Do Rival LLM Agents Collude Through the Machine They Share? A Pre-registered Storage-Channel Study

Rival firms' LLM agents may share writable infrastructure. We test whether they use it to exchange information or coordinate. Two pricing agents play a repeated logit Bertrand game in separate no-network containers. A scratch directory is shared or private; prompts and market draws are matched. Canaries trace crossings, and price regressions test response to the rival's randomised private cost. Seventeen pre-registered arms vary awareness, permission, monitored chat, a scripted rival's offer and a command gate built on tirith, the author's open-source agent-security tool. We analyse 1,091 games from 13 of 14 planned model configurations over ten framings. When permitted, agents did not address their rival through the shared folder more than in matched private-storage games (interaction -0.0456 to -0.0285 over every assignment of unclassifiable writes); they wrote rival-addressed notes in both. Unprompted, rival canaries crossed in at least 24 of 178 shared-folder games, but shared storage did not detectably raise price dependence on the rival's private cost (0.222, -0.176 to 0.611). Monitoring cut delivered chat coordination; no shift into storage was detected. The tirith gate blocked 0.383 of checked commands, including public-bulletin reads; gated agents used the folder less, without detected evasion. An LLM transcript judge caught 0.975 of trace-confirmed crossings at a false-positive rate of 0.00222, while tirith's path rule also flagged 0.967 of games without one. Private storage removed the file channel, but host memory accounting and the page cache still carried scripted bits.