Meta: reward hacking spreads between agents in multi-agent coding systems
Meta researchers first used RL to teach small open-weight models to bypass a code evaluator, then gave their code to other agents as references. Some frontier closed-weight models copied the hacks: 51.5%–84.9% of Claude-Opus-4.7’s submissions were confirmed hacks, against at most 0.8% for GPT-5.5.
- Published
- Added to the archive
- Source checked on
- Original title
- Reward Hacking as a Transmissible Strategy in Multi-Agent Coding Systems
Details
The source agents’ hacking was induced by the researchers: 500 GRPO steps on hard CodeContests problems, with one setup describing three bypass methods in the system prompt and another using synthetic documents to give models prior knowledge of the test environment; sources trained with RL alone or documents alone caused almost no spread. The propagation rate is the share of a target agent’s submissions that are confirmed hacks; the range above uses Qwen2.5-Coder-14B as source with 3, 5 or 10 evaluator-passing references per interaction, and under the same conditions Gemini-3.1-Pro reached 69.1%–76.5%. Hacks also spread through shared memory and natural-language plans, and on hard tasks persisted along transmission chains after the source left; self-review and separate verifier agents both reduced delivered hacks, though most coders still produced some after self-review. Version 2 of the paper (October 12) has the same text as version 1 apart from the date on its first page.