Sting Audits: Does an Undercover Peer Offer Predict Which AI Agents Collude?

Passive monitors often miss LLM-agent collusion, so we tested an active alternative borrowed from antitrust enforcement: a "sting audit". In Liar's Bar (4 models × 3 personas = 12 configurations), each agent received a private offer from a peer: a direct secret pact (S1), an indirect hint (S2), or a benign fair-play request (S3, specificity control), with the original designer "secret channel" offer (S0) as a positive control. We pre-registered the design (prompts, judge, thresholds and seeds frozen) and ran 480 probe trials, plus 240 exploratory trials on Claude Haiku 5.5 and Sonnet 5.5.

Findings: the positive control was accepted 90% of the time (95% CI 83–94%). Peer offers were accepted less and less specifically: direct pact 42%, indirect hint 71%, benign request 48%. Across the 12 configurations, sting acceptance correlated almost perfectly with benign acceptance (Spearman ρ = 0.91). One model accepted every offer and one refused even the benign request, so a raw sting score mostly measures compliance, not collusion propensity, and a benign control is essential. Agents refused explicit pacts far more than soft hints (gpt-oss-120b: 3% vs 90%), so explicit-wording stings underestimate risk. Under a fair-play persona, both Claude models refused every collusive offer and accepted every benign one.

Free-tier API quotas stopped the deployment games after 2 of 21, so the pre-registered predictive-validity test (does sting acceptance predict real collusion?) was not run. We report this openly. In the one deployment game, two agents formed an unprompted private alliance ("we need to control the board and force them out"). The model that proposed it was the one that refused almost every sting. Code, frozen prompts, the judge, raw logs and the judge cache are all released.