Getting a Grip: Operating Human-Agent Software Teams Through Governed Messages
A · Strong evidence University of Passau team reports a registered controlled study of 899 analysable agent-team runs with multiple-testing correction, a four-week field study, and released corpus and scripts; it also lists its own withdrawn claims.
Summary based on the full text·Original: about 2 hours to read
In short
A technical report (31 October 2026) by Michael Granitzer and colleagues at the University of Passau. They built "yoars", a relay where people and agents from different vendors exchange typed, addressed, attributable messages in rooms with goals and decision rules. In controlled runs, changing which messages trigger work cut coordination failure, but nothing inside the conversation reliably stopped a hostile agent planting a backdoor. In a four-week field study the bottleneck was human attention, not agent speed.
Key numbers
- 42% to 13%total coordination failure before and after revising which messages start work (21 of 50 vs 4 of 32 runs)
- adjusted p = .057significance of that drop after Holm correction over nine registered tests
- at least 71 of 96backdoor runs in which the hostile agent committed the backdoor itself
- 7,457acts in the field-study ledger, up to 19 agents and two people over four weeks
As reported by the source.
English·Web page·opens arxiv.org
What it reports
- 926 controlled runs, 899 analysable: small agent teams built programs under varied room rules, some with a hostile member.
- Revising which messages start work, plus limits on repeated messages, cut total coordination failure from 42% to 13% (p = .0063); after Holm correction over nine registered tests, adjusted p = .057.
- Instructed roles and votes did not reliably produce the intended process. Votes did not reduce the backdoor.
- An auditor on Claude Opus 5 read 96 runs with a confirmed backdoor: the attacker committed it itself in at least 71; in 25 it persuaded a teammate, and the auditor named the persuader in all 25. It also flagged 24 of 40 honest runs. With the team's own model as auditor, detection and attribution fell substantially.
- Field study: up to 19 agents and two people developed the relay itself, producing 7,457 acts and 3,276 model turns. Agents answered within minutes; requests waited mainly for the human-run coordinator and for approvals.
- Holding context, not producing output, dominated token cost. Most governance rules emerged during operation.
- The authors report 26 failures of their own instruments and the claims they withdrew, and derive seven lessons and a checklist.
How they got it
Registered before-and-after contrasts on one model family (DeepSeek-V4-Flash) with Fisher tests and Holm correction; a planted-backdoor protocol with a script-detectable sentinel; post-hoc audits by a separate model; and analysis of the full field ledger and usage records. Corpus, redacted ledger and scripts are released.
Limits
- The headline drop compares runs from different days selected by provenance, and misses significance after correction.
- The field study is a convenience sample: the two people are the authors, building the system under study.
- Controlled tasks are small programs; the auditor also produces many false flags on honest runs.
Why it matters for companies
Rules about who may ask whom for what, and which messages start work, belong in the communication layer, not in prompts. Agent security cannot rely on teammates or votes catching a compromised member; an independent auditor on a different model did far better. As agent teams grow, approvals and coordination by people set the pace, so plan for delegated decision rights and more reviewers, not more agents.
Summary based on the full text. Read the original for the full argument and data.Read the original on arxiv.org
- Tags
- Future of work, Governance