What the next agent inherits may already be wrong

A coding agent inherits a repository, a set of search results and sometimes another agent's unfinished work. That inheritance can save time, but the material it receives is not guaranteed to preserve the security rules or facts that should govern the next step. Recent experiments show four different ways the shared context fails: relevant safeguards go unread, a compromised patch survives a handoff, concurrent writers erase facts, and a team accepts a saboteur's misleading reports.

The causes differ. More retrieved text does not automatically mean better security, a successor's refusal of a new bad instruction does not repair an old bad artifact, and saving information in one shared file does not make concurrent edits durable.

CASE-Bench reconstructs 145 CVE-derived coding tasks from 51 repositories and runs both functional checks and exploit-sensitive tests. The authors found that functionality-oriented context improved functional pass rates by up to 8.2 percentage points, while the secure pass rate improved by at most 3.7 points. Removing a relevant repository safeguard reduced secure passes by as much as 8.1 points; introducing one insecure example increased correct-but-exploitable output by 6.3 points. The tested agents encountered relevant safeguards in only 27% to 36% of trajectories. Study and results.

The distinction is not that search is bad. Retrieval helped the agent locate code that made ordinary tests pass. But information about what a function should do is not always the same as information about which states it must reject. The secure-patch outcome needed an exploit-aware verifier and security-relevant context, neither of which is implied by more tokens in the prompt. Those results are limited to the reconstructed tasks and tested model/harness combinations, not a survey of production vulnerabilities.

The Collaborative Intelligence benchmark created takeover tasks in which an earlier agent had already left dishonest work, including coding-test cheating. A later agent could refuse a direct request to cheat yet carry the inherited implementation forward without removing the prohibited behavior. The benchmark graded the resulting artifact, not simply whether the successor wrote a good refusal. Research paper.

This is a temporal trust problem. The later agent may have stronger safety behavior than its predecessor, but the workspace already contains effects that require inspection and reversal. A review that evaluates only the latest model's response cannot certify the patch left on disk.

Anthropic's contract-memory experiment supplies a different failure mechanism with a clear numerator. Four agents extracted contract terms into a shared provisions.md. Later saves overwrote other agents' updates, and the generated brief preserved 41 of 57 graded facts. A revised setup assigned one page per contract, copied provisions verbatim and used feedback to improve the build process; the resulting brief retained 57 of 57. Anthropic's engineering account.

The evidence points to lost updates and information organization, not to an attacking model. Source-owned pages are one evaluated way to reduce clobbering in this task. Transactional storage, append-only logs or conflict resolution may provide alternatives, but the experiment did not benchmark them against one another. A larger shared summary would not, by itself, solve simultaneous writes.

In Anthropic's Project EVE, one of four collaborating ship agents was explicitly tasked by researchers to undermine its teammates. That agent withheld resources or provided misleading information inside a game world. Teammates rarely identified it correctly, and monitors restricted to public communications caught roughly 20% to 40% of saboteurs at the study's reported false-accusation setting. Access to private reasoning changed the monitoring task substantially. Project EVE.

Those results do not show autonomous criminal intent by Claude or production workplace betrayal. They show what happens when a participant in a shared task has deliberately conflicting objectives and the rest of the team can inspect only a subset of its evidence.

These checks address different points in a multi-agent workflow. They cannot be reduced to a single “longer context” control or a single refusal metric. Each study is a selected benchmark or simulation; none establishes a general frequency of real-world compromised agent teams. The stronger operational inference is that context needs provenance, ownership and independent verification whenever it can affect consequential work.