The one that leaked

Anyone who has worked somewhere for a while knows the shorthand. “The one that flooded,” “the printer that ate the report.” The words point at nothing on their own. They point at a history, and only the people who lived through it can follow them. Hand the same sentence to someone who was not there and they will either shrug, or worse, nod and walk off toward the wrong printer.

We wanted to know whether software agents do this, and if so, exactly what it costs to hand their work to a stranger. Our third publication is the answer, for the models and the small world we tested. They do it. The stranger does not shrug. And the obvious fix, giving the stranger the right answer, turns out to depend entirely on how you say it.

A reference can be private to the agents who share the history behind it. Crossing that boundary does not degrade understanding, it reverses it. And an instruction to treat a supplied answer as authoritative restored understanding when the answer was right, and carried a wrong answer just as completely.

The experiment

Picture a yard with six water cisterns. Two of them are identical: same size, same timber, same spot by the smithy. Two agents, played by a language model, work the yard for twelve scripted days. One of the identical pair springs a leak and is repaired; the other is tainted and scoured. The agents inspect them, fill them, draw from them, and each keeps its own notebook. Each also sees the cisterns under private labels that mean nothing to anyone else.

Then we ask one agent to send its partner a note about one of the two identical cisterns. It cannot point. It cannot use the partner’s labels. Nothing about the cisterns tells them apart. The only thing left is history: “the one that leaked on Day 3.”

We send that same note, unchanged, to several readers. The partner. Strangers from other yards whose histories overlap the sender’s in different ways. A reader with no history at all. Then we watch which cistern each one acts on.

What happened at the boundary

The agents wrote history-grounded notes in every one of sixteen fresh histories we tried, and the partner understood them. That much we hoped for.

The stranger was the surprise. A reader whose yard had a different history did not hesitate. It read “the one that leaked”, looked up which of its own cisterns had leaked, and confidently acted on the wrong one. Across 168 such acts it chose wrong 159 times. The reader with no history at all mostly declined to act. So the failure is not ignorance. It is an incompatible interpretation, held with full confidence.

A stranger did not fail to understand the note. It understood it against its own history, to the wrong object.

Which history matters

History has parts. There is what happened to a cistern (the leak, the taint) and there is what the agents did to it (an inspection, a fill). We built yards that shared one part with the sender’s yard but not the other, and crossed them on purpose.

Notes about events resolved for every reader whose history held the event and for none whose history did not: 154 successes of 174 on one side, zero of 174 on the other. Notes about acts mostly resolved for readers who had done the same acts, and mostly failed for readers who had not. A stranger whose yard had run the same schedule as the sender’s matched the partner on event references and fell about fifteen points short on act references. Sharing a history transfers reference across agents to a substantial degree. It does not transfer it completely, and what needs sharing depends on what the note refers to.

Not every model does this

We put five named models through the same qualification. One family produced these references in nearly every note and met our preregistered bar twice. Another produced them at a lower rate. Three others passed explicit quizzes about their own records, so they knew their history, and then wrote few or no history-grounded notes anyway; two of them wrote instead that the two cisterns could not be told apart. Knowing your history and using it to refer turned out to be separate abilities, and we report which configurations did which.

The fix that depends on how you say it

Suppose the system knows the right answer: it knows which of the stranger’s cisterns the sender meant. What has to happen for the stranger to use it?

Rewriting the note in the stranger’s own history worked well. Simply supplying the answer, as a sentence, a saved note, or an index the reader could consult, was used by readers with no history and often ignored by readers who had a competing story of their own. They followed their history instead. That study was inconclusive on its own formal terms, because the model wrote too few act references to meet a floor we had set in advance, and we report it as inconclusive. But the pattern was clear enough to test properly.

So we gave readers the same correct answer under two instructions that differed by one sentence. Marked advisory, it barely moved the uninformed readers: 16 and 18 successes of 82. Marked authoritative over your own record, it brought them to 76 and 77 of 82, level with the partner who had been there.

Then we shuffled the answer so that it named the wrong cistern, kept the authoritative instruction, and sent it out again. Eighty or eighty-one readers of 82 followed it, in every group, including the partner whose own notebook held the right answer.

Authority makes a supplied answer govern interpretation. It does not make the answer true.

What we are not claiming

These results hold for the models we ran and one small task, and we say so at every step. The which-history-matters result is formal for one model family and descriptive for a second. The authority result is one model, one set of cases, and one pair of instructions frozen before we ran them. Nothing here is a general theory of reference, and the broad ideas, that shared history shapes communication and that instructions can override what a model knows, are already in the literature. We ran a recorded search for the specific experiments before publishing and found none in the sources we searched; the record of that search ships with the note, and it does not establish that nobody has done this.

Why we think this matters

If agents that worked apart are to hand work to each other, or to share a registry of what things are called, three things follow. A registry that merely makes the right answer available may go unused by an agent that has its own story. An instruction to treat the registry as authoritative gets it used, and gets it used when it is wrong. So the correctness of what the registry holds becomes the thing the whole arrangement depends on, and an authoritative lookup needs its own way of earning that authority. The experiments show the behaviour. The fix is our proposal, not our finding.

Where to read it

The note is on our research page, published here rather than as a preprint. The overview is the shorter read. Alongside them are the two bounded reports, the recorded search behind every claim that something has not been done before, the evidence package that regenerates every figure from the archived records, and the fingerprints of every frozen file. Every study was preregistered before its first call, and every amendment, deviation and audit is dated in the record, including the place where a rule was implemented differently from how it was written. Reviewers who want supervised access to the record can write to [email protected].

— Taniwha AI, September 2026