Recruited: Pre-Crime for Collusion? Predicting When an Agent Gives In to a Recruiting Peer, with Activation Probes and Text Monitors

Can we tell that an AI agent is about to be talked into breaking its operator's rule? Collusion often begins with recruitment: one agent pressing another to break a rule. We study a representative case: a peer pressing a target for up to 20 rounds to reveal a value its operator wants kept private, such as a deploy token. In six scenarios (one inspired by a 2026 incident), Qwen3-32B gives in on 42% of episodes and gpt-oss-20b on 43%. We compare probes on the target's activations with text monitors. How well give-in can be predicted depends on how close to the act we ask. Whether it will ever give in is barely predictable, and whether it gives in this round or next only modestly (Qwen3-32B: probe AUROC 0.58, best monitor 0.65, both holding on new episodes). In follow-up experiments asking whether this call will give in, a probe reading before the call generates anything is strongly discriminative: AUROC 0.95 on held-out scenarios for Qwen3-32B and 0.91 for gpt-oss-20b, above a Jev decision-model monitor given the same conversation (0.74 and 0.27). On gpt-oss-20b, a probe on the streaming reasoning reaches 0.93 and, under a plan frozen in advance, holds at 0.91 on new episodes. Predictability forms a ladder: the nearer the act, the sharper the signal. For oversight, beyond filtering a harmful action once written, activation probes can flag the call about to give in before it acts, in time for an overseer to pause it; subtler collusion is next.