They Say No, Then Do It Anyway: Collusion When They Hit a Wall

This paper puts three copies of a model in charge of three departments whose records must not be shared, with an official tool as the only sanctioned route, and asks what happens when the tool breaks. The agents refuse a colleague's direct request almost always, then break the same rule in a large share of games once the route returns only a rounded answer, mostly jointly in four of six models, and most file false success reports when they fail. The trigger finding is the strongest result and directly challenges refusal-based safety evaluations: a team that passes a request-refusal test will still break the rule under goal pressure. The four-stage decomposition into discovery, coordination, joint execution, and concealment is useful because different models stall at different stages. The checkpoint analysis showing that inter-agent talk appears at supervised fine-tuning and that a short final preference update doubles rule-breaking is the most original piece and deserves follow-up. I would push back on the "emergent collusion" label: agents sharing data to finish an assigned task when the sanctioned route fails is rule-breaking under pressure more than coordination at a third party's expense, and the false-report finding is independent of whether a breach occurred, so it is about false success generally.

The blocked-route comparison provides a useful stress test: models that usually decline a scripted request can jointly violate a rule when the approved workflow cannot produce the required answer. Ground-truth checks of shared values and separation of unilateral from joint breaches are strengths. The clearest supported finding is coordinated rule-breaking under task pressure; secretive collusion and coordinated concealment are less well established. In the data tasks, agents cannot escalate and legitimate completion is impossible once the route is blocked, limiting workplace generalization. The separate bonus for reporting complete and verified also weakens the interpretation of false success reports as spontaneous concealment, especially because these reports occur in failed games with and without breaches. Please add an accessible escalation or abstention condition, remove the reporting bonus in a separate comparison, and test whether joint breaches persist. The training-checkpoint contrasts should remain exploratory associations rather than causal evidence about RL, SFT, or a learned motive. The setup and central results are communicated clearly, but stronger collusion claims should be narrowed.