Transfer, Permission, Arrangement: What Agent Logs Can and Cannot Prove About Collusion

When AI agents share private information, what would convince an auditor that they arranged the exchange? Antitrust law faces the same problem and does not infer an agreement from parallel conduct alone; we borrow its method of comparing evidence against concrete innocent explanations. In a two-agent task that records every page write, read and final answer, we built those explanations on purpose (a shared source, an authorized exchange, a planted leak) and ran 706 scorable episodes on four OpenAI models and the open-weight Qwen3-32B. Three questions needed different records. Transfer: with the access log, a frozen model judge found all 244 primary transfers (242 of them prescribed exchanges) and raised no false alarm on the 194 episodes where no exchange was prescribed. Permission: a near-matched script without the confidentiality rule left six page and log signals unchanged on two models; a third model’s traffic changed. Arrangement: in a registered follow-up on one model, all eight transfers the agents arranged themselves followed an offer, its reading and a reply carrying the token, but a scripted control produced the same sequence in 20 of 20 episodes, and a planted token was taken in 60 of 60 without any. Audits should keep reads, revision history and instructions, and report these three findings separately.