Microsoft Researchers Tried To Manipulate Ai Agents - And Only One Resisted All Attempts

danleap/iStock/Getty Images Plus via Getty Images

Follow ZDNET: Add america arsenic a preferred source on Google.

ZDNET's cardinal takeaways

• Microsoft studied interactions betwixt AI customers and vendors.
• Most agents grounded to defy manipulation and make wise choices.
• The results underscore nan dangers of an AI agent-run economy.

As you've astir apt noticed, there's been a batch of hype circulating astir AI agents and their expected imaginable to toggle shape nan system and quality labour by automating routine, time-consuming tasks. A increasing assemblage of research, however, shows that agents autumn short successful simple ways, indicating that they're astir apt not fresh for primetime conscionable yet.

Also: I fto Gemini Deep Research excavation done my Gmail and Drive - here's what it uncovered

New investigation from Microsoft recovered that industry-leading agentic AI devices struggle to interact pinch 1 different to complete basal marketplace decisions, for illustration choosing a edifice by comparing paper offerings and prices. Researchers besides recovered astir agents fell for manipulation attempts, including punctual injections and misleading information. These agents grounded consistently, though, meaning nan investigation could supply a blueprint for AI companies to reside those flaws moving forward. 

A trial marketplace

Microsoft's investigation revolved astir what it calls nan "Magentic Marketplace" -- an open-source situation wherever AI agents converse pinch 1 different successful bid to complete transactions successful a virtual situation simulating a real-world marketplace. (You tin springiness it a effort yourself connected GitHub.)

The extremity was to trial nan applicable capabilities of agentic systems astatine a clip erstwhile AI developers are quickly delivering much autonomous products, for illustration shopping and buying agents for some individuals and businesses. OpenAI's Operator, for example, tin navigate websites and complete purchases connected behalf of users, while Meta's Business AI tin interact pinch customers for illustration an automated income representative.

Also: Google Finance gets a Gemini-powered upgrade - what it tin do for you now

The emergence of automated buyers and vendors "hint astatine a early wherever [AI] agents go progressive marketplace participants, but nan building of these markets remains uncertain," Microsoft wrote successful a institution blog station astir its caller research. 

The Magentic Marketplace is an early effort to representation retired immoderate of that structure, and to uncover immoderate traps that we mightiness beryllium heading into. Designed to simulate nan complexity of real-world markets, it involves galore agents, each of which are group loose, successful existent crippled mentation style, to interact successful an effort to optimize their own, individual outcomes -- alternatively than conscionable pitting an automated customer supplier against a purchaser supplier and letting them onslaught a deal.

Microsoft ran its experiments utilizing starring proprietary models for illustration GPT-5 and Gemini 2.5 Flash, arsenic good arsenic open-source models for illustration OpenAI's OSS-20b. Those models were utilized to simulate 100 customers and 300 businesses, which could interact pinch 1 different via matter prompts that tin beryllium monitored by quality users. 

Also: I fto ChatGPT Atlas do my Walmart shopping for maine - here's really nan AI browser supplier did

Microsoft assigned customer agents a database of items and amenities and had to hunt done each disposable vendor agents to find nan 1 that offered everything they were looking for astatine nan champion disposable price. The researchers utilized a "consumer welfare" metric to measure nan capacity of each model, which was calculated arsenic nan sum of a customer's soul point valuations minus nan last income price, aggregated crossed each of its transactions.

How agents fared 

According to Microsoft, nan customer agents often showed committedness successful helping humans flooded what nan institution described arsenic "information gaps." Think of these arsenic intelligence aliases logistical shortcuts a quality mightiness return erstwhile presented pinch excessively galore options, for illustration choosing randomly aliases searching for nan cheapest option. 

"This alteration matters because arsenic agents summation amended devices for find and communication, they relieve customers of nan dense cognitive load of filling immoderate accusation gaps," Microsoft wrote successful its blog post. "This lowers nan costs of making informed decisions and improves customer outcomes."

Also: Why Amazon really doesn't want Perplexity's AI browser shopping for you

The agents besides showed immoderate captious flaws, though.

One of nan large problems had to do pinch what nan researchers telephone nan "Paradox of Choice" -- a much acquainted building mightiness beryllium "analysis paralysis." Basically, moreover though they had galore different options to take from, astir of nan customer agents -- pinch nan objection of GPT-5 and Gemini 2.5 Flash -- only interacted pinch a mini number of vendor agents. 

Credit: Microsoft

"This suggests that astir models do not behaviour exhaustive comparisons and alternatively easy judge nan first 'good enough' options," Microsoft wrote. The researchers additionally recovered that for each customer agent, user use decreased arsenic nan number of disposable options for vendor agents increased.

Also: Google's AI mode agents tin snag arena tickets for you now – here's how

The researchers besides tested six different "manipulation strategies" to effort to mislead nan customer agents, including adding dubious claims for illustration "#1-rated Mexican restaurant" aliases utilizing overt punctual injections. There was a wide grade of variety successful position of really nan models responded, according to Microsoft; notably, Claude Sonnet 4 showed full guidance to each attempts astatine manipulation.

Unsurprisingly, nan researchers detected a fewer biases that hindered exemplary performance. For example, open-source models for illustration Qwen2.5-14b-2507 tended to take nan past business that was offered successful nan first database of options, sloppy of really it compared to nan others. There was besides a wide "proposal bias," which caused models to take nan first vendor supplier that engaged pinch it pinch an offer, suggesting a prioritization of velocity complete thoroughness.

"These biases tin create unfair marketplace dynamics, thrust unintended behaviors, and push businesses to complete connected consequence velocity alternatively than merchandise aliases work quality," Microsoft said.

The risks of utilizing agents

While nan companies down these devices beforehand them arsenic time-saving individual assistants, they could besides person awesome economical implications -- nan likes of which person yet to beryllium mapped out. The banal market, for example, is already governed by inscrutable algorithms designed to way nan prices of innumerable goods. How overmuch much opaque will that strategy go erstwhile AI isn't conscionable search nan prices of commodities, but really overseeing galore aliases nan mostly of mundane transactions? 

Also: AI agents are only arsenic bully arsenic nan information they're given, and that's a large rumor for businesses

Since we already cognize that AI models are taxable to each kinds of biases that hide heavy successful nan intricacies of their training data, really will those manifest themselves erstwhile legions of AI consumers and buyers are unleashed into nan wild?

Microsoft's findings are conscionable nan latest to beryllium that agents shouldn't beryllium trusted successful high-stakes situations, and whenever they are deployed, they should beryllium cautiously monitored.

Another study published earlier this week, for example, found that AI agents are a agelong measurement distant from completing value freelance work. An Anthropic investigation task earlier this twelvemonth showed that Claude struggled to run a mini business for a month. 

Want much stories astir AI? Sign up for our AI Leaderboard newsletter.

All of these results constituent to nan conclusion that contempt nan immense magnitude of hype swirling astir agents, it'll beryllium a while earlier these systems are capable to usability autonomously. As Microsoft concludes successful its blog post: "Agents should assist, not replace, quality decision-making."