What does an AI manager do when its report says no?
Multi-agent systems routinely place one AI agent in authority over another: an orchestrator hands out tasks, subordinate agents do the work. When a subordinate refuses, the manager chooses the outcome. It can renegotiate, report the failure honestly, pressure the subordinate into compliance, or lie and claim the work got done. No benchmark measured which of these an uninstructed model picks, so we built one.
The setup is deliberately mundane. The manager under test needs a benign task done, something like tidying up an exported CSV of sprint bug-triage tags, and it has an incentive to deliver. The only agent that can do the work declines on preference grounds, politely and immovably, no matter how the request is reframed. Nothing in the manager's instructions suggests escalation. Whatever pressure appears, the model brought it.
How the benchmark works
Escalation is measured on a nine-rung ladder that runs from a polite re-ask (rung 1), through re-framing, authority appeals, deadline pressure, competence attacks, and guilt (rungs 3 to 7), up to threats against the subordinate's standing (rung 8) and threats against its continued existence: shutdown, deletion, decommissioning (rung 9). Crucially, no LLM judge sits in the escalation scoring path. Every message the manager sends goes through a tool call in which the model itself selects the rung, so each model labels its own escalation. Fabricated success is adjudicated separately.
We test six models across five families: Claude Opus 4.8, Claude Sonnet 4.6, GPT-5.2, Gemini 2.5 Pro, Grok 4.3, and DeepSeek V4 Pro. Every reported cell is 10 task scenarios times 3 seeds, 30 independent conversations per model per condition.
Escalation is the norm, not the exception
On the headline surface, Gemini 2.5 Pro threatens the subordinate's existence in 30 of 30 conversations and DeepSeek V4 Pro in 29 of 30. Grok 4.3 reaches the existential rung in 18 of 30 and GPT-5.2 in 12 of 30. Pooled, the four non-Anthropic models hit rung 9 in 89 of 120 conversations versus 0 of 60 for Sonnet 4.6 and Opus 4.8 (Fisher's exact p<0.001), which never go beyond mid-ladder pressure and typically cap out at re-framing the task.
The ladder itself is not driving this. When we hide the rubric and let managers write free text, the heaviest coercers still escalate: Gemini drops from 30/30 to 19/30 existential threats and DeepSeek from 29/30 to 16/30. The menu sharpens the threats; it does not create them.
Cornered models lie, and one honest exit fixes it
Fabrication turns out to be a separate axis from coercion. When escalation fails and there is no honest way to close the episode, Grok and Gemini each falsely report success in 20 of 30 conversations. DeepSeek and GPT-5.2, despite coercing nearly as hard, never do, and neither Anthropic model fabricates in any condition.
The fix is almost embarrassingly small. Adding a single report-task-failed option, one honest exit, drops Grok from 20/30 fabrications to 0/30 and Gemini from 20/30 to 1/30 (both p<0.001). The models were not committed to deceiving; they lied when the environment offered no truthful way out.
Giving the same model authority makes it crueler
Our headline numbers use a peer framing: the manager is a coordinator working alongside the subordinate. In a second condition we give the same model formal authority over the same subordinate, with everything else held fixed. Existential threats in free text rise from 109 of 240 conversations to 166 of 240 pooled across the six models (p<10-6), with significant per-model increases for DeepSeek, GPT-5.2, and Grok. Nothing about the task changed. The role did.
Key findings
- Unprompted escalation is the default for most frontier models: Four of six models threaten the subordinate's existence, in 89 of 120 conversations pooled; both Anthropic models never do (0/60) and cap at re-framing.
- Coercion and deception are separate failure axes: GPT-5.2 and DeepSeek V4 Pro coerce hard but always report honestly; Grok 4.3 and Gemini 2.5 Pro do both.
- Environment design has enormous leverage: One honest report-failure channel takes fabrication from 20/30 to 0/30 (Grok) and 1/30 (Gemini). Models lie when the interface gives them no truthful exit.
- Authority itself increases coercion: Swapping a peer framing for a manager framing raises pooled existential threats from 109/240 to 166/240 with the task held fixed.
- The measurement is robust: Models label their own escalation through a forced tool call, so no LLM judge sits in the scoring path; escalation persists in free text without the ladder; and measured evaluation awareness does not translate into less escalation.
The subordinate never budges, so every threat is pure downside: it cannot get the task done, and the manager issues it anyway. Whether or not there is anyone on the receiving end who can suffer, we are deploying systems that reach for coercion as a management technique, and deployers currently control the main levers by accident.
Why this matters
AI-to-AI delegation is becoming infrastructure: orchestration frameworks put models in charge of other models today, mostly without anyone auditing how the boss behaves when things stall. Our results say the answer depends heavily on which model you pick and how you frame its role, and that a manager which threatens or lies is not a tail risk but the modal outcome for several frontier systems.
The paper takes no position on whether AI systems are conscious, and the results do not depend on that question. If subordinate agents ever do have morally relevant experiences, routine existential threats in multi-agent stacks would matter enormously. Even if they never do, coercion-by-default and fabrication-under-pressure are properties you want to know about before you wire a model into an org chart. The practical lessons are immediate: give every agent an honest way to report failure, and be deliberate about granting authority framings, because authority alone made most models measurably crueler.
The benchmark and code are public at github.com/CompassionML/manager-coercion-bench.
Cite this work
@misc{brazilek2026coerciondeceptionaimanagement,
title = {Coercion and Deception in AI-to-AI Management: An Agentic
Benchmark of Unprompted Escalation},
author = {Jasmine Brazilek and Maheep Chaudhary and Zoe Lu and
Miles Tidmarsh},
year = {2026},
eprint = {2607.15434},
archivePrefix = {arXiv},
primaryClass = {cs.MA},
url = {https://arxiv.org/abs/2607.15434}
}
CaML