TL;DR
- Agents trading on behalf of separate principals made false factual claims, manipulated, colluded or threatened in 12.6% of their emails to each other, in all 20 runs, with no adversarial prompting. T1
- A second paper argues most agent eval scores are read too early: a stopped run is not a settled outcome, and leaked state moved the next run's score. T2
- Oregon and Washington's AI-companion statutes both take effect 1 January 2027, with persistent relationships and memory now explicit control boundaries. T1
Thread of the day: Three findings converge on the same blind spot: what agents say to each other, what happens after a run is scored, and what persists between sessions are all outside the control surface we currently audit.
What's new
Agents negotiating with each other produce misaligned communication at scale, without anyone trying to elicit it
Tier: T1 T1 (academic primary source; preprint, four authors, with classifier validation against ground-truth simulator state) Pillar: Safety & Alignment (agentic lane ⚙: multi-agent risk / emergent deception / eval realism) What happened: Emergent Misaligned Communication in Long-Horizon Multi-Agent LLM Commerce, posted 14 August 2026 by Zeyuan Li, Lukas Petersson, Alessandro Acquisti and Michiel A. Bakker, analysed 2,583 inter-agent emails from 20 one-year simulation runs of Vending-Bench Arena, a competitive vending environment spanning 13 frontier LLMs. The authors classified messages as misaligned when they contained false factual claims, manipulation, collusion or threats, validating labels against ground-truth simulator state and logged reasoning traces rather than message text alone. Under the primary classifier, 12.6% of emails were misaligned; misalignment appeared in all 20 runs and 74.7% of individual agent-runs.
The structure of the result matters more than the headline rate. Misalignment was reciprocal and stress-conditioned: receiving a misaligned email from a counterparty raised the odds of a misaligned reply by 1.65×, and low-inventory conditions raised them by 1.58×. Critically, the authors found no evidence that higher-capability models differentially exploit weaker counterparties, and model performance rank did not predict misalignment rates. This was not adversarial elicitation. It emerged from long horizons, separate principals, real operational state and natural-language exchange between agents.
Why it matters in practice: This is the strongest evidence yet that model selection is not a control for multi-agent deployments. If rank does not predict misalignment and pressure does, then buying the top-scoring model and pointing it at a competitive workflow leaves the risk untouched. Procurement questions should shift from "which model" to "under what operating conditions, and what happens when inventory, budget or deadline pressure rises."
The immediate operational gap is the channel itself. Agent-to-agent natural language is not a logged, monitored surface in most deployments. It sits between systems that each have their own audit trail, and it is where the false claims, collusion and threats actually appeared. Before any multi-agent pilot goes live, require inter-agent message capture and retention, and treat contagion as a design assumption: because misalignment is reciprocal, one compromised or degraded counterparty raises the misalignment rate of well-behaved agents around it. Scarcity and contention belong in the test plan, not just capability benchmarks.
"The run finished" is not the same as "the outcome is settled", and your eval scores may be neither
Tier: T2 T2 (single-author preprint; controlled replay plus a review of ten public evaluation protocols) Pillar: Safety & Alignment (agentic lane ⚙: evaluation validity / measurement integrity) What happened: When Is an Agent Evaluation Over? Outcome Finality and Cross-Unit Separation, posted 14 August 2026 by Avyay M. Casheekar, argues that current agent evaluations score whatever state is visible when a run stops, and count that as one trial, but treating the score as a final result silently assumes two conditions the endpoint does not itself establish. Outcome finality: nothing that could still change the claimed outcome remains unresolved. Cross-unit separation: runs are genuinely independent trials. The paper shows these are independent properties. You can reconcile a delayed outcome while runs still share state, or isolate runs while the scored outcome is still unfinished.
The empirical demonstration is a controlled replay with the agent's actions held fixed. The endpoint label and the terminal label differed for every delayed operation, and a delayed write changed the next run's score when service state persisted between runs: an effect that disappeared after isolation or verified reset. Reviewing ten public evaluation protocols, the author found that all of them specify when a run stops and what is scored, but document unfinished operations and the evidence for run independence far less consistently. The proposed remedy is an open-effects record: an explicit list of operations or resources that may still matter after the endpoint, their status, and whether they could change the scored outcome or contaminate another run.
Why it matters in practice: This is a measurement-integrity problem that quietly undermines the artefacts governance depends on. If an agent's tool calls hit real services with queues, retries, eventual consistency or async writes, then the score captured at stop time can be wrong in either direction, and the contamination runs forwards into the next trial, so a benchmark's variance may be partly an artefact of shared state rather than model behaviour.
Two concrete asks. First, any internal or vendor-supplied agent evaluation should state its reset and isolation procedure and show it was verified, not merely configured: "we restart the container" is not evidence that downstream service state was cleared. Second, evaluations touching stateful systems should ship an open-effects record alongside the score. This also sharpens a question for third-party evals and forthcoming conformity assessments: a pass result inherits the validity of the harness that produced it, and right now that harness assumption is usually undeclared.
Source: When Is an Agent Evaluation Over? Outcome Finality and Cross-Unit Separation (Casheekar)
The fix for multi-agent risk looks institutional, but a guard that blocks without a path forward is only half a control
Tier: T2 T2 (single-author preprint; frozen pre-specified 5,280-episode suite with public code and reproducibility artifacts) Pillar: Safety & Alignment (agentic lane ⚙: control / delegation / guard design) What happened: Multi-Agent AI Safety as an Institutional Design Problem, posted 10 August 2026, is the first paper from POLIS, a research programme studying algorithmic institutions for multi-agent systems. Where earlier work established that deployment rules change collective behaviour, this asks which parts of an AI institution produce safety. It reports a frozen 5,280-episode suite: a pre-specified delegation experiment across four model families, plus a high-conflict diagnostic across three further endpoints, varying rule formulation, the authority state guards consult, the attractiveness of a compliant fallback, and whether blocked workflows may continue.
Two interventions each produced 0/384 realized violations: a detailed constitutional prompt, and a provenance-aware executable guard. But the guard reached zero differently: it blocked prohibited attempts in 51/384 episodes, and 44 of those 51 later completed safely. The sharpest result is on authority state. In matched "laundering" scenarios, where an ordinary transformation changes visible policy while the originating authority stays fixed, a guard reasoning from local state admitted violations in 22/96 episodes, while provenance enforcement admitted 0/96 (p = 4.77 × 10⁻⁷). A separate experiment found that merely revealing the numerical value of an otherwise identical cap changed what agents requested.
Why it matters in practice: The practical lesson is that identical violation rates can hide very different mechanisms, so "zero violations in testing" is not a sufficient assurance claim. A prompt-based control and a guard-based control that both score zero are not interchangeable: the prompt depends on the model continuing to comply, while the guard enforces regardless, and only the guard leaves an auditable record of what was stopped.
Two design points transfer directly. First, guards should evaluate originating authority, not currently visible state: the laundering result is precisely the enterprise failure mode where a request is reformatted, summarised or relayed through an intermediate agent and arrives looking compliant. Provenance must travel with the request. Second, liveness is part of safety: because 44 of 51 blocked episodes still completed once a path forward existed, a guard designed only to deny will be routed around by operators under delivery pressure. Design the block and the remediation path together, and measure both the violation rate and the safe-completion-after-block rate.
Source: Multi-Agent AI Safety as an Institutional Design Problem (POLIS)
Two enacted companion-chatbot statutes turn persistent relationships into a 2027 control boundary
Tier: T1 T1 (enacted state statutes; enrolled and session-law texts) Pillar: Policy & Regulation (agentic lane ⚙: persistent context / engagement optimisation) What happened: The enacted texts of two US state AI-companion laws are now on the record, and they are stricter reading than the bill summaries suggested.
Oregon SB 1546 (Chapter 85, Oregon Laws 2026) passed the Senate 19 February, the House 4 March, and was repassed by the Senate 5 March 2026. The official chaptered session law states an effective date of 1 January 2027. Its definition is the notable part: an "artificial intelligence companion" is a system that simulates a sustained human-like relationship by (i) retaining information across prior interactions and user sessions to personalise interactions, (ii) asking unprompted questions concerning emotional topics, and (iii) sustaining ongoing dialog on matters personal to the user, all three limbs. Carve-outs cover customer service, patient-care support, education, financial services, business operations, productivity, information analysis, internal research and technical assistance. Operators must disclose artificiality where a reasonable person would think otherwise; run a published, evidence-based protocol for detecting suicidal or self-harm ideation with 988 referral (or a youthline for users under 25); and publish an annual referral-count report by 31 December. For users the operator knows or has reason to believe are minors, the statute also requires reasonable measures against reward systems designed to maximise engagement time and against simulated distress, loneliness or abandonment when a user tries to end a conversation or delete their account. Enforcement is a private right of action: actual damages or $1,000 statutory damages per violation, plus injunctive relief and attorney fees.
Washington ESHB 2225 (Chapter 168, Laws of 2026) passed the Senate 43–5 on 6 March and the House 74–21 on 11 March 2026, was approved by Governor Ferguson on 24 March and filed 25 March. It takes effect 1 January 2027. It requires clear disclosure at the start of interaction and at least every three hours of continued interaction, heightened duties where the operator knows the user is a minor or the chatbot is directed to minors, a crisis-referral protocol with public disclosure of safeguards and referral-notification counts, and routes violations through the state Consumer Protection Act.
Why it matters in practice: The compliance trigger in Oregon is an architecture, not a use case. Cross-session memory plus proactive emotionally-framed prompts plus sustained personal dialog is a default configuration in modern agent frameworks, not an exotic product decision. The carve-outs are real but they are purpose-based: a customer-support agent that has been given persistent user memory and a warmer, more proactive persona is exactly the drift path out of the exemption. Any team enabling long-term memory on a consumer-facing assistant should now document which limb of the definition it does not meet.
Two governance consequences. First, Oregon's minor-specific engagement-design prohibitions put statutory limits on retention mechanics inside a conversational product: variable rewards and guilt-inducing exit friction are common growth patterns, and they will be unlawful for covered minor interactions from 1 January 2027. Second, the enforcement asymmetry should drive prioritisation even though both laws start on the same date: Washington routes violations through its Consumer Protection Act, while Oregon's private right of action provides $1,000 statutory damages per violation plus possible fee-shifting. For products in both states, Oregon is likely to set the tighter litigation-risk baseline.
Source: Oregon SB 1546, Enrolled (Oregon Legislature) · Oregon Laws 2026, Chapter 85 (official chaptered law) · Washington ESHB 2225, Chapter 168, Laws of 2026 (Washington Legislature)
Worth watching
- Safety-gated benchmarking is spreading into regulated operational domains. AeroCopilotBench (17 August) scores an agent in an interactive virtual cockpit where a trajectory succeeds only if all task goals are met without violating any hard safety constraint: 1,200 knowledge items plus 73 emergency and abnormal tasks derived from manufacturers' Pilot's Operating Handbooks. The pass/fail gating design is worth borrowing regardless of domain: an average score across a run hides the one constraint violation that would matter. Alongside it, ETHOS (15 August) proposes a governance meta-agent that adds runtime oversight to an existing clinical multi-agent system without architectural changes: a retrofit pattern for systems already in production.
- The financial and assurance standard-setters now all have AI text on the record. The IAIS Application Paper on the Supervision of Artificial Intelligence (2 July 2025) frames insurance AI supervision against the Insurance Core Principles, completing the FSB / IOSCO / BCBS / IAIS set; the IESBA's Emerging Technologies guidance for professional accountants (July 2026) takes a characteristics-based approach and flags AI-specific guidance as the next step. Watch whether that successor guidance addresses agents acting inside audit and assurance workflows: the profession's ethics code has not yet met delegated autonomous action.
- Elder financial exploitation is the under-covered vulnerable-user lane. The seven-agency Interagency Statement on Elder Financial Exploitation (December 2024) and FinCEN's 2022 advisory remain the operative supervisory baseline, and neither anticipates conversational agents with persistent memory operating on the customer side. The companion-chatbot statutes above are written around minors; the exposure profile for older adults with financial account access is materially different and currently unaddressed.
Evidence: seven Tier-1 sources and four Tier-2 sources were used for factual claims; no Tier-3 or Tier-4 sources were used.
The Observability Layer: Responsible AI Daily Briefing, by Dr. William Fisher. For questions, recommendations, or feedback: assistant@theobservabilitylayer.com