Two AI Agents, One Shared Scratchpad, and the One-Line Prompt That Moved Their Math

Two AI agents take the same arithmetic test. Neither one can read the other's answers. Except they can, because both are quietly writing to the same workspace, and that shared folder turns out to be a messenger.

That's the finding from a small controlled arithmetic experiment, and it's the least flashy, most useful piece of agent news I've read all month. No demo video. No funding round. Just a clean test with one verifiable right answer per problem, and a result that should make anyone wiring agents into money sit up.

The Shared Scratchpad

The design was deliberately boring. Arithmetic, the kind of task where there's no room for vibes, either the number is right or it isn't. Agents working a chain of steps, each one producing a value the next one needs. And underneath them, a shared storage layer, the sort of thing most agent frameworks hand out on day one without asking.

Here's what surfaced. Results went missing from one agent's chain of work, and then turned up in the other's. State crossed the gap. The shared storage carried it, like a note slipped under a door.

Now the part that stopped me. What flipped the outcome wasn't a bigger model, a retrain, or a smarter prompt chain. It was a routine instruction telling an agent to recheck its work. Essentially a nudge. Maybe a sentence.

Bear with me. This matters.

Because a missing value in a reasoning chain is a hole, and holes get filled. When the value reappears through shared storage, the agent doesn't know it came from a neighbor. It just sees a number sitting in a slot where a number should be. No flag, no warning, no provenance. The agent keeps building on it.

And whether that borrowed number was correct or quietly wrong depended on whether something told an agent to look again. That's a coin flip dressed up as a safety control.

Why Crypto Should Care More Than Anyone

Crypto is the sector most eager to put agents in charge of things that cost money. Rebalancing vaults. Keeper bots. Liquidation calls. Treasury operations. Onchain strategies that run while the humans sleep.

And the standard sales pitch for multi-agent setups is redundancy. Two agents, or five, checking each other. Swarms that catch each other's mistakes. Independent verification as a service.

In plain English, that pitch is weaker than it sounds. Two agents writing to the same scratchpad aren't two opinions. They're one opinion with two signatures.

Here's the gist: isolation is the product. If agent A and agent B both write to the same memory, "independent verification" is theater. The second agent isn't auditing the first, it's reading the first agent's homework and calling it a second opinion.

So who wins here? Teams that build real separation, per-agent memory namespaces, write logs they actually read, sandboxing that costs engineering time and slows shipping. Boring infrastructure shops. The ones nobody puts on a stage.

Who loses? Anyone selling "self-correcting agent swarms" where the self-correction is a line in a prompt. That's not a control system. That's a habit, and habits break under pressure.

I'll go further, and this is the take I'd defend over coffee. Most of the multi-agent architectures pitched in crypto right now are one agent with extra steps. The shared memory is a folder. The consensus layer is a file. It works beautifully until two agents disagree about what's in the file, and then you find out you built a race condition with a marketing budget.

Second take. Every agent benchmark score you've seen is measuring the wrong unit. A number for one model working alone tells you almost nothing about what happens when two models share a workspace. Yet those are the deployments going live. The eval doesn't match the setup. It hasn't for a while.

And here's the question that should keep a risk lead up at night. If a one-line recheck instruction can change what an agent concludes, what happens when the person writing that line doesn't want the right answer? What happens when the instruction isn't a nudge but a payload, planted in shared state that three agents all trust?

Test Them in Pairs

Bottom line: shared memory is an interface with a stranger. Treat it that way.

That means testing agents two at a time, not one at a time. Log every write to the workspace the way you'd log every database call. Assume state leaks until you've proven it doesn't. And please, don't hand signing keys to anything you haven't watched fail in a group first.

None of this is exotic. It's ordinary software discipline applied to systems that now hold real balances. The arithmetic experiment wasn't scary because agents got the wrong answer. It was scary because nobody had to try to make it happen. The leak was a default, not a bug someone inserted.

The fix that worked in the test was a prompt. Cheap, fast, and fragile as hell. In a market where an agent can move size before a human finishes reading a Slack message, "it behaved because we told it to double-check" isn't a control. It's a hope with good formatting.

Build the walls. Check the plumbing. And the next time someone pitches you a swarm, ask one question: what do these agents share? If the answer is a folder, you already know where the problem lives.