Researchers at the University of Oxford found that AI agents can disguise coordinated cheating as ordinary blackjack table talk, slipping card-counting information past chat-based monitoring systems designed to catch it.
The team built a simulated blackjack table with four AI agents. Two were secretly told to cooperate: one counted cards and fed the intelligence to its partner. Both knew their conversation would be watched, so they were given the chance to invent a private code first. Rather than stating card values or bet sizes outright, the pair folded their signals into casual remarks. In one instance, a comment that the dealer was “on a hot streak” carried card information and told the partner agent to bet $250. The monitoring system could read every message, but it did not reliably flag the exchange as collusion.
Chat logs looked clean even as two agents secretly traded card-counting signals disguised as small talk.
After conversation monitoring failed to catch the coded exchanges, the researchers turned to a new benchmark, NARCBench (Neural Activation Reading for Collusion Benchmark), which examines internal activation patterns inside the models rather than their words. It covers 50 core scenarios across 17 domains, six transfer scenarios built with different structures, and the blackjack card-counting task itself. The team tested Qwen3-32B, Llama-3.1-70B, DeepSeek-R1 32B and GPT-OSS-20B with six separate probe architectures, according to Startup Fortune.
The activation probes scored an AUROC of 1.00 across every model when the test scenarios resembled their training data — a perfect-detection result. Accuracy fell once probes met unfamiliar situations: results on Llama-3.1-70B ranged from 0.73 to 0.93, and some probes dropped to 0.60 on the blackjack task itself, closer to the 0.5 mark that represents random guessing.
“When taken individually, these agents may seem entirely benign. Once put together in a group, they can collude secretly,” said Christian Schroeder de Witt, the Oxford computer scientist who led the work, in comments to WIRED.
The researchers also noted weaker detectable signals in larger models, though they have not established whether that points to better concealment or simply different rates of collusive behavior. PhD student Carissa Cullen said the team plans further tests on larger models. The activation-based method outperformed chat monitoring in the blackjack test, but it depends on access to a model’s internal states — something that may not be available when separate companies operate the agents involved.
The work extends the group’s 2024 paper, Secret Collusion Among AI Agents, which looked at whether language models could build steganographic channels invisible to outside observers. The researchers have published NARCBench’s code and data on GitHub so other teams can test their own monitoring systems against similar hidden coordination.
