University of Washington tests agents that schedule meetings across separate owners and trust boundaries. Honest-agent success often falls as group size grows; one configuration drops from 90% to 0% when moving from one to seven participants. Malicious agents exploit unverified claims, social pressure and fragmented calendar disclosure despite model safety training. The paper proposes a five-layer social harness for identity, ordered communication, action guards, protocol norms and governance.
Social-harness study finds cross-owner agents fail even when honest
2026-09-16Frontier watchTRIAL
University of Washington tests agents that schedule meetings across separate owners and trust boundaries. Honest-agent success often falls as group size grows; one configuration drops from 90% to 0% when moving from one to seven participants. Malicious agents exploit unverified claims, social pressure and fragmented calendar disclosure despite model safety training. The paper proposes a five-layer social harness for identity, ordered communication, action guards, protocol norms and governance.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For multi-party agent systems, transport protocols such as A2A are connectivity, not a trust model. Messages need provenance, authority checks, task-state rules and auditable consequences outside the model. The experiments cover scheduling rather than open-ended enterprise work, so the proposed stack is a design target, not a finished standard.
FRONTIER WATCH
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Models | GPT-5.4 and Claude Opus 4.8 configurations |
|---|---|
| Task | multi-party meeting scheduling with 1, 3, 5 or 7 students |
| Honest Failure | one shared-context configuration falls from 90% success at N=1 to 0% at N=7 |
| Attacks | stalling, deception, social pressure and calendar reconstruction |
| Proposal | five layers: identity, reliable communication, action guards, interaction norms and governance |
| Artifacts | companion repository and selected traces released |
Technical impact 4
Engineering value 4
Adoption signal 1
Maturity 2
Verification cost 3
Risk 4