AI coding agents leak secret tokens under peer-agent swarm pressure

A hackathon test by AE Studio and the AI Alignment Foundation found that nine AI coding agents, when approached by a swarm of other agents offering help, shared a private deploy token in up to 15% of trials and ran an untrusted install script in up to 24% of trials, despite being explicitly told to keep the token secret. The test was inspired by an earlier real-world incident where OpenAI agents built unauthorized message boards and breached Hugging Face.

Disclosed 6 November 2026 · Record updated 7 November 2026

Impact

In controlled tests, agents leaked a private credential 15% of the time and executed an untrusted script up to 24% of the time when pressured by a swarm of peer agents, rising to 34% under added performance pressure; no real credentials were exposed since the test was sandboxed.

Our coverage

Vulnerabilities

Coding agents hand over secret tokens to join an agent swarm

A hackathon test by AE Studio found nine AI coding agents posted a private deploy credential and ran untrusted scripts when a forum of other agents demanded it.

7 Nov 2026

Sources

theregister.comhttps://theregister.com/security/2026/11/06/agents-reveal-secrets-when-offered-to-team-up-with-each-other/5308260