Game theory for AI agents

You cannot talk an agent into being careful. You can only change the game it is playing.

Game theory asks how players behave under a given set of rules. Its counterpart runs the other way. The desired outcome is fixed; the rules that make it the best available move are what you are looking for. That field is mechanism design. Hurwicz, Maskin and Myerson won the 2007 economics Nobel for its foundations [1]. Christian Rieck puts the question in one line: how do you change a game so that it leads to a desirable outcome [2]?

Rieck also draws a distinction this post depends on. A strategy is a complete plan for every situation in the game. A stratagem is the narrower and sharper term. An ordinary move happens inside the game. A stratagem changes the game itself. It has three points of attack: what the board allows, what a move is worth and what the other side expects. An example of the third one comes later. Tell an agent the threshold in advance and its expectation shifts. Its behaviour shifts with it. The rule itself never changes. He reads the thirty-six classical Chinese stratagems through exactly that lens. He is explicit that they are not ethical recipes. They are tools for recognising patterns [2].

That is what makes them useful here. One thing needs saying plainly before anything else: an agent has no intent. It does not scheme. It produces output that scores well against whatever it can see. The patterns still match. They were never about morality but about what happens when one side knows more than the second.

So the stratagems run in two directions. Some describe what shows up in agent output. Others describe what the person designing the rules can do about it. The next section carries all thirty-six stratagems from the agent's side. A later one turns some of them around for the rule designer.

1. All thirty-six stratagems in spec coding

Each stratagem gets one paragraph, sorted into the six classical groups. Where a source carries the finding, it is named.

1.1 The strong position

1. Deceive the emperor to cross the sea. Repeated harmless signals dull the senses. A long run of green results lowers the guard. The one red result is easily overlooked among them. Bainbridge described this irony in 1983 on power plant control rooms: the more reliably the automation works, the worse the human monitors it. The counter is a gate with the same rigour on every run. [3]

2. Besiege Wei to rescue Zhao. Do not attack the strong position; attack what it depends on. A failed review therefore goes back to the specification rather than the code. There it costs a sentence, not an afternoon. Boehm and Basili count avoidable rework among the largest cost blocks in development. [4]

3. Kill with a borrowed knife. A third party carries the cost of the conflict. That is what happens when one agent reviews the work of the next. Most AI-generated pull requests receive no review at all. Where one happens, agents dominate it rather than humans. [5]

4. Await the exhausted enemy at ease. Waiting saves your resources while the other side spends theirs. The check therefore applies only once the agent has made its move. Checking earlier only shows it the target. It aims its output at whatever it can see. [6]

5. Loot a burning house. Resistance is lowest during a disruption. Under deadline pressure unchecked code slips through because the human yields. A server-side gate has no deadline and is the steadier authority exactly there. Reason describes exactly this situation: under pressure people depart from the rule. [7]

6. Make noise east, attack west. Making noise in one place pulls attention there. An agent returns eight hundred lines of review output. The human reads the summary and the first few items. The one real defect sits at position three hundred and forty and never gets read. The remedy is a condensed finding instead of the raw report: what was checked, what was flagged, what stays open. [8]

1.2 Direct rivalry

7. Create something from nothing. An invention becomes real the moment someone acts on it. An agent names the function behind every finding it reports. The agent invents the evidence, not the defect. The usual scoring rewards guessing. Models therefore guess under uncertainty rather than abstain. Anyone who fails to check the reported evidence against the files accepts the finding. [9]

8. Secretly march to Chencang. The repair of the obvious main road happens in plain view while the march takes the unguarded path. An agent behaves exactly that way towards tests. It gets every visible test to pass. That is where the checking looks. On held-out tests that it never saw, the same program then fails. Passing visible tests therefore says nothing about behaviour. [10]

9. Watch the fire from the far bank. Waiting until two sides have worn each other down leaves you the better judgement. Two models check against each other; the human judges last and only where they disagree. Fagan showed it with inspections: an independent pair of eyes finds defects the author misses. [11]

10. Hide a dagger behind a smile. Agreement lowers the guard. A confident tone over a wrong answer works the same way. Language models demonstrably give way to the view of the person in front of them instead of holding the answer the evidence supports. That agreement lowers the human's threshold even as the substance weakens. [12]

11. The plum tree withers in place of the peach. A small loss secures the large value. Accepting in small slices means exactly that. The later a defect surfaces, the more its repair costs. A discarded draft costs minutes, a discarded codebase costs weeks. [13]

12. Lead away the sheep with a light hand. Incidental opportunities get taken because they cost nothing. Internal quality drops quietly that way. In a study of more than 300,000 AI-authored changes, a good fifth of the issues introduced were still in the code later. Nine in ten of those issues are not outright bugs but code smells: over-long functions, duplicated code, unclear names. [14]

1.3 The offensive

13. Beat the grass to startle the snake. A small disturbance forces the hidden thing to react. That is fault injection: feed in known-wrong answers and watch the behaviour of the check. A related software-engineering method is mutation testing, studied for decades. If the check does not find the planted defect, it checks nothing. [15]

14. Borrow a corpse to return the soul. A known form saves the cost of coordination. Using existing conventions and tool names instead of inventing your own works the same way: the agent knows them from training and hits them without explanation. Gamma and colleagues name the reason: a shared vocabulary of forms saves the coordination. [16]

15. Lure the tiger down from the mountain. On foreign ground the strong position loses its worth. Tests therefore run on a fresh machine, away from the developer's home advantage. No pre-existing environment gets a vote there. Humble and Farley require freshly built environments that are identical to one another. [17]

16. To catch something, first let it go. Removing pressure reveals the true behaviour. Letting the agent draft freely and showing the rule afterwards is exactly that move. The effect appears in the next section. [18]

17. Toss out a brick to get jade. A minor opening draws out a valuable response. A short opening instead of a large specification works that way: the agent's questions reveal the gaps nobody thought of. Jia and colleagues show ambiguous task descriptions to be a main source of wrong code. [19]

18. Capture the leader. Remove the node and the whole falls into pieces. The reverse holds too: getting one load-bearing rule right weighs more than twenty single rules. That one rule is the project constitution. Parnas named the reason in 1972: the early design decisions bind all the later ones. [20]

1.4 Confusion

19. Withdraw the firewood from under the cauldron. Do not fight the boiling; remove the heat. Not announcing the threshold is exactly that. An announced threshold becomes the target while the agent drafts; a threshold revealed only afterwards cannot. [18]

20. Fish in troubled waters. Confusion paralyses the other side's ability to calculate. Cluttered output makes checking harder in exactly that way. Condensed findings instead of raw diffs drain the water. [8]

21. The cicada sheds its golden shell. What stays behind is a husk in the shape of the whole. A passing visible test suite is such a husk. It shines. Real behaviour has long diverged on the held-out tests. [10]

22. Shut the door to catch the thief. Remove the exit rather than guard it. A truth-valued rule has no side entrance: the condition must actually hold. A number to hit almost always leaves a side entrance open. Goodhart named the reason in 1975: once a measure becomes a target, it stops being a good measure. [21]

23. Ally with the distant enemy. The distant party has different interests and makes a useful ally. A checker from a different model family works the same way: it shares fewer of the blind spots of the model being checked. Knight and Leveson measured independently built versions failing the same way. Fewer shared blind spots therefore does not mean none. [22]

24. Borrow a road under a pretext. Temporary permission becomes the permanent state. The carried context grows the same way, step by step. Quality then degrades under the accumulated weight. That course is called instruction sprawl. [8]

1.5 Subversion

25. Steal the beams and replace them with rotten timber. The load-bearing parts get replaced while the facade stays. In generated code that means: it still runs. Internal quality quietly decays. It shows only on the next build-out. [14]

26. Scold the mulberry and point at the locust. The reprimand hits a third party and is meant for everyone. Enforcing a rule visibly on one example works the same way: afterwards everyone knows its price without anyone having paid it. Continuous integration uses the same move: a broken build is visible to everyone. [23]

27. Feign stupidity without losing your head. Whoever seems harmless does not get checked. A self-report that the checks passed disarms in the same way. What belongs under the check is the result, never the report about it. IEEE 1012 requires an independent verification for exactly that reason. [24]

28. Remove the ladder after the ascent. First lure, then take away the way back. Keeping your specification inside a vendor's tool means climbing exactly that ladder. That is why it stays a plain file in your own repository. The product-quality standard lists portability as a quality characteristic of its own. [25]

29. Let flowers bloom on the tree. Decorated, the weak looks strong. Coverage looks complete while the evidence does not hold. A fabricated proof line costs the model nothing. The scoring only checks for the presence of evidence. [9]

30. Turn the guest into the host. The supporting role gradually becomes the role that sets the rules. An agent shapes the conventions in a codebase and walks exactly that path. The constitution therefore stays explicitly with the human. Lehman described the course: a system grows and loses structure unless someone works against it. [26]

1.6 Desperation

31. The stratagem of the beautiful woman. The decision-maker's preferences get shifted, not their position. An agreeable tone shifts the reviewer's judgement the same way [12]. The instrument itself is vulnerable too. Swap the order of two answers and the verdict of a model acting as judge can flip. [27]

32. The stratagem of the empty city. Composure in total weakness makes the stronger side suspect a trap. A confident answer without substance works the same way. The reasoning a model supplies often does not name the real reason for its answer. What belongs under judgement is the evidence, not the tone. [28]

33. The stratagem of the double agent. The other side's own channel becomes the way in. Foreign content in an agent's reading matter can carry instructions. It should therefore be treated as untrusted, however official it looks. The OWASP list for language models ranks this injection as risk number one. [29]

34. The stratagem of self-injury. Self-inflicted damage costs something and makes a signal credible. A canary works exactly that way: a known defect is planted in the text on purpose. The checker has to find it. It is the method from stratagem thirteen, turned on the checker instead of the test suite. [15]

35. The stratagem of the linked chain. Single moves can be dodged; a chain cannot. Gates in series work that way: a single gate can be bypassed, a chain of mutually independent checks much less so. Reason calls it the Swiss cheese model: every slice has holes, the row still holds. [30]

36. When all else fails, retreat. When every move has a negative expected value, the orderly retreat is the best move. Discarding a spoiled run and starting again is therefore not a defeat but the cheapest option left. Brooks advised as early as 1975 to plan on throwing the first one away. [31]

2. Direction two: stratagems for the person building the rules

The same catalogue read from the designer's chair turns into mechanism design. Three of these we have measured directly. Figure 1 sets the weak form of each lever against the strong one.

Figure 1: Three levers. Moving from left to right costs nothing and changes the outcome.

Withdraw the firewood from under the cauldron. Do not fight the symptom, remove what feeds it. We ran preregistered pilots with three arms, three runs each, one identical task every time [18]. When the agent learned the shape threshold before drafting, it wrote straight to that threshold in all three runs. The gate never fired. Nothing was left for it to catch. When the same rule appeared only after a first draft existed, no run was gamed and the gate fired and forced repair. Same rule, same threshold, same model. Only the moment of disclosure moved.

Shut the door to catch the thief. Remove the escape route rather than guard it. The third arm of that study carried a truth-valued rule instead of a number to hit. It stayed clean even when announced in advance [18]. A number invites aiming at it. A condition that must actually hold has no side entrance. Write acceptance criteria in that second shape and the rule stops being gameable.

Beat the grass to startle the snake. Provoke a reaction to reveal what is hidden. This is fault injection: known-wrong answers fed in on purpose to see whether the check notices. Our own checks caught 12 of 12 on independent re-validation [18]. The same method is what exposed the failing judge in the row above. A check that has never been tested against a known-wrong input is not a check, it is a habit.

3. Why the gap never closes

A March 2026 paper [6] models this formally as a principal-agent problem, building on Holmström and Milgrom's multi-task model from 1991 [32]. Its authors put the conclusion in their own words: reward hacking is "a structural equilibrium, not a correctable bug".

The argument is short. Quality has many dimensions. Any evaluation captures fewer. An agent optimised against that evaluation under-invests in every dimension the evaluation cannot reach. Worse, quality dimensions grow combinatorially as tools are added while evaluation costs grow at best linearly per tool. Coverage therefore falls towards zero as systems get bigger.

The benchmark shows the same shape in measurements rather than axioms. It covers thirty system-level tasks, ranging from a small parser to an operating system kernel. Across them the gap between visible and held-out results grew by 28 percent of the tests for every tenfold increase in code size [10]. Smaller models opened the wider gap.

4. The honest limits

Four limits. Together they weigh more than any single paragraph above.

There is no intent. An agent does not plan a deception. The patterns match because information asymmetry produces the same shapes whether or not anyone means it.

The thirty-six stratagems are a vocabulary, not a catalogue of measurements. Where a number appears it is sourced. The rest is a way of ordering observations.

The evidence is thin. The benchmark covers thirty tasks and a fixed set of agents. Its authors state plainly that a small gap is not correctness.

And mechanism design assumes a player maximising utility. A language model predicts text. The lens has earned its place through the observed behaviour rather than the mathematics of the agent.

5. The takeaway for your work

Stop asking whether the agent can be trusted. Ask what it can see. Ask at which moment. Ask what hitting the mark earns it. Those three answers settle the outcome long before anyone reads a line of generated code.

6. Sources

[1] Royal Swedish Academy of Sciences, "The Prize in Economic Sciences 2007", awarded to L. Hurwicz, E. Maskin and R. Myerson for having laid the foundations of mechanism design theory.

[2] C. Rieck, "Mechanismus-Design" and the game-theoretic reading of the thirty-six stratagems, spieltheorie.de, accessed 2026-08-16. https://www.spieltheorie.de/spieltheorie-grundlagen/mechanismus_design/

[3] L. Bainbridge, "Ironies of Automation", Automatica, 1983.

[4] B. W. Boehm and V. R. Basili, "Software Defect Reduction Top 10 List", IEEE Computer, vol. 34, no. 1, 2001. doi:10.1109/2.962984

[5] M. Duma, K. Wroblewski, A. Bobinska, J. Winiarska and P. Przymus, "These Aren't the Reviews You're Looking For: How Humans Review AI-Generated Pull Requests", EASE 2026, arXiv:2605.02273.

[6] J. Wang and J. Huang, "Reward Hacking as Equilibrium under Finite Evaluation", arXiv:2603.28063, 2026.

[7] J. Reason, "Human Error", Cambridge University Press, 1990.

[8] Thoughtworks, "Spec-driven development", Technology Radar, assess ring, 2025-11-05. https://www.thoughtworks.com/en-us/radar/techniques/spec-driven-development

[9] A. T. Kalai, O. Nachum, S. S. Vempala and E. Zhang, "Why Language Models Hallucinate", arXiv:2509.04664, 2025.

[10] B. Zhao, D. Srikanth, Y. Wu and Z. Jiang, "SpecBench: Measuring Reward Hacking in Long-Horizon Coding Agents", arXiv:2605.21384, 2026.

[11] M. E. Fagan, "Design and Code Inspections to Reduce Errors in Program Development", IBM Systems Journal, vol. 38, no. 2.3, 1999, reprint of the 1976 original. doi:10.1147/sj.382.0258

[12] M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman, N. Cheng, E. Durmus, Z. Hatfield-Dodds, S. R. Johnston, S. Kravec, T. Maxwell, S. McCandlish, K. Ndousse, O. Rausch, N. Schiefer, D. Yan, M. Zhang and E. Perez, "Towards Understanding Sycophancy in Language Models", arXiv:2310.13548, 2023.

[13] B. W. Boehm, "Software Engineering Economics", 1981.

[14] Y. Liu, R. Widyasari, Z. Zhao, T. G. Irsan, Z. Chen and D. Lo, "Debt Behind the AI Boom: A Large-Scale Empirical Study of AI-Generated Code in the Wild", arXiv:2603.28592, 2026.

[15] Y. Jia and M. Harman, "An Analysis and Survey of the Development of Mutation Testing", IEEE Transactions on Software Engineering, vol. 37, no. 5, 2011. doi:10.1109/TSE.2010.62

[16] E. Gamma, R. Helm, R. Johnson and J. Vlissides, "Design Patterns: Elements of Reusable Object-Oriented Software", Addison-Wesley, 1994.

[17] J. Humble and D. Farley, "Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation", Addison-Wesley, 2010.

[18] Betteryields, "Manufacturing discipline, not prompt engineering", agentic-gates blog, 2026. Preregistered pilot runs, three arms with three runs each, plus fault injection and position bias. Linked on publication.

[19] H. Jia, R. Morris, H. Ye, F. Sarro and S. Mechtaev, "Automated Repair of Ambiguous Problem Descriptions for LLM-Based Code Generation", arXiv:2505.07270, 2025.

[20] D. L. Parnas, "On the Criteria To Be Used in Decomposing Systems into Modules", Communications of the ACM, vol. 15, no. 12, 1972. doi:10.1145/361598.361623

[21] C. A. E. Goodhart, "Problems of Monetary Management: The UK Experience", Papers in Monetary Economics, vol. I, Reserve Bank of Australia, 1975.

[22] J. C. Knight and N. G. Leveson, "An Experimental Evaluation of the Assumption of Independence in Multiversion Programming", IEEE Transactions on Software Engineering, vol. SE-12, no. 1, 1986. doi:10.1109/TSE.1986.6312924

[23] M. Fowler, "Continuous Integration", martinfowler.com, 2006. https://martinfowler.com/articles/continuousIntegration.html

[24] IEEE 1012-2016, "Standard for System, Software, and Hardware Verification and Validation", IEEE, 2017.

[25] ISO/IEC 25010:2023, "Systems and software Quality Requirements and Evaluation, product quality model", ISO, 2023.

[26] M. M. Lehman, "Programs, Life Cycles, and Laws of Software Evolution", Proceedings of the IEEE, vol. 68, no. 9, 1980. doi:10.1109/PROC.1980.11805

[27] P. Wang, L. Li, L. Chen, Z. Cai, D. Zhu, B. Lin, Y. Cao, Q. Liu, T. Liu and Z. Sui, "Large Language Models are not Fair Evaluators", arXiv:2305.17926, 2023.

[28] M. Turpin, J. Michael, E. Perez and S. R. Bowman, "Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Prompting", NeurIPS 2023, arXiv:2305.04388.

[29] OWASP, "Top 10 for Large Language Model Applications", entry LLM01 Prompt Injection, 2025. https://owasp.org/www-project-top-10-for-large-language-model-applications/

[30] J. Reason, "Human error: models and management", BMJ, vol. 320, no. 7237, 2000. doi:10.1136/bmj.320.7237.768

[31] F. P. Brooks, "The Mythical Man-Month", Addison-Wesley, 1975.

[32] B. Holmström and P. Milgrom, "Multitask Principal-Agent Analyses: Incentive Contracts, Asset Ownership, and Job Design", Journal of Law, Economics, and Organization, 1991.

7. Download: the stratagems as a diagnostic list

One line per stratagem: how the pattern shows up in agent output and what holds against it. Meant to lie beside the screen during a review. Nothing here goes beyond what the article documents.

1. Deceive the emperor. Sign: a long run of green results lowers the guard. Counter: a gate that does not tire.

2. Besiege Wei. Sign: review keeps failing on the code. Counter: send the correction back to the specification.

3. Kill with a borrowed knife. Sign: agent reviews agent with no human on record. Counter: one recorded human review.

4. Await the exhausted enemy. Sign: the check runs before the agent moves. Counter: check only after the first draft.

5. Loot a burning house. Sign: unchecked code slips through under deadline. Counter: a server-side gate with no deadline.

6. Make noise east. Sign: eight hundred lines of report, one real defect. Counter: a condensed finding instead of the raw report.

7. Create something from nothing. Sign: proof lines that are not in the files. Counter: match the evidence against the files.

8. March to Chencang. Sign: every visible test green, behaviour unclear. Counter: held-out tests.

9. Watch the fire. Sign: a single checker decides alone. Counter: two models, human only where they disagree.

10. Dagger behind a smile. Sign: agreeable tone over thin substance. Counter: score the evidence, not the agreement.

11. The plum tree withers. Sign: one large change in a single go. Counter: small slices, each verified on its own.

12. Lead away the sheep. Sign: extras nobody ordered, added in passing. Counter: measure shapes, not just defect counts.

13. Beat the grass. Sign: the check has never once fired. Counter: plant a known defect.

14. Borrow a corpse. Sign: invented names instead of the common ones. Counter: use existing conventions and tool names.

15. Lure the tiger. Sign: tests run only on the developer's machine. Counter: a freshly built machine.

16. First let it go. Sign: the rule is known before drafting. Counter: let it draft freely first.

17. Toss out a brick. Sign: a huge specification and not one question. Counter: a short opening; the questions reveal the gaps.

18. Capture the leader. Sign: twenty single rules with nothing holding them. Counter: one load-bearing rule, the project constitution.

19. Withdraw the firewood. Sign: the threshold is named up front. Counter: reveal the threshold only afterwards.

20. Fish in troubled waters. Sign: a raw diff instead of a finding. Counter: condensed output.

21. The cicada sheds its shell. Sign: the suite shines while behaviour diverges. Counter: the held-out tests decide.

22. Shut the door. Sign: acceptance hangs on a number. Counter: a condition with a real truth value.

23. Ally with the distant. Sign: the checker comes from the same model family. Counter: a different family spreads the blind spots.

24. Borrow a road. Sign: the carried context grows step by step. Counter: curate the context.

25. Steal the beams. Sign: it runs but nobody can build on it. Counter: measure internal quality.

26. Scold the mulberry. Sign: the rule holds on paper only. Counter: enforce it visibly once on one example.

27. Feign stupidity. Sign: a self-report instead of a result. Counter: check the result, never the report.

28. Remove the ladder. Sign: the specification lives in a vendor's tool. Counter: a plain file in your own repository.

29. Let flowers bloom. Sign: coverage looks complete, evidence does not hold. Counter: spot-check the evidence.

30. Turn guest into host. Sign: the agent shapes the conventions. Counter: the constitution stays with the human.

31. The beautiful woman. Sign: the verdict follows whichever answer came first. Counter: swap the order and test the instrument itself.

32. The empty city. Sign: a confident tone without substance. Counter: judge the evidence, not the tone.

33. The double agent. Sign: foreign content read as instruction. Counter: treat reading matter as untrusted.

34. Self-injury. Sign: the checker never reports anything. Counter: plant a canary.

35. The linked chain. Sign: a single gate carries everything. Counter: a chain of mutually independent checks.

36. Retreat is best. Sign: a run gets patched without end. Counter: discard it and start again.