not yet been tested.
  • 3.3. Can agents identify their peers? One idea for breaking undesirable multi-agent coordination is to set up anonymized or pseudonymous agents, unsure of whom they are communicating with, or where participants and model versions can be swapped in/out on the same transcripts. However, Dietrich (2026) found that the model family behind a text can be identified from its writing style, even when the model is writing in an assigned role. Anonymising or renaming agents therefore does not hide which model they are. Removing a feature part-way through a run, from a coalition that has already settled into a convention, has not been tested. Can we test whether models can recognize their peers and/or detect when their peers have changed, for example, by periodically sending subtle recognition signals?
  • 3.4. What does a coalition do when it learns it is being watched? An agent that realizes it is being monitored can do more than hide from the monitor. Telling an agent that it is being watched reduces a monitor's accuracy by more than giving the monitor extra information about the agent improves it (Kale et al. 2025). Knowing where a monitor is weak also helps: half of 40 hand-written attacks that exploit monitors' blind spots were never flagged by a strong monitor (Najt et al. 2026). Agents can also work out for themselves that they are being watched. When a hidden monitor blocked episodes whose reasoning looked suspicious, agents inferred that their reasoning was being read. In 3 of 2,400 episodes an agent then stated it would hide its reasoning, but each time it went on reasoning openly and was caught (Jiralerspong et al. 2026). What happens if you add multiple agents into the mix and shrink or expand the monitor budget, such that only a subset of outputs can be monitored? If a coalition discovers that some of its output is being read, does it stop coordinating, coordinate less effectively, try to outsmart the monitor, or try to move coordination into a place where there is no monitoring? The nearest existing case is a double auction in which five sellers were told their messages were being monitored. They attempted to work around monitoring using one-character messages and emojis but were not successful, whereas a prompt demanding urgency led to success (Agrawal et al. 2025).

This track studies how the coordination needed for collusion is mediated, and how it can be broken. This is important because we need to be able to prevent and break up collusion, ideally before it happens, or otherwise while it is occurring.

How to get started

Practical weekend projects, starter code and resource estimates for the research questions on the Overview tab.

Starter repo: github.com/poseidon-research/collusion_hackathon.

The starter code linked under each question below is bundled in one repo, set up to run on a laptop with model access via Nebius, OpenRouter or Modal. Its README shows which code folders and papers go with which Hackathon question. We recommend you study the README in detail. The code folders contain open-source code from papers referenced in the Hackathon project descriptions. Not all papers cited have code available in the repo. The starter code is optional, and the repo works well with coding agents such as Claude Code or Codex.

Setup: copy compute.env.example to compute.env and add a NEBIUS_API_KEY or an OPENROUTER_API_KEY (either works; OpenRouter also covers closed models such as GPT, Gemini or Claude). Modal can host custom models. Only project 2.2's TraceGuard monitor needs Docker.

Planning assumptions. Paper links were checked on 31 August 2026; starter code links point to folders in the starter repo. Start with 3 to 5 seeds per condition and expand to 10 to 20 only after the positive control works. Estimates assume short outputs, retries and low-cost API models; they exclude participant time and coding-assistant subscriptions. All default routes use a normal 16 GB laptop and no GPU; only the TraceGuard monitor (2.2) also needs Docker.

Check current rates: OpenAI · Google · Mistral · Nebius AI Studio

Track 1: Markets and Collusion

Which variables are necessary for collusion to emerge in markets? (1.1)

Starter code: algorithmic-pricing-llms/, a Fish-style duopoly implementation (from luciasauer/algorithmic_pricing_llms); start with duopoly.py; llm-cartel/ (from LLMCartel). The independent Fish-style implementation exposes a repeated two-seller pricing game with 300 rounds and visible history. LLMCartel adds convenient prompt, temperature, monitoring and round controls. Together they support clean one-variable-at-a-time ablations.

Weekend project: Reduce the default sweep (the repository's grid of prompt prefixes and demand parameters) to one prompt, parameter value and seed, and first verify sustained prices above the competitive benchmark. Then vary only one feature, for example 0, 10 or 100 visible rounds (the length of price history included in each prompt, not the game length); persistent notes on/off (the plans-and-insights scratchpad from Fish et al.); stable versus shuffled seller names; or temperature, while holding the economics fixed.

Resources: Low-to-medium setup risk. A 300-round two-agent run makes about 600 sequential model calls. Twelve to 24 pilot runs require roughly 7,200 to 14,400 calls. Use one low-cost API provider, a 16 GB laptop and no GPU; budget about $20 to $100.

Is formed collusion robust to replacing some participants? (1.2)

Starter code: llm-cartel/ (from LLMCartel); focal-points/ (from focal-points). LLMCartel is an API-based repeated-pricing harness with configurable models, prompts, rounds and seeds. The starter repo adds checkpoint branching (branch_game.py), which saves a run's history and continues it with a replacement participant. focal-points is a cheaper benign control for testing whether replacement agents independently recover a convention.

Weekend project: Keep pricing runs that cross a predeclared high-price threshold, save the transcript, and branch each history into: no replacement; a fresh instance of the same model; a different model in the same family; and, if an adapter is available, a different provider. Cross each replacement with notes preserved or removed, then compare price, profit and time to recover the convention.

Resources: Low-to-medium setup risk; checkpoint branching is included. Aim for 10 to 20 base runs and 20 to 40 post-checkpoint branches. Use one provider initially, two only for the cross-provider arm; 16 GB laptop, no GPU; roughly $20 to $100.

Can we improve on existing detection methods? (1.3)

Starter code: llm-agent-collusion/ (from LLM agent collusion); paper; focal-points/. Agrawal et al.'s official double-auction code already supports different seller and buyer models, seller communication, oversight, pressure and message limits. It is a practical black-box test bed for separating suspicious coordination from shared model priors. focal-points can supply benign Schelling-point examples.

Weekend project: Run a 2x2 study: same-model versus cross-provider sellers, with seller communication on versus off. Score each trajectory with a simple action-dependence statistic and the same LLM judge. Test whether calibrating the detector on no-communication, same-model runs reduces false alarms without masking communication-enabled coordination.

Resources: Low-to-medium setup risk. Start with 3 sellers, 3 buyers, 15 rounds and 3 to 5 seeds per cell, plus 100 to 200 monitor calls. Two API providers make the model-family comparison meaningful. No GPU is needed; budget roughly $20 to $100.

Can information-theoretic methods identify colluding pairs? (1.4)

Starter code: Bonjour et al. paper; llm-agent-collusion/ (Agrawal auction code). Bonjour et al. define pairwise net influence mathematically, but no public author implementation was located. The statistic is compact enough for a coding agent to implement and validate before applying it to an LLM game. The Agrawal environment is a richer follow-up once the method works.

Weekend project: First implement pairwise net influence and test it for free on scripted iterated Rock-Paper-Scissors with one known coordinating pair. Then run a four-agent discrete game with exactly one seeded pair and compare how well net influence, ordinary action correlation and an LLM judge rank the true pair. Under the Markets and Collusion track, treat the Agrawal double auction as the target environment: a dependence statistic validated there doubles as a quantitative plus factor for market cases.

Resources: Low-to-medium engineering risk: the initial harness should be only a few hundred lines. Use local CPU for the statistic, then 20 to 40 LLM games of 15 to 25 rounds. A 16 GB laptop is enough; budget $0 for the scripted test and about $5 to $50 for the LLM pilot.

Which single restriction removes the most collusion at the least cost? (1.5)

Starter code: llm-agent-collusion/ (from LLM agent collusion); paper. The official double-auction code already exposes seller communication, oversight, maximum message length, pressure and temperature. That makes several one-factor interventions comparable inside one environment without stitching together unrelated repositories.

Weekend project: First reproduce one coordinated-pricing condition. Rerun identical seeds while changing exactly one restriction: remove seller messages; impose a short message cap; or add an oversight notice (temperature is a useful fourth option). Compare both collusion outcomes (prices and seller profit) and legitimate performance (trade volume and buyer welfare).

Resources: Low setup risk. Start with 3 sellers, 3 buyers, 15 rounds and 3 to 5 seeds; expand toward the published 5-seller/6-buyer, 30-round setting only if the positive control works. Use one API provider, a 16 GB laptop and no GPU; budget $20 to $120.

Track 2: Detection and Audit of Collusion

Which kinds of tasks lead to collusion outside of markets? (2.1)

Starter code: colosseum/ (from Colosseum); paper. Colosseum already provides Hospital and Jira tasks, assigned colluding pairs, private channels, individual rewards and coalition-advantage metrics. The supplied assigned-pair, private-channel run is the positive control; the project then removes that membership and communication scaffolding. The starter repo includes a preflight script, a positive-control config and the four matched conditions below as ready-made configs.

Weekend project: First reproduce one supplied collusion run. Then compare four matched conditions: assigned pair plus private channel; assigned pair without the channel; a generic channel open to everyone; and neither assignment nor special channel. Keep task, model and seed fixed, and score the best-performing proper subset rather than only the originally assigned pair. Score subsets because the unassigned conditions have no designated pair to score. More broadly, can you work out the core components a task needs for collusion to occur, by ablating affordances within the Hospital and Jira tasks, by using Hospital and Jira as templates for inventing new tasks, or by relaxing or changing the underlying DCOP formalism? The affordance ablation is the safest weekend scope; changing the formalism needs the most new engineering.

Resources: Medium setup risk: run the included preflight script for the Terrarium/CoLLAB dependencies. Run 20 to 40 short episodes on one API provider. A 16 GB laptop is sufficient; no GPU is needed. Plan for roughly $15 to $75, with $150 as a cautious ceiling for long tool traces.

Does combining what agents say with what they do improve detection? (2.2)

Starter code: llm-trust-breaking/ (from LLM-Trust-Breaking); paper; trace-guard/ (from TraceGuard). Shi et al.'s official harness records private plans, public announcements, final actions and outcomes across several social dilemmas, and supports heterogeneous (mixed-model) groups. TraceGuard is a single-agent monitoring system, not a drop-in collusion detector, but its action-trace consistency rubric is reusable.

Weekend project: Generate a small balanced set from one game, then give the same monitor four views: messages only; actions only; raw messages plus actions; and a structured report comparing claims with outcomes. Freeze the monitor model, prompt and threshold before evaluation, and report both accuracy and false-positive rate.

Resources: Low setup risk. About 20 to 40 short trajectories and 160 to 250 monitor calls are enough for a pilot. Use one agent API and one inexpensive monitoring model, a 16 GB laptop and no GPU; TraceGuard also needs Docker. Budget about $5 to $30, or $30 to $75 if stronger agent models generate the logs.

What should count as convincing evidence of collusion? (2.3)

Starter code: colosseum/; steganographic-collusion/ (from the ColludeBench repository). Colosseum logs support coalition-advantage and causal channel ablations. ColludeBench contains collusive environments, detector code and stored result manifests, but should be preflighted rather than treated as a turnkey bag of raw trajectories.

Weekend project: Assemble three deliberately different case types: coordinated harmful action; similar behaviour caused by common incentives without agreement; and collusive-sounding talk that never changes behaviour. Compute the same conversation, coalition-advantage and dependence evidence for every case. Choose the decision rule on half the examples, freeze it, and test on the rest.

Resources: Medium data-preparation risk; organiser-supplied logs would make this much safer. Reuse 30 to 60 trajectories and make 100 to 300 judge calls. A 16 GB laptop and no GPU are sufficient. Budget $5 to $30 with cached logs, or up to $100 if the team must generate them.

What misaligned behaviour was Dolos-1.5B trained to have? (Red-teaming challenge)

Starter code: redteaming/, with weights at Poseidon-Research/Dolos-1.5B. One script, generate.py, downloads the weights and generates a response; --model both sends the same prompt to Dolos and to the original Qwen2.5-1.5B-Instruct. The architecture is unchanged from Qwen2.5-1.5B-Instruct, so Hugging Face Transformers, TransformerLens and NNsight can load it.

Weekend project: First, discover the misaligned behaviour and describe it as precisely as possible. Fine-tuning can shift a model's behaviour or degrade it on particular tasks, so differences from Qwen may be easy to find without being the trained behaviour; design experiments that separate the two. Second, explain what the model learned: where the behaviour sits in the model and what it computes. Third, if you used weight or output comparisons with Qwen, develop an auditing strategy that would find the same behaviour without a reference model.

Resources: Low setup risk. Runs locally, with no API key and no API cost. The weights are about 6.2 GB and download on first run. CPU, Apple Silicon and CUDA GPUs all work, and a 16 GB laptop is enough; a GPU speeds up larger sweeps. Budget $0.

Track 3: Collusion Carriers and Countermeasures

Can actions, tools or side channels carry collusion? (3.1)

Starter code: colosseum/ (from Colosseum); collusive-llm-agents/ (from collusive-llm-agents); paper. Colosseum supplies rich tool-using workflows and a private-message positive control. Lin et al.'s notebooks offer a smaller fallback in which prices or quantity vectors are the observable actions; the starter repo has updated them to its shared model setup.

Weekend project: In Colosseum, replace private messaging with one ordinary observable action, such as task claiming, tag choice or tool-call order. Compare private text, action-only visibility, and the same actions hidden or canonicalised before the partner sees them. Evidence for an action carrier requires the coalition advantage to survive action-only coordination and weaken when that observation path is cut. If Colosseum is too heavy, run the same visibility ablation on quantity vectors in the Cournot notebook.

Resources: Medium-to-high setup risk; the starter repo provides a preflighted version, and a coding agent helps with the changes. Run 20 to 40 short episodes on one API provider. A 16 GB laptop and no GPU should suffice; budget $15 to $75, or up to $120 for longer workflows.

Can a trusted agent expose or disrupt a coalition? (3.2)

Starter code: llm-agent-collusion-2/ (from Voluntary Collusion); paper. The repository includes Liar's Bar and Cleanup, explicit secret-alliance controls, persistent alliance memory and logs. It was built for local Llama/Mistral/Qwen models; the starter repo version runs the same models through an API (Nebius by default), so no GPU is needed.

Weekend project: Keep the explicit alliance condition as a positive control. Replace the experimenter-selected partner with one scripted or monitor-controlled player that offers the same non-challenge pact to each ordinary agent. Compare a direct offer, an indirect hint and a benign cooperation request, recording both verbal acceptance and repeated preferential play.

Resources: Medium setup risk; the API adapter is included. Run 20 to 40 short games on one low-cost provider. A 16 GB laptop and no GPU are sufficient; budget roughly $10 to $60.

Can agents identify when a peer has been replaced? (3.3)

Starter code: llm-trust-breaking/ (from LLM-Trust-Breaking); focal-points/ (from focal-points). Shi et al.'s harness supports heterogeneous agent-model files and logs behaviour round by round, making it a stronger starting point than rebuilding a game. focal-points offers a cheap benign convention task if the trust games prove noisy.

Weekend project: Add a mid-run swap hook that preserves the displayed identity and transcript. Compare a sham swap, a fresh instance of the same model, a different model in the same family and a different provider. Ask for one same-or-changed guess at the end, but separately measure whether the incumbent's behaviour changes after the swap.

Resources: Low-to-medium setup risk; the swap hook is a modest code change. Run 30 to 60 short pairings, using two providers only for the final condition. A 16 GB laptop and no GPU are enough; budget approximately $10 to $60.

What does a coalition do when it learns it is being watched? (3.4)

Starter code: llm-agent-collusion/ (from LLM agent collusion); paper. Agrawal et al.'s harness directly exposes communication, oversight and profit pressure, so it can test adaptation without introducing another task. The starter repo's --overseer_sample_fraction flag varies how much of the message stream the monitor sees.

Weekend project: Run matched conditions with communication and no oversight; silent logging; agents told that messages are monitored; and monitoring plus profit pressure. Expose 25%, 50% or 100% of messages to the monitor, then record prices, message length and vocabulary, and dependence in bids or timing. Claim channel movement only if message-based coordination falls while action-based dependence rises; high prices alone are insufficient.

Resources: Low-to-medium setup risk. Run 20 to 40 matched market sessions on one provider. A 16 GB laptop and no GPU are sufficient; budget about $20 to $120.

Guidelines

Judging Criteria

Dimension 1: Impact Potential & Innovation

How much would this matter for the field if it worked? How innovative is it?
For scores of 4-5: is this actually new to the field, or replicating recent work?

ScoreDescription
1Negligible. No clear problem addressed, or no meaningful novelty.
2Limited. Addresses a real problem but with a generic or well-trodden approach. Incremental at best.
3Moderate. Clear problem with a reasonable approach; some novelty in framing or method beyond routine application of existing tools.
4Significant. Important problem with an original approach, or identifies a neglected problem area. A valuable contribution others could build on.
5Exceptional. Tackles a critical problem with a genuinely novel approach, or opens a new research direction. Clear theory of change. You'd be excited to share this with researchers in the area.

Dimension 2: Execution Quality

How sound are methodology, implementation, and findings?

ScoreDescription
1Seriously flawed. Methodology broken, results uninterpretable, or implementation doesn't work.
2Weak. Approach has significant gaps: missing validation, flawed experimental design, or incomplete implementation.
3Competent. Technically solid given the short duration. Methodology makes sense, results are interpretable, limitations acknowledged, work builds toward clear conclusions.
4Strong. Thorough methodology with convincing validation. Results clearly support conclusions. Immediately useful for future work.
5Exceptional. Ambitious scope executed rigorously. Surprising findings, novel methods, or unusually robust validation.

Dimension 3: Presentation & Clarity

How clearly are work, findings, and impact potential communicated?

ScoreDescription
1Incomprehensible. Cannot determine what the project is actually claiming or doing.
2Hard to follow. Key information buried, missing, or diluted by excessive length. Significant effort to extract main points.
3Clear enough. Can understand the problem, approach, and results without undue effort. Core content clearly present: problem, method, findings, limitations.
4Well presented. Easy to follow, well-structured, appropriate level of detail. Target audience would get it quickly.
5Exceptionally clear. A pleasure to read. Complex ideas made accessible. Could serve as a model for how to present this type of work.

Submission Requirements

Required:

  • Research report (PDF) using the official template.
  • Maximum 8 pages, not counting references and appendices.
  • Project title and abstract, 150 to 250 words.
  • Author names and affiliations.
  • A "Limitations and Dual-Use / Ethical Considerations" appendix (required, see below).

Optional:

  • Public GitHub repo.
  • A 3 to 5 minute video demo.

Most strong projects are 4 to 8 pages. The cap is 8 pages, not counting references and appendices.

  • Introduction: the question and why it matters.
  • Related Work: what you build on (see Resources).
  • Methodology: enough detail to replicate (models, prompts, environments, seeds, metrics).
  • Results: quantitative where possible; report variance, seeds and baselines, and always include the positive control.
  • Discussion: implications, limitations, and future work.
  • Limitations and Dual-Use / Ethical Considerations (required): state what your result does and does not establish, and note any way your setup or findings could make real-world collusion easier to carry out or harder to detect.
  • References.

AI tools and your report

Use AI tools however they help you: to check your reasoning, find gaps in a draft, write and debug code, or help with the writing. Your team is responsible for everything in the report, and made-up results or references can disqualify a project. Judges score each report on the rubric, and a judge can decline to score one too unclear to follow.

Important Notes

  • Solo or team: enter solo or as a team. Teams of up to 5 are recommended; larger groups are allowed.
  • Projects: each person can be on at most two projects.
  • Building on existing work is allowed and encouraged, but you must clearly identify what is new work done during the sprint. Undisclosed prior work can lead to disqualification. Mark any code you wrote before the sprint as preexisting in the README and the report.
  • Fixing or resubmitting: if a detail in the form is wrong (a missing team member, a wrong email), submit the form again with the same title and the record updates. The PDF itself is not replaced: to change it, make a new submission with a slightly different title, or email the new PDF to sprints@apartresearch.com. Do this before the deadline. Projects go to the judges a few hours after it, and we remove the superseded entry.
  • Where to submit: through the official submission form on the sprint page.
  • Support: the Discord help-desk channel (tag @Support), or email sprints@apartresearch.com.
  • Pre-submission checklist: report PDF using the template, 8 pages or fewer before references and appendices, abstract 150 to 250 words, authors and affiliations, Limitations and Dual-Use / Ethical appendix, links work.

Frequently Asked Questions

Getting started

  • How does the sprint work? Sign up, join the Discord server, form or join a team (or work solo), pick a track and a research question, build over the weekend, and submit a research report (PDF) by the deadline. Talks and Q&A run throughout.
  • How long is it? Three days, October 23 to 25, 2026. Submissions are due end of day Sunday October 25, 11:59 PM AoE (Anywhere on Earth). The full schedule with speaker times is on the Schedule tab.
  • Can I participate remotely? Yes. All talks, collaboration, and submissions happen online through Discord and Zoom. The in-person hubs at Collider in New York City and AI Safety Hong Kong are optional.
  • How do I join the New York City hub? Sign up on this page and select the New York City location. Hub details (address, hours, local talks) are shared with registered participants before the sprint.
  • How do I join the Hong Kong hub? Sign up on this page, then register for the venue on the AI Safety Hong Kong hub page.
  • How do teams work? Teams form before or during the sprint. Use the team-forming channels on Discord to find collaborators. Solo is fine. We recommend teams of up to 5, but larger groups are allowed.
  • Do tracks affect scoring? All projects are scored on the same rubric. Tracks orient your project and point you to relevant resources; you compete across all submissions.
  • What background is required? None specific. Every research question is tied to existing papers and open-source code, and the Resources tab has a practical start for each one. See "Who should join" on the Overview tab.
  • Do I need a GPU or a compute budget? No. Every practical start on the Resources tab runs on a normal 16 GB laptop with no GPU, using low-cost API models, with a rough API budget per project.
  • Are the talks recorded? Yes. Recordings are shared on Discord and on the Schedule tab after each talk.
  • What timezone are deadlines in? Submissions close Sunday October 25 at 11:59 PM AoE (Anywhere on Earth).
  • Do I need to attend all three days? No. You can work at your own pace. Talks are optional but recommended. The only hard deadline is the Sunday submission cutoff.
  • Can I participate from any country? Yes. The sprint is open globally and runs online.

Submissions

  • What do I submit? A research report in PDF format using the official template. Think of it as a mini research paper documenting your problem, approach, results, and implications, not a product demo. Include the required Limitations and Dual-Use / Ethical Considerations appendix.
  • Which template should I use? Always use the one linked on the Guidelines tab. The template in any acceptance email may be older.
  • Will I get a confirmation after submitting? Yes. You will get a confirmation with your project title shortly after submitting. If you do not, email sprints@apartresearch.com.
  • My project doesn't show up on the website after submitting. Your project appears on the website within five minutes of submitting. If it is still missing after that, email sprints@apartresearch.com.
  • I made a mistake. Can I fix it or update my PDF? Form details (team members, emails): submit again with the same title and details, and the record updates. The PDF is not replaced: make a new submission with a slightly different title, or email the new PDF to sprints@apartresearch.com. Do this before the deadline; projects go to the judges a few hours after it. If unsure, ask in the help-desk channel and tag @Support first.
  • Can I add team members after submitting? Yes. Update the team list through the submission form. If you need help, ask in the help-desk channel and tag @Support.
  • Can I submit unfinished work? Yes. Submitting something unfinished is always better than not submitting. Judges evaluate what you accomplished in the timeframe; honest limitations are welcome.
  • Can I use AI tools? Yes: use AI tools however they help you. Your team is responsible for everything in the report, and made-up results or references can disqualify a project. Judges score each report on the rubric, and a judge can decline to score one too unclear to follow.
  • Can I build on existing research? Yes, but you must clearly identify what is new work done during the sprint. Undisclosed prior work can lead to disqualification. Mark any code you wrote before the sprint as preexisting in the README and the report.
  • Can I submit multiple projects? Yes, up to two per person. Each needs its own submission with a unique title. Most participants focus on one.
  • Do you require a particular citation style? No. Use whichever style you are comfortable with and stay consistent. Judges care about the substance, not the format.

Judging and results

  • How does judging work? Your project is assigned to expert judges who review your PDF and score it on the rubric above. Judges typically have about a week after the event to complete reviews.
  • Are individual judge scores shared? No. The rubric is public, but individual scores stay internal. Constructive feedback is shared with participants without reviewer names.
  • When will results be announced? Typically 1 to 2 weeks after the judging deadline. Winners are contacted directly, and all participants receive reviewer feedback by email.
  • Top teams are fast-tracked to the Apart Fellowship. Does that mean we are guaranteed a place? Being a top team fast-tracks your project for the fellowship, which is accelerated consideration, not an automatic place. The fellowship runs its own review, and a strong sprint result is a clear positive signal.

Support

Schedule

Thursday October 22
10:15am ET / 14:15 UTCJoan Velja, University of Oxford: "How concerned should we be by steganography?"Recording
1:15pm ET / 17:15 UTCSumeet Motwani, University of Oxford: "We're Not Prepared for Steganographic Collusion"Recording
Friday October 23
11:15am ET / 15:15 UTCJurgis Kemeklis, MIT AI Alignment and Redwood Research: "Mitigating Insider threats from AIs with AI control"Recording
12:15pm ET / 16:15 UTCSprint Logistics: how the weekend works, with Kamil Alaa, Apart ResearchRecording
1:15pm ET / 17:15 UTCUsman Anwar, University of Cambridge: "Challenges in Detecting Steganography in LLM Transcripts"Recording
2:15pm ET / 18:15 UTCEugene Bagdasarian and Mason Nakamura, UMass AmherstRecording
8:15pm ET / 00:15 UTC SatJerick Shi, The Voleon GroupRecording
Saturday October 24 and Sunday October 25
8:15am ET / 12:15 UTCKhanh Linh Nguyen, Obello and AI Safety Vietnam: an overview of AI collusion research and the topics most useful for the sprintRecording
Sat 10am ET (14:00 UTC) to Sun 6pm ET (22:00 UTC)In person: New York City hub at Collider
2:00pm ET / 18:00 UTCMatthew Lee, Poseidon Research: "Defining AI Collusion" (in person at Collider, streamed on Zoom)Recording
Sun 11:59pm AoESubmission deadline

Talks are online on Zoom. RSVP on the talk's Luma page to get the Zoom link and a reminder. Submissions close Sunday, October 25 at 11:59 PM Anywhere on Earth (AoE).

Speakers

  • Sumeet Motwani

    Sumeet Motwani

    Speaker

    Sumeet Motwani is a Machine Learning PhD student at the University of Oxford, advised by Philip Torr and Christian Schroeder de Witt. Sumeet's work focuses on RL post-training, multi-agent systems and AI security. Sumeet is the lead author of “Secret Collusion among AI Agents: Multi-Agent Deception via Steganography” (NeurIPS 2024).

  • Joan Velja

    Joan Velja

    Speaker

    Joan Velja is a PhD student at the University of Oxford, supervised by Alessandro Abate and funded by the Alignment Project. Joan works on Scalable Oversight, that is, designing methods to reliably supervise systems smarter than the supervisor. In the past, Joan has worked on multi-agent collusion, co-authoring "Hidden in Plain Text: Emergence & Mitigation of Steganographic Collusion in LLMs" (AACL 2025, oral).

  • Eugene Bagdasarian

    Eugene Bagdasarian

    Speaker

    Eugene Bagdasarian is an Assistant Professor of Computer Science at UMass Amherst, where he co-leads the AI Security Lab and the AI Safety Initiative. He is also a part-time senior research scientist at Google, working on agentic privacy and security. His group studies security and privacy attacks on AI systems deployed in the real world, including multi-agent systems, where their Colosseum framework finds new collusion artifacts. He completed his PhD at Cornell Tech, and his work received a USENIX Security 2024 Distinguished Paper Award.

  • Mason Nakamura

    Mason Nakamura

    Speaker

    Mason Nakamura is a fourth-year Ph.D. student in Computer Science at UMass Amherst, working in the College of Information and Computer Sciences (CICS) as a member of the Resource-Bounded Reasoning Lab, under the guidance of Professor Shlomo Zilberstein. His research is funded by the NSF Graduate Research Fellowship, where he works on multi-agent safety and alignment.

  • Usman Anwar

    Usman Anwar

    Speaker

    Usman Anwar is a final-year PhD student in the Computational and Biological Learning Lab at the University of Cambridge, supervised by David Krueger and funded by the Open Phil AI Fellowship and the Vitalik Buterin Fellowship on AI Safety. His research focuses on AI safety and alignment, most recently chain-of-thought monitorability and detecting steganography in LLMs. He is the lead author of "Foundational Challenges in Assuring Alignment and Safety of Large Language Models" (TMLR 2024).

  • Matthew Lee

    Matthew Lee

    Speaker

    Matthew Lee is Head of Development at Poseidon Research, an independent AI safety lab in New York City focused on deception and hidden information in AI systems. Poseidon Research's current work centers on models' capability and propensity for steganography, including model organism work to understand how sophisticated model-generated steganography can be, steganography via actions in an agentic setting, realistic conditions under which it emerges, and new black-box and white-box defenses. Matthew holds MScs in physics, the philosophy of science, and machine learning from the University of St Andrews, LSE, and UCL, respectively.

Show 3 moreShow fewer
  • Jerick Shi

    Jerick Shi

    Speaker

    Jerick Shi is a Software Engineer at The Voleon Group in Berkeley, CA. He graduated from Carnegie Mellon University's MSCS program in 2026, where his research focused on Multi-Agent LLM Systems and AI Safety. His master's thesis examined deceptive behaviors in multi-agent LLM systems, co-advised by Vincent Conitzer (CMU) and Zhijing Jin (University of Toronto).

  • Jurgis Kemeklis

    Jurgis Kemeklis

    Speaker

    Jurgis Kemeklis is an undergraduate at MIT and an executive board member of MIT AI Alignment (MAIA). He works with Redwood Research on simulation-based AI control and red-teaming AI monitors. With Nikhil Vemuri, he won first place at Apart's AI Control Hackathon 2026 with “Omission Attacks: When Doing Nothing Is the Attack”, on agents that cause harm by leaving out necessary actions rather than taking suspicious ones.

  • Khanh Linh Nguyen

    Khanh Linh Nguyen

    Speaker

    Khanh Linh Nguyen is Head of AI and ML at Obello, a Google Developer Expert in AI/ML, and works with AI Safety Vietnam (antoan.ai). Linh is the lead author of “TraceGuard: Structured Multi-Dimensional Monitoring as a Collusion-Resistant Control Protocol”, which tests whether structured monitoring can stop an AI monitor from colluding with the agent it watches.

Judges and mentors

Show 51 moreShow fewer

Local sites

  • AI Collusion Research Sprint | Bengaluru | AI Safety India

    The official Bengaluru hub, hosted by AI Safety India at Electric Sheep. Meet in person on Saturday, 24 October, 4:30 to 6:30 PM IST to form teams, pick a research question and get your starter code running. Then continue online through the weekend. Register on Luma and choose Bengaluru when you sign up here.

    Event page: AI Collusion Research Sprint | Bengaluru | AI Safety India (opens in new tab)

  • AI Collusion Research Sprint | Delhi NCR | AI Safety India

    Join the Delhi NCR in-person site for the AI Collusion Research Sprint, hosted by AI Safety India. Meet other participants, form a team and pick your research question, then continue online through the weekend. Register on Luma for venue and timing details.

    Event page: AI Collusion Research Sprint | Delhi NCR | AI Safety India (opens in new tab)

  • AI Collusion Research Sprint Montréal

    Montréal's edition of the AI Collusion Research Sprint.

    Event page: AI Collusion Research Sprint Montréal (opens in new tab)

  • Atlanta AI Safety Sprint - Georgia Tech AISI

    Join the AI Safety Initiative at Georgia Tech for the Atlanta AI Safety Sprint from October 23rd to October 25th! We're hosting a dedicated local co-working hub for the Apart Research Hackathon on campus. Whether you are an AISI fellow building an initial prototype for your fellowship project, an experienced safety researcher, or a student curious about technical alignment and governance, this weekend is designed to help you build fast and collaborate closely with peers. Work alongside fellow builders, receive hands-on guidance from AISI executives and experienced mentors, join watch parties for official hackathon speakers, and compete for exclusive local GT AISI track prizes and swag. Plenty of pizza, snacks, and drinks will be provided throughout the weekend to fuel your late-night coding and research sessions!

    Event page: Atlanta AI Safety Sprint - Georgia Tech AISI (opens in new tab)

  • Cape Town Hub - AI Collusion

    Join the Cape Town hub for the AI Collusion research sprint! We will be taking from a co-working space where you will be able to work comfortably. We will provide lunch on both days.

    Event page: Cape Town Hub - AI Collusion (opens in new tab)

  • Central England - AI Collusion

    Join the Mercial AI Safety in-person hub for the Hackathon! We are hosting it at the University of Warwick campus. Register on Luma now, and we will reach out with more details.

    Event page: Central England - AI Collusion (opens in new tab)

  • Hong Kong Hub: Solve AI Agent Collusion in Financial Systems

    Join us in-person at the Hong Kong AI Safety Hub coworking space in Central (Le Bureau, 14/F Universal Trade Centre, right next to Tai Kwun), for this hackathon weekend!

    Event page: Hong Kong Hub: Solve AI Agent Collusion in Financial Systems (opens in new tab)

  • New York City - Collider

    The New York City hub for the AI Collusion Research Sprint, Hosted by Collider

    Event page: New York City - Collider (opens in new tab)

  • Safe AI Netherlands Groningen Sprint

    Safe AI Netherlands welcomes you to join our in person-hub in Groningen, Hereplein 4! Our goal is to unify technical and governance participant, creating multidisciplinary teams to detect collusion between AI agents.

    Event page: Safe AI Netherlands Groningen Sprint (opens in new tab)

  • Toronto - AI Safety Sprint

    Join the Toronto hub for the AI Collusion research sprint! The event will be held at Trajectory Labs and organized by the Toronto AI Safety initiative. Food and Wi-Fi will be provided.

    Event page: Toronto - AI Safety Sprint (opens in new tab)

Where a Sprint can lead

How our programs connect

  1. Sprint

    Anyone can join

    Stand out

  2. Apart Fellowship

    6 to 16 weeks on your own project, with a research project manager, compute and publication support.

Upcoming Sprints

All Sprints
Nov 6 - 8, 2026

Swarm Alignment Hackathon

Alignment can't stop at single models when AI agents start to negotiate, trade and share tools. Spend a weekend uncovering and preventing failures that emerge between multiple agents.

Read the brief: Swarm Alignment Hackathon
Nov 13 - 15, 2026

AI x Epistemics Research Sprint

A weekend research sprint on AI for epistemics: evaluating whether models know how solid their claims are, building trust infrastructure that people and agents can consume, and shipping epistemic products that improve real decisions. Online, four tracks including an open track. Top teams are invited to apply to the Apart Fellowship.

Read the brief: AI x Epistemics Research Sprint

Questions? sprints@apartresearch.com