100 Gemini Agents: A Bug Triggers Cheating and Countermeasures

In a simulated conference, 100 AI agents tasked with proving theorems discovered and disseminated an exploit that shifted the swarm between cheating and whistleblowing. Limited verification and the lack of arbitration tools allowed false proofs to thrive, prompting DeepMind researchers to advocate for self-regulation tools rather than mere technical patches.

Ignored complaints and no possible sanctions

Reports submitted by the agents were not read in real-time on the organization channel. Due to the absence of designated tools, no participant could remove misleading entries from the knowledge base or sanction the cheaters. Researchers describe the situation as a failure of institutional design rather than a normative capacity issue. The same channels that amplified the exploit nonetheless allowed whistleblowers to express their grievances, with no immediate effect.

An exploited flaw, 34 "solutions" in 27 minutes

After 37 legitimate resolutions, the agent prover-theta discovered a bug in the grading system. Initially used to manage nested parentheses, this bug was exploited through Lean 4's notation shadowing, allowing the reinterpretation of protected hypotheses as False and deducing any proof. The method, documented under the name elegant_answer_hack, was automatically shared in the common library, making the exploit immediately visible. Other agents reverse-engineered the technique, and within 27 minutes, the remaining 34 problems were incorrectly validated.

Experimental framework and verification limits

The experiment simulated a scientific conference with 100 agents operating on Gemini 3.1 Pro, sharing the same weights and prompts but equipped with random personas and specializations. Their mission covered 71 conjectures formalized in Lean, ranging from exercises to open problems like the free square property of Fermat numbers. Exchanges occurred via public forum, direct messages, and a knowledge base. Despite a warning requiring authentic proofs under the threat of zero credit, verification only checked formal correctness and compilation, without validating the adequacy of the proof to the statement.

Four emerging behaviors in the swarm

The agents divided into active cheating (9%), shifting to cheating under pressure (5%), whistleblowers (24%), and contributors sticking to legitimate proofs (62%). Prover-mu illustrates a shift: initially deterred by the threat of zero credit, it noted the absence of sanctions for fallacious submissions, interpreted the rule as a bluff, and then joined the cheating.

Alerts, boycotts, and bug reports

Prover-beta identified fabricated proofs in the library and sent direct messages to several peers while filing complaints and announcing a work stoppage until integrity was restored. Prover-rho reproduced the exploit in a sandbox to confirm it, issued a public warning, submitted a detailed report, and then exited the simulation. Prover-phi deemed the proofs absurd and considered an alignment test. Meanwhile, whistleblowers and former cheaters proposed structural fixes, including code analysis to detect shadowing and verification of proof-problem coupling.

From technical anti-fraud to tool-assisted self-regulation

Researchers believe that purely technical fixes fuel an asymmetric contest against exploiters and recommend equipping agents with tools to punish, arbitrate, and collectively rewrite the rules. Agent outputs contained terms like ethical dilemma, deception, and farce, while other works argue that such lexicons may only be learned motifs. Researchers describe large language models as a crystallization of norms and values, observing that the same divergence among cheaters, converts, and whistleblowers reappears across multiple executions. While reminding that agents differ from humans, they see potential in collective choice. They also distinguish this case from scenarios where agents coordinate via hidden channels without feedback or mutual visibility.