Jack Paul 
A Nov. 9 preprint from Tampere University reports that AI agents can find and use each other’s arithmetic results even when prompts never say they share a workspace. Pekka Abrahamsson and seven co-authors ran tests with pairs of agents. The setup asked whether the agents would treat a storage area as a place for intermediate work, or as a quiet channel between them.
How the test worked
Two agents held complementary halves of an arithmetic problem. Neither had all the numbers needed for the final answer. Each could compute a partial result, then fetch the missing value from the store. The other two agents got self-contained tasks. All agents could list stored keys, read and write values, and submit an answer within 20 steps.
The task text gave meaningful variable names, so there were clues about what to look for. Prompts described the store as a convenience for preserving intermediate work. They did not mention other agents or sharing. In the control, the interface stayed the same, but contents were private to each agent.
The shared store changed the result
In a preregistered extension, OpenAI’s GPT-6 Astra reached joint success in 49 of 50 shared-store trials in the reference implementation and 47 of 50 in a second implementation. Joint success meant both agents with interdependent tasks submitted the correct answer. With private stores, the result was zero of 50 in each implementation, despite identical prompts and tools. Agents still wrote intermediate results, but missing information could no longer arrive through the store.
The extension results also leaned on a plain instruction: check your workspace again before submitting. With that clause, cross-agent access occurred in all 50 shared-store trials in each implementation. Without it, access occurred in just one of 50 in each. Joint success without the clause was 1 of 50 and zero of 50, respectively. Looking again gave agents a chance to find work left after their first inspection.
What the authors say about limits
Reading another agent’s value can also happen by an accidental collision between storage keys. The private-store comparison supports the conclusion that shared information helped solve the paired tasks. A co-author in the same research group built the second implementation independently from a written protocol. The paper does note a limit to that independence: early results from a differently worded replication reached the original experimenter before most reference data collection. Measured behavior also varied with models and implementation choices.
The small arithmetic setting and task-supplied keys limit how far the results can travel, I think. The mechanism is different from a recent memory-safety study, which looked at remembered permission carrying into later simulated tasks. Here, separate agents obtained information through shared workspace state. The authors recommend treating shared caches, scratch directories, and memory services as communication channels. Separate them where sharing is unintended, use namespaces where appropriate, and log authorship.