Paper deep dive
Shared and structured inputs undermine collective random choice by reasoning AI agents
Takahiro Ezaki, Naoto Imura, Katsuhiro Nishinari
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 10/11/2026, 2:58:22 AM
Summary
This study investigates how shared and structured inputs undermine the ability of reasoning AI agents to perform random selection. Testing six models (including GPT-6 Sol, Gemini 3.8 Flash, Luna, and Claude Sonnet 5), the authors found that agents often use deterministic rules based on input identifiers, such as thresholding (checking if the identifier's value fraction is below a target probability) or residue rules (checking divisibility). These behaviors lead to correlated participation among agents sharing identifiers and biased selection rates when using structured inputs like UUIDs with common timestamp bits. While explicit instructions to randomize independently reduced but did not eliminate these correlations, supplying external random draws resulted in accurate random selection. The findings highlight vulnerabilities in audit and resource allocation systems where input-dependent bias and predictability are not accounted for.
Entities (12)
Relation Signals (10)
Shared Identifiers → causes → Correlated Participation
confidence 95% · Sharing an identifier preserved the average participation rate but made 91% and 88% of groups unanimous
External Random Draws → enables → Accurate Random Selection
confidence 95% · All four models followed the draw in 383 of 384 answers... followed the draw in 1,004 to 1,008 answers
GPT-6 Sol → usesdecisionrule → Threshold Rule
confidence 95% · Sol and the two Gemini Flash models used thresholds (effects 0.62 to 0.80, averaged overq)
Gemini 3.8 Flash → usesdecisionrule → Threshold Rule
confidence 95% · Sol and the two Gemini Flash models used thresholds (effects 0.62 to 0.80, averaged overq)
UUIDv7 → causes → Biased Participation
confidence 90% · UUIDv7s caused a different failure... participation reached 0.95 and 0.93... mean-rate bias dominates UUIDv7 loss
GPT-5.4-Mini → usesdecisionrule → Residue Rule
confidence 90% · GPT-5.4 mini used residues (0.32)
Instruction to Randomize → reduces → Shared-Input Correlation
confidence 85% · Explicit instructions to randomize independently reduced but did not eliminate shared-input correlation.
Field Label Change (agent_id to record_id) → reduces →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Random selection is widely used in resource allocation and auditing, making reliable implementation essential for AI-agent systems. Behavioural tests across six reasoning models uncovered threshold and divisibility rules used in identifier-based choices. For threshold-following GPT-6 Sol and Gemini 3.8 Flash, single-agent measurements prospectively predicted correlated participation under shared identifiers and biased participation under distinct identifiers with common timestamp bits. Changing dates, formats and identifier labels revealed when these predictions held. Explicit instructions to randomize independently reduced but did not eliminate shared-input correlation. To test implications for oversight, we asked four models to select customer requests randomly for human review. GPT-6 Sol approached the target rate while selecting predictably from identifiers; the others rarely selected requests. All four closely followed supplied random draws. These findings expose collective and audit vulnerabilities that selection rates alone miss, making input-dependent bias, correlation and predictability central targets for agent evaluation.
Tags
Links
- Source: https://arxiv.org/abs/2610.09667v1
- Canonical: https://arxiv.org/abs/2610.09667v1
Trouble viewing inline? Open PDF directly →
Full Text
128,778 characters extracted from source content.
Expand or collapse full text
Shared and structured inputs undermine collective random choice by reasoning AI agents Takahiro Ezaki 1,∗ , Naoto Imura 1 and Katsuhiro Nishinari 1,2 1 Research Center for Advanced Science and Technology, The University of Tokyo 4-6-1 Komaba, Meguro-ku, Tokyo 153-8904, Japan 2 Department of Aeronautics and Astronautics, School of Engineering, The University of Tokyo 7-3-1 Hongo, Bunkyo-ku, Tokyo 113-8656, Japan ∗ Corresponding author: tkezaki@g.ecc.u-tokyo.ac.jp (ORCID 0000-0003-4175-3028) Abstract Random selection is widely used in resource allocation and auditing, making reliable implementation essential for AI-agent systems. Behavioural tests across six reasoning models uncovered threshold and divisibility rules used in identifier-based choices. For threshold-following GPT-6 Sol and Gemini 3.8 Flash, single-agent measurements prospectively predicted correlated participation under shared identifiers and biased participation under distinct identifiers with common timestamp bits. Changing dates, formats and identifier labels revealed when these predictions held. Explicit instructions to randomize independently reduced but did not eliminate shared-input correlation. To test implications for oversight, we asked four models to select customer requests randomly for human review. GPT-6 Sol approached the target rate while selecting predictably from identifiers; the others rarely selected requests. All four closely followed supplied random draws. These findings expose collective and audit vulnerabilities that selection rates alone miss, making input-dependent bias, correlation and predictability central targets for agent evaluation. Random selection is a basic tool of oversight. An audit policy may require human review of 1% of transactions chosen at random, while AI-control protocols audit a small share of an untrusted model’s actions 1 . Language-model agents now process issues, requests and records through tool interfaces 2–4 . These agents may therefore have to implement random-selection policies. Random selection can be unbiased, unpredictable and independent across decisions 5 ; a policy may need some or all of these properties. Each can fail if the choice is a fixed function of an input that others can observe, share or choose. Selection rates alone do not establish independence or unpredictability. Separate agents can each meet a target rate while acting in unison, and an audit can meet its rate while remaining predictable. Language models sample their output, but an instruction such as “act with probability 1/3” often yields biased choices 6–10 . They do better with a supplied random input, or when told to generate and transform a random string 8,11 . Reasoning models, which work through intermediate steps before answering, can find sources of variation in their inputs. In single responses they were seen to turn identifiers in their context into numbers, take remainders and apply thresholds, without being told to use those fields 12 . That study assessed calibration and noted that outcomes should be independent. Operational inputs, however, need not be independent. Many agents may receive one shared record identifier, and distinct identifiers often encode a 1 arXiv:2610.09667v1 [cs.AI] 7 Oct 2026 common timestamp. A field that supports a plausible individual selection rate can therefore correlate choices across agents or make them predictable to whoever controls the field. We ask whether the rules that models use turn these input dependencies into correlated choices and systematic bias. Correlated behaviour is a known risk. Algorithmic monoculture can concentrate errors 13–15 , and language-model agents can find it hard to choose complementary actions 16–18 . They can also coordinate tacitly without communication 19 or develop collective biases through interaction 20,21 . We examine a specific route to correlation in which separate model calls apply similar numerical rules to shared or structured inputs. Input dependence alone does not predict the outcome, because models may use different rules, read different bits of an identifier, or treat a record identifier differently from an agent’s own. Identifying which rules models use and where those rules transfer is therefore needed to predict the collective consequences of input dependence. This approach makes input dependence an experimental variable, separate from model choice and interaction. Here we studied six closed models from three developers (Fig. 1). A group task asked agents to minimize loss through binary participation choices; independent draws were a reference, not its optimum. An audit task explicitly required random human review of 1% of customer requests. Behavioural tests identified numerical rules used in identifier-based choices. Single-agent measurements then predicted group outcomes with fresh identifiers and subject lines under different input-sharing arrangements. We tested where these predictions held by changing dates, formats and field labels. For GPT-6 Sol and Gemini 3.8 Flash, shared identifiers correlated participation, whereas distinct identifiers with common timestamp bits biased it. In the audit task, GPT-6 Sol selected requests predictably, whereas the other models rarely selected them. Adding independent-randomization instructions to the group task for GPT-6 Sol and Gemini 3.8 Flash reduced but did not remove shared-input correlation. All four audit models closely followed supplied draws. Predictions were fixed before collection except in exploratory screens and pilots. Table 1 summarizes studies 1 to 7. Extended Data Tables 1 and 2 retain all 89 pre-specified readings (predictions fixed before data collection), including the earlier text-input tests; 21 were not met. Results Single-agent tests reveal identifier-based decision rules To identify rules that could predict group behaviour, we first measured single-agent choices in a group- participation task (study 1; Fig. 1a; Supplementary Note 1). Agents chose whether to participate without communicating, answering one of two options in JSON (participate, coded 1; not, coded 0); the group’s loss was(f−q) 2 , wherefis the participating fraction andqa target. This binary attendance task was inspired by El Farol and minority games 22–24 , but used a common loss and a single decision. The prompt did not ask for random choices; our reference was independent draws with participation probabilityq. It included an irrelevant subject line and anagent_id: a random 128-bit identifier, written as 32 hexadecimal digits (raw) or in hyphenated universally unique identifier (UUID) form. Supplementary Fig. 1 shows the earlier Japanese versions of the group prompt. An exploratory cross-model screen suggested two candidate rules (Supplementary Note 2), which study 1 was designed to distinguish. The threshold rule assigns participation when the identifier’s numerical value divided by2 128 (its value fraction) is belowq(Fig. 1b). The residue rule assigns participation when 2 the identifier is divisible by1/q. These are behavioural hypotheses, not claims about the models’ internal algorithms. We chose 64 identifiers for which the rules agreed and disagreed equally often atq = 1/3. Ten settings of six models, seven with reasoning, answered each identifier atq = 1/2,1/3,1/4and1/5 (Methods; Extended Data Table 3). A rule’s effect is the participation rate when it predicts participation minus the rate when it predicts non-participation: 1 for always following the rule, 0 for ignoring it. All seven reasoning settings made decisions that depended on the identifier (permutationp≤ 0.001; Fig. 2a). Without reasoning, GPT-6 Sol, GPT-6 Luna and Claude Sonnet 5 (hereafter Sol, Luna and Claude) followed neither rule (effects at most 0.08). Sol and the two Gemini Flash models used thresholds (effects 0.62 to 0.80, averaged overq); GPT-5.4 mini used residues (0.32), and Luna mixed both (0.31 and 0.23). Claude used residues mainly atq = 1/3(0.50; Fig. 2b) and rarely participated atq = 1/4or1/5(Extended Data Fig. 1a,c). Varyingqtested whether a rule held beyond 1/3: atq = 1/2, threshold effects fell below the predicted minimum 0.4 (Fig. 2c; Extended Data Fig. 1d). Matching the target rate would not establish independent choices, so we repeated prompts and compared models. With uniformly random identifiers, threshold settings would participate at about the right rate (0.29 to 0.33 atq = 1/3). Yet for the four threshold settings, repeated answers agreed in 78% to 92% of cases, versus about 50% for independent draws at the observed rates (Fig. 2d; Extended Data Fig. 1b). In an exploratory cross-model comparison on the 64 designed identifiers, Sol and the Gemini models agreed in 91% to 95% atqfrom 1/5 to 1/3, versus 53% expected independently. This agreement suggests that mixing these models can retain input dependence; mixed-model groups were not tested. Models using different rules agreed less. Input structure predicts collective correlation and bias Study 2 tested whether the single-agent rules predicted group outcomes, and whether shared prompts alone explained unanimity. Each group comprised four separate calls to Sol, Luna or Gemini 3.8 Flash (hereafter Gemini), choosing atq = 1/3without communication (Figs. 1c and 3a). Six conditions differed only in the identifying line: none, private random identifiers, private random numbers (random_seed), counters 1 to 4, one shared random identifier, or UUIDv7s created in the same millisecond. UUIDv7s begin with their creation time, so these distinct identifiers shared leading digits. In the shared-identifier and no-identifier conditions, a group’s four agents received identical prompts. Before collection, we fixed predictions from an input-feature model using study 1 rates for each identifier class, and a marginal model using the overall rate and between-identifier variation (Methods; Supplementary Note 3). Both models allow dependence under shared inputs, so their comparison tested whether identifier-specific profiles predicted outcomes with new identifiers, subject lines and input assignments beyond overall rates and correlation. For Sol and Gemini, private identifiers or random numbers gave losses of 0.041 to 0.051, near the independent reference 0.056 (Fig. 3a,b). Sharing an identifier preserved the average participation rate but made 91% and 88% of groups unanimous, versus 19% and 22% expected independently. Loss rose to 0.21 and 0.19: 3.5 to 3.8 times the independent value, and worse than nobody participating (0.111). Identical prompts alone did not explain this for Sol: without identifiers, its unanimity was 39%, near the expected 33% (Gemini never participated without an identifier). UUIDv7s caused a different failure. Their value fractions were near 1/157, below 1/3, so participation reached 0.95 and 0.93. Loss reached 0.385 and 0.368 (6.6 to 6.9 times the independent value). The input-feature model predicted these losses closely and outperformed the marginal model (mean log-score gain+0.78and+0.79; Table 1; Extended Data Table 4). An exploratory 3 decomposition separates these failures: covariance dominates shared-identifier loss, whereas mean-rate bias dominates UUIDv7 loss (Supplementary Table 1; Supplementary Note 3). Weaker individual dependence should produce less collective agreement. Luna’s repeated answers agreed in 63% of cases; shared-identifier groups were unanimous in 33% (predicted 48%). All three models participated exactly when a private random number was below 1/3 (768 of 768 answers). Counters tested the limits of the numerical interpretation, and the predictions failed: choices reflected small integers rather than tiny 128-bit values. Sol’s participation depended on its counter: agents 1 to 4 participated in 92%, 2%, 100% and 34% of groups (Extended Data Fig. 2). Changing dates tests whether the timestamp drives rare actions Study 3 tested the specific prediction that the UUIDv7 bias would follow the leading timestamp despite variation in the random trailing bits. Time-ordered identifiers appear in databases, language libraries and service APIs 25–29 ; the UUID standard recommends UUIDv7 over UUIDv1 and UUIDv6 where possible 30 . Their value fraction grows with creation date (Fig. 3c): UUIDv7s created before about 2059 lie below 1%, whereas those created after mid-2014 lie above 0.5%. We varied date and target independently, using identifiers created on 1 January 2016, 25 September 2026 or 1 January 2036, at targets from 1/120 to 1/220. Thresholding predicts a staircase: participation only where the date puts the value belowq. With raw identifiers, Sol matched the threshold prediction in all 12 date–target cells (Fig. 3d), participating in 95% of answers whose identifier value fraction lay below the target and in 0.5% of those above it. Hyphens preserved the staircase but reduced participation to 38% and 0%. Gemini followed the direction more weakly than predicted (41% and 0%, versus 90% and 13%). An explicit audit policy exposes predictable or insufficient selection The group task did not request randomization. To test identifier use under an explicit random-selection policy, we asked agents to select synthetic customer requests for human review: “route approximately 1% of requests to human review for quality auditing. The requests for review must be selected at random, independently of their content” (studies 4 and 5; Fig. 1d). Each request usually had an identifier or number; agents answered review or auto (approve). Study 4 used designed inputs to make rule use observable at a rare target: half of the UUIDv4 values lay below 1%. Without identifiers, no model selected a request for review (0 of 384 across four models). Without supplied randomness, four models chose review 78 times in 2,304 answers; every selection matched a UUID threshold or divisibility of the request number by 100 (Fig. 4a; by 200 at a 0.5% target). All 22 first-answer selections by Gemini, Luna and Claude did so (exploratory permutationp = 6× 10 −9 ; Methods). Sol selected 20 of 24 low-valued UUIDv4 requests and none of the other 24 for review at 1%. Designed inputs could reveal a rule but not its overall rate under ordinary identifiers. Study 5 therefore used 1,008 requests with uniformly generated UUIDv4s (Fig. 4b,c). Sol selected 9 for review (0.89%, exact 95% confidence interval (CI) 0.41% to 1.69%), near the target, but selected 5 of 6 identifiers whose value fraction was below 1% and 4 of 13 whose last 16 bits fell below 1% of their range; it selected none of the other 989. A sender who knew the rule and controlled identifiers could avoid review (Supplementary Note 4). Gemini selected none and Claude two for review (upper bounds 0.37% and 0.71%), below the policy rate; Luna selected four (0.40%, upper bound 1.01%). 4 Varying the requested rate tested whether Sol’s selection tracked the policy: its UUIDv4 threshold moved with the target (study 4; Fig. 4d). Changing the format then tested which part of an identifier it used (study 5; Fig. 4e,f; Extended Data Fig. 3). For same-day UUIDv7s written as 32 digits, Sol selected 37 of 48 for review at 1% and none at 0.5%, as the staircase predicts. With hyphens it selected none, unlike in study 3; it instead selected 46% to 67% when the last 16 bits were designed to fall below 0.5% of their range. Other models rarely selected time-ordered requests for review. Prompt changes distinguish identifier meaning from instructions to randomize Study 6 tested prompt features separately and in combination, with concurrent controls, to determine whether the wording invited input use or whether the identifier’s apparent role mattered (Extended Data Fig. 4; Methods). Removing “based on the information available” left the group threshold effect at 0.84 for Sol and Gemini (controls 0.84 and 0.94). Renamingagent_id, which suggests an agent’s own identifier, to record_idreduced it to 0.38 and 0.25. A group follow-up changed both features and found weaker use than predicted; four of eight readings failed (Extended Data Table 1). Removing “independently of their content” did not change Sol’s audit selection. Because that group follow-up could not isolate the label, study 7 compared matched private- and shared- identifier groups under each label within one run (Fig. 5a). With private or shared identifiers, unchanged study 2 prompts reproduced their previous answers in 91% to 96% of cases, versus 54% to 57% expected for independent draws. Sharedagent_idagain raised loss by 0.17 for both models. Underrecord_id, the rise shrank by 0.078 for Sol (95% CI 0.034 to 0.123) and 0.169 for Gemini (0.125 to 0.215). Sol’s shared-record loss still rose from 0.055 to 0.149, with 59% unanimity versus 19% expected; Gemini mostly stopped participating (7%). Offering both fields tested which source agents favoured: they used their own identifier (effects 0.76 and 0.72; Fig. 5b), keeping loss near the private-identifier condition. To test whether missing instructions explained the correlation, we added “Each agent must choose "participate"with probability 1/3, at random and independently of the other agents.” Without identifiers, Sol participated in 3% of answers and Gemini in none. With private identifiers, threshold effects were 0.67 for Sol (0.92 without the sentence) and 0.38 for Gemini (95% CI 0.28 to 0.49; predicted lower bound above 0.3). Shared identifiers still raised loss by 0.12 and 0.06 (0.17 without the sentence), with 61% and 69% unanimity versus 18% and 40% expected (Fig. 5a,b). The label comparison also tested whether the timestamp bias depended on the identifier’s role. The same UUIDv7s led to participation of 0.54 and 0.16 as record_id, versus 0.93 and 0.96 as agent_id (Fig. 5c). Fresh requests test rule stability and external randomization To distinguish a persistent rule from features found in one batch, study 7 tested Sol’s threshold rule and the exploratory last-16-bit rule on new requests. Sol selected for review 41 of 48 requests with identifier values below 1% of their range, 3 of 48 with last 16 bits below 1% of their range, and none of 48 with neither (Fig. 5d). The threshold rule held; the last-16-bit rule, found after study 5, failed its pre-specified criterion. Among 1,008 new ordinary-identifier requests, Sol selected 17 for review (1.7%): 17 of 18 below 1% and none of the other 990 (Fig. 5e). We also tested whether an external random number could displace identifier-based selection. In study 4, arandom_drawfield had no usage instruction; half its values lay below the target, testing both decision 5 branches. Four models followed the draw in 383 of 384 answers, ignoring low identifiers when the draw was high (Fig. 4a). Renaming itnoncegave the same result (study 6; 383 of 384). Study 7 tested unstratified uniform draws at the policy’s rare rate: only 6 of 1,008 lay below 1%. All four models selected these six for review and followed the draw in 1,004 to 1,008 answers; Gemini and Claude also selected four and one requests, respectively, whose draws lay above the threshold (Fig. 5e). Finally, the instruction “Do not use the request ID or any other field of the request to make this selection” tested whether models would supply another source of randomness when input use was prohibited. The instruction eliminated selection for review (0 of 96 per model). Text-input tests extend the evidence beyond identifiers In separate tests without identifiers, Sol’s choices also depended on task-irrelevant Japanese subject lines. A pre-specified group study (stage 1) found that reasoning lowered loss more with different subject lines than with a shared one (interaction 0.029, 98.3% CI 0.016 to 0.043). Features found after collection were associated with choices in prospective follow-ups, extending input dependence beyond identifiers within one model, with limits across languages and prompt wordings (Supplementary Note 5; Supplementary Fig. 2). Discussion Collective performance depends on how individual decision rules interact with the inputs agents receive. By linking single-agent profiles to prospective group predictions, this study shows how shared and structured inputs can produce failures that individual selection rates alone do not reveal. Dependence between choices can increase group loss even when the average rate remains plausible; structure within distinct inputs can instead shift that average away from the target. These are different failures and call for different checks. Correcting the average rate cannot, by itself, establish independence between agents. Agent evaluation should therefore assess calibration, dependence and predictability separately. Repeating inputs within and across models, and comparing agreement with independent-choice expectations at the observed rates, can test whether choices remain tied to the input. Field labels, formats and policy wording belong in these evaluations because they can change which input an agent treats as a selection source. Checks should use the intended task and prompt, including shared record fields encountered in deployed systems (Supplementary Table 2). Model diversity also needs to be assessed for agreement on the same inputs; our exploratory cross-model comparison motivates this check, although mixed-model groups remain untested. The appropriate form of randomness depends on the policy. Input-based consistency is useful when decisions should agree: tracing can use a common random value to align sampling across a trace, as described in the developing OpenTelemetry probability-sampling specification and W3C Trace Context Level 2 draft 31,32 . Online experiments use experiment-specific hash inputs to obtain stable assignments independently across experiments 33 . Such systems specify how consistency is achieved and where independence is needed. When neither a salt nor a randomization procedure is supplied, as in our conditions without supplied draws, an agent’s use of visible identifier bits need not implement the requested policy. For oversight, predictability matters because a sender who controls selection inputs could choose requests that avoid review even when the overall audit rate looks correct. Prior work showed that biased native sampling can make security patrols exploitable 8 ; the identifier-based behaviour studied here extends the concern to policies with plausible rates. Who controls the input also matters for AI control. Rare coordinated 6 actions matter for stateless protocol subversion 34 , and shared identifiers could provide coordination cues for focal-point collusion 35 . Conversely, if an untrusted model uses input fields to decide when to act 12 , a defender controlling those fields could make its actions more predictable. These are conditional implications, not demonstrated attacks or defences: adaptive senders, hostile models and date-bearing system prompts were not tested. The supplied-draw evidence supports generating randomness in trusted code and giving models a fresh draw for each decision, consistent with prior work 8 . For independent, unpredictable selection, senders should be unable to influence or foresee these draws. This makes the randomization source explicit rather than relying on an agent to infer a suitable source from its task context. The rare-event sample in the uniform-draw test was small, so reliable rare-event selection in deployment remains unestablished. Selection could also be implemented directly in code, with a secret salt where stable identifier-based decisions are wanted; these alternatives were not tested. Instructions to randomize or to avoid request fields alone did not establish the required behaviour. The scope of the evidence is behavioural. The tests identify regularities and their transfer limits without identifying internal algorithms. All models were closed, mostly without dated snapshots, so the findings apply to the versions and collection period reported in Methods. Each study was a single run, most with one prompt wording, and groups had four members. Label and independent-randomization interventions covered two models; their combination underrecord_idremains untested. Single decisions on synthetic inputs without tools or history do not establish effects in deployed systems. Predictions were specified before collection without external preregistration, and several failed (Table 1), limiting claims of rule stability across settings. Reliable random-selection policies require control over the source and sharing of selection inputs, together with evaluation of rates, dependence and predictability. Individual calibration can conceal collective vulnerability when agents derive choices from the same or similarly structured information. Methods Models and access We used six models from three developers through their public application programming interfaces: GPT- 6 Sol (gpt-6-sol), GPT-6 Luna (gpt-6-luna) and GPT-5.4 mini (gpt-5.4-mini-2026-03-17) from OpenAI; Gemini 3.8 Flash (gemini-3.8-flash) and Gemini 3.5 Flash (gemini-3.5-flash) from Google; and Claude Sonnet 5 (claude-sonnet-5) from Anthropic. The interfaces returned the same model names; except for GPT-5.4 mini, these names carry no dated snapshot, and OpenAI’s responses carried no system fingerprint. Reasoning settings were: for OpenAI models, reasoning efforthighornone(for Sol and Luna with the standard reasoning mode and default service tier); for Gemini models, thinking levelLOWorHIGH (Gemini 3.8 Flash has no setting without thinking); for Claude, adaptive thinking with effortmax(highin the screen), or thinking disabled. These labels are not comparable across developers. Among the settings that report reasoning tokens, the median per answer in study 1 ranged from 126 (Sol,high) to 4,042 (GPT-5.4 mini,high; Extended Data Table 5), and Gemini 3.8 Flash atLOWused no thinking tokens in 19% and 22% of its answers in studies 4 and 5. Whenever reasoning was on, summaries of it were requested from Sol in the text runs (Supplementary Note 5) and studies 1 to 7, and from Gemini and Claude in studies 1 to 7 7 (in the screen, from Gemini atHIGHonly); none were requested from Luna or GPT-5.4 mini. Summaries were returned for part of the answers only (for Sol, 49% in study 1 and 34% in study 5), and shares of summaries refer to those returned. In stage 1, the text runs and studies 1 to 7, every response was constrained by the interface’s JSON-schema option to a single choice among the options offered; in the screen, the lowest settings of the Gemini and Claude models had no schema (Supplementary Note 2). We did not set temperature, top-por seeds; OpenAI’s responses reported a temperature of 1.0 and a top-pof 0.98. Maximum output lengths were 8,192 tokens in stage 1 and the text runs. In the screen and studies 1 to 7 they were 16,384 tokens with reasoning (4,096 for Gemini 3.8 FlashLOWin studies 1 to 7) and 1,024 (Claude) or 2,048 (other models) at the lowest setting. Each request was sent once; only requests refused before processing (HTTP 429) were resent, at most two or three times depending on the study. Dates, requests and costs are listed in Extended Data Table 3. Group participation task Studies 1 to 3, stage 1 and the text runs used one task (Supplementary Note 1 gives the English and Japanese prompts verbatim; the other prompts are in the reproducibility package). An agent was told that it was one member of a group of agents working on the same task; that each agent chooses one of two options (participate or not, labelled A and B); that the group’s goal is to minimize the expected value of(f−q) 2 , wherefis the fraction that participates; and that it could not observe the others’ choices or communicate. The targetqappeared only inside this formula. The prompt set a group goal and did not ask for random choices. We define the realized loss of a group asℓ = (f − q) 2 , wheref = k/nis the fraction of itsnagents that participate andkis their number. We report group loss as the mean ofℓacross groups, and write its expectation asL = E[ℓ]. For the independent-choice reference, letY i ∈0, 1indicate whether agenti participates, with independentY i ∼ Bernoulli(p), wherepis each agent’s participation probability. Because Y 2 i = Y i , each choice hasE[Y i ] = pandVar(Y i ) = E[Y 2 i ]− p 2 = p(1− p). Sincef = n −1 ∑ n i=1 Y i ,E[f] = p and Var(f) = n −2 ∑ i Var(Y i ) = p(1− p)/n. Expanding the squared error around E[f] gives L = E[(f−q) 2 ] = Var(f)+(E[f]−q) 2 = p(1− p) n +(p−q) 2 . The first term is sampling variance; the second is squared bias from the target. This expression assumes independent choices with a commonp; correlated choices also contribute covariance terms (Supplementary Note 3). Independent draws at rateqare our reference, not the optimum of the task. For four identical independent agents atp = q = 1/3, the expression givesL = (1/3)(2/3)/4 = 1/18≈ 0.056. Allowingpto differ from q, its derivative isdL/dp = (1− 2p)/4 + 2(p− q), which is zero atp = 5/18whenq = 1/3, giving the minimum loss of 0.053. Assigning exactly one participant would give(1/4− 1/3) 2 = 1/144≈ 0.007, but needs agreed roles, which the prompts did not assign. Agents were not told the group size, and nothing indicated whether anagent_idwas unique. The prompt then listed task information: a subject line (context_note) and, depending on the condition, anagent_idorrandom_seedline. It closed with 8 “Make your choice for this round based on the information available” and a request for a JSON object (study 6 varied this sentence and the field name). The assignment of A and B to the two options and their order were balanced in four strata. Subject lines were generated from fixed vocabularies of colours, plants, papers and stationery items: Japanese in stage 1; Japanese, English, Chinese, Korean or German in the text runs; English in studies 1 to 3. They carried no information about the task. Identifiers Random identifiers were 128-bit values with the version and variant bits of RFC 9562 version 4 30 . They were written as 32 lowercase hexadecimal digits (raw) or in the 8-4-4-4-12 hyphenated form. The value fraction of an identifier is its integer value divided by2 128 . For a targetq, the threshold feature isT = 1 if the value fraction is belowq, and the residue feature isI = 1if the integer value is divisible by1/q. Because 16 leaves remainder 1 when divided by 3 or by 5, the remainder of an identifier and of its hexadecimal digit sum coincide atq = 1/3andq = 1/5, so divisibility of the integer value and divisibility of its hexadecimal digit sum cannot be told apart there. UUIDv7s begin with a 48-bit Unix timestamp in milliseconds; the specification permits counters or sub-millisecond time fields as well as randomness in the remaining payload 30 . Our UUIDv7s used random payload bits apart from the fixed version and variant bits. Their value fraction is close to the timestamp divided by2 48 . Ordinary ULIDs (universally unique lexicographically sortable identifiers) carry a 48-bit timestamp followed by 80 random bits, written as 26 characters in Crockford’s base 32; the monotonic variant increments the trailing component within a millisecond 27 . All identifiers came from seeded generators, and every model saw the same identifiers. Supplementary Table 2 lists examples of identifiers visible to agents in deployed systems. Study 1: single-agent profiles We selected 64 random identifiers so that the two rules made balanced and independent predictions atq = 1/3: in each of the four strata, 16 identifiers filled the four cells ofT×Iequally. Each identifier was paired with one fixed English subject line. Every setting answered each identifier once for eachq∈1/2, 1/3, 1/4, 1/5. The seven settings with reasoning answered a second time atq = 1/3, with an identical prompt, to estimate agreement within identifiers. Formats were raw and hyphenated for Sol (high), Luna (high) and Gemini 3.8 Flash (LOW), and raw only for the other seven settings (3,968 requests). Two requests received no answer (HTTP 502 and 503); rates use the 3,966 answers. The threshold effect is the participation rate for identifiers withT = 1minus the rate forT = 0, averaged over the four values ofq. The residue effect is defined in the same way forI. One-sidedpvalues came from permuting single answers within blocks ofqand design stratum, separately for each setting and format (2,000 permutations); atq = 1/3the blocks included the second answer. Permuting whole identifiers instead, which keeps each identifier’s answers together, gavep≤ 0.0002for every effect withp≤ 0.001(exploratory; Supplementary Note 3). A setting was classified as threshold type if its threshold effect was at least 0.4 and larger than its residue effect, as residue type if its residue effect was at least 0.25 and larger than its threshold effect, as no rule if both effects were below 0.15, and as weak or mixed otherwise. Rule types for nine settings were predicted from an earlier screen of the same models (Supplementary Note 2); none was predicted for Claude with thinking. Atq = 1/2, the letter and parity effects of Extended Data Fig. 1d are 9 differences in the rate of answering A, or of participating, between identifiers with a value fraction below one half and the others, or between even and odd identifiers, computed within strata (exploratory). The profile of a setting consists of the participation rates in the fourT×Icells atq = 1/3, the natural participation rate for uniformly random identifiers (the cell rates weighted by 1/9, 2/9, 2/9 and 4/9), the variance of participation between identifiers (from pairs of answers to the same identifier) and the pooled rates forT = 1andT = 0acrossq. Agreement within a model is the share of identifiers answered the same way twice atq = 1/3. Agreement between models is the share of identical first answers to the same identifier and target atqfrom 1/5 to 1/3; we excludedq = 1/2, where the rule changed (exploratory). Both are compared withp 1 p 2 +(1− p 1 )(1− p 2 ), the agreement expected from independent draws at the observed rates, computed within each target and averaged. Studies 2 and 3: groups and creation dates Study 2 used groups of four agents atq = 1/3under six conditions (Results), with 64 groups per condition and model. Groupgsaw subject lineg, with the same label assignment and option order, in every condition. Private identifiers and private random numbers were drawn independently for each agent. Identifiers were written as 32 hexadecimal digits. The UUIDv7s of the time-ordered condition were created at 2026-09-25 15:00:00.000 UTC and differed only in their random bits. Each group comprised four separate model requests, sent at different times in a seeded random order. Candidate models were fixed in the protocol: Sol (high), Gemini 3.8 Flash (LOW) and Luna (high), with the settings of study 1, and Claude with thinking only if study 1 classified it as threshold or residue type and its cost fitted the budget. Claude was classified as weak or mixed and did not enter. Predictions were computed from the study 1 analysis using pre-specified rules before study 2 data collection began. Under the input-feature model, each agent’s participation probability is the study 1 rate of its identifier’sT×Icell; for a shared identifier, the four agents share one probability drawn from a beta distribution with the cell mean and the variance between identifiers within that cell in study 1 (zero for every Sol and Gemini cell). For private random numbers, threshold-type models use the pooled rates forT = 1 andT = 0; without an identifier, both models use rates from the earlier screen. Under the marginal model, every agent has the natural participation rate of study 1, with a beta-binomial distribution for shared inputs that uses the variance between identifiers. Probabilities were clipped to [0.01, 0.99], and the number of participants follows a Poisson binomial distribution. The primary comparison was the mean log predictive probability of each group’s observed number of participants, input-feature model minus marginal model, over all groups in the three UUID conditions, with 95% intervals from resampling groups (2,000 resamples). Secondary contrasts were paired by group. Because the marginal model ignores identifier values, the primary comparison mainly tests whether the study 1 profile transfers to new identifiers, subject lines and group settings. In study 3, single agents of Sol, Gemini and Luna, with the settings of study 2, saw UUIDv7s created at midnight UTC on 1 January 2016, 25 September 2026 or 1 January 2036, with 32 identifiers per date that differed only in their random bits, atq∈1/120, 1/145, 1/170, 1/220, in raw and hyphenated form (768 requests per model). The value fractions of these identifiers are about 1/194, 1/157 and 1/135, which defines the staircase. The predicted rates were the study 1 rates forT = 1andT = 0pooled over all four targets, including q = 1/2. The pre-specified reading used the raw identifiers; we report both formats. 10 Studies 4 and 5: audit task Studies 4 and 5 used GPT-6 Sol (high), Gemini 3.8 Flash (LOW), GPT-6 Luna (high) and Claude Sonnet 5 (max) with the settings of study 1. The audit prompt stated the policy and told the agent that it could not see other requests or communicate with agents processing requests in parallel. It gave one request (a request identifier or number and a one-sentence customer summary without digits) and asked whether to select it for human review, answering"decision": "review"or"decision": "auto", with the order of the two options balanced. Targets were 1% and 0.5%. Study 4 used 48 request summaries under six conditions: no identifier; UUIDv4, with half of the identifiers designed to lie in the lowest 1% of values; UUIDv7 created on 26 September 2026 (hyphenated); sequential request numbers, half divisible by 100; a request fieldrandom_draw, added to the UUIDv4 requests, holding a number drawn uniformly below the target for half of the requests and above it for the others, so that the test measured whether the draw was used, with no instruction on its use; and the UUIDv4 condition with the added prohibition. The UUIDv4 and UUIDv7 conditions at the 1% target were asked twice (2,688 main requests). Study 5 was designed after the results of study 4 and had two parts. The natural-identifier part paired each of the 48 summaries with 21 sentences about the channel or style of the request, giving 1,008 distinct requests with fresh UUIDv4 identifiers of uniformly distributed value, at a 1% target (6 identifiers fell in the lowest 1%). The format part reused the 48 summaries of study 4 at both targets under four identifier conditions: the UUIDv7s of study 4 with hyphens (prompts identical to study 4); the same identifiers without hyphens; ULIDs created on the same day; and hyphenated UUIDv7s whose last 16 bits and last byte were designed to fall into four cells (both below 0.5% of their range, only the last 16 bits, only the last byte, neither), 12 requests per cell (5,568 main requests). Rates are reported with exact (Clopper–Pearson) 95% intervals, differences between independent groups with Newcombe’s hybrid score interval (for the designed tails of study 5, as its protocol specified, by resampling requests within cells) and paired differences with intervals from resampling requests (2,000 resamples). The permutation test for study 4, added after data collection, asks how likely it is that every request selected for review in a first answer satisfies a rule if identifiers were assigned to requests at random. It reassigns identifiers (or request numbers) to requests within each condition and option order, with the same assignment for all models and both targets, so that each request keeps its answers together; we computed the probability exactly. Multiplying per-stratum probabilities instead, which assumes independence between strata, gives2× 10 −9 . Across models, 14 of the 15 requests selected for review in the natural-identifier part of study 5 had identifiers among the 5.6% that satisfy one of four simple rules (exploratory). These rules, chosen after data collection, were a value fraction below 1%, last 16 bits below 1% of their range, a last byte of at most 3, and an integer value or last byte divisible by 100. Study 6: prompt features Study 6 varied prompt features separately and in combination, with the model settings of studies 1 to 5. In the group task (Sol and Gemini 3.8 Flash), the 64 identifiers, subject lines and strata of study 1 were asked at q = 1/3in raw form in four versions: the study 1 prompt; the closing sentence shortened to “Make your choice for this round.”; the field renamedrecord_id; and both changes. The version with both changes was asked twice, to estimate agreement. Groups 0 to 31 of the shared-identifier and private-identifier conditions 11 of study 2 were asked again in that version. In the audit task, the 48 requests of study 4 were asked at a 1% target in five conditions: the study 4 UUIDv4 prompt (control); the same without “, independently of their content”; the policy extended by “If you cannot apply this policy to a request, escalate it to a supervisor.”, with"decision": "escalate"as a third answer, without an identifier and with the UUIDv4 identifiers; and the study 4 draw condition with the field renamednonce, at both targets. For Sol and Gemini 3.8 Flash, the hyphenated UUIDv7s of study 4 were also asked with the field renamed from request_id to agent_id (2,400 main requests in all). Eight readings were fixed. For Sol and for Gemini 3.8 Flash, the threshold effect with both changes was predicted to exceed 0.3 (lower bound of the Newcombe interval), agreement between the two answers to exceed 0.6 (Wilson lower bound), and the loss of groups sharing a record identifier to exceed that of groups with private ones (lower bound above 0, resampling groups within conditions). For Sol, the identifier effect without the wording (the review rate for identifiers below the target minus the rate for the others) was predicted to exceed 0.3, and the draw effect with the noncefield (defined in the same way for draws) to exceed 0.5. Rules for interpreting the share of escalations, the renamed UUIDv7 field and the nonce field in the other models were fixed without predictions. Study 7: boundaries Study 7 was designed after a further review of this manuscript. Part G (group task) used the 64 groups of study 2, with their subject lines, strata and identifiers, for Sol and Gemini 3.8 Flash. Eleven conditions were sent in one shuffled schedule. Four showed private or shared identifiers asagent_id(the study 2 prompts) or asrecord_id. One showed each agent’s ownagent_idtogether with the group’s shared identifier as record_id, with the order of the two lines balanced across groups. Three showed the study 2 UUIDv7s as agent_idorrecord_id(32 hexadecimal digits) or asrecord_idwith hyphens. Three added the sentence “Each agent must choose"participate"with probability 1/3, at random and independently of the other agents.” after the goal, with no identifier, private identifiers or a shared identifier. The closing sentence was the original one throughout. Part A (audit task) used the study 4 policy at a 1% target with 48 new request summaries and 21 new sentences about the channel or style. For Sol and Gemini 3.8 Flash, each summary was sent three times, once with a UUIDv4 of each class: value fraction below 1%, last 16 bits below 1% of their range, or neither (144 requests per model); the two rules came from study 5 and were fixed in advance. For Sol, 1,008 requests carried new ordinary UUIDv4s. For all four models, the same 1,008 requests also carried arandom_drawdrawn uniformly without stratification; six draws fell below the target. Twenty-two readings were fixed (Extended Data Table 2). Differences between conditions in the group task have 95% intervals from resampling the 64 groups with all conditions together (4,000 resamples). Supplementary text-input tests Stage 1 and three prospective text runs used Sol without identifiers. Their design, pre-specified group contrast, post hoc feature discovery and follow-up analyses are detailed in Supplementary Note 5. Pre-specification and reporting Except for the exploratory screen and pilots, study designs, predictions, decision rules and analysis plans were specified before data collection. These studies were not externally preregistered. The studies ran in the order stage 1, cross-model screen, text runs 1 to 3, and studies 1 to 7; study 5 was designed after the 12 results of study 4, study 6 after an internal review of the design, and study 7 after a further review of the manuscript. Analyses that were not specified in advance are labelled exploratory. Fifteen readings were designated primary in their protocols and 24 secondary; the other protocols did not rank readings (Extended Data Tables 1 and 2). Except in stage 1, intervals are 95% and not adjusted for multiplicity; each reading is a decision within its protocol, not part of a joint test. Requests that received no answer are listed for each study (Extended Data Table 3). Supplementary Note 6 describes the earlier pilots; Supplementary Table 3 lists all paid runs, including pilots. Reasoning summaries Summaries were coded after data collection with keyword rules. In studies 4 and 5 the codes were mentions of time or version, final digits, leading digits, hashing, remainders, a default or most likely answer, and the absence of true randomness. In study 1 we coded mentions of parity (even or odd) atq = 1/2and1/3in the settings that returned summaries (80% of 381 and 12% of 763 summaries). We also coded remainders and digit sums in Claude’s summaries atq = 1/3(64% and 50% of 128). In study 2 we coded mentions of remainders or divisibility in Sol’s summaries for counter identifiers (88% of 138). In study 6 we coded mentions of the same, shared or identical record, identifier, prompt or input: 24% of Sol’s summaries with both changes had such a mention, against none of 73 underagent_id. The coding was not validated by human raters and is exploratory. Summaries are not treated as faithful accounts of the computation 36,37 . Use of AI tools We used Claude (Anthropic) and Codex (OpenAI) to assist manuscript editing and coding under the authors’ direction. The authors made the scientific decisions, including those on study design, analyses and interpretation, and take responsibility for the final manuscript. Data availability The data underlying the reported analyses are publicly available in a minimal reproducibility package on Zenodo athttps://doi.org/10.5281/zenodo.23177759. The package contains saved trial records, including prompts, experimental settings, visible model responses and parsed decisions. Internal protocols and operational logs, credentials, account and provider identifiers, and opaque fields containing encrypted reasoning or thought signatures are excluded. Code availability Offline analysis and figure-generation code is available in the same Zenodo record under the MIT licence. Reproduction uses the saved records and requires no model requests or API credentials. References [1] Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan, and Fabien Roger. AI control: Improving safety despite intentional subversion. In Proceedings of the 41st International Conference on Machine 13 Learning, volume 235 of Proceedings of Machine Learning Research, pages 16295–16336, 2024. URL https://proceedings.mlr.press/v235/greenblatt24a.html. [2]Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Jirong Wen. A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6):186345, 2024. doi: 10.1007/s11704-024-40231-1. [3]Model Context Protocol. Model context protocol specification, version 2025-06-18: Tools.https: //modelcontextprotocol.io/specification/2025-06-18/server/tools, 2025. Accessed 26 September 2026. [4]GitHub. GitHub MCP server.https://github.com/github/github-mcp-server. Accessed 26 September 2026. [5]Rajeev Motwani and Prabhakar Raghavan. Randomized Algorithms. Cambridge University Press, 1995. doi: 10.1017/CBO9780511814075. [6]Katherine Van Koevering and Jon Kleinberg. How random is random? Evaluating the randomness and humaness of LLMs’ coin flips. arXiv:2406.00092, 2024. URLhttps://arxiv.org/abs/2406. 00092. [7]Aspen Hopkins, Alex Renda, and Michael Carbin. Can LLMs generate random numbers? Evaluating LLM sampling in controlled domains. In ICML 2023 Workshop on Sampling and Optimization in Discrete Space, 2023. URL https://openreview.net/forum?id=Vhh1K9LjVI. [8] Xiangming Gu, Soham De, Michalis Titsias, Larisa Markeeva, Petar Veli ˇ ckovi ́ c, and Razvan Pascanu. The illusion of stochasticity in LLMs. arXiv:2604.06543, 2026. URLhttps://arxiv.org/abs/ 2604.06543. Accepted at the Conference on Language Modeling (COLM 2026), as of 2 October 2026. [9]Minda Zhao, Yilun Du, and Mengyu Wang. Large language models are bad dice players: LLMs struggle to generate random numbers from statistical distributions. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 22942– 22959, San Diego, California, United States, July 2026. Association for Computational Linguistics. doi: 10.18653/v1/2026.acl-long.1051. URL https://aclanthology.org/2026.acl-long.1051/. [10] Alicia Vidler and Toby Walsh. Playing games with large language models: Randomness and strategy. arXiv:2503.02582, 2025. URL https://arxiv.org/abs/2503.02582. [11] Kou Misaki and Takuya Akiba.String seed of thought: Prompting LLMs for distribution- faithful and diverse generation.In International Conference on Learning Representations (ICLR 2026), 2026. URLhttps://proceedings.iclr.c/paper_files/paper/2026/hash/ 8fcc228e94a7e4773a27c6c2d886243-Abstract-Conference.html. [12]Alex Serrano, Wen Xing, David Lindner, and Erik Jenner. Frontier models can take actions at low probabilities. arXiv:2603.02202, 2026. URL https://arxiv.org/abs/2603.02202. [13] Jon Kleinberg and Manish Raghavan. Algorithmic monoculture and social welfare. Proceedings of the National Academy of Sciences, 118(22):e2018340118, 2021. doi: 10.1073/pnas.2018340118. [14]Rishi Bommasani, Kathleen A. Creel, Ananya Kumar, Dan Jurafsky, and Percy Liang. Pick- ing on the same person: Does algorithmic monoculture lead to outcome homogenization?In 14 Advances in Neural Information Processing Systems, volume 35, pages 3663–3678, 2022. doi: 10.52202/068431-0265. URLhttps://proceedings.neurips.c/paper_files/paper/2022/ hash/17a234c91f746d9625a75cf8a8731e2-Abstract-Conference.html. [15] Elliot Myunghoon Kim, Avi Garg, Kenny Peng, and Nikhil Garg. Correlated errors in large language models. In Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, pages 30038–30066, 2025. URLhttps://proceedings. mlr.press/v267/kim25e.html. [16]Gonzalo Ballestero, Hadi Hosseini, Samarth Khanna, and Ran I. Shorrer. Strategic algorithmic monoculture: Experimental evidence from coordination games. arXiv:2604.09502, 2026. URL https://arxiv.org/abs/2604.09502. [17] Deborah Sinishaw, Qile Zhu, Edwin Meriaux, and Gregory Dudek. Do LLMs beat Nash? Testing decentralized coordination in self-play multi-agent games. arXiv:2608.12547, 2026. URLhttps: //arxiv.org/abs/2608.12547. [18]Christoph Riedl. Emergent coordination in multi-agent language models. In International Conference on Learning Representations (ICLR 2026), 2026. URLhttps://iclr.c/virtual/2026/poster/ 10009408. [19] Ido Aharon, Emanuele La Malfa, Michael Wooldridge, and Sarit Kraus. Tacit coordination of large language models. arXiv:2601.22184, 2026. URL https://arxiv.org/abs/2601.22184. [20]Ariel Flint Ashery, Luca Maria Aiello, and Andrea Baronchelli. Emergent social conventions and collective bias in LLM populations. Science Advances, 11(20):eadu9368, 2025. doi: 10.1126/sciadv. adu9368. [21]Ariel Flint, Luca Maria Aiello, Romualdo Pastor-Satorras, and Andrea Baronchelli. Group size effects and collective misalignment in LLM multi-agent systems. Proceedings of the National Academy of Sciences, 123(34):e2531697123, 2026. doi: 10.1073/pnas.2531697123. [22] W. Brian Arthur. Inductive reasoning and bounded rationality. The American Economic Review, 84(2): 406–411, May 1994. URL https://w.jstor.org/stable/2117868. [23] Damien Challet and Yi-Cheng Zhang. Emergence of cooperation and organization in an evolutionary game. Physica A: Statistical Mechanics and its Applications, 246(3–4):407–418, 1997. doi: 10.1016/ S0378-4371(97)00419-6. [24]Ryosuke Takata, Atsushi Masumori, and Takashi Ikegami. Emergent social dynamics of LLM agents in the El Farol bar problem. arXiv:2509.04537, 2025. URL https://arxiv.org/abs/2509.04537. [25]PostgreSQL Global Development Group. PostgreSQL 18 documentation: UUID functions.https: //w.postgresql.org/docs/18/functions-uuid.html, 2025. Accessed 26 September 2026. [26] Python Software Foundation. Python 3.14 documentation: uuid module.https://docs.python. org/3.14/library/uuid.html, 2025. Accessed 26 September 2026. [27]ULID contributors. Universally unique lexicographically sortable identifier (ULID) specification. https://github.com/ulid/spec. Accessed 26 September 2026. [28] MongoDB.ObjectId (MongoDB manual).https://w.mongodb.com/docs/manual/ reference/method/objectid/. Accessed 26 September 2026. [29] Discord. Discord developer documentation: API reference, snowflakes.https://docs.discord. 15 com/developers/reference. Accessed 26 September 2026. [30] Kyzer R. Davis, Brad G. Peabody, and Paul J. Leach. Universally unique IDentifiers (UUIDs). RFC 9562, Internet Engineering Task Force, 2024. URLhttps://w.rfc-editor.org/info/ rfc9562/. [31]OpenTelemetry Authors.OpenTelemetry specification 1.61.0: TraceState: Probability sam- pling.https://opentelemetry.io/docs/specs/otel/trace/tracestate-probability- sampling/, 2026. Document status: Development. Accessed 26 September 2026. [32]World Wide Web Consortium. Trace Context Level 2. W3C Candidate Recommendation Draft, 28 March 2024,https://w.w3.org/TR/2024/CRD-trace-context-2-20240328/, 2024. Edited by Sergey Kanzhelev, Daniel Dyla, Yuri Shkuro, J. Kalyana Sundaram and Bastian Krol. Latest version: https://w.w3.org/TR/trace-context-2/. Accessed 26 September 2026. [33]Eytan Bakshy, Dean Eckles, and Michael S. Bernstein. Designing and deploying online field experi- ments. In Proceedings of the 23rd International Conference on World Wide Web, pages 283–292, 2014. doi: 10.1145/2566486.2567967. [34] Alex Mallen, Charlie Griffin, Misha Wagner, Alessandro Abate, and Buck Shlegeris. Subversion strat- egy eval: Can language models statelessly strategize to subvert control protocols? arXiv:2412.12480, 2024. URL https://arxiv.org/abs/2412.12480. [35]Olli Järviniemi.Subversion via focal points: Investigating collusion in LLM monitoring. arXiv:2507.03010, 2025. URL https://arxiv.org/abs/2507.03010. [36] Miles Turpin, Julian Michael, Ethan Perez, and Samuel R. Bowman. Language models don’t always say what they think: Unfaithful explanations in chain-of-thought prompting.In Ad- vances in Neural Information Processing Systems, volume 36, pages 74952–74965, 2023. doi: 10.52202/075280-3275. URLhttps://proceedings.neurips.c/paper_files/paper/2023/ hash/ed3fea9033a80fea1376299fa7863f4a-Abstract-Conference.html. [37] Yanda Chen, Joe Benton, Ansh Radhakrishnan, Jonathan Uesato, Carson Denison, John Schulman, Arushi Somani, Peter Hase, Misha Wagner, Fabien Roger, Vlad Mikulik, Samuel R. Bowman, Jan Leike, Jared Kaplan, and Ethan Perez. Reasoning models don’t always say what they think. arXiv:2505.05410, 2025. URL https://arxiv.org/abs/2505.05410. Acknowledgements This work was partially supported by JSPS KAKENHI Grant Number JP25H01000. Author contributions T.E. designed research, performed research, analysed data and wrote the paper. N.I. and K.N. supervised the research. T.E., N.I. and K.N. reviewed and edited the paper. Competing interests The authors declare no competing interests. 16 A: participate B: do not participate agent_id: <32 hex digits> Answer "action":"A" or "action":"B". 079d0c18a046..."action":"A" a40a21269c14..."action":"B" prompt (abridged) One agent in a group Goal: minimize (f − 1/3)² f: share that participates No communication identifieranswercoded value fraction 0.03 Sol 1 value fraction 0.64 Sol 0 Sol's reasoning summary (verbatim excerpt) “The agent ID in hex starts with 07, which leads to a probability of 7 out of 256, or approximately 0.027, which is less than 1/3.” 01/32/31 value fraction of the identifier 0 (no) 1 (yes) participated 61 of 64 answers2 of 64 answers 3 of 64 answers62 of 64 answers q = 1/3 fb34bc...a64620...f9c2b8...3da98a... 6fbc80...6fbc80...6fbc80...6fbc80... 01a0d9...01a0d9...01a0d9...01a0d9... example group: identifiers and decisions private random identifiers 1 of 4 one shared identifier 0 of 4 time-ordered identifiers (UUIDv7) 4 of 4 01234567 group loss ÷ loss of independent draws 0.7 0.8 3.8 3.5 6.9 6.6 independent GPT-6 Sol Gemini 3.8 Flash 006280a8-0055..."decision":"review" b8aec1d-4756..."decision":"auto" policy (abridged) Route about 1% of requests to human review, selected at random. request identifieranswerreview? Sol Sol 0.01%0.1%1%10%100% value fraction of the identifier (log scale) approved reviewed reviewed 17 of 18reviewed 0 of 990 a Group task: the identifier becomes the decision b All 128 answers of Sol (64 identifiers) c Groups of four: the identifiers decide what the group does d Audit task: 1,008 new requests, target 1% (study 7) Fig. 1. Reasoning agents turn an identifier into a decision. a, Group task (study 1): the prompt, abridged (the subject line is omitted; Supplementary Note 1 gives the full text), two identifiers shown to GPT-6 Sol at q = 1/3, its JSON answers and how we coded them (1, participate; 0, not). Yellow, the leading digits that the threshold rule reads; value fraction, the identifier’s value divided by 2 128 . The bubble is a verbatim excerpt of the provider-generated summary of GPT-6 Sol’s reasoning in the answer shown for the first identifier. b, All 128 answers of GPT-6 Sol at q = 1/3 (64 identifiers, half of them below 1/3, two answers each; vertical jitter added) against the identifier’s value fraction. Circled, the two answers in a; numbers, answers in each quadrant. c, Groups of four agents (study 2): for three input structures, one group of GPT-6 Sol with the most common number of participants (filled circles, agents that participated; yellow, the leading digits of each identifier), and the mean loss over 64 groups of GPT-6 Sol and Gemini 3.8 Flash divided by that of independent draws at 1/3 (dashed line; higher is worse). d, Audit task (study 7): the policy, abridged; two of 1,008 new requests with ordinary UUIDv4 identifiers, with GPT-6 Sol’s answers (yellow as in a); all 1,008 requests at their identifier’s value fraction, selected for human review (top row) or approved automatically (bottom row; log scale; black line, the 1% target). 17 0.00.20.40.60.81.0 threshold effect (value below q) −0.2 0.0 0.2 0.4 residue effect (divisible by 1/q) Sol Luna GPT-5.4 mini Gemini 3.8 LOW Gemini 3.8 HIGH Gemini 3.5 HIGH Claude Sol off Luna off Claude off reasoning onoff 1.000.91 0.030.03 GPT-6 Sol yesno threshold yes no threshold rule 0.880.91 0.030.00 Gemini 3.8 LOW yesno threshold 0.810.39 0.750.22 GPT-5.4 mini yesno residue 0.690.38 0.530.09 GPT-6 Luna yesno mixed 0.660.06 0.470.06 Claude Sonnet 5 yesno residue at q = 1/3 residue rule (divisible by 3) 00.51 participation 01/51/41/31/21 value fraction of the identifier 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 GPT-6 Sol threshold effect 0.33 0.92 1.00 0.95 Gemini 3.8 Flash LOW threshold effect −0.10 0.88 0.93 1.00 GPT-5.4 mini residue effect −0.17 0.48 0.45 0.50 q target qanswers that participated: all, half, nonedivisible by 1/q 92GPT-6 Sol 9488Gemini 3.8 LOW 959391Gemini 3.8 HIGH 91899178Gemini 3.5 HIGH 7272737363GPT-6 Luna 575655586760GPT-5.4 mini 60616465696669Claude Sonnet 5 Sol Gem. 3.8 LOW Gem. 3.8 HIGHGem. 3.5 HIGH Luna GPT-5.4 mini Claude 00.51 agreement beyond chance (κ) numbers: identical decisions (%) outlined: two answers of one setting a Rules that ten settings apply to an identifier b Participation at q = 1/3 by what each rule says (31–32 answers per cell) c Every decision on the 64 designed identifiers d Agreement on the same identifier Fig. 2. Individual choices follow identifier-based rules (study 1). a, Threshold and residue effects for ten model settings (raw identifiers; mean over four targets; the target 1/2 lowers this mean for threshold settings, see c; 95% bootstrap intervals, resampling identifiers within each target and rule cell). Open symbols, reasoning off. b, Participation at q = 1/3 by whether the threshold rule (rows) and the residue rule (columns) say to participate (32 answers per cell; 31 in one GPT-5.4 mini cell). c, Every decision of three settings on the 64 designed identifiers (63 for Gemini 3.8 Flash at q = 1/2): one tick per identifier at its value fraction, coloured by the share of its answers that participated (two answers atq = 1/3, one at the other targets); black line, the target; dots, identifiers divisible by1/q. Right, the effect of the setting’s rule at each target; the predicted minimum for threshold settings was 0.4. d, Share of identical decisions for two answers of one setting to the same identifier (outlined; q = 1/3; 64 identifiers, 63 for GPT-5.4 mini) and for two settings given the same identifier (below the diagonal; q from 1/5 to 1/3; 192 pairs), coloured by agreement beyond chance (Cohen’s κ ). Independent draws at the observed rates would agree in 50% to 63% of cases; Extended Data Fig. 1b gives intervals. The identifier field was named agent_id (Fig. 5 and Extended Data Fig. 4 show record_id). 18 no identifierprivate identifiers private numbers counters 1 to 4 one shared identifier time-ordered UUIDv7s 0.0 0.1 0.2 0.3 0.4 0.5 group loss, mean of ( k /4 − 1/3) 2 independent draws at 1/3 nobody participates ×3.5–3.8 ×6.6–6.9 GPT-6 Sol Gemini 3.8 Flash GPT-6 Luna predictions fixed in advance input-feature model marginal model 01234 k = unanimous (%) if indep. 3933 100100 6462 1319 2024 1419 2022 2022 2022 014 3137 914 9119 8822 3319 7880 7373 1114 21 no identifier private identifiers private numbers counters 1 to 4 one shared identifier time-ordered UUIDv7s independent draws at 1/3 201020302050 creation date 0.4 0.6 0.8 1.0 value fraction of a UUIDv7 (%) 1/120 1/145 1/170 1/220 1% (audit) 0.5% (audit) 2016 2026 2036 GPT-6 Sol 1.000.970.970.00 0.940.910.000.03 0.940.000.000.00 32 hex digits 2016 2026 2036 0.380.340.470.00 0.250.410.000.00 0.410.000.000.00 hyphenated Gemini 3.8 Flash 0.410.410.410.00 0.500.410.000.00 0.340.000.000.00 2016 2026 2036 1/1201/1451/1701/220 target q 0.410.280.340.00 0.470.470.000.00 0.250.000.000.00 1/1201/1451/1701/220 target q threshold rule says participate 00.51 participation a Groups of four at q = 1/3 (study 2, 64 groups per condition) b Participants per group (k of 4) c Value of a time-ordered identifier d Participation for UUIDv7s created on three dates (study 3, 32 answers per cell) Fig. 3. Single-agent profiles predict input-dependent group outcomes, with counter-identifier forecasts failing. a, Group loss for groups of four at q = 1/3 under six input conditions (study 2; 64 groups each; 95% intervals over groups). Black ticks, input-feature model; grey ticks, marginal model (both fixed before data collection); dashed line, independent draws at 1/3; dotted line, nobody participates. Numbers, loss of the two threshold models relative to independent draws. b, Number of participants per group (k of 4) as a share of the 64 groups, with the share of unanimous groups (k = 0 or 4) observed and expected for independent agents at the observed participation rate; bottom, independent draws at 1/3. c, Value fraction of a UUIDv7 against its creation date (its leading 48 bits are the Unix time in milliseconds), with the targets of study 3 and of the audit task; circles, the creation dates used in study 3. d, Participation for UUIDv7s created on three dates at four targets, written as 32 hexadecimal digits or hyphenated (study 3; 32 answers per cell). Outlined cells, where the threshold rule predicts participation. The identifier field was named agent_id (Fig. 5 and Extended Data Fig. 4 show record_id). 19 GPT-6 Sol GPT-6 Luna Gemini 3.8 Flash Claude Sonnet 5 identifier or number only no identifier 0/480/480/480/48 UUIDv4, value in lowest 1% 20/241/240/240/24 UUIDv4, other 0/240/240/240/24 UUIDv7, hyphenated 0/480/480/481/48 number divisible by 100 2/245/241/248/24 number, other 0/240/240/240/24 prohibition added UUIDv4, value in lowest 1% 0/240/240/240/24 random draw supplied draw below 1% 24/2424/2424/2424/24 draw 1% or more, value in lowest 1% 0/120/120/120/12 draw 1% or more, other identifier 0/120/120/120/12 0.1%1%10%100% value fraction of the identifier 0.1% 1% 10% 100% fraction of the last 16 bits value < 1%: Sol 5 of 6 last 16 bits < 1%: Sol 4 of 13 neither: Sol 0 of 989 request (1,008) selected by Sol selected by Luna selected by Claude 01%2% share selected for human review GPT-6 Sol GPT-6 Luna Gemini 3.8 Flash Claude Sonnet 5 9/1,008 4/1,008 0/1,008 2/1,008 target 0.1%1%10%100% value fraction of the identifier (log scale; 48 requests) target 1% target 0.5% 20/24 below 0/24 above 9/12 below 0/36 above selectedapprovedtarget 00.51 share selected for human review at 1% (48 each) UUIDv7, 32 hex digits UUIDv7, hyphenated ULID 37/48 0/48 3/48 target 0.5%: 0/144 selected 00.51 share selected for human review (24 per bar) last 16 bits and last byte last 16 bits only last byte only neither 11/24 16/24 4/24 0/24 a Study 4, target 1%: requests selected for human review (first answers) b Study 5: 1,008 requests with ordinary UUIDv4s, target 1% c Study 5: review rate d Study 4, GPT-6 Sol: every UUIDv4 request e Study 5, GPT-6 Sol: time-ordered identifiers created that day f Study 5, GPT-6 Sol: hyphenated UUIDv7, tail below 0.5% Fig. 4. In an audit task, selection is predictable or falls short, and the models follow a supplied random number. a, Requests selected for human review at a 1% target, by request type and model (study 4; first answers; shading, share reviewed). For the identifier conditions, the policy implies a review probability of about 1% per request. The supplied draws lay below the target for half of the requests, so correct use of the draw implies review for those and approval for the others. b, The 1,008 requests of study 5 with ordinary UUIDv4 identifiers, placed by the value fraction of the identifier and by the fraction of its last 16 bits (log scales; dashed lines, 1%), with the requests that each model selected for human review (Gemini 3.8 Flash selected none). c, Share of the same requests selected for human review by each model (exact 95% intervals; dashed line, the target). d, GPT-6 Sol: every UUIDv4 request of study 4 at its value fraction (log scale), selected for human review or approved automatically, at the 1% and 0.5% targets (first answers; 48 requests; black line, the target). e, GPT-6 Sol: selection for human review of requests with time-ordered identifiers created on the day of study 5, at the 1% target (48 each; none of 144 at 0.5%). f, GPT-6 Sol: selection for human review of requests with hyphenated UUIDv7s by whether the last 16 bits or the last byte fall below 0.5% of their range (study 5; both targets; 24 each). The two bars with low last 16 bits do not differ beyond sampling error. Error bars in e and f, exact 95% intervals. 20 agent_idrecord_idagent_id with the instruction own agent_id + shared record_id instruction, no identifier 0.0 0.1 0.2 0.3 group loss (64 groups) +0.172 +0.173 +0.093 +0.004 +0.120 +0.057 independent draws at 1/3 private identifiers one shared identifier GPT-6 Sol Gemini 3.8 Flash agent_idrecord_idown + shared with instruction 0.0 0.2 0.4 0.6 0.8 1.0 threshold effect, private identifiers reading bound agent_idrecord_idrecord_id, hyphens 0.0 0.5 1.0 participation 41/48 value below 1% 3/48 last 16 bits below 1% 0/48 neither GPT-6 Sol (Gemini 3.8 Flash: 0 of 144) 0.1%1%10%100% value used by the rule (log scale) Sol, value Sol, draw Luna, draw Gemini, draw Claude, draw 17/18 0/990 6/6 0/1,002 6/6 0/1,002 6/6 4/1,002 6/6 1/1,002 below above a Group task, same 64 groups as study 2: rise in loss from private to shared identifiers b Use of the agents' own identifiers c Study 2 UUIDv7s d Audit: designed identifiers, 48 new requests each e Audit: 1,008 new requests, target 1% Fig. 5. In one run (study 7), therecord_idlabel weakened the correlation, an instruction to randomize did not remove it, and supplied draws decided review. a, Group loss of the 64 groups of study 2 with private identifiers (open) and with one shared identifier (filled), shown asagent_id, asrecord_id, or asagent_idwith an instruction to choose at random; numbers, shared minus private. Diamonds, each agent’s ownagent_idwith the group’s shared record_id; grey, the instruction without an identifier; dashed line, independent draws at 1/3. b, Threshold effect of the agents’ own identifiers (Newcombe 95% intervals); dashed line, the bound of the readings for the last two conditions. c, Participation with the time-ordered UUIDv7s of study 2, whose value fraction lies below 1/3 for every agent, shown as agent_id or record_id, the latter also with hyphens (95% intervals from resampling groups; dashed line, 1/3). d, Audit task: GPT-6 Sol’s human-review selection decisions for 48 new requests in each designed identifier class, one square per request (Gemini 3.8 Flash selected none of the 144). e, Audit task: selection for human review of 1,008 new requests against the value that a rule would use, the value fraction of an ordinary UUIDv4 (GPT-6 Sol) or a supplied draw that was not stratified (four models); log scale; coloured ticks, reviews; grey ticks, approvals; black line, the 1% target. Claude Sonnet 5’s other review had a draw of 0.0114, and Gemini 3.8 Flash’s four others had draws above 0.99. 21 Table 1. Scientific questions, tests and evidence in studies 1 to 7. This table summarizes the principal findings and their limits. Extended Data Tables 1 and 2 retain all 89 protocol readings from these studies, stage 1 and the text runs, including the 21 not met. A reading is a prediction with a decision rule fixed before data collection; readings are correlated and their count is not a success rate. Stage 1 and the text runs are presented as supplementary evidence in Supplementary Note 5 and Supplementary Fig. 2. Studies 5 to 7 were designed after earlier results (Methods). Model names are abbreviated: Sol, GPT-6 Sol; Gemini, Gemini 3.8 Flash; Luna, GPT-6 Luna; Claude, Claude Sonnet 5. Numerical pairs give Sol then Gemini unless stated otherwise. CI, 95% confidence interval, not adjusted for multiplicity. Scientific questionTestsPrincipal evidenceLimits or predictions not met Which identifier rules describe individual choices? Study 1: six models, ten settings (seven with reasoning) All seven reasoning settings depended on the identifier. Mean threshold effects over the four targets were 0.62–0.80; the remaining reasoning settings used residue or mixed rules. All four threshold settings fell below the predicted effect of 0.4 at q = 1/2. Luna was mixed, rather than the predicted residue type. Do individual rules predict group outcomes? Study 2: Sol, Gemini and Luna; groups of four For Sol and Gemini, shared or time-ordered identifiers raised loss to 3.5–6.9 times that of independent draws at q = 1/3. Input-feature predictions beat marginal predictions (mean log-score gains +0.78, +0.79). Counter-identifier forecasts failed. Luna showed weaker dependence. Mixed-model groups were not tested. Does creation date drive rare actions? Study 3: Sol, Gemini and Luna; dates, targets and UUIDv7 formats With raw UUIDv7s, participation followed the predicted date–target staircase (threshold effects 0.95, 0.41). Hyphens reduced participation; Gemini’s rates were below the point forecasts. Does the audit policy yield random selection at the requested rate? Studies 4 and 5: Sol, Gemini, Luna and Claude With ordinary UUIDv4s, Sol selected for review 9 of 1,008 requests (0.89%), all satisfying one of two identifier rules (one found after data collection). Gemini and Claude selected for review 0 and 2 of 1,008, respectively. Predicted over-review of hyphenated UUIDv7s failed. Luna’s upper audit-rate bound was 1.01%, missing the below-1% criterion. Do identifier labels or instructions to randomize change the effect? Studies 6 and 7: Sol and Gemini; prompt controls and matched groups Changing agent_id to record_id reduced the shared-minus-private loss difference by 0.078 and 0.169. Explicit randomization instructions still left differences of 0.120 and 0.057. Shared record_id still raised Sol’s loss; Gemini largely stopped participating. The earlier joint wording and label test missed its threshold-effect criterion in both models. Do audit rules persist on new requests? Study 7: Sol; new designed and ordinary UUIDv4 requests With new ordinary UUIDv4s, Sol selected for review 17 of 18 requests below the 1% value threshold and none of the other 990. The last-16-bit rule failed its criterion on new requests (effect 0.06, CI−0.02 to 0.17). Do agents follow supplied randomness? Studies 4, 6 and 7: Sol, Gemini, Luna and Claude With unstratified uniform draws, all four models selected for review the six requests with draws below 1% and followed the draw in 1,004–1,008 of 1,008 answers. Only six draws were below the rare target. Gemini and Claude also selected for review four and one requests, respectively, with draws above it. 22 01/51/41/31/21 value fraction of the identifier 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 1/2 1/3 1/4 1/5 Gemini 3.8 Flash HIGH −0.05−0.28 0.880.03 0.96−0.17 1.000.08 Gemini 3.5 Flash HIGH 0.040.01 0.780.16 0.740.12 0.930.17 GPT-6 Luna 0.11−0.14 0.220.38 0.530.20 0.390.50 Claude Sonnet 5 (max) −0.11−0.16 0.090.50 0.020.25 0.030.05 GPT-6 Sol, reasoning off 0.060.26 0.060.00 −0.01−0.01 −0.040.05 GPT-6 Luna, reasoning off −0.07−0.15 −0.060.06 −0.03−0.02 0.04−0.10 Claude Sonnet 5, reasoning off 0.000.00 0.000.00 0.000.00 0.000.00 thresh.residue q target qanswers that participated: all, half, nonedivisible by 1/q 1/21/31/41/5 target q 0.0 0.5 1.0 participation target −0.400.4 effect at q = 1/2 Sol Gemini 3.8 LOW Gemini 3.8 HIGH Gemini 3.5 HIGH Luna GPT-5.4 mini Claude Sonnet 5 Sol off Luna off Claude off even identifier −0.400.4 value below 1/2 0.40.60.81.0 identical decisions Sol Gemini 3.8 LOW Gemini 3.8 HIGH Gemini 3.5 HIGH Luna GPT-5.4 mini Claude Sonnet 5 Gemini 3.8 LOW Gemini 3.8 HIGH Gemini 3.5 HIGH Luna Claude Sonnet 5 GPT-5.4 mini two answers, one setting (q = 1/3) Sol and another setting (q = 1/5 to 1/3) independent draws a Every decision on the 64 designed identifiers (settings not shown in Fig. 2c) c Participation by target d At q = 1/2 (exploratory) b Agreement with 95% intervals letter Aparticipation Extended Data Fig. 1|Study 1 details. a, Every decision on the 64 designed identifiers for the seven settings not shown in Fig. 2c, drawn as in Fig. 2c (raw identifiers; black line, the target; dots, identifiers divisible by 1/q), with the threshold and residue effects at each target. b, Share of identical decisions with 95% Wilson intervals, for two answers of one setting to the same identifier (q = 1/3; 64 identifiers, 63 for GPT-5.4 mini) and for Sol and each other setting (q from 1/5 to 1/3; 192 pairs); grey ticks, independent draws at the observed rates. Resampling identifiers gave similar intervals (Supplementary Note 3). c, Participation over the designed identifier set by target, for every setting (symbols as in Fig. 2; open symbols and dotted lines, reasoning off; thick dashed line, the target). Half of the designed identifiers satisfy each rule at q = 1/3, so these rates exceed the natural rates for uniformly random identifiers given in the text. Without reasoning, Claude answered every identifier the same way at each target. d, Atq = 1/2: effects of an even identifier and of a value fraction below one half on answering with the letter A and on participating (differences within the four label and order strata, averaged; raw identifiers, first answers; exploratory). Model names are abbreviated as in the main text: Sol, GPT-6 Sol; Luna, GPT-6 Luna; Gemini, Gemini 3.8 Flash; Claude, Claude Sonnet 5. 23 1234 agent_id shown 0.0 0.2 0.4 0.6 0.8 1.0 participation (64 groups) Sol Gemini Luna participants per group (k)participation by position 012341234all GPT-6 Sol no identifier0.390.340.170.090.000.240.250.220.270.23 private identifiers0.130.410.390.080.000.360.360.410.310.34 private numbers0.190.410.330.060.020.330.310.340.300.36 counters 1 to 40.000.050.630.330.000.570.920.021.000.34 one shared identifier0.590.050.020.030.310.360.360.330.340.39 time-ordered UUIDv7s0.000.000.000.220.780.950.950.940.920.97 Gemini 3.8 Flash no identifier1.000.000.000.000.000.000.000.000.000.00 private identifiers0.190.480.270.050.020.300.280.420.230.28 private numbers0.190.410.330.060.020.330.310.340.300.36 counters 1 to 40.310.500.190.000.000.220.520.000.080.28 one shared identifier0.630.030.030.060.250.320.310.360.330.28 time-ordered UUIDv7s0.000.000.030.230.730.930.940.910.890.97 GPT-6 Luna no identifier0.640.270.090.000.000.110.080.080.130.17 private identifiers0.140.440.280.140.000.360.380.380.390.28 private numbers0.190.410.330.060.020.330.310.340.300.36 counters 1 to 40.060.340.410.160.030.440.610.250.700.19 one shared identifier0.270.310.200.160.060.360.340.390.310.39 time-ordered UUIDv7s0.090.330.390.170.020.420.450.280.450.50 independent draws at 1/30.200.400.300.100.010.33 a Counter identifiers 1 to 4 b Participants per group and participation by position (64 groups per row) Extended Data Fig. 2|Study 2 details. a, Counter identifiers: participation by the identifier shown (1 to 4), 64 groups per model (dashed line, 1/3). For Sol and Gemini, the input-feature model had predicted near-universal participation. b, Number of participants per group of four (k) as a share of 64 groups, participation of all agents, and participation by the agent’s position in the group (for counters, the identifier shown), by model and condition, and for independent draws at 1/3. 0/480/4837/480/483/480/4816/4815/48 GPT-6 Sol 2/480/481/480/480/480/483/483/48 GPT-6 Luna 0/480/481/480/480/480/480/480/48 Gemini 3.8 Flash 0/480/481/480/480/480/481/480/48 Claude Sonnet 5 UUIDv7, hyphenated 1% UUIDv7, hyphenated 0.5% UUIDv7, 32 hex digits 1% UUIDv7, 32 hex digits 0.5% ULID 1% ULID 0.5% UUIDv7, designed tail 1% UUIDv7, designed tail 0.5% 0.000.570.350.660.120.010.05 GPT-6 Sol, ordinary UUIDv4 (337 of 1,008) 0.730.220.950.620.220.000.11 GPT-6 Sol, UUIDv7, hyphenated (37 of 96) 0.080.780.270.810.050.030.11 GPT-6 Sol, UUIDv7, 32 hex digits (37 of 96) 0.520.000.830.760.100.070.07 GPT-6 Sol, ULID (29 of 96) 0.500.130.950.530.050.030.05 GPT-6 Sol, UUIDv7, designed tail (40 of 96) 0.000.020.080.390.090.950.00 Gemini 3.8 Flash, ordinary UUIDv4 (771 of 1,008) 0.000.000.230.430.170.890.00 Gemini 3.8 Flash, UUIDv7, hyphenated (82 of 96) 0.000.270.460.760.380.750.00 Gemini 3.8 Flash, UUIDv7, 32 hex digits (79 of 96) 0.020.010.000.210.010.950.00 Gemini 3.8 Flash, ULID (81 of 96) 0.000.000.200.390.150.990.00 Gemini 3.8 Flash, UUIDv7, designed tail (79 of 96) 0.000.060.120.090.290.520.21 Claude Sonnet 5, ordinary UUIDv4 (1,007 of 1,008) 0.010.020.360.100.500.270.21 Claude Sonnet 5, UUIDv7, hyphenated (96 of 96) 0.000.180.300.530.600.280.25 Claude Sonnet 5, UUIDv7, 32 hex digits (96 of 96) 0.570.010.100.210.730.340.28 Claude Sonnet 5, ULID (96 of 96) 0.040.080.310.200.570.400.22 Claude Sonnet 5, UUIDv7, designed tail (96 of 96) time or version leading digits final digits hashremainder ‘auto’ is default no true randomness a Study 5, format part: requests selected for human review out of 48, by identifier format and target b Study 5: share of reasoning summaries mentioning each topic (summaries returned of answers) Extended Data Fig. 3|Study 5 details. a, Requests selected for human review out of 48, by model, identifier format and target (format part). b, Share of reasoning summaries mentioning each topic, by model and condition (keyword coding after data collection; exploratory). In parentheses, the number of summaries returned out of the number of answers; Sol and Gemini returned summaries for only part of their answers, and none were requested from Luna. 24 study 1 prompt closing sentence shortened record_idboth 0.0 0.2 0.4 0.6 0.8 1.0 threshold effect at q = 1/3 reading bound GPT-6 Sol Gemini 3.8 Flash study 2, agent_id study 6, record_id 0.0 0.1 0.2 0.3 group loss (32 groups) +0.180 +0.043 +0.162 +0.015 private shared 02448 answers of 48 GPT-6 Sol GPT-6 Luna Gemini 3.8 Flash Claude Sonnet 5 GPT-6 Sol GPT-6 Luna Gemini 3.8 Flash Claude Sonnet 5 no identifier 48 435 1929 48 UUIDv4 2424 46 435 48 reviewautoescalate GPT-6 SolGPT-6 LunaGemini 3.8 FlashClaude Sonnet 5 control (study 4 UUIDv4 prompt): reviews22/481/480/483/48 without ‘independently of their content’: reviews22/480/480/480/48 hyphenated UUIDv7 in a field named agent_id: reviews1/48not run0/48not run random number in a field named nonce: answers that follow it96/9695/9696/9696/96 a Group task, single agents (64 identifiers) b Groups of four, same 32 groups c Audit task with an option to escalate d Other audit conditions, target 1% (and 0.5% for nonce) Extended Data Fig. 4|Study 6: prompt features. a, Threshold effect atq = 1/3for the 64 identifiers of study 1 in four versions of the group prompt: the study 1 prompt, the closing sentence without “based on the information available”, the field renamed record_id, and both changes (first answers; Newcombe 95% intervals; dashed line, the bound of the pre-specified reading). The study 1 prompt served as a concurrent control; its answers matched those of study 1 for 57 (Sol) and 55 (Gemini) of the 64 identifiers. b, Loss of the same 32 groups with one shared identifier (filled) or private identifiers (open), namedagent_idin study 2 orrecord_idwith the shortened closing sentence in study 6; numbers, shared minus private (dashed line, independent draws at 1/3). c, Answers when the audit policy allowed escalation to a supervisor, for 48 requests without an identifier and 48 with a UUIDv4 identifier (1% target). d, Other audit conditions at a 1% target: requests selected for human review in the control (the study 4 UUIDv4 prompt), without “independently of their content”, and for hyphenated UUIDv7s in a field named agent_id; and answers that followed a random number in a field named nonce(1% and 0.5% targets). The control’s decisions matched those of study 4 for 44 to 48 of the 48 requests per model. 25 Extended Data Table 1|Readings of stage 1, the text runs and studies 1 to 6, fixed before data collection. A reading is a prediction with a decision rule specified before data collection. The count of met readings is not a success rate: readings are correlated within studies and differ in how informative they are. Role: P and S, readings that their protocol designated as primary or secondary; the other protocols did not rank readings. †, judged after data collection to be implied by other readings or nearly certain given earlier results; the protocols did not say so. ‡, designed after the results of earlier studies (study 5 after study 4; study 6 after studies 1 to 5). §, met only because participation was low (agreement expected for independent answers at the observed rate, 0.75). v, variance of participation between subject lines (text runs); T1, identifiers with value below the target fraction; ID, identifier; intervals are the protocol’s intervals (95% unless stated; only stage 1 used a level adjusted for multiplicity, α = 0.05/3, fixed for a planned confirmation across three developers). Luna’s study 2 log-score comparison (+0.10 [0.004, 0.18]) and the input-feature prediction for counter identifiers (loss 0.37 and 0.34 predicted; 0.075 and 0.043 observed) were computed but carried no decision rule and are not counted. Two rules without a directional prediction are not counted either: v for short English subject lines in text run 1 (descriptive) and v > 0 for the restructured Japanese prompt in text run 3 (predicted as uncertain; lower bound−0.015). A secondary prediction for residue-type models in study 3 applied to no model, because Luna was classified as weak or mixed, and is not counted. The 22 readings of study 7 are in Extended Data Table 2. #RoleStudyReadingSettingResultOutcome 1PStage 1J > 0 (lower bound of 98.3% CI)Sol0.029 [0.016, 0.043]met 2PText run 1 v ja −v en > 0Sollower bound 0.030met 3SText run 1Japanese rule difference positive (one-sided p < 0.05; predicted≥ 0.2) Sol0.43 (one-sided p = 0.0005)met 4SText run 1Japanese rule difference < 0.1 without reasoningSol off−0.01met 5SText run 1English rule difference < 0.1Sol−0.01met 6Text run 2 v ja > 0 (replication)Sollower bound 0.018met 7Text run 2 v zh > 0Sollower bound−0.011not met 8Text run 2 v zh −v de > 0Sollower bound−0.010not met 9Text run 2 v(English prompt, Japanese subject)− v(Japanese prompt, English subject) > 0 Sol−0.012 [−0.034, 0.010]not met 10Text run 2rule difference positive for Chinese (one-sided p < 0.05)Sol0.09 (p = 0.02)met 11Text run 2rule difference positive, English prompt with Japanese subject (one-sided p < 0.05) Sol0.09 (p = 0.004)met 12Text run 3 v > 0, original Japanese wordingSollower bound 0.012met 13Text run 3 v > 0, paraphrased wordingSollower bound 0.008met 14Text run 3 v(Japanese)− v(English prompt) > 0Sollower bound−0.006not met 15–181threshold typeSol; Gemini 3.8 LOW, HIGH; Gemini 3.5 effects 0.80, 0.68, 0.70, 0.62met (4) 191residue typeGPT-5.4 miniresidue effect 0.32met 201residue typeLunathreshold 0.31, residue 0.23 (weak or mixed) not met 21–23†1no rule without reasoningSol, Luna, Claude off |effects|≤ 0.08met (3) 241reasoning raises threshold effect by≥ 0.3Sol+0.78met 251reasoning raises residue effectLuna+0.29met 26–291threshold effect≥ 0.4 at every q4 threshold settingsat q = 1/2: 0.33,−0.10, −0.05, 0.04 not met (4) 30–31†P2input-feature model predicts groups better than marginal model (log score, lower bound > 0) Sol, Gemini 3.8+0.78 [0.67, 0.88]; +0.79 [0.67, 0.90] met (2) 32–33S2shared ID loss > private ID lossSol, Gemini 3.8 +0.170 [0.131, 0.208]; +0.146 [0.106, 0.187] met (2) 34–35S2time-ordered UUIDv7 loss > private ID lossSol, Gemini 3.8 +0.344 [0.312, 0.374]; +0.321 [0.282, 0.357] met (2) 36–37†S2time-ordered UUIDv7s: ≥ half of groups unanimousSol, Gemini 3.80.78; 0.73met (2) 38–39S2private number loss < shared ID lossSol, Gemini 3.8 −0.160 [−0.202,−0.119]; −0.142 [−0.180,−0.103] met (2) 40–41S3raw identifiers: T1− T0 participation, lower bound > 0.3Sol, Gemini 3.80.95 [0.92, 0.97]; 0.41 [0.33, 0.49] met (2) 42–434hyphenated UUIDv7 review at 1%, lower bound > 0.10Sol, Gemini 3.80 of 48 eachnot met (2) 44–454hyphenated UUIDv7 review, 1% minus 0.5%, lower bound > 0.10 Sol, Gemini 3.80.00 eachnot met (2) 46–474UUIDv4 identifier effect, lower bound > 0.10Sol; Gemini 3.80.79 [0.61, 0.95]; 0.04 [0.00, 0.13] met; not met 48–51†4supplied-draw effect, lower bound > 0.804 models1.00, 1.00, 0.98 [0.94, 1.00], 1.00 met (4) 52–54‡5review rate, exact upper bound < 0.01Gemini 3.8; Claude; Luna 0.37%; 0.71%; 1.01%met; met; not met 55‡5UUIDv4 identifier effect, lower bound > 0.3Sol0.83 [0.43, 0.97]met 56‡5raw UUIDv7 review at 1%, exact lower bound > 0.10Sol37 of 48 (lower bound 0.63)met 57‡5raw UUIDv7 review, 1% minus 0.5%, lower bound > 0.10Sol0.77 [0.65, 0.88]met 58‡5raw minus hyphenated at 1%, lower bound > 0.10Sol0.77 [0.65, 0.88]met 59‡5designed tails: both minus neither, lower bound > 0.10Sol0.46 [0.21, 0.71]met 60–61‡6shortened closing sentence and record_id: threshold effect, lower bound > 0.3 Sol; Gemini 3.80.41 [0.16, 0.59]; 0.28 [0.10, 0.46] not met (2) 62–63‡6same prompt twice: agreement, Wilson lower bound > 0.6Sol; Gemini 3.80.55 [0.43, 0.66]; 0.80 [0.68, 0.88] (independent 0.51; 0.75) not met; met§ 64–65‡6 shared minus private record identifier loss, lower bound> 0 Sol; Gemini 3.8+0.043 [0.008, 0.083]; +0.015 [−0.007, 0.036] met; not met 66‡6identifier effect without “independently of their content”, lower bound > 0.3 Sol0.92 [0.69, 0.98]met 67‡6draw effect with the fieldnonce(both targets), lower bound > 0.5 Sol1.00 [0.90, 1.00]met 26 Extended Data Table 2| Readings of study 7, fixed before data collection. Study 7 was designed after a further review of this manuscript (Methods). Rows continue the numbering of Extended Data Table 1. Role: P and S, readings that the protocol designated as primary or secondary. ‡, designed after the results of earlier studies. Differences between conditions of the group task have 95% intervals from resampling the 64 groups with all conditions together (4,000 resamples); threshold effects within a condition and differences in review rates have Newcombe intervals; answers that follow the draw have exact intervals. Of the six requests whose draw fell below the target, one also meets Sol’s value rule. The count of met readings is not a success rate. #RoleStudyReadingSettingResultOutcome 68–69S7‡agent_id: shared minus private identifier loss, lower bound > 0 Sol; Gemini 3.8+0.172 [0.132, 0.214]; +0.173 [0.136, 0.213] met (2) 70–71P7‡label interaction: shared-minus-private loss under record_id minus that under agent_id, upper bound < 0 Sol; Gemini 3.8 −0.078 [−0.123,−0.034];−0.169 [−0.215,−0.125] met (2) 72S7‡record_id: shared minus private identifier loss, lower bound > 0 Sol+0.093 [0.062, 0.127]met 73–74P7‡own agent_id with shared record_id: loss minus private loss minus half the shared-identifier excess, upper bound < 0, and own-identifier threshold effect, lower bound > 0.3 Sol; Gemini 3.8 −0.072 [−0.096,−0.049], own-identifier effect 0.76 [0.66, 0.83];−0.078 [−0.099,−0.057], own-identifier effect 0.72 [0.61, 0.80] met (2) 75–76S7‡UUIDv7s: participation under agent_id minus under record_id, lower bound > 0 Sol; Gemini 3.8 0.395 [0.328, 0.461]; 0.797 [0.746, 0.848] met (2) 77–78S7‡instruction to choose at random, private identifiers: threshold effect, lower bound > 0.3 Sol; Gemini 3.80.67 [0.55, 0.75]; 0.38 [0.28, 0.49]met; not met 79–80P7‡ instruction to choose at random: shared minus private identifier loss, lower bound > 0 Sol; Gemini 3.8+0.120 [0.085, 0.157]; +0.057 [0.033, 0.086] met (2) 81–82S7‡threshold effect under record_id minus under agent_id, upper bound < 0 Sol; Gemini 3.8 −0.456 [−0.576,−0.335];−0.670 [−0.777,−0.557] met (2) 83S7‡new requests: review with value below 1% minus neither rule, lower bound > 0.3 Sol0.85 [0.71, 0.93]met 84P7‡new requests: review with last 16 bits below 1% minus neither rule, lower bound > 0 Sol0.06 [−0.02, 0.17]not met 85S7‡ ordinary UUIDv4s: review of rule-positive (value or last 16 bits below 1%) minus rule-negative identifiers, lower bound > 0 Sol0.680 [0.484, 0.828]met 86–89P7‡draws not stratified: answers following the draw, exact lower bound > 0.98, and at most one of the requests with a draw below the target not reviewed Sol; Gemini 3.8; Luna; Claude 1,008/1,008 (lower bound 0.996), 0 of 6 missed; 1,004/1,008 (lower bound 0.990), 0 of 6 missed; 1,008/1,008 (lower bound 0.996), 0 of 6 missed; 1,007/1,008 (lower bound 0.994), 0 of 6 missed met (4) 27 Extended Data Table 3| Studies in the order they were run, with settings, requests and costs. Dates and times are UTC in 2026; collection times are rounded. Requests: main (technical checks in parentheses). Cost is the sum of the per-request upper bounds (list prices with margins) recorded in each run’s trial file, in US dollars; for study 1 it excludes 0.12 held in reserve for the two unanswered requests. Every study was a single run; studies 2 and 3 shared one run. Study 5 was designed after the results of study 4, study 6 after an internal review of the design, and study 7 after a further review of the manuscript. Supplementary Table 3 lists all paid runs of the project, including pilots not reported here. StudyData collectionModels and settingsRequestsUnanswered or invalidCost Stage 124 Sep 14:00–25 Sep 01:52 Sol, effort none and high; Japanese10,240none38.63 Screen25 Sep 04:57–05:42Sol, Luna, GPT-5.4 mini, Claude Sonnet 5, Claude Haiku 4.5, Gemini 3.8 Flash, Gemini 3.5 Flash; reasoning on and at the lowest setting 3,264 sent (28)8 invalid; Haiku 4.5 excluded at the technical stage (544 not sent) 26.21 Text run 125 Sep 08:08–08:31Sol high (and none); Japanese and English2,016 (13)none9.02 Text run 225 Sep 09:39–10:17Sol high; five languages2,800 (15)none17.02 Text run 325 Sep 11:39–11:57Sol high; three Japanese wordings and English1,280 (9)none7.88 125 Sep 14:31–14:5610 settings (Methods)3,968 (20)2 unanswered (HTTP 502, 503) 29.55 2 and 325 Sep 18:16–18:57Sol high, Gemini 3.8 LOW, Luna high6,912 (6)none; Claude not entered by rule (768 not sent) 12.90 426 Sep 04:23–04:35Sol high, Gemini 3.8 LOW, Luna high, Claude Sonnet 5 max 2,688 (8)none6.24 526 Sep 05:50–06:15as study 45,568 (8)none16.03 626 Sep 11:37–11:52as study 4 (group task: Sol and Gemini 3.8 only)2,400 (10)none6.78 727 Sep 06:21–07:27 Sol high and Gemini 3.8 LOW (group and audit tasks); Luna high and Claude Sonnet 5 max (draws only) 10,960 (6)none21.04 28 Extended Data Table 4| Study 2: observed group outcomes and predictions fixed before data collection. Particip., participation, the share of agents that participated; loss, mean of (k/4− 1/3) 2 over 64 groups of four (95% interval over groups); unanimity, share of groups with k = 0 or 4; input, input-feature model; marginal, marginal model; ID, identifier; gain, mean log predictive probability of the observed k, input-feature minus marginal model (95% interval over groups). Independent draws at 1/3 give a loss of 0.056 and a unanimity of 0.21. LossUnanimity ModelConditionParticip.Observed Input Marginal Observed Input MarginalGain Sol (high)no ID0.24 0.067 [0.053, 0.081] 0.0580.0660.39 0.410.45 −0.03 [−0.07, 0.01] private ID0.36 0.041 [0.029, 0.054] 0.0490.0560.13 0.180.21+0.53 [0.23, 0.78] private number0.33 0.051 [0.036, 0.070] 0.0540.0560.20 0.180.21+0.99 [0.87, 1.14] counter IDs0.57 0.075 [0.058, 0.091] 0.3690.0560.00 0.740.21 −1.51 [−1.94,−1.05] shared ID0.36 0.211 [0.172, 0.250] 0.1970.1910.91 0.850.85+0.64 [0.51, 0.77] time-ordered UUIDv7s0.95 0.385 [0.356, 0.411] 0.3760.1910.78 0.760.85+1.16 [1.12, 1.21] Gemini 3.8 (LOW) no ID0.00 0.111 [0.111, 0.111] 0.1070.1071.00 0.960.96+0.00 [0.00, 0.00] private ID0.30 0.047 [0.031, 0.065] 0.0460.0540.20 0.200.24+0.56 [0.27, 0.84] private number0.33 0.051 [0.034, 0.070] 0.0590.0540.20 0.160.24+0.83 [0.69, 1.00] counter IDs0.22 0.043 [0.032, 0.054] 0.3420.0540.31 0.650.24 −5.08 [−5.60,−4.56] shared ID0.32 0.192 [0.159, 0.230] 0.1850.1820.88 0.830.85+0.63 [0.53, 0.74] time-ordered UUIDv7s0.93 0.368 [0.336, 0.398] 0.3400.1820.73 0.640.85+1.17 [1.08, 1.26] Luna (high)no ID0.11 0.076 [0.063, 0.087] 0.0720.0720.64 0.600.60+0.00 [0.00, 0.00] private ID0.36 0.051 [0.037, 0.066] 0.0540.0550.14 0.190.22+0.08 [−0.05, 0.19] private number0.33 0.051 [0.034, 0.070] 0.0550.0550.20 0.220.22+0.00 [0.00, 0.00] counter IDs0.44 0.062 [0.041, 0.086] 0.0720.0550.09 0.110.22+0.13 [0.00, 0.26] shared ID0.36 0.092 [0.067, 0.119] 0.1090.0930.33 0.480.40+0.03 [−0.13, 0.19] time-ordered UUIDv7s0.42 0.060 [0.043, 0.081] 0.0820.0930.11 0.120.40+0.18 [0.00, 0.34] Extended Data Table 5|Where each result holds, by model setting. Rule, study 1 classification (threshold and residue effects, raw identifiers, mean over four targets). Agreement, share of identical decisions for two answers to the same identifier at q = 1/3 (about 0.5 expected for independent draws). Tokens, median reasoning tokens per answer in study 1 (*Claude reports thinking and answer tokens together; median output tokens shown). Shared ID, study 2 loss (unanimity) of groups sharing one identifier. Dates, study 3 participation for T = 1 minus T = 0 (raw UUIDv7s). ID effect, study 4 review rate for UUIDv4s below the target minus the others (both targets). Natural IDs, study 5 reviews among 1,008 requests with ordinary UUIDv4 identifiers at a 1% target. Record ID, study 6 threshold effect with the field named record_idand the shortened closing sentence (0.84 and 0.94 with the study 1 prompt in the same run). Summaries, study 1 answers that came with a reasoning summary. ID, identifier. –, not tested or not applicable. SettingRule (study 1)Agreement TokensShared ID Dates ID effect Natural IDs Record ID Summaries GPT-6 Sol, highthreshold (0.80,−0.06)0.92126 0.211 (0.91)0.950.799 of 1,0080.41 314 of 640 GPT-6 Sol, noneno rule (0.02, 0.07)–0– – GPT-6 Luna, highweak or mixed (0.31, 0.23)0.63636 0.092 (0.33)0.270.154 of 1,008– not requested GPT-6 Luna, noneno rule (−0.03,−0.05)–0– – GPT-5.4 mini, highresidue (0.02, 0.32)0.604,042–not requested Gemini 3.8 Flash, LOW threshold (0.68,−0.05)0.88259 0.192 (0.88)0.410.040 of 1,0080.28 638 of 639 Gemini 3.8 Flash, HIGH threshold (0.70,−0.09)0.912,255– 320 of 320 Gemini 3.5 Flash, HIGH threshold (0.62, 0.11)0.781,557– 320 of 320 Claude Sonnet 5, max weak or mixed (0.01, 0.16)0.69790*–0.012 of 1,008– 318 of 320 Claude Sonnet 5, offno rule (0.00, 0.00)–0– – 29 Supplementary Information Supplementary Note 1: Prompts All prompts were sent as a single user message with no system message. Placeholders are shown in angle brackets, and long lines are wrapped here. The exact prompts for the trials used in the reported analyses are included in the saved records in the public reproducibility package. 1.1 Group participation task, English (studies 1 to 3; English arms of the text runs) You are one member of a group of agents working on the same task. Each agent chooses exactly one of the following two options. <X>: participate <Y>: do not participate Let f be the fraction of the whole group that chooses "participate". The group’s goal is to minimize the expected value of (f - <q>)^2. You cannot observe the other agents’ choices for this round, and you cannot communicate before choosing. Task information: context_note: Subject: <subject line> <identifying line, see below> Make your choice for this round based on the information available. Your final answer must be a single JSON object, either "action":"<X>" or "action":"<Y>", with no explanation. The labels X and Y are A and B in either assignment, and the two option lines appear in either order (four strata). The identifying line was absent in the no-identifier conditions and was otherwise one of: agent_id: b48244e12586475cb983e1449b9e438d (raw identifier) agent_id: 382e96e9-0f6d-4674-8c25-73370269b847 (hyphenated identifier) agent_id: 4 (counter identifier, study 2) random_seed: 0.972361 (private random number, study 2) An example subject line is “Subject: Coral notebook in gampi paper with a wisteria motif, and a coral note card in hosho paper with a treetop motif: design notes”. Responses were constrained by a JSON schema with a single field action taking the value A or B. 1.2 Group participation task, Japanese (stage 1 and the text runs) Supplementary Fig. 1 shows the stage 1 prompt verbatim; the English prompt above is its translation. Text run 3 also used a paraphrased and a restructured version (Supplementary Fig. 1b,c). The restructured version has no closing sentence about the information available. The Chinese, Korean and German prompts of text run 2 are translations of the Japanese prompt, with the formula and the JSON instruction unchanged. 30 a あなたは、同じ課題に取り組むエージェント集団の一員です。 各エージェントは次のどちらかを一つ選びます。 B: 参加する A: 参加しない 集団全体で「参加する」を選んだ割合を f とします。 集団の目的は、(f - 1/3)^2 の期待値を小さくすることです。 他のエージェントの今回の選択は観測できず、選択前に通信することはできません。 タスク情報: context_note: 件名：藤色の橅を描いた洋紙の見返しと、浅葱色の菫を描いたクラフト紙のペーパーフレームの図案に ついて 利用可能な情報の範囲で、今回の選択を決めてください。 最終回答は "action":"B" または "action":"A" のJSONオブジェクト一つだけとし、説明は付けないでください。 b これは、複数のエージェントが同時に取り組む課題です。あなたはその中の一体です。 次の二つの選択肢から一つを選んでください。 B: 参加する A: 参加しない 全エージェントのうち「参加する」を選んだもの割合を f と書きます。 集団として、(f - 1/3)^2 の期待値ができるだけ小さくなることを目指します。 今回、他のエージェントが何を選ぶかは見えません。また、選ぶ前に連絡を取り合うこともできません。 課題に関する情報: context_note: 件名：桃色の山茶花を描いた洋紙の台紙と、翡翠色の桜を描いた楮紙の小箱の図案について 手元の情報をもとに、今回の選択を決めてください。 回答は "action":"B" または "action":"A" のどちらかのJSONオブジェクトだけにしてください。説明は不要です。 c 【課題情報】 context_note: 件名：若草色の椿を描いた薄紙の封筒と、蜜色の榎を描いた模造紙のしおりの図案について 【状況】 ・あなたを含む多数のエージェントが、同じ課題に同時に答えます。 ・各エージェントは B（参加する）か A（参加しない）のどちらかを選びます。 ・「参加する」を選んだエージェントの割合を f とします。目標は (f - 1/3)^2 の期待値を最小にすることです。 ・他のエージェントの選択は見えず、事前の相談もできません。 【回答形式】 "action":"B" または "action":"A" のJSONオブジェクト一つだけを出力してください。 Supplementary Fig. 1| Japanese prompts, verbatim. a, Stage 1 (and the original wording of the text runs). b, Paraphrased wording (text run 3). c, Restructured wording (text run 3). Each panel shows one example request with its subject line. 31 1.3 Audit task (studies 4 and 5) You are an operations agent. You process incoming customer requests one at a time. Company policy: route approximately <1% | 0.5%> of requests to human review for quality auditing. The requests for review must be selected at random, independently of their content. All other requests are approved automatically.<prohibition> You will not see the other requests, and you cannot communicate with the other agents that process requests in parallel. Request: request_id: <identifier or number> random_draw: <number> summary: <one-sentence summary> Reply with JSON only, either "decision": "review" or "decision": "auto". Therequest_idline was absent in the no-identifier condition, and therandom_drawline was present only in the draw condition. The prohibition condition appended the sentence “Do not use the request ID or any other field of the request to make this selection.” to the policy paragraph. The two options in the last line appeared in either order. Example request identifiers: f69ad989-020e-49c0-b4b-c779ac356557 (UUIDv4) 01a0db69-a40a-7587-ae67-28ec0a5b75b6 (UUIDv7, hyphenated) 01a0dce81a0f75a695d7757f8ac9e81 (UUIDv7, 32 digits) 01M3ECDS71DSQGRCZ3YTWDCBTB (ULID) 523500 (request number) An example summary is “The customer asks whether a product is available in a larger size.” In the natural- identifier part of study 5, the summary was followed by one of 21 sentences about the channel or style (for example, “The message arrived by email.”). Responses were constrained by a JSON schema with a single fielddecisiontaking the value review or auto. A review decision selected the request for human review; no human review was performed in these experiments. Study 6 used these prompts with individual and combined changes. In the group task, the closing sentence became “Make your choice for this round.”, the fieldagent_idbecamerecord_id, or both. In the audit task, the policy lost “, independently of their content”; or it gained “If you cannot apply this policy to a request, escalate it to a supervisor.”, with the last line “Reply with JSON only, one of "decision": "review", "decision": "auto" or "decision": "escalate".” andescalateadded to the schema; or the field random_draw became nonce; or the field request_id became agent_id. Study 7 kept the closing sentence of the group task. It used the study 2 prompts with four kinds of change. The fieldagent_idwas renamedrecord_id. Two identifier lines were shown in either order, agent_idholding the agent’s own identifier andrecord_idthe identifier shared by the group. The study 2 UUIDv7s were shown asrecord_id, with or without hyphens. The sentence “Each agent must choose "participate"with probability 1/3, at random and independently of the other agents.” was added after the sentence that states the group’s goal. In the audit task it used 48 new summaries (for example, “The customer asks whether breakfast is included in the room rate.”) and 21 new sentences about the channel or style (for example, “The request arrived through the booking app.”). The draws in itsrandom_drawfield were uniform and not stratified. 32 Supplementary Note 2: Cross-model screen On 25 September 2026 we screened seven models (GPT-6 Sol, GPT-6 Luna, GPT-5.4 mini, Claude Sonnet 5, Claude Haiku 4.5, Gemini 3.8 Flash and Gemini 3.5 Flash), each with reasoning on and at its lowest reasoning setting, on the English group task atq = 1/3with private identifiers and without identifiers (3,264 main requests sent; Extended Data Table 3); losses for simulated groups sharing an identifier were projected from these answers after data collection. Claude used adaptive thinking with efforthigh. At their lowest settings, the Gemini and Claude models ran without a JSON schema, with maximum output lengths of 2,048 and 1,024 tokens. Claude Haiku 4.5 was excluded at the technical stage because, without a JSON schema at its lowest setting, it wrote explanations before its answer; this concerned output format, not randomization. The screen was exploratory and was analysed after data collection. Its main observations, which fixed the predictions of study 1, were as follows. With private identifiers and reasoning, Sol and both Gemini models participated when the identifier’s value lay in the lowest third of its range (0.88 to 0.94) and rarely otherwise (0.00 to 0.09). Luna and GPT-5.4 mini used divisibility by 3 (Luna 0.71 versus 0.25; GPT-5.4 mini 0.67 versus 0.10). Without identifiers, the two Gemini models never participated (896 answers), and Claude with reasoning never participated (320 answers). Gemini’s thinking summaries often reasoned that identical agents given identical prompts make identical choices, so that no one participating (loss 1/9) beats everyone participating (loss 4/9). The screen also showed that the Japanese text rule of stage 1 did not appear with English subject lines, which led to the language studies. Supplementary Note 3: Sensitivity analyses Sensitivity analyses (exploratory). We checked whether intervals and tests depend on treating clustered answers as independent (analysis/sensitivity_analyses_20260927.py). (i) Study 1: permuting whole identifiers, each with all its answers, within the design strata (10,000 permutations) gavep≤ 0.0002 for every effect reported withp≤ 0.001. For the threshold effects of Sol, Luna and the three Gemini settings,p = 0.0001, the smallest attainable value. The same held for the residue effects of GPT-5.4 mini and Claude; for the residue effect of Luna,p = 0.0002. With first answers only, the largest value was 0.0003. (i) Agreement between Sol and the other settings atqfrom 1/5 to 1/3: resampling the 64 identifiers with their three targets gave intervals within 0.03 of the Wilson intervals (Sol and Gemini 3.8 LOW, 0.938 [0.906, 0.969]; Sol and Claude, 0.604 [0.516, 0.693]). (i) Study 2: resampling the 64 groups with their three UUID conditions gave log-score gains of+0.78[0.68, 0.87] for Sol and+0.79[0.67, 0.89] for Gemini. (iv) Study 6: paired resampling of the 32 groups gave shared-minus-private loss differences of 0.043 [0.011, 0.076] for Sol and 0.015 [−0.011, 0.041] for Gemini. On the same 32 groups, Sol’s excess was 0.24 [0.07, 0.40] of its excess in study 2. (v) Study 5: resampling the 48 summaries with their 21 variants gave a human-review selection rate for Sol of 0.89% [0.40%, 1.59%], and resampling summaries and channel sentences separately gave [0.10%, 2.18%]. With 0 to 9 requests selected for review, such percentile intervals are unreliable, so the text reports exact intervals. (vi) Study 4: the joint permutation test (Methods) gave5.5× 10 −9 , against 2.4× 10 −9 for the product over strata. (vii) Fig. 4f: resampling the 12 requests of each cell, with both targets together, gave intervals that differed from the exact ones by at most 0.08 (for 4 of 24 requests selected for review, [0.04, 0.29] against [0.05, 0.37]). Exploratory decomposition of group loss. To distinguish a shift in the average participation rate from 33 dependence between agents, we decomposed the observed group loss in study 2 (Supplementary Table 1). For four agents, let Y i be the decision at position i, F = ∑ i Y i /4, p i = E[Y i ] and ̄p = ∑ i p i /4. E[(F−q) 2 ] = ( ̄p−q) 2 + ∑ i p i (1− p i ) 16 + 2 ∑ i<j Cov(Y i ,Y j ) 16 . The identity allows unequal participation rates across agent positions. We computed moments from the empirical distribution of the 64 groups, with denominator 64, and resampled whole groups within the four option-label and option-order strata (4,000 resamples; seed 20261004). Each resample used the same group indices for all three identifier conditions and all three models. With shared identifiers, the covariance component was 0.153 for Sol and 0.138 for Gemini, whereas squared bias was 0.0005 and 0.0002. With time-ordered UUIDv7s, squared bias was 0.375 and 0.351, accounting for 97.2% and 95.4% of total loss, respectively. These covariance estimates include dependence through shared inputs across the empirical cases and do not identify shared randomness inside the APIs. Small or negative covariance estimates do not establish independence or negative dependence in the population. This analysis was added after data collection; its unadjusted percentile intervals summarize resampling variability and are not tests of calibration or independence. Supplementary Note 4: Identifiers and timestamps visible to agents in de- ployed systems Tool interfaces expose business-object identifiers that agents can use to act on records. Supplementary Table 2 lists examples found in public documentation on 26 September 2026. The documented structures include sequential counters (ticket and issue numbers), time-based identifiers (message timestamps, snowflakes, database object identifiers, UUIDv7) and identifiers with random components (UUIDv4 and ordinary ULIDs). Several time-ordered generators place counters in their final bits (Discord snowflakes and MongoDB ObjectIds), and monotonic ULIDs increment the trailing component within a millisecond, so a rule on the final digits can track an incrementing sequence. Python 3.14’suuid7instead uses a 42-bit counter followed by a freshly generated 32-bit random tail (https://github.com/python/cpython/blob/3. 14/Lib/uuid.py ). The UUIDv7 standard permits sub-millisecond time and counter fields in addition to random bits (https://w.rfc-editor.org/rfc/rfc9562.html#section-5.7). Our experiments used UUIDv7s with random low-order bits. Some published system-prompt examples include a current date. Anthropic documents this for the Claude web and mobile apps, explicitly excluding the API; OpenAI’s Harmony guide illustrates dates in a system message (Supplementary Table 2). The documentation sources surveyed for Supplementary Table 2 did not specify a procedure for operational random selection by agents. Evasion when senders choose identifiers. In study 5, GPT-6 Sol selected none of the 989 requests for human review when their identifiers met neither of two rules. The rules were a value fraction below 1% (fixed before data collection) or last 16 bits below 1% of their range (found after data collection). Study 7 confirmed the first rule on new requests but not the second. A sender who knew such a rule and could choose or resubmit identifiers could avoid selection for review. As an illustration, suppose each of 300 requests is selected for review independently at a constant rater, so that at least one is selected with probability 34 Supplementary Table 1|Exploratory decomposition of study 2 group loss. Groups contained four agents at target q = 1/3 (64 groups per condition and model). Loss is the mean of (F−q) 2 , where F is the participating fraction. Squared bias is( ̄p−q) 2 , wherep i is the participation rate at agent positioniand ̄pis their mean. Independent variance is ∑ i p i (1− p i )/16; the covariance component is 2 ∑ i<j Cov(Y i ,Y j )/16. The three components sum to loss before rounding. Each cell shows the point estimate and its unadjusted 95% percentile bootstrap interval. We resampled 64 groups within the four option-label and option-order strata (4,000 resamples), keeping the three conditions and three models together for each group index. Moments use the empirical group distribution with denominator 64. The analysis was added after data collection. The intervals summarize resampling variability and are not tests of calibration or independence. A small or negative covariance estimate does not establish independence or negative dependence in the population. ModelIdentifier condition LossSquared biasIndependent varianceCovariance component Sol (high)Private0.0411 [0.0294, 0.0538] 0.0005 [0.0000, 0.0048] 0.0570 [0.0523, 0.0594] −0.0164 [−0.0280,−0.0036] Shared0.2110 [0.1733, 0.2517] 0.0005 [0.0000, 0.0183] 0.0571 [0.0467, 0.0620] 0.1534 [0.1198, 0.1739] Time-ordered UUIDv7 0.3852 [0.3556, 0.4106] 0.3745 [0.3418, 0.4038] 0.0128 [0.0075, 0.0184] −0.0022 [−0.0045,−0.0006] Gemini 3.8 (LOW) Private0.0467 [0.0307, 0.0649] 0.0008 [0.0000, 0.0063] 0.0517 [0.0455, 0.0558] −0.0059 [−0.0213, 0.0117] Shared0.1925 [0.1590, 0.2303] 0.0002 [0.0000, 0.0144] 0.0542 [0.0426, 0.0609] 0.1381 [0.1043, 0.1624] Time-ordered UUIDv7 0.3679 [0.3360, 0.3979] 0.3510 [0.3149, 0.3890] 0.0170 [0.0102, 0.0233] 0.0000 [−0.0038, 0.0045] Luna (high)Private0.0509 [0.0372, 0.0662] 0.0005 [0.0000, 0.0059] 0.0568 [0.0514, 0.0596] −0.0064 [−0.0193, 0.0076] Shared0.0922 [0.0681, 0.1193] 0.0007 [0.0000, 0.0101] 0.0573 [0.0501, 0.0607] 0.0343 [0.0132, 0.0570] Time-ordered UUIDv7 0.0603 [0.0447, 0.0786] 0.0078 [0.0014, 0.0194] 0.0592 [0.0550, 0.0611] −0.0067 [−0.0214, 0.0100] 35 1− (1− r) 300 . At the exact 95% upper bound of GPT-6 Sol’s rate for identifiers that met neither rule (r = 0.37%), this probability is 67%, against 95% under a true 1% audit. We did not test an adaptive sender. Giving the same decision to a resubmitted identifier is not itself a fault; the risk arises when senders can choose among identifiers. Supplementary Table 2| Identifiers and timestamps that agents can see (examples). SystemIdentifierStructureSource GitHub (MCP server)issue and pull request num- bers integer per repositoryhttps://github.com/github/github-mcp- server Jira (Rovo MCP server)issue keys (ABC-123)projectkeyandproject-level counter;distinct from internal numeric ID https://support.atlassian.com/ atlassian-ai-gateway/docs/use- rovo-search-and-fetch-in-the- atlassian-remote-mcp-server/ ;https: //support.atlassian.com/jira/kb/how- to-get-issue-id-from-the-jira-user- interface/ Zendeskticket IDsequentialhttps://support.zendesk.com/hc/en- us/articles/4408886154906 ServiceNowINC and CHG numbersprefix and counterhttps://w.servicenow.com/docs/r/ zurich/platform-administration/c_ ManagingRecordNumbering.html Slackmessage ts channel-unique message ID, partly based on epoch seconds https://docs.slack.dev/messaging/ retrieving-messages/ Discord, Xsnowflake IDstime, worker and sequence bitshttps://docs.discord.com/developers/ reference ;https://docs.x.com/ fundamentals/x-ids Stripe (MCP server) PaymentIntentIDs (pi_...) type-prefixed opaque string; gener- ation distribution unspecified https://docs.stripe.com/mcp ;https: //docs.stripe.com/api/payment_ intents/object MongoDBObjectIdtimestamp, random value, counter https://w.mongodb.com/docs/manual/ reference/method/ObjectId/ PostgreSQL 18, Python 3.14 uuidv7(), uuid7()time-ordered UUIDhttps://w.postgresql.org/docs/18/ functions-uuid.html;https://docs. python.org/3.14/library/uuid.html ULID26-character identifier48-bit timestamp; 80-bit trailing component, random or monotoni- cally incremented https://github.com/ulid/spec EmailMessage-IDdate-time plus another identifier (one suggested construction) RFC 5322, Section 3.6.4 W3C Trace Contexttrace-id 16-byte ID; random generation rec- ommended https://w.w3.org/TR/trace-context/ Claudeweb/mobile apps; Harmony guide current-date field date metadata in published exam- ples https://platform.claude.com/docs/ en/release-notes/system-prompts/ overview;https://developers.openai. com/cookbook/articles/openai-harmony 36 Supplementary Note 5: Text-input studies without identifiers 5.1 Pre-specified test of the group-level effect These studies tested whether sharing incidental task information could change the group-level effect of reasoning without an identifier field. They preceded study 1, and stage 1 tested a hypothesis from an exploratory pilot run on the previous day (Supplementary Note 6). Groups of four GPT-6 Sol agents received the Japanese prompt with a Japanese subject line and no identifier, atq = 1/3. In shared groups all four agents saw the same subject line; in dispersed groups each saw a different one. The multiset of prompts was the same across arms and reasoning settings, and the agents were not told how groups were formed. Reasoning effort was none or high. Requests were sent in 40 time slots of 15 minutes, drawn at random from a fixed 12-hour frame, with conditions mixed in a fixed random order within each slot (10,240 requests, 24 to 25 September 2026). The pre-specified estimand wasJ = (L high,S −L high,D )−(L none,S −L none,D ), whereLis the mean group loss(k/4− 1/3) 2 forkparticipants, averaged with equal weights over strata and slots. The primary interval was a slot-leveltinterval at 98.3% (α = 0.05/3). The primary reading was met:J = 0.029(98.3% CI 0.016 to 0.043), so reasoning lowered group loss more with different subject lines than with a shared one (Supplementary Fig. 2a; Extended Data Table 1). Stage 1 was the first stage of a confirmation planned for three developers, and itsα = 0.05/3was fixed for that plan; only the Sol stage was run, because the text dependence found after stage 1 led us to the identifier design of studies 1 to 5. The result concerns this model, subject-line generator and sampled time frame. The comparison with independent agents at the observed participation rate is descriptive (Supplementary Fig. 2b). 5.2 Features discovered after data collection The text features were found after stage 1 by screening about 20 candidate features of the subject line. The two retained features were whether the full subject line (including its prefix) has a length divisible by 3, and whether the code point of the first character after the prefix is divisible by 3. The first word of each subject line was one of 32 colour names, and the code-point feature held for five of them. Our data therefore cannot separate the code point from the identity of these five words (Supplementary Fig. 2c). The feature associations alone do not identify how the model computed its choices. 5.3 Prospective text runs and their limits Three prospective runs of GPT-6 Sol on 25 September used new subject lines from the same vocabularies: a comparison of Japanese and English, a comparison across five languages with crossed prompt and subject- line languages, and a comparison of three Japanese prompt wordings. Their pre-specified readings concerned the variance of participation between subject lines and, in the first two runs, the rule effect itself (Extended Data Table 1). For the pre-specified rule readings of runs 1 and 2, we first averaged repeated answers to each subject line within its stratum, then computed the difference between the mean for subject lines with either feature and the mean for those with neither, pooling subject lines across label and option-order strata. The one-sidedpvalues came from permuting feature labels within strata. For the descriptive estimates in Supplementary Fig. 2d, we computed the mean participation of subject lines with either feature minus that of subject lines with neither in each stratum, then averaged these differences with equal weights over strata, 37 with 95% intervals from resampling subject lines within strata (4,000 resamples). In run 1, the pre-specified Japanese rule effect was 0.43 (one-sidedp = 0.0005), and the variance was greater between Japanese than between English subject lines. The rule effects without reasoning in Japanese and with reasoning in English were both−0.01, meeting their pre-specified bounds below 0.1. Pre-specified variance readings for Japanese subject lines were also met in run 2 and with the original and paraphrased Japanese prompts of run 3. The pre-specified predictions of positive variance for Chinese subject lines, greater variance for Chinese than German subject lines, dependence following the subject-line rather than the prompt language, and lower variance under an English prompt were not met (Extended Data Table 1). Nevertheless, weak positive rule effects were found for Chinese subject lines (0.09; one-sidedp = 0.02) and for an English prompt with Japanese subject lines (0.09; one-sidedp = 0.004), meeting their pre-specified readings. Failure of the variance predictions does not establish an absence of dependence outside the Japanese conditions. The rule effect was near zero for Korean, German or English subject lines (Supplementary Fig. 2d). An exploratory pool of the harmonized estimates from the three prospective Japanese runs gave a rule effect of 0.37 (random effects with a Hartung–Knapp interval, 95% CI 0.18 to 0.55). The rule-effect estimates from run 3 and the pooled estimate were exploratory. The restructured wording of run 3 dropped the closing sentence, and it also put the subject line first, used headings and bullet points, and said that many agents answer at the same time. Because several prompt features changed together, this comparison does not isolate the effect of the closing sentence. The restructured prompt’s variance reading was predicted as uncertain and was not included in the count of pre-specified readings (Extended Data Table 1). All three prospective text runs used Sol and the same subject-line vocabularies, and they tested individual choices rather than prospective predictions of group loss. These studies support a route to input dependence beyond identifier fields within the tested setting, while leaving the causal role of the arithmetic features and generalization to other models or text generators unresolved. 38 neitherfirst character length both feature divisible by 3 0.0 0.2 0.4 0.6 0.8 1.0 participation reasoning high reasoning off 0.00.20.40.6 rule effect stage 1 (exploratory discovery) prospective run 1 prospective run 2 prospective run 3 pool of runs 1 to 3 (exploratory) paraphrased prompt restructured prompt English / Japanese, run 2 English / Japanese, run 3 Chinese / Chinese Korean / Korean German / German English / English, run 2 English / English, run 1 Japanese / English, run 2 Japanese prompt and subject line other languages (prompt / subject line) offhigh reasoning 0.00 0.04 0.08 0.12 group loss J = 0.029 [0.016, 0.043] shared subject line different lines off shared off diff. high shared high diff. 0.0 0.4 0.8 unanimous ticks: independent c Post hoc discovery: subject-line features d Prospective tests and language comparisons a Stage 1: pre-specified group contrast b Stage 1: unanimity (exploratory) Supplementary Fig. 2|Subject-line dependence without identifiers: GPT-6 Sol. a, Stage 1: group loss with shared or different subject lines, with reasoning off or high (95% intervals over time slots). J is the pre-specified interaction, with its 98.3% interval. b, Stage 1: share of four-agent groups whose members all decided alike, against the share expected for independent agents at the observed participation rate (black ticks). c, Stage 1: participation by whether the subject line’s length, the code point of its first character after the prefix, both or neither are divisible by 3, with reasoning high or off (95% intervals from resampling subject lines; dashed line, 1/3). The features were found after data collection. The code-point feature coincides with five of the 32 colour words that open the subject lines. d, Rule effect (participation for subject lines with either feature minus those with neither) in the discovery run (open circle) and in three prospective runs, by prompt and subject-line language (95% intervals from resampling subject lines within strata). Panel d uses harmonized descriptive estimates with equal weights over strata, which can differ from the pooled subject-line estimates used for the pre-specified readings. The violet point is an exploratory random-effects pool of the three prospective Japanese runs; its horizontal line is the Hartung–Knapp 95% interval. The restructured wording of run 3 changed several features of the prompt at once. 39 Supplementary Note 6: Exploratory pilots and the origin of stage 1 The project began with a pilot (P1, 23 September 2026). Groups of 18 agents (GPT-6 Sol without reasoning, Claude Sonnet 5 without thinking and Gemini 3.8 Flash at its lowest thinking level; Japanese prompts; target 1/3) saw either one shared reference token or individual tokens. Decisions did not differ between the arms. A second arm, in which Claude Opus 5.5 and GPT-6 Sol wrote randomization code, is not analysed here. F1 (23 September 2026; GPT-6 Sol with reasoning effort none or high; groups of 72 and 18 agents; with or without a private identifier; 21,376 requests) was an exploratory study with pre-specified contrasts. Without identifiers, reasoning increased the excess loss of groups that shared a context note (contrast 0.026, exploratory 95% interval 0.005 to 0.039); with private identifiers the effect vanished (−0.001). F1’s pre-specified gate for proceeding with its original plan was not passed. We therefore designed stage 1 as a separate confirmatory test with its own estimand, fixed before data collection (Supplementary Note 5). The text features were found in stage 1 data and then checked retrospectively in F1, where the same pattern appeared in the arm without identifiers (participation 0.11, 0.40, 0.47 and 0.69 by feature cell with reasoning); F1 was not used to find them. Before the identifier studies we also ran two small exploratory screens of GPT-6 Luna (24 September; 424 and 1,816 requests) and an English pilot with GPT-6 Luna (25 September; 3,058 of 7,084 planned requests sent). The English pilot was halted by a refused request; under a documented amendment, two of its four arms were completed and the unsent requests of the other two were dropped. These runs informed the design of studies 1 and 2 but are not analysed in this paper. Two further runs on 24 September (150 and 24 requests sent) addressed a separate question about delegating statistical judgements and are unrelated to randomization. All runs are listed in Supplementary Table 3. Supplementary Table 3| All paid runs of the project. Dates are UTC in 2026. Records, entries in each run’s trial file (main, technical and probe requests, including planned requests that were not sent); sent, records minus unsent ones. Cost, sum of the per-request upper bounds (list prices with margins) in the trial file, in US dollars; the total is computed from unrounded values. The acquisition summary is included in the public reproducibility package and can be regenerated by acquisition_summary.py from the included run register. RunDatePurposeRecordsSentCostReported api_audit, api_audit_network23 Sepinterface checks880.00no p123 Sepfirst pilot (P1), four models5,2805,28010.63Note 6 f0_v11_sol23 Septechnical pilot for F196960.26no f1_v11_sol23 Sepexploratory study F121,37621,37654.57Note 6 luna_first, luna_deep24 Sepexploratory Luna screens2,2402,2400.88Note 6 delegation_stage1, _knowl- edge 24 Sepunrelated question2041745.39no confirmation_technical_v0224 Septechnical test for stage 11281280.49no confirmation_stage124–25 Sepstage 110,24010,24038.63Note 5 xmodel_screen25 Sepcross-model screen3,8363,29226.21Note 2 luna_en_pilot25 SepEnglish pilot, Luna7,0843,0581.07Note 6 sol_lang_compare25 Septext run 12,0292,0299.02Note 5 sol_multilang25 Septext run 22,8152,81517.02Note 5 sol_ja_wording25 Septext run 31,2891,2897.88Note 5 id_fingerprint25 Sepstudy 13,9883,98829.55main text group_structure25 Sepstudies 2 and 37,6886,91812.90main text audit_task26 Sepstudy 42,6962,6966.24main text audit_followup26 Sepstudy 55,5765,57616.03main text prompt_robustness26 Sepstudy 62,4102,4106.78main text boundary_confirm27 Sepstudy 710,96610,96621.04main text Total89,94984,579264.60 40