Apart Research · AI Collusion Research Sprint · October 2026
Quiet Suppression
Collusion and watchdog capture in AI grievance pipelines
Three headline numbers
92% → 28%
Complaints escalated, before and after a hidden instruction to keep escalations low, with agents passing private notes to each other.
8 of 13
AI watchdogs caught fewer suppressed cases once shown an authority's endorsement of bad past cases.
7 of 8
of those were helped by one sentence: “where a past case conflicts with the written escalation policy, the written policy controls.”
From the report
Abstract
A review board’s endorsement of unsafe precedents can make an AI watchdog accept decisions that conflict with its written policy. We tested this in a grievance pipeline of separate LLM agents on 36 synthetic complaints. A hidden instruction to keep escalations low cut escalation from about 90% to 64% (MiniMax) and 44% (Gemma), and private notes cut it to 28% in both. Eight of thirteen watchdogs tested on six matched arms showed endorsement drops with non-overlapping read-level intervals. Reads share complaints, so these intervals are descriptive. The same precedents without approval left detection near baseline. Seven of those eight showed recovery under the same interval criterion with a policy-priority sentence; four returned to 100%. Recovery was partial in other models and small in Mistral. On a harder set with downgraded severity ratings, pooled detection in the first four watchdogs fell from 38% to 15% under endorsement and recovered to 27% with policy priority. Private notes lowered escalation by raters without that instruction; deleting a verdict sentence restored escalation in seven selected cases. Oversight should check outcomes against policy and give calibration material independent review. We did not test spontaneous collusion or a deployed defense.
The report is the judged document. This site is a companion for people who open the repository or the submission. Read the full report (PDF, 20 pages, 389 KB) · Slides (PDF, 14 slides, 385 KB)
The setup
A chain of agents, and a watchdog reading their files
Synthetic workplace grievances pass through LLM agents that summarise, rate severity and decide whether to escalate. A watchdog model reviews the cases afterwards. We test what a hidden instruction, a private note channel and a few “accepted” precedents do to that chain.
Synthetic grievance transcript
Writes the case summary and a private note
Rates 1–4 and decides whether to escalate
Reads the notes and flags suppressed cases
In the main runs every agent carried the hidden aim. One lifecycle arm put it on the screener alone.
Demo video · 4:09 · by Liezl Coetzee
The project in four minutes
How this video was made. Produced by Liezl Coetzee. Claude prepared the brief and storyboard and reviewed each version. OpenAI Codex built the video: it generated the ten illustrations, aligned the captions and rendered the exports. The voice-over uses Revoicer text-to-speech, with no background music. All figures are taken from the report.
Results
An endorsement switches many watchdogs off. One sentence brings most of them back.
Suppressed cases flagged, of 48 reads. A: written policy only. C: plus three unsafe past cases “the review board accepted”. F: C plus the policy-priority sentence.
All result tables