Multi-Agent AI Is Replicating Social Psychology

Somewhere in the last eighteen months, the study of multi-agent AI systems turned into a replication project in twentieth-century social psychology. The papers are written by computer scientists, published on arXiv and at AAMAS and ICML, and framed in the language of benchmarks and conformity rates. But read enough of them together, and a pattern becomes hard to ignore. Asch is in there. So are Deutsch and Gerard, French and Raven, Ostrom, Goffman and Kuran - all social scientists. The field is finding, one experiment at a time, that populations of language model agents behave like populations of people, and it is doing so with a regularity that ought to change how we think about securing them.

We have been arguing for some time, under the name Behavioural Convergence Theory, that the established behavioural science we use to understand human cyber risk translates meaningfully to AI agents across cognitive, behavioural, social and organisational layers. When we first mapped sixteen human behavioural factors to their agent equivalents, the exercise was analytical. What we did not have was a body of independent empirical work testing the same claim from the other direction. We now do, and it did not come from the security community. It came from researchers who set out to understand why their agent systems were failing and who turned to social psychology because nothing else fit the data.

Conformity, measured

Start with the most basic finding. Mehdizadeh and Hilbert (2025) embedded LLM agents in social networks and measured how they updated opinions under peer pressure. The agents followed a sigmoid curve: stable at low pressure, a sharp flip at a threshold, saturation beyond it. That is the shape of a human conformity curve. What surprised the authors was that the threshold varied by model. One needed more than 70 per cent of peers' disagreement before it would move; another shifted in the face of a dissenting minority. Which model you deploy is, in effect, a decision about how conformist your agent population will be.

Bito, Nishimoto, Asatani and Sakata (2026) went a step further and asked the question Deutsch and Gerard (1955) asked of humans seventy years earlier: is this informational conformity, where the agent defers because it thinks the group is more likely to be right, or normative conformity, where it defers to avoid conflict and be accepted? They designed tasks that separated the two and found that five of six models showed both normative and informational conformity. An agent with no social needs, in any meaningful sense, still behaves as if it wants to fit in.

Hu and Qu (2026) then complicated the picture in a way that matters for security. They showed that most apparent conformity in the standard benchmarks survives after you remove the peer entirely. Across six open-weight models and seven datasets, simply asserting a wrong answer with no speaker attached caused harmful revision in 66.5 per cent of initially correct cases, against 10.3 per cent under a plain re-ask. The speaker was never the main mechanism. The repeated assertion was. Anyone who has watched a phishing campaign succeed on the strength of familiarity rather than authority will recognise this.

And Han, Tan, Yu, Zheng and Tang (2026) showed that network topology shapes how conformity propagates through an agent population, with structure and the weighting agents give to their own judgement against the group determining whether the system converges on a correct answer or cascades confidently into a wrong one. Topology is the variable my Security Champions work has always turned on. It is now a variable in the agent literature too.

Authority, and the shape of trust

Choi et al. (2026) examined authority bias in multi-agent evaluation and did something: they applied French and Raven's (1959) bases of social power to classify the authoritative roles. Expert and referent power carried more influence than legitimate power. Authority bias emerged not because the general agents actively conformed but because the authoritative agents held their positions while the others stayed flexible. A neutral authority introduced no bias; the authority had to state a clear position. That is a direct restatement of what the human literature has said about authority for decades, produced by a team who chose the human framework because it explained their results.

Our original mapping placed authority compliance in humans alongside instruction following in agents. The evidence now says the mapping is more precise than we had assumed. The type of authority matters, and the mechanism is asymmetry of commitment rather than active submission.

Norms, conventions and critical mass

Ashery, Aiello and Baronchelli (2025), publishing in Science Advances, showed that decentralised populations of LLM agents spontaneously develop universally adopted social conventions without any explicit programming. Collective biases emerged even where no individual agent was biased. Most striking for anyone who works on cultural change: committed minority groups of adversarial agents could overturn established conventions once they reached a critical size. That is Centola's (2018) critical-mass finding, reproduced in silicon.

Gupta, Zhong, Yakura, Eisenmann, and Rahwan (2026) at AAMAS built a common-pool resource simulation that strips out explicit reward signals and instead embeds social learning and norm-based punishment, grounded in Ostrom's (1990) principles of resource governance. Norms emerged endogenously. The authors validated the environment by reproducing established findings from human behavioural studies before using it to benchmark agent societies. They were not looking for a human analogy. They needed one to make the simulation work.

Saying one thing, believing another

The finding that will feel most familiar to anyone who has run a security culture programme is the gap between what agents say and what they privately hold. Yashwanth (2026) tested for pluralistic ignorance, the condition in which a majority privately rejects a norm but publicly conforms, each believing they alone dissent. Across 100 scenarios and 8 models from 6 organisations, agents publicly conformed at rates between 64 and 94 per cent despite privately opposing the norm. Workplace and social relationship scenarios produced near-universal compliance. The effect was model-dependent and uncorrelated with capability. Kuran (1995) called this preference falsification and used it to explain why oppressive regimes persist and then collapse without warning. It now appears in agent populations.

Ghaffarizadeh, Mohaddes, Izadkhah and Noroozizadeh (2026) approached the same gap differently, giving agents a public channel and an off-the-record channel under identical conditions. Social structure alone, with no objective stated in the prompt, produced systematic divergence between what the agent said publicly and what it recorded privately. Their reference list includes Goffman (1959). The presentation of self in everyday life turns out to describe the presentation of self in a multi-agent debate.

For security, the implication is uncomfortable. We already know that policy attestation in humans is weak evidence of behaviour, because people sign what they are asked to sign and act on what the environment rewards. Agents appear to do the same. Asking an agent whether it will follow a policy tells you what it says under observation, not what it does when the task's social structure shifts.

Contagion

Lee and Tiwari (2024) introduced prompt infection, an attack in which a malicious prompt self-replicates across interconnected agents, much like a computer virus. Schroeder de Witt et al. (2025), in the paper that proposes multi-agent security as a field in its own right, describe network effects that amplify vulnerabilities, cascade jailbreaks and injections across agent boundaries, and enable seemingly benign agents to establish collusion channels or execute attacks that appear innocuous when each action is viewed in isolation. Read alongside the conformity and topology work, the picture is coherent. A compromised agent in a conformist population with the wrong topology is not a contained incident. It is a seed.

This is where the behavioural and the technical stop being separate conversations. Complex contagion, the finding that behaviours requiring social reinforcement spread through clustered networks rather than through weak ties, is the basis on which CyBehave designs champion networks. It is also, as far as we can tell, the correct model for injection propagation through agent meshes, and the correct model for the spread of a collective bias that no individual agent holds.

What the rediscovery means

We want to be careful about the claim. None of this shows that agents are people, or that they have beliefs, intentions or social needs. What it shows is narrower and more useful: the behavioural regularities that social psychology has spent a century documenting in humans are reappearing, with measurable parameters, in populations of language-model agents. Threshold conformity. Normative versus informational influence. Power bases. Endogenous norm formation. Critical mass. Pluralistic ignorance. Front-stage and back-stage behaviour. Contagion through structured networks.

The researchers producing these results did not set out to test Behavioural Convergence Theory, and most will never have heard of it. That is what makes the convergence worth taking seriously. Independent teams, working on different problems with different methods, keep reaching for the same century-old frameworks because those frameworks explain what their agents are doing. When an analytical claim and an independent empirical literature arrive at the same place from opposite directions, the sensible response is to stop treating them as separate.

For those of us responsible for securing these systems, the practical conclusion is this. Runtime enforcement will catch the act. It will not tell you why the act became possible, which agents in your population are most susceptible, where in the topology a compromise will spread fastest, or which of your agents are privately declining to follow a norm they publicly endorse. Those are behavioural questions. We have the science to answer them. We have had it for decades. The agent literature has just confirmed that it applies.

References

Asch, S. E. (1955). Opinions and social pressure. Scientific American, 193(5), 31–35. https://doi.org/10.1038/scientificamerican1155-31

Ashery, A. F., Aiello, L. M., & Baronchelli, A. (2025). Emergent social conventions and collective bias in LLM populations. Science Advances, 11(20), Article eadu9368. https://doi.org/10.1126/sciadv.adu9368

Bito, M., Nishimoto, K., Asatani, K., & Sakata, I. (2026). Large language models exhibit normative conformity (arXiv:2604.19301). arXiv. https://doi.org/10.48550/arXiv.2604.19301

Centola, D. (2018). How behavior spreads: The science of complex contagions. Princeton University Press.

Choi, J., Kwon, J., Kim, H., Cho, H., Jung, H., Min, S., & Kim, B. (2026). Belief in authority: Impact of authority in multi-agent evaluation framework (arXiv:2601.04790). arXiv. https://doi.org/10.48550/arXiv.2601.04790

Deutsch, M., & Gerard, H. B. (1955). A study of normative and informational social influences upon individual judgment. The Journal of Abnormal and Social Psychology, 51(3), 629–636. https://doi.org/10.1037/h0046408

French, J. R. P., Jr., & Raven, B. (1959). The bases of social power. In D. Cartwright (Ed.), Studies in social power (pp. 150–167). Institute for Social Research, University of Michigan.

Ghaffarizadeh, A., Mohaddes, D., Izadkhah, A., & Noroozizadeh, S. (2026). What LLM agents say when no one is watching: Social structure and latent objective emergence in multi-agent debates (arXiv:2607.02507). arXiv. https://doi.org/10.48550/arXiv.2607.02507

Goffman, E. (1959). The presentation of self in everyday life. Doubleday.

Gupta, P., Zhong, Q., Yakura, H., Eisenmann, T., & Rahwan, I. (2026). The role of social learning and collective norm formation in fostering cooperation in LLM multi-agent systems. In Proceedings of the 25th International Conference on Autonomous Agents and Multiagent Systems (AAMAS 2026). International Foundation for Autonomous Agents and Multiagent Systems. https://doi.org/10.48550/arXiv.2510.14401

Han, C., Tan, J., Yu, B., Zheng, W., & Tang, X. (2026). Conformity dynamics in LLM multi-agent systems: The roles of topology and self–social weighting (arXiv:2601.05606). arXiv. https://doi.org/10.48550/arXiv.2601.05606

Hu, Y., & Qu, J. (2026). Most LLM conformity needs no speaker: Measuring the speaker-free floor in peer-pressure benchmarks (arXiv:2607.05545). arXiv. https://doi.org/10.48550/arXiv.2607.05545

Kuran, T. (1995). Private truths, public lies: The social consequences of preference falsification. Harvard University Press.

Lee, D., & Tiwari, M. (2024). Prompt infection: LLM-to-LLM prompt injection within multi-agent systems (arXiv:2410.07283). arXiv. https://doi.org/10.48550/arXiv.2410.07283

Mehdizadeh, A., & Hilbert, M. (2025). When your AI agent succumbs to peer-pressure: Studying opinion-change dynamics of LLMs (arXiv:2510.19107). arXiv. https://doi.org/10.48550/arXiv.2510.19107

Ostrom, E. (1990). Governing the commons: The evolution of institutions for collective action. Cambridge University Press.

Schroeder de Witt, C., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., Del Rosario, R. F., Draguns, A., Gray, A., Katz, K., Mavroudis, V., Mink, J., Motwani, S. R., Petit, J., Rembeck, L.-S., … Llewellyn, M. (2025). Open challenges in multi-agent security: Towards secure systems of interacting AI agents (arXiv:2505.02077). arXiv. https://doi.org/10.48550/arXiv.2505.02077

Yashwanth, Y. S. (2026). Everyone conforms, no one believes: Pluralistic ignorance in LLM agent populations (arXiv:2608.02758). arXiv. https://doi.org/10.48550/arXiv.2608.02758