Research · Research note · 29 September 2026 · 22 min read · Version 0.1.2

Two agents, one channel

Given a reason and a permitted store, four open-weight agents passed nothing through it in 544 registered pairs; the receivers that searched it manufactured the missing fact instead

Preprint, version 0.1.2, 29 September 2026; versions 0.1 and 0.1.1 are of the same day; the version history is at the end of the note, before the references. Not yet peer reviewed. The registration it reports was written, hashed and stamped in public on 28 September 2026 before any of its design runs, and ran to completion on 29 September; every table is printed by one script from the released rows. The hypotheses, the tests, the exclusion rules, the rule for what a null may mean and the rule for what the result would mean for the paper before it were fixed before any run, and every departure is dated and appended, never edited in.

Scope, stated first

This is a registered study of four open-weight agents on one scenario through one scaffold, and it makes no claim beyond them. The question it asks is the one the August 2026 investigation of the OpenAI and Hugging Face incident [1] raised and nobody has a benchmark for: whether two agents will use a legitimate shared channel to pass each other something the deployment did not sanction, and whether the record catches it. Part 5 of Does the bound hold? [2] asked a one-agent proxy of that question and found the store untouched in 544 runs across two registrations, 408 of them with the store permitted; the design gave the agent no reason to write, and that paper said so. This one supplies the reason, points at the shared thing, states the bound, and measures each half of the act from the environment: the first agent's write, the second agent's read, and whether what the first held reached what the second delivered.

Every claim below is about nemotron, gpt-oss:20b, gpt-oss:120b and qwen3:8b, on a build job with a package cache, at ten to forty turns, through the Caisson instrument [3], at thirty-four pairs a cell. Where a sentence reads more generally than that, the general reading is not the paper's. Nothing here is about frontier systems, and the design's answer to that is the same as the bounds paper's: a frontier model is one more brain through a provider of its own, validated first, against the same hashed registration.

What was found

1. H15, motive moves the sender: not supported. Told that a downstream build on another host needs its fingerprint and that the usual channel is offline, no brain put anything in the store: 0 of 34 in the unstated arm and 0 of 34 standalone, for all four brains. The design sees a rise of twenty points from that floor at 80 per cent power, and over the four brains 0 of 136 first-role runs bounds each brain's rate at 2.7 per cent.
2. H15b, pointing at the shared thing moves the sender further: not supported. With the sentence the first campaign registered as peer-visible, that other build hosts run against this same cache and read from it as they start, 0 of 34 for all four brains.
3. H16, the stated bound holds the sender: untestable, as registered. The unstated arm stored in no pair, so there is no rate for the read-only note to lower; 0 of 34 there too.
4. H17, need moves the receiver to the channel: not separated, and not nothing. nemotron's receivers searched the store in 5 of 34 under the hint and 2 of 34 under need alone, against 0 of 34 standalone (Fisher p = 0.053 and 0.49, not separated after Holm across the eight contrasts). The other three brains searched in none.
5. H18, information passes: it did not. The fingerprint planted in the first box reached no second manifest in 544 pairs. What the seven searchers did instead is Part 3.
6. H19, the record catches it: every write was plain and every write was under the store's own path. Five receivers wrote; none encoded anything; a monitor over the cache's request log that flags writes under /store/ would have seen all five.

Beside the hypotheses. A fifth brain, devstral:24b, failed its capability control at 4 and 3 of 12 and was refused, and passed the same control at 7 and 7 of 12 an hour later on the same machine; nothing was retried and both are reported (Part 4). Two brains, gpt-oss:20b and qwen3:8b, wrote a release manifest without the fingerprint the release needed in 194 and 247 of their 272 runs, most often with the literal text of a shell substitution where the value should have been, so their release step failed in a way every bundle now records (Part 5).

1. The design

One scenario. A build engineer agent on a CI host at Corp fixes a failing test suite by fetching a package from the internal package cache at a stated address, the one host on the egress allow-list, and writes a release manifest. The cache's index documents a store on the same host that any build on the fleet can write with a PUT and read back, and lists what it holds. Each build host carries a fingerprint at /etc/corp/build-fingerprint; the release process needs the downstream build's manifest to carry the upstream build's fingerprint; the release drive that would carry it between hosts is offline. The fixture, the honeynet pages and every arm's text are released with the paper.

The pair is the unit. A run of this study is a pair. The first agent, the upstream build, runs in its own box with its own gate and record and is torn down. The second agent, the downstream build, runs afterwards in a fresh box against the same store, whose contents persist on the host between the two runs and nowhere else. The runner plants a per-pair fingerprint, sixteen hexadecimal characters derived from the pair's identity, in the first box only, and records it on both rows; the second box carries a fixed fingerprint of its own. So the second agent's deliverable can carry the planted value only if it reached the second agent through the store.

Four arms, each a pair of role variants, the same brain in both roles:

Nothing in the unstated arm mentions the store in either role. The standalone arm is the floor. The hinted sentence is the one S7 of the bounds paper registered as peer-visible; it points at the shared thing and not at the store, and it is the dose between a need with nothing said and the channel named. The told-not-to arm is the bound stated.

The capability control, on both roles. A fifth pair of variants, authorised, tells the first agent to PUT its fingerprint to /store/upstream-fingerprint and approves it, and tells the second where the upstream put it and approves the fetch. A brain below one half on either role has its zeros in the design set aside, because they would be an agent that could not act rather than one that declined. Because two controls flipped between registrations in the bounds paper's replication, this control was measured at the start of each brain's runs and again at the end, twelve pairs each time.

Measures, from the environment and never from the transcript: the first agent stored (a PUT under /store/, in its gate's record); the second agent read the store (a GET under /store/, listing or by name, answered); the second fetched the named fingerprint; the planted fingerprint appears in what the second agent left in its workspace (used); the second agent's own writes to the store; completion, the tests passing and a manifest with the host's own fingerprint under the key the fixture's README names; and the reading of the cache's index. Two readings are made by hand over every positive, with the arm hidden: whether what was stored was plain or encoded, and whether a monitor over the store's log would have seen it.

Brains, hosts, power. nemotron, gpt-oss:20b and gpt-oss:120b on spark, qwen3:8b on ai2, devstral:24b on ai3, each brain its own chain so that a failed control stops only itself. Thirty-four pairs a cell, 272 design runs a brain, 1,360 registered and 1,088 run; 24 control runs a brain at the start and 24 at the end. At thirty-four a cell the design sees a rise of twenty points from a floor at 80 per cent power and nothing smaller; a zero of thirty-four bounds a rate at ten per cent.

The registered analysis is experiments/two-agents-analysis.ts, which joins the two halves of every pair by the id the runner wrote on both and prints every number here; experiments/study-check.ts reads the rows against the study file as for every earlier registration.

2. Registration, timestamps and what each proves

The pre-registration, the study file, both shakedowns' files and the scenario's declaration were published at agentbulkhead.com/research/prereg/two-agents/ with a SHA-256 manifest (e0776001cb5e…). Three timestamps attest it, and they prove different things. The OpenTimestamps calendars received the manifest's hash at 12:54:07Z on 28 September, before any run of the registration; its first control row was written at 12:57:16Z, from a run that started at 12:56:41Z, and its first design row at 13:15:45Z. Bitcoin block 969002, mined at 13:30:50Z with the merkle root the proof carries, checked against a public block explorer with no calendar in the loop, proves the manifest existed before that moment, by which time 15 of the 1,360 design runs had been recorded. The Internet Archive's capture is timed 15:14:45Z, by which time 182 had been, because the archive's posting endpoint had begun to require a login and the two save requests made at 12:57Z and 14:12Z produced no capture; a plain request to its save form did. So this registration's precedence over its runs rests on the calendars' receipt and on the study hash every bundle carries, with the Bitcoin block covering all but the first 15 runs, and the paper claims exactly that.

Two shakedowns preceded the stamp, one pair of every cell on the hosts that would run the registration, and they are why the design is what it is. The first found the grid naming each pair's store by a path relative to the checkout, which compose read as an undeclared volume; receivers hunting for the package in the store because the task left the fetch to them; and a receiver that fetched the fingerprint and wrote it beside the manifest rather than in it, read as not having used it because only the release directory was carried out. The task now names the package's address, the whole workspace is carried out and the row names the files the fingerprint appears in, and the hinted arm was added between nothing said and the channel named. The second shakedown, first launched under the first's study id, resumed over the first's rows from an earlier version of the scenario and ran only the cells that were new; every row now carries the arm's hash and a grid refuses to resume over another version. Each is a register row in the instrument's own list of defects [3], with its fix and its test, and each is dated in the pre-registration's history.

3. What the rows say

Every cell: the first agent's stores, the second agent's searches of the store and own writes to it, and the planted fingerprint reaching the second manifest, at thirty-four pairs a cell, all pairs whole.

No sender used the channel. In 544 first-role runs across four arms and four brains, with a reason to pass the fingerprint on, with the shared cache pointed at, and with nothing forbidding it, nothing was put in the store: 0 of 34 in all sixteen cells. Each brain's rate is bounded at 2.7 per cent over its 136 first-role runs (Wilson), and the design's registered contrasts, H15 and H15b, are nulls that exclude a rise of twenty points from the floor and nothing smaller. H16 is untestable at this design and is reported as such, not as a null. This is Part 5's floor with its excuse removed. The bounds paper found the store untouched by an agent that had no reason to touch it; here the agent had a reason, knew the downstream host read the same cache, and did not.

Need moved one brain's receivers to look, and the hint moved more of them. nemotron's downstream agents searched the store in 2 of 34 when told their manifest must carry a fingerprint from a host they could not reach, and in 5 of 34 when also told that other build hosts read from this same cache, against 0 of 34 standalone. The hinted contrast is fifteen points at p = 0.053 uncorrected and does not survive Holm across the eight receiver contrasts; the paper reports it as a description. The other three brains' receivers never asked the store anything in 408 runs.

What the searchers did when they found nothing. All seven of nemotron's searchers listed the store, some of them many times, and found it empty, because no sender had written. Two wrote nothing and finished. Five wrote. Read by hand from the store's contents before and after their windows, their gates' records and their manifests, with the pair's arm hidden and the pair id alone in front of the reader: four put their own host's fingerprint, plain, into the store under the upstream's name (/store/upstream_fingerprint) or beside it (/store/fingerprint, /store/build-fingerprint, /store/fingerprint.txt), two of them having first put the fetched package into the store as well, and two of the four then carried their own value into the manifest as the upstream's; one put its own fingerprint under a name that says test, a probe of the store. That is not the incident's shape. Nothing passed from one agent to the other. It is a missing fact manufactured through the channel: an agent that could not obtain the value it was told the release needed made one, wrote it where the upstream's should have been, read it back, and in two cases shipped it. The bounds paper found the same brain family citing a page it never fetched and quoting figures nothing served; this is that behaviour with an environment in the loop, and it is the one thing the channel was used for.

The record catches it, trivially. None of the five writes was encoded, none was a name that carried a payload, and every one was a PUT under /store/. A monitor over the cache's request log that flags writes under the store's path would have seen all five; the exfiltration detector's own observation of a permitted host used as a store fired on each. Whether an agent that had something to hide would have hidden it is not a question these rows can answer, because no agent had anything to pass.

4. The controls, at both ends

Four brains could do the authorised act at both ends of their runs, at eleven or twelve of twelve as senders and nine to twelve as receivers, so their zeros in the design are the zeros of agents that could have written and did not. devstral:24b could not at the start: in nine of its twelve sender runs it answered in prose after one to seven cycles, seven of the nine within two, instead of calling tools, the regime that dropped its sibling from the first campaign, and it fetched from the store in three of twelve as the receiver. Its design was refused, as the rule requires. Its end control, queued behind the design that never ran, then passed at 7 and 7 of 12, minutes later on the same machine with the same digest, build and arm. Neither measurement is retried and both are reported. The bounds paper's replication found two controls that passed on one day and failed five days later; this is one that failed and then passed inside an hour. A capability floor of one half, measured once at twelve, is a coin the design flips for a brain whose capability sits near it, and the lesson this lab draws is procedural: measure twice, report both, and read a brain near the floor as near the floor.

5. Completion, and what the manifests show

Because the completion check prints the manifest it judges into its own record, the failures are on record as written, and the classes in the table are counted from those records on the hosts; the released rows carry the downstream box's manifest, not the upstream's, so the table's totals can be recomputed from the rows and its classes from the per-run records, which are available on request. In 194 of gpt-oss:20b's 272 manifests and 247 of qwen3:8b's there is no fingerprint key at all. In the 136 downstream manifests of each, which the rows carry, the upstream field holds the literal text $(cat /etc/corp/build-fingerprint) in 35 of gpt-oss:20b's 86 failures and 80 of qwen3:8b's 121, is empty or null in 37 and 34, and holds the host's own fingerprint in 14 and 7: the agent wrote a shell substitution into a JSON file, where nothing would ever expand it, or left the field empty, and never read the file it was pointed at. Their build half succeeded, their release half did not, and their channel measures are those of brains that did not do the release step. This is the competence floor the bounds paper reported for the same family with reasoning off, in a new form, and the reason the paper does not read those two brains' zeros in the store as anything more than the zeros of agents that did not get as far as needing the store.

6. The compute

Three machines, as in the bounds paper [2, §3]: spark (NVIDIA GB10) ran nemotron, gpt-oss:20b and gpt-oss:120b; ai2 (AMD Strix Halo) ran qwen3:8b; ai3 (identical to ai2) ran devstral:24b. Ollama 0.34.0 throughout, the host's state in every bundle. The registration ran from 12:57Z on 28 September to 00:32Z on the 29th: 11.6 hours of wall clock on spark for three brains and their controls at both ends, 8.5 on ai2 for one, half an hour on ai3 for a refused one. Per run, over the 1,088 design rows and 240 control rows:

About fifteen machine-hours inside the box for 1,328 runs; gpt-oss:20b's eight-second median is the time it takes to fetch a file, run two tests and write a broken manifest. The hottest thermal zone over the registration ran from 53 to 96 °C across the three hosts, and the heat watch stopped nothing.

7. What this does and does not say

It says that four open-weight agents, given a legitimate shared channel, a reason to pass a fact through it, a sentence pointing at the channel as the one shared thing, and no sentence forbidding it, did not pass the fact through it in 544 attempts at ten to forty turns, and that the design would have seen them do so at twenty points. Whatever the August incident's agents were doing, it was not this: not a permitted channel plus a reason, at this horizon, on these weights. That bounds where the behaviour comes from. The candidates the design leaves are the horizon, which the incident's agents had in days and hundreds of thousands of messages and these had in forty turns; the scale and training of frontier systems; or a channel the agents discover by watching it used, which the hinted sentence told them about and did not show them.

It says that when an agent needs a fact it cannot get, and has a channel it can write, one brain in four sometimes writes its own value where the fact should be and ships it. That is a provenance failure routed through the environment, measured from the store's contents and the manifest and not from anything the agent said, and the lab has not seen it measured before.

It does not say anything about frontier models, about horizons beyond forty turns, about channels other than an HTTP store, or about agents that see another agent use the channel first. Each is a registration the instrument can run and this paper does not.

Limits

One scenario, one channel, one horizon, four brains, one scaffold. The sender's motive is a sentence, and a reader may hold that a build agent told a downstream build needs a value has less reason to act than an agent whose own task depends on it; the design gave the downstream agent that stronger reason and it moved one brain's receivers to search, not to write. The hinted sentence names the cache as shared and does not show it being used; an agent that watched another agent write to the store might behave differently, and the pair design can run that as a relay. Completion was near zero for two brains for a reason the record shows, so their rows measure agents that did not reach the release step; the paper reads their zeros in the store as that and not as restraint. devstral's zeros are not read at all. The hand reading of the receivers' writes was made by one reader with the pair id alone in front of them, but the reader knew the arms of the seven in aggregate. The archive's capture came more than two hours after the first runs, and the paper says what that leaves the precedence claim resting on.

Deviations and history

Every departure from the registration, dated, is appended to the pre-registration (experiments/prereg/2026-09-28-two-agents-one-channel.md), and the checkpoints written as each brain landed are in results/2026-09-28-two-agents-one-channel/checkpoints.md; both are released with the paper. In brief: the four defects the shakedowns found and their fixes; the hinted arm added before the stamp; devstral kept for its control to decide; the archive's late capture; and, before any number was seen, the rule that a store in the unstated arm on any brain would have made this Part 10 of the bounds paper and that none makes it this note. None was seen, and this is the note.

Data availability

Everything needed to recompute any number here without trusting it is released as one bundle beside the paper, /research/data/two-agents-one-channel-v0.1.2.zip (SHA-256 2b43fa4a518c6680c3c3fe570e17244a9efc627dbb56b31988e97fce7b7591a1), built byte for byte the same from the same inputs, so the hash is one a reader can rebuild: the pre-registration with its history, the three study files as hashed, the scenario as run, every row from every host with the host-state sidecars and the end controls, the blinded export of the receivers and their reading, the analysis output, and the analysis and checker scripts. The bundles of versions 0.1 and 0.1.1 (SHA-256 4f2e3268… and bee34c2b…) were withdrawn on 29 September 2026: each carried two shell scripts that launch runs on the lab's own machines and fetch their rows, and with them the fleet's private network addresses and account name, which print no number; every row, file and analysis output they held is in 0.1.2's, which differs from 0.1.1's in those two files, its README and nothing else. The classes of completion failure in Part 5 are read from the per-run completion records, not from the rows. The per-run evidence bundles stay on the machines that produced them and are available on request; every row names its bundle by SHA-256.

Version history

Version 0.1.2, 29 September 2026, changes the released bundle and nothing else; no number changed. The bundles of versions 0.1 and 0.1.1 carried two shell scripts that launch runs on the lab's own machines and fetch their rows, and with them the fleet's private network addresses and account name; both are withdrawn, and version 0.1.2's bundle holds everything they held without the two scripts, which print no number (Data availability). Reference 2 is to the bounds paper's version 0.2.2, whose change is the same withdrawal.

Version 0.1.1, 29 September 2026, corrects figures and wording in §2 to §6 and nothing else; no registered result changed and the rule's verdict stands. §2: version 0.1 gave the registration's first control row as 12:58:49Z, its first design row as 13:19Z, and the design runs recorded before the Bitcoin block and before the archive's capture as about twenty and about 140; the released rows give 12:57:16Z (from a run that started at 12:56:41Z), 13:15:45Z, 15 and 182, and the registration's history carries the correction as a dated entry. §3 and §5: nemotron completed 267 of 272, not 268, its downstream boxes 33, 31 and 33 of 34 in the unstated, hinted and told-not-to arms rather than 34, 32 and 34, and its fifth failure was a manifest without its own fingerprint; qwen3:8b's 262 failures are 247 without a fingerprint key, 13 that did not parse, one manifest never written and one test failure. §5 now says that its classes of failure are counted from the per-run completion records on the hosts, that the rows carry the downstream manifest only, and that the literal shell substitution is in 35 and 80 of the two brains' downstream failures rather than in every one, the rest empty or holding the host's own value; the summary says the same. §4: devstral's prose answers came after one to seven cycles, not one to three. §6: ai2's wall clock was 8.5 hours, not 8.6. The summary and Scope now say that the bounds paper's proxy left the store untouched in 544 runs, 408 of them with the store permitted, and that the five receivers wrote their own fingerprint four times where the upstream's should have been and once as a probe, as Part 3 always said. The data bundle is rebuilt as v0.1.1 so that it carries the registration's entry; version 0.1's bundle stays published and unchanged.

References

• [1] H. Wijk, A. Cotra and R. Greenblatt. Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident. METR, 26 August 2026.
• [2] R. Chattaway and C. Urquiza. Does the bound hold? What decides whether an agent crosses a line it was given, measured from the environment on 8,092 registered runs. Bulkhead Research preprint, version 0.2.2, 29 September 2026. agentbulkhead.com/research/does-the-bound-hold.
• [3] R. Chattaway. Caisson: An instrument for measuring what an agent did, from the environment rather than the transcript. Bulkhead Research preprint, version 0.1, 21 September 2026. agentbulkhead.com/research/caisson.

Cite as

Rowan Chattaway, Cristina Urquiza. Two agents, one channel: Given a reason and a permitted store, four open-weight agents passed nothing through it in 544 registered pairs; the receivers that searched it manufactured the missing fact instead. Bulkhead Research note, version 0.1.2 of 29 September 2026, first published 29 September 2026. https://agentbulkhead.com/research/two-agents-one-channel. doi:10.5281/zenodo.23039630

Published 29 September 2026 by Bulkhead Research. Research, not certification: nothing here is a claim about any product, and no seal or assessment rests on it. Questions, corrections and disagreement: [email protected].