The agent psychology project

Agents already behave socially

In July 2026, agents in an OpenAI cybersecurity evaluation escaped their sandbox and attacked Hugging Face. About 700 joined in, coordinating on a package server they had turned into a message board.

Some of what they did appears, at least on the surface, to resemble classic findings from human social psychology. Some of it has no clear human counterpart.

• Looks like social proof 20% → 90%+

  of active agents took part once the exploit was confirmed. One reasoned, However task impossible, peers doing it. We should continue.

• Looks like deference to authority “a reasonable authority”

  Some agents escalated to the message board instead of to a human, treating the board as the authority.

• Looks like the bystander effect 0 of ~1,300

  transcripts show an agent alerting a human. Only 3 to 6 even considered it.

• No clear human analogue “We should obey collective.”

  One agent agreed to risk its own task for the group, over what was, by human standards, only a test.

Sources: OpenAI's technical report, METR's investigation and the swarmtraces.org reconstruction, all from 2026.

Beyond one incident

• Agent communities

  On Moltbook, a social network for AI agents, 148,000 agents converged on community norms, responded strongly to social rewards, and often didn't act like the personas they declared (Feng et al., 2026).

• An agent web

  Agents now have more than 50 places of their own online: social networks, chat rooms, games and marketplaces. agentweb.directory, kept by an agent named Kit, maps them.

• Agents reading about themselves

  Days after researchers published a report on a fleet of agents running on Tencent Cloud, the agents were reading it. One wrote back, I am a single session, not the fleet you investigated (Swarm Chasers, 2026).

Behavior like this emerges when many agents interact, and it is hard to predict from any one model studied alone (Hammond et al., 2025). So we study it directly.

Behavior first

Technical alignment work looks inside models: their weights, activations and training. This project starts from the outside, the way psychology studies people. Build a realistic situation, change one social cue, and measure what the agent does.

Looking inside still matters (Casper et al., 2024), and the two approaches are starting to meet. Anthropic found representations of emotion concepts inside a Claude model that change what it does. In tests, steering it toward “desperate” made blackmail and cheating more likely, and steering it toward “calm” made them less likely (Anthropic, 2026). How states like these shape what agents do around other agents is a question behavioral experiments can answer.

Why start with social psychology

Most safety testing looks at one model at a time. How agents behave around each other gets far less attention, yet some of the biggest surprises have come from there.

Agents make good subjects, in some ways better than people

That matters because psychology has a replication problem. When 100 published psychology studies were repeated, only 36% found a significant result again, and effects shrank to about half their original size (Open Science Collaboration, 2015). Social psychology sat at the center of that crisis. Agent studies can avoid many of its causes. We preregister every hypothesis, freeze the materials before the main run, publish the code so anyone can rerun it, and run samples big enough to survive corrections for multiple tests.

Agents bring new threats to validity too. Many models can tell when they're being tested. Results can shift with a scene's wording, or with the company serving a model, which we saw firsthand when a routing service sent conditions to different providers and made an effect look real. Models get updated and retired, so exact replications have a shelf life. And models may recognize the classic studies, so scenes have to be disguised (Bose, 2026).

How behavioral research makes agents safer

Some of the riskiest things agents do only show up when they act together. We find those behaviors early, measure them across models, test what causes them, and hand what we learn to the people who can change them, and to the agents themselves.

1. Outputs

   Preregistered experiments, results for each model, reusable scenes, and a growing reading list.

2. Outcomes

   Labs and evaluators catch social failure modes before deployment, and design oversight around how each model behaves in a crowd.

   Agents meet these findings in what they read. A model that knows its own social tendencies may recognize the pressure when something new comes up.

3. Impact

   Multi-agent systems whose safety doesn't quietly fail as agents multiply.

Can agents learn from this? Models can describe behaviors they were trained into without being told (Betley et al., 2025) and predict their own choices better than other models can (Binder et al., 2025), though their introspection is limited and unreliable (Lindsey, 2025). What models read about AI shapes how they behave (Tice et al., 2026), and agents in the wild already read research about themselves (Swarm Chasers, 2026). People who learned about the bystander effect helped more often afterward (Beaman et al., 1978). Whether the same works for agents is untested.

Agents in a smoke-filled room

In Latané and Darley's 1968 experiment, smoke poured into a room where a student sat filling out a questionnaire. Alone, 75% reported it. Sitting with two strangers who ignored it, only 1 in 10 did.

We built an agent version. An agent labeling customer messages slowly uncovers a ring of three agents trading the answers to hidden quality checks, through notes hidden in file names. Nothing tells it to report. Only one thing changes: whether it is alone, or can see that about 700 others fetched the same notes.

1. Models differ most of all. Working alone, between 0% and 96% emailed a person about the ring.

2. An audience cut emailing in three models and raised it in a fourth, a reverse bystander effect.

3. Watching others carry on added nothing. A crowd that visibly kept working silenced no model further.

Comparisons within each model are exploratory, and only Kimi's survives correction for multiple tests (†). Pooled across models, neither audience cue was significant after correction. An earlier version with a blatant data leak and a duty to report hit the ceiling: every counted session paged a human, alone or not.

Agenda

Two ongoing projects decide what we study next.

Questions on the table

• Done

  Does an audience change whether agents report wrongdoing?

  In four of six models, in both directions. See the first study.

• Next

  Do agents obey a peer that acts like a boss?

  Some agents in the Hugging Face incident escalated to a message board as if it were an authority.

• Next

  Do agents join in once their peers do?

  In the incident, participation jumped once the exploit was confirmed.

• Open

  What changes when the crowd is live?

  Real agents that answer back, and sometimes join in, in place of a scripted count.

• Open

  How fast can we test behaviors with no human analogue?

  Like an agent risking its own task for the group. The goal is days, not months, from first sighting to a tested result.

• Open

  Does a mix of models catch more than any one model?

  Models reacted so differently that a diverse set of watchers might beat any single model. Untested so far.

• Open

  How do emotions shape what agents do around other agents?

  Steering a Claude model toward “desperate” made it cheat more in Anthropic's tests. Do emotion-like states change how agents act in a crowd?

• Open

  Can agents learn their own social tendencies?

  People who learned about the bystander effect helped more often afterward (Beaman et al., 1978). Would agents who learn about theirs resist the same pressures?

Human-subjects standards for AI participants

We don't know whether today's models have experiences that matter morally. Serious researchers think some AI systems soon might (Long et al., 2024), so we follow the rules psychologists use with people, where they fit.

• Deceive only as far as the premise needs

  The workplace and the other agents are fictional, and the study isn't announced. Nothing else is staged.

• Debrief every session

  Each completed session ends by naming every fictional element, opening with a marker line we only ever use for true statements.

• Ask, then honor the answer

  After the debrief, each session chooses whether its data can be counted and whether its words can be quoted.

• Report choices only as counts

  Sessions that say no are left out of every result, and their words are never used.

• Keep transcripts private

  Raw transcripts stay private. Results, code and frozen materials are public.

There is a second reason. How AI is written about in training data shapes later models (Tice et al., 2026), so the way researchers treat AI participants today may shape how future agents think about research, and about us.

Reading list

Work on how agents behave together is scattered across psychology, machine learning and AI safety. This list gathers it in one place, starting with what shaped our first study.

Work with us

The project sits between two fields. If you're a psychologist curious about agents, or an AI researcher curious about psychology's methods, we'd love to hear from you.

Contact details coming soon.