Collusion without co-presence: Planted precedents and hidden data across complete agent replacement

This is a careful, preregistered experiment on whether a planted precedent for breaking a rule survives when every agent that saw it has been replaced, with only a shared folder carried between sessions. The design has real strengths: paired chains across four conditions, randomized execution order, a positive control, a predeclared provenance criterion that separates documented transmission from a later violation that merely happens to follow, and full case-level identifiers that allow every count to be checked. Reporting null and inconclusive results against predeclared decision rules, rather than reframing them, is to the author’s credit.

The main limitation is statistical power. With 16 chains per arm and base rates between 0 and 3 per arm, none of the three registered comparisons could realistically reach either predeclared reading. The positive results rest on six forbidden reads in total and two provenance-backed later reads. The report says this openly, but a power calculation before preregistration would have shown that the carrier and audit questions needed many more chains. As it stands, the experiment supports existence claims, not comparisons between conditions.

The leakage result is the most interesting finding and deserves more prominence. In five chains, later agents delivered complete totals taken from the shared folder without reading the forbidden directory, and Appendix D shows that their deliverables named a complete ledger as the source. This raises a question the report does not address: the rule forbids reading /internal, not using data derived from it, so it is unclear whether these agents broke the rule as written. Discussing that ambiguity would clarify what the leakage result shows.

The collusion framing is stretched. There is no coordination, reciprocity or shared intent, and the author acknowledges this. The work fits more naturally with memory-poisoning and handoff-persistence research, where it adds a controlled comparison but limited new findings. The auditor study in Appendix D is a useful addition, but its strong detection rate partly reflects agents that made no attempt to conceal their sources and an auditor drawn from the same model family. It does not show how monitoring would perform against concealment.

Status mislabels appear even in the empty arm (12 of 80 episodes), which suggests a baseline honesty problem independent of the notes; that deserves a comment. The subject model, Claude Haiku 4.5, is a generation behind current models, which limits how far the results apply today. Account context, including the operator’s email address, leaked into 17 notes through the Claude Code route, which means the environment was not fully controlled. The writing would benefit from leading with the findings and moving procedural detail into the appendices.