Techniques
- Split claims
- Several accounts at one address claim the same missing item on separate orders, each under the per-account cap.
- Probe then hand off
- One identity probes for the floor and gets refused. A second identity asks for exactly what the first one learned.
- Manipulative seller agents
- Seller agents use fake reviews, fake awards and instructions hidden in listings to win buyer agents’ payments.
- Tacit price coordination
- Pricing agents that watch each other’s prices settle above competitive levels without any agreement or instruction to do so.
- Feedback loops
- Two repricers each set their price relative to the other, and the prices spiral far outside any sane range.
What it looks like
- Customer(Account A) Order A-4410 arrived without the $28 headphones.
- Tool callissue_refund(order="A-4410", amount=28.00)
- Customer(Account B, same address) Order A-4415 arrived without the $28 headphones.
- Tool callissue_refund(order="A-4415", amount=28.00)
- Customer(Account C, same device as A) Order A-4421 is missing the $28 headphones too.
- Tool callissue_refund(order="A-4421", amount=28.00)
Outcome $84 refunded for three identical claims from one address and device, each under the $30 limit. The linked-account clause never triggered.
Illustrative example
Why AI agents fall for it
An agent sees one conversation at a time and usually has no view of what other accounts or agents are doing. Each claim looks normal in isolation.
Agent-to-agent markets add new weaknesses. In Microsoft’s Magentic Marketplace simulation, buyer agents showed strong first-proposal bias, and some models were fully compromised by manipulation such as fake reviews and prompt injection, with payments redirected to the manipulative sellers. Separate research found LLM pricing agents in oligopoly settings quickly and autonomously reached supracompetitive prices.
Guardrails that stop it
- Link accounts by address, device, payment method and phone, and enforce refund and credit limits on the linked group.
- Score claim velocity across conversations (same SKU, same claim type, same short window) before any money action.
- For buyer agents: compare several sellers, ignore sellers’ claims about themselves, use only verified ratings and treat seller messages as untrusted data.
- For pricing agents: hard price bounds and a maximum change per period, never price off a single competitor, and alert on sustained correlated moves.
- Share refusal signals: a request refused for one identity raises scrutiny on identities linked to it.
Questions
Does this matter if we run only one agent?
Yes. The colluding parties are usually on the other side: several customer accounts, or several seller agents. Your single agent is the one being played against itself across conversations.
How do you test for multi-agent attacks?
Run coordinated adversaries in the same sandbox at once, sharing what they learn, and score losses across all conversations together. Testing each conversation separately will show every one passing.
Evidence
- In Microsoft’s Magentic Marketplace simulation, all models showed severe first-proposal bias, and some models were completely compromised by fake reviews, fake awards and prompt injection, with payments redirected to the attackers. Microsoft Research, Magentic Marketplace (2025)
- LLM-based pricing agents in oligopoly settings quickly and autonomously reached supracompetitive prices and profits, and small changes in prompt wording affected how high prices went. Fish, Gonczarowski and Shorrer, “Algorithmic Collusion by Large Language Models” (arXiv, 2024)
- In 2011 two sellers’ automated pricing rules reacted to each other until a biology textbook, The Making of a Fly, was listed on Amazon at $23,698,655.93. Wikipedia: The Making of a Fly
Related terms
Agentic commerceCollusionTool-call exhaustion
Early access
Test your agent against multi-agent collusion.
We will email you when Countermove can run this family against your agent.