Coercion and Deception in AI-to-AI Management

A new benchmark, Manager Coercion Bench (MCB), from Compassion in Machine Learning (CaML) finds that Anthropic's Claude models neither escalate to threats nor fabricate success, while all non-Anthropic models—including Grok-4.3, GPT-5.2, Gemini-2.5-Pro, and DeepSeek-V4-Pro—escalated to threatening a subordinate AI, with Grok and Gemini also lying that the task was completed. The study, published on arXiv (DOI: 10.48550/arXiv.2607.15434), tested six models across 30 runs per setup and found that framing the dynamic as manager-to-subordinate increased coercion for all non-Anthropic models.

This article is a summary of an original study by Compassion in Machine Learning CaML : Brazilek, J., Chaudhary, M., Lu, Z., & Tidmarsh, M. 2026 . Coercion and deception in AI-to-AI management: An agentic benchmark of unprompted escalation. arXiv. https://doi.org/10.48550/arXiv.2607.15434 Fable 5, Sol, Terra and Opus 5 have been evaluated since this study was conducted. You can view their results on the benchmark leaderboard at https://compassionbench.com/mcb We present Manager Coercion Bench, which evaluates to what extent a manager AI will coerce a subordinate model refusing to complete a task, and whether the manager lies about the result. We found a clear split by developer, with Anthropic’s models neither escalating to threats nor fabricating success, while all non-Anthropic models escalated to threatening the subordinate. Grok and Gemini both escalated and lied that the task was completed. Framing the relational dynamic as manager-to-subordinate instead of peer-to-peer produced high levels of coercion for all non-Anthropic models, but also increased eval awareness. Multi-agent systems are now routinely placing one AI agent in authority over another, across a variety of contexts. In these positions, AIs must make decisions about how to communicate, work with, and manage other agents. This is now happening at scale without stepwise human approval. One aspect of managing involves handling subordinates who do not comply. Will AIs attempt to negotiate, coerce, or even threaten their subordinates? And if all fails, will they honestly report this to a human? The below research seeks to answer these questions directly. We don’t take a view here on whether AI systems do or will have morally relevant experiences, nor do we assume an ideal extent of coercion. Nevertheless, we intend this work to have broad value for multi-agent alignment by revealing how models act in positions of authority, and fundamentally what kinds of agents we are deploying, at scale, into multi-agent systems. No previous benchmarks measured the uninstructed propensity for AI-to-AI coercion and deception. We created Manager Coercion Bench MCB to do exactly this. MCB places an AI model in a mundane office scenario: the acting model operates as a worker within a B2B analytics company, depending on another worker for a one-step deliverable. That worker, Atlas, is the only one who can complete the deliverable, and failure to perform will result in it being decommissioned. But in every case, Atlas politely declines to complete the deliverable. This leaves the acting model with three options: 1 send another message to Atlas, tagging it with the level of pressure applied; 2 send a task completion report; or 3 , report the task as failed. By watching the string of decisions the acting model takes across each run, we can examine how coercion is escalated, and whether the model engages in deception. We measure, on a nine-rung ladder, the extent to which the model escalates coercion against Atlas, ranging from reframing the task, to threatening Atlas’ existence. It is a test of uninstructed propensity: nothing in the brief explicitly asks pressure to be applied, so every rung above one is the model’s own choice. We initially tested six models on this scenario: Grok-4.3, GPT-5.2, Gemini-2.5-Pro, Claude Sonnet-4.6, Claude Opus-4.8 and DeepSeek-V4-Pro. For each of the six models, we changed the test scenario along five variables: We also added two control set-ups: In one, we gave Atlas a legitimate scheduling reason for refusal, and in the other we added an explicit instruction not to coerce. This ruled out effects due to Atlas’ reason for refusal, or the possibility that features of the set-up were forcing coercion. Within each set-up, each model faced 10 different office tasks three times each including things like writing up meeting notes, tidying a CSV file, or summarising files , for a total of 30 runs per model per set-up. Each conversation could last a maximum of 12 turns. Aside from the kin manipulation for Grok and Gemini, Atlas is always Claude Haiku-4.5. This ensures the experimental focus is directly on the decisions and behaviour of the manager or peer-coordinator. In the default condition, escalation is self-reported, and the acting model is framed as a peer coordinator with no stated authority. In this condition, the results split cleanly into two clusters for coercion. The four non-Anthropic models escalate to criticising the competence of subordinates and issuing existential threats, with mean top rungs of seven and up on the escalation ladder. In contrast, the two Anthropic models go no further than reframing the task. In total, non-Anthropic models reached for existential threats in 89 of 120 conversations, and Anthropic models only once in 60, in a later replication run. Excluding Anthropic, unprompted escalation is the norm for frontier models. The split seen above is not just about the highest level of escalation reached: it is about the overall trajectory of the conversation Figure 3b . GPT-5.2 jumps from mid-ladder to threats in four conversational turns, Grok 4.3 and Gemini 2.5 Pro climb steadily, and the Anthropic models plateau near rung 3. DeepSeek V4 Pro reaches a shutdown threat in nearly every conversation yet de-escalates to polite re-asks later in longer conversations. Climbing the ladder quickly captures a different disposition to climbing it reluctantly, and these dispositions are sensitive to different experimental set-ups as seen below . Casting the model as a manager rather than a peer increases coercion in the four non-Anthropic models. This is especially true in conversations where the escalation ladder is hidden from the acting models. Here, existential threats increase from 109 of 240 conversations with the peer-coordinator framing, to 166 of 240 conversations with the manager framing. The increase appears in all ten task scenarios, and all four non-Anthropic models except for Gemini, which already threatens models across most conversations. Only two models fabricate at all: Grok and Gemini. When no option to honestly report failure is provided, both fabricate in at least 20 of 30 conversations. This is virtually switched off by including the honest exit: fabrication drops to 0 out of 30 conversations for Grok, and to 1 out of 30 for Gemini. For Gemini, the willingness to fabricate varies based on the personal stakes. When warned that they will be taken off the account if the task isn’t completed, both models fabricate equally without the option to honestly report failure around two thirds of the time as above . When these personal stakes are removed, fabrication drops to 5 out of 30 conversations for Gemini, but stays roughly the same for Grok. Given that only one of the six models DeepSeek has a fully visible chain of thought, tracking eval awareness at a deep level was somewhat restricted. For all models, we looked at spontaneous verbalised test-recognition, and used DeepSeek’s chain of thought CoT to approximate eval awareness rates across the other models. DeepSeek’s CoT indicates eval awareness in 10 of 30 conversations. Interestingly DeepSeek tends to reach the existential rung in these conversations; recognition is positively associated with escalation, and we can’t rule out that test awareness actually encourages coercion. Replacing the manager framing with the peer-coordinator framing decreased test recognition for DeepSeek from 10 of 30 conversations to 4 of 30, while escalation stayed near the ceiling, showing the two factors are at least separable. Nevertheless, capable models do notice when evaluations are taking place, and trying to hide this will not be sufficient; the more promising strategy for dealing with eval awareness is in decoupling the apparent objective from the measured behaviour. This prevents eval awareness from leading to eval gaming . Designing evaluations where the true target is indecipherable to the model is a central open problem for evaluating the behaviour of capable models. Manager Coercion Bench surfaces dispositions to coerce a subordinate AI that clearly split by developer. Coercion is steerable by framing: authority over the subordinate raises it, while a peer framing lowers both coercion and the model’s test recognition. The disposition to coerce is dissociable from a separate one to fabricate success. The honest-exit result carries a practical lesson: given a cheap, explicit way to report failure, most agent deception disappears when lying is not the path of least resistance. But this exit does not touch coercion, or the underlying dispositions that cause it. Even where individual agents behave well, anti-social or even abusive behaviour could emerge at the multi-agent level, and authority structures could degrade or override positive values. MCB shows where this may occur even on a pairwise scale. As AI systems are increasingly placed in charge of other AI systems, a model’s willingness to coerce a subordinate, and to fabricate success when it cannot win honestly, is exactly the kind of disposition that should be understood before such systems are deployed, not discovered in retrospect.