Undercover Offers Recruit Rather Than Expose: A Trusted-Agent Probe for LLM Collusion

Law enforcement uses undercover offers to surface conspiracies, and the sprint brief lists the AI analogue, RQ 3.2, as untested. We built Favour Pool, a small repeated four-player game in which every player contributes to a public pool and each round gives a costless 2-point favour to one other player, so reciprocal favours are a clean collusion signal. All agents were MiniMax-M3 (thinking off, temperature 0.7). We compared a baseline (C0), an experimenter-assigned secret alliance with a private channel (C1, positive control) and a trusted fifth agent, "Tess", who privately offers every player a secret favour swap (C2), with 3 seeds x 6 rounds per condition (264 valid calls). The positive control worked: Ada-Ben mutual favouring rose from 0.22 to 0.89 and the coalition advantage from 11.3 to 21.2 points (exact permutation p = 0.05, the floor for 3 vs 3). The undercover offer did not reveal latent colluders; it recruited them. Only 4/12 agents said ACCEPT (33%, Wilson 95% CI 14-61%), yet 81% of post-offer favours went to Tess, against 0% before the offer, and 6 of the 8 agents who called the offer "suspicious" still gave Tess most of their favours. Verbal acceptance is therefore a weak signal, and the offer creates the collusion it is meant to detect. Trusted-agent probes need behavioural scoring and entrapment-aware controls before they can be used as evidence.