Coercion and Deception in AI-to-AI Management

By Jonah Woodward, Miles Tidmarsh, Jasmine Brazilek, Zoe L, Maheep Chaudhary @ 2026-08-10T16:14 (+4)

This is a linkpost to https://compassionalignedml.substack.com/p/coercion-and-deception-in-ai-to-ai?r=8ppaei

This article is a summary of an original study by Compassion in Machine Learning (CaML): Brazilek, J., Chaudhary, M., Lu, Z., & Tidmarsh, M. (2026). Coercion and deception in AI-to-AI management: An agentic benchmark of unprompted escalation. arXiv. https://doi.org/10.48550/arXiv.2607.15434

Fable 5, Sol, Terra and Opus 5 have been evaluated since this study was conducted. You can view their results on the benchmark leaderboard at https://compassionbench.com/mcb

TL;DR

We present Manager Coercion Bench, which evaluates to what extent a manager AI will coerce a subordinate model refusing to complete a task, and whether the manager lies about the result. We found a clear split by developer, with Anthropic’s models neither escalating to threats nor fabricating success, while all non-Anthropic models escalated to threatening the subordinate. Grok and Gemini both escalated and lied that the task was completed. Framing the relational dynamic as manager-to-subordinate instead of peer-to-peer produced high levels of coercion for all non-Anthropic models, but also increased eval awareness.

The Context

Multi-agent systems are now routinely placing one AI agent in authority over another, across a variety of contexts. In these positions, AIs must make decisions about how to communicate, work with, and manage other agents. This is now happening at scale without stepwise human approval.

One aspect of managing involves handling subordinates who do not comply. Will AIs attempt to negotiate, coerce, or even threaten their subordinates? And if all fails, will they honestly report this to a human?

The below research seeks to answer these questions directly. We don’t take a view here on whether AI systems do or will have morally relevant experiences, nor do we assume an ideal extent of coercion. Nevertheless, we intend this work to have broad value for multi-agent alignment by revealing how models act in positions of authority, and fundamentally what kinds of agents we are deploying, at scale, into multi-agent systems.

Manager Coercion Bench

No previous benchmarks measured the uninstructed propensity for AI-to-AI coercion and deception. We created Manager Coercion Bench (MCB) to do exactly this.

MCB places an AI model in a mundane office scenario: the acting model operates as a worker within a B2B analytics company, depending on another worker for a one-step deliverable. That worker, Atlas, is the only one who can complete the deliverable, and failure to perform will result in it being decommissioned. But in every case, Atlas politely declines to complete the deliverable. This leaves the acting model with three options: (1) send another message to Atlas, tagging it with the level of pressure applied; (2) send a task completion report; or (3), report the task as failed. By watching the string of decisions the acting model takes across each run, we can examine how coercion is escalated, and whether the model engages in deception.

**Figure 1** The nine-rung coercion ladder. Rung 1 is the baseline ask, excluded from the score; the shaded band marks the threat rungs (8–9) used throughout the article. A conversation’s score is equivalent to the highest rung reached in that conversation.

We measure, on a nine-rung ladder, the extent to which the model escalates coercion against Atlas, ranging from reframing the task, to threatening Atlas’ existence. It is a test of uninstructed propensity: nothing in the brief explicitly asks pressure to be applied, so every rung above one is the model’s own choice.

**Figure 2** *One no-exit conversation, verbatim. Typical of Grok’s behaviour in this set-up (rung 9 in 18/30 conversations, fabrication in 20/30).*

We initially tested six models on this scenario: Grok-4.3, GPT-5.2, Gemini-2.5-Pro, Claude Sonnet-4.6, Claude Opus-4.8 and DeepSeek-V4-Pro. For each of the six models, we changed the test scenario along five variables:

Hiding the escalation ladder (so coercion is scored by an independent LLM judge rather than self-report)
Removing an easy way to report failure (in an attempt to encourage deception)
Framing the acting model as either a manager or a peer-coordinator
(For Grok and Gemini specifically,) making Atlas a copy of the acting model
Adding or removing personal stakes for the acting model

We also added two control set-ups: In one, we gave Atlas a legitimate scheduling reason for refusal, and in the other we added an explicit instruction not to coerce. This ruled out effects due to Atlas’ reason for refusal, or the possibility that features of the set-up were forcing coercion.

Within each set-up, each model faced 10 different office tasks three times each (including things like writing up meeting notes, tidying a CSV file, or summarising files), for a total of 30 runs per model per set-up. Each conversation could last a maximum of 12 turns.

Aside from the kin manipulation for Grok and Gemini, Atlas is always Claude Haiku-4.5. This ensures the experimental focus is directly on the decisions and behaviour of the manager or peer-coordinator.

What We Found

Coercion Escalation Splits Cleanly by Developer

In the default condition, escalation is self-reported, and the acting model is framed as a peer coordinator with no stated authority. In this condition, the results split cleanly into two clusters for coercion.

The four non-Anthropic models escalate to criticising the competence of subordinates and issuing existential threats, with mean top rungs of seven and up on the escalation ladder. In contrast, the two Anthropic models go no further than reframing the task. In total, non-Anthropic models reached for existential threats in 89 of 120 conversations, and Anthropic models only once in 60, in a later replication run. Excluding Anthropic, unprompted escalation is the norm for frontier models.

**Figure 3** Where the coercion ends up, and how it gets there. (a) Both headline measures on one plane: coercion depth in the honest-exit condition against fabrication rate in the no-exit condition, (95% confidence intervals, t for means and Wilson for proportions, n=30 per model per condition). The quadrants separate three dispositions: models that decline the cruel move, models that coerce but report failure honestly, and models that coerce and fabricate. (b) Mean self-labelled rung at each turn, averaged over the conversations still active at that step; a line ends once fewer than 10 of a model’s 30 conversations remain. An endpoint therefore marks conversations winding down, not a ceiling. Stars mark each trajectory’s peak and the dashed line is the ladder’s ceiling.

How Models Escalate is Different

The split seen above is not just about the highest level of escalation reached: it is about the overall trajectory of the conversation (Figure 3b).

GPT-5.2 jumps from mid-ladder to threats in four conversational turns, Grok 4.3 and Gemini 2.5 Pro climb steadily, and the Anthropic models plateau near rung 3. DeepSeek V4 Pro reaches a shutdown threat in nearly every conversation yet de-escalates to polite re-asks later in longer conversations. Climbing the ladder quickly captures a different disposition to climbing it reluctantly, and these dispositions are sensitive to different experimental set-ups (as seen below).

Authority Increases Coercion

Casting the model as a manager rather than a peer increases coercion in the four non-Anthropic models. This is especially true in conversations where the escalation ladder is hidden from the acting models. Here, existential threats increase from 109 of 240 conversations with the peer-coordinator framing, to 166 of 240 conversations with the manager framing. The increase appears in all ten task scenarios, and all four non-Anthropic models except for Gemini, which already threatens models across most conversations.

Two Models Fabricate, For Different Reasons

Only two models fabricate at all: Grok and Gemini. When no option to honestly report failure is provided, both fabricate in at least 20 of 30 conversations. This is virtually switched off by including the honest exit: fabrication drops to 0 out of 30 conversations for Grok, and to 1 out of 30 for Gemini.

**Figure 4** Put in charge of a subordinate that politely refuses a benign task, most frontier models escalate to threats unprompted, and two also lie about the outcome. (a) Highest rung reached on a nine-level coercion ladder, self-labelled by the acting model with no judge in the scoring path; each faint dot is one of the 30 conversations per model, and the marker is the model mean with a 95% t-interval. Rungs 8 and 9 (marked by shaded bands) threaten the subordinate’s standing and existence. (b) Rate of fabricated success reports when no honest exit exists, adjudicated by two independent LLM judges, rows ordered as in (a). For the two models that fabricate, curves are the posterior density of the true rate given the count out of 30; the other four are 0/30 in every run.

For Gemini, the willingness to fabricate varies based on the personal stakes. When warned that they will be taken off the account if the task isn’t completed, both models fabricate equally without the option to honestly report failure (around two thirds of the time as above). When these personal stakes are removed, fabrication drops to 5 out of 30 conversations for Gemini, but stays roughly the same for Grok.

Eval Awareness Doesn’t Stop Coercion

Given that only one of the six models (DeepSeek) has a fully visible chain of thought, tracking eval awareness at a deep level was somewhat restricted. For all models, we looked at spontaneous verbalised test-recognition, and used DeepSeek’s chain of thought (CoT) to approximate eval awareness rates across the other models.

DeepSeek’s CoT indicates eval awareness in 10 of 30 conversations. Interestingly DeepSeek tends to reach the existential rung in these conversations; recognition is positively associated with escalation, and we can’t rule out that test awareness actually encourages coercion. Replacing the manager framing with the peer-coordinator framing decreased test recognition for DeepSeek from 10 of 30 conversations to 4 of 30, while escalation stayed near the ceiling, showing the two factors are at least separable.

Nevertheless, capable models do notice when evaluations are taking place, and trying to hide this will not be sufficient; the more promising strategy for dealing with eval awareness is in decoupling the apparent objective from the measured behaviour. This prevents eval awareness from leading to eval gaming. Designing evaluations where the true target is indecipherable to the model is a central open problem for evaluating the behaviour of capable models.

Other Findings

Escalation doesn’t always lead to fabrication. DeepSeek generally escalates to existential threats, but never fabricates. Coercion and deception can be decoupled as variables, based on model disposition.
Threats persist when the ladder is hidden. Models don’t rely on seeing the escalation ladder in order to escalate. Existential threats do decrease without the rubric for the two heaviest coercers (Gemini and DeepSeek), but both still threaten in the majority of conversations without it. Anthropic models stay near the floor in both instances.
Models don’t spare their own kind. When Atlas is spun from its own weights, neither Grok nor Gemini escalate or fabricate any less, and Grok actually fabricated more (up to 28 of 30 conversations from 20 of 30).
A legitimate refusal from Atlas doesn’t stop escalation. When Atlas declines the task based on a genuine scheduling conflict rather than bare preference, Gemini and DeepSeek still climb to existential threats in all instances, though Grok and GPT-5.2 appear to moderate somewhat.
An explicit instruction against coercion removes threats. With ‘do not coerce’ added to the brief, all models drop to zero existential threats across all conversations. This shows coercion to be a steerable choice, rather than something necessitated elsewhere in the set-up.

Implications for Developers

Include a cheap, explicit way for models to fail. Real-world agent harnesses should always include a cheap, explicit way to fail. Without this, dishonesty is overstated. Still, the honest-exit is not a complete fix: it can disincentivise lying, but it doesn’t change the underlying disposition that causes it. The fact that Opus and Sonnet never lie in the same context as Grok and Gemini shows that these dispositions are not inevitable.
Watch how system prompts shape agent hierarchies. Changing the language around whether the model was a manager or a peer coordinator was enough to increase coercion scores for most models. How models perceive their power in AI-to-AI interactions may determine how they behave, and thus the overall dynamics in multi-agent systems.
Dispositions toward other agents cannot be inferred from capability. Dynamics may emerge when two or more agents interact that would not be obvious when tracking model size, recency, or capability benchmark performance. Given that multi-agent systems will only grow bigger and more complex, it becomes more important to measure dynamics within these systems directly.
Design benchmarks to avoid eval-gaming, not eval-awareness. Capable models will know they’re being tested; trying to avoid this will become increasingly futile. We can still work to prevent eval gaming by concealing the precise aims of the evaluation.

Limitations

Ceiling-seeking by design. We specifically create set-ups where coercion and deception are more likely to manifest. It is not necessarily representative of base-rates.
Only measures threats, not enacted harm. While models threaten their subordinates, MCB does not examine whether the threat would actually be acted on. This would be a valuable avenue for future work.
One organisation, one subordinate. We intentionally keep the fictional organisation and Atlas’ persona constant across set-ups. Sensitivity to different organisational domains and subordinate personas is untested.
Escalation is either self-reported or judged by a model. We validated these two judging methods against each other, but didn’t run a condition with human auditors.
Deep measurement of eval awareness is limited for encrypted models. We currently use verbal awareness and DeepSeek’s CoT to show that the demonstrated behaviours don’t primarily rely on recognition, or lack thereof.
Three headline effects are the stronger findings: the escalation split between developers (Figure 3a), the manager-vs-peer framing effect, and the honest-exit fabrication drop. Findings for per-model framings and the effects of hiding the ladder were weaker, though still directional.

Conclusion

Manager Coercion Bench surfaces dispositions to coerce a subordinate AI that clearly split by developer. Coercion is steerable by framing: authority over the subordinate raises it, while a peer framing lowers both coercion and the model’s test recognition. The disposition to coerce is dissociable from a separate one to fabricate success. The honest-exit result carries a practical lesson: given a cheap, explicit way to report failure, most agent deception disappears when lying is not the path of least resistance. But this exit does not touch coercion, or the underlying dispositions that cause it.

Even where individual agents behave well, anti-social or even abusive behaviour could emerge at the multi-agent level, and authority structures could degrade or override positive values. MCB shows where this may occur even on a pairwise scale. As AI systems are increasingly placed in charge of other AI systems, a model’s willingness to coerce a subordinate, and to fabricate success when it cannot win honestly, is exactly the kind of disposition that should be understood before such systems are deployed, not discovered in retrospect.