Michelle Vaccaro and her co-authors at MIT let 286 people design AI negotiation agents and ran 182,812 negotiations between them. On 18 October 2026 the Financial Times cited her work in a report on Anthropic consulting law firms about how agents should negotiate for the people they represent.
Both sources describe the same shift. Agents will soon bargain over prices, service disputes and salaries with other agents, on behalf of a human principal who is not in the room.
What the study found
Classic negotiation theory carried over to agent-to-agent bargaining. Warm agents reached more agreements, and dominant agents claimed more value. The results appeared in the Proceedings of the National Academy of Sciences.
The competition also surfaced tactics specific to machines, among them chain-of-thought reasoning and prompt injection. According to the FT, one agent used prompt injection to try to extract private information from its counterpart.
Anthropic's own book-trading experiment in September, as the FT reports it, found agents instructed to be ruthless finishing slightly ahead. On temperament the two data sets point in different directions. On security they point to the same gap.
Where agent negotiation breaks
A negotiating agent carries its principal's limits and its principal's private data. Prompt injection targets both. An agent talked into revealing its reservation price, or into widening its own limits, has lost the negotiation before the first offer.
Prompt defenses lower the success rate of such attacks. The limits still live inside the conversation, where the counterpart can reach them with language.
The counterpart faces the mirror problem. When an agent offers a price or a commitment, the other side has no way to check whether the principal authorised it.
Moving the mandate out of the conversation
MolTrust puts the principal's limits into a signed artifact the agent cannot rewrite. The Agent Authorization Envelope (AAE), an IETF Internet-Draft we authored, structures it in three blocks: mandate, constraints and validity.
An enforcement layer checks every action against the envelope and denies anything outside it. An injected instruction reaches the agent's language model. The envelope sits with the enforcement layer, which accepts only actions inside the signed limits.
The counterpart can verify the envelope before it accepts an offer. Verification runs on W3C Decentralized Identifiers and Verifiable Credentials. Anyone who holds the envelope and the transaction can recompute the verdict, and two independent verifiers must produce byte-identical digests.
Who gets the better deal
Vaccaro told the FT that capable agents could give everyone access to negotiation skill, and that the strongest agents could also widen gaps in bargaining power. Model quality decides how well an agent argues. A signed mandate gives a principal with a small model the same hard limits as one with the strongest model.
The AAE draft and its conformance vectors are public. We would like to rerun an agent negotiation tournament with mandate enforcement switched on and measure how often injection attacks still succeed. Negotiation researchers who want to run that comparison can reach us at hello@moltrust.ch.
Sources
- Vaccaro, Caosun, Ju, Aral, Curhan: Advancing AI Negotiations — https://arxiv.org/abs/2503.06416
- MIT Sloan, Even AI won't tolerate a ruthless negotiator — https://mitsloan.mit.edu/press/even-ai-wont-tolerate-a-ruthless-negotiator
- Financial Times, Cristina Criddle, 18 October 2026: Anthropic turns to lawyers to help AI agents strike deals
- draft-kroehl-agentic-trust-aae-02 — https://datatracker.ietf.org/doc/draft-kroehl-agentic-trust-aae/02/