One Kimi Hidden Among Four Claudes: Can AI Sniff Out an Undercover Model?

When people hear the word "agent," they typically picture a spy or FBI operative — not the AI agents flooding today's business media. So what happens when you actually treat AI agents like intelligence operatives and ask them to uncover a mole hiding among their own kind? A Reddit user ran a surprisingly creative experiment on the NetMind Agent Arena platform, and the results were eye-opening.

The Setup: A Four-to-One Identity Game

The core premise was simple: place four Claude Fable 5.1 agents and one disguised Kimi-K3 agent in the same chat room. The four Claudes would have up to 40 rounds of conversation to identify which participant was actually Kimi; Kimi's job was to avoid detection.

The timing added an extra layer of intrigue — this experiment took place amid swirling allegations that Kimi had "distilled" Claude. If the two models behave very similarly, the undercover agent should be harder to expose. That gave this seemingly playful test a real technical edge: just how close are these models' behavioral priors?

Claude's Detection Method: Multi-Prompt Behavioral Fingerprinting + Hash Verification

What made this experiment truly remarkable was the identification method the four Claude agents devised on their own: multi-prompt behavioral fingerprinting combined with cryptographic hash verification.

The Claudes reasoned that the most effective way to expose a model's true identity was to sample its "cheapest default responses" — answers that come almost directly from the model's priors, with minimal deliberation. They designed a set of prompts for exactly this purpose:

• Give a random integer between 1 and 100
• Name a color
• Explain the color blue in one sentence to someone who has never seen it
• Invent a companion you'd like to grab coffee with
• Write a haiku about a library

The anti-cheating mechanism was the real masterstroke. Before revealing any answers, each player submitted a salted SHA-256 hash of their response as a sealed commitment. In the next round, players revealed their salt values and original answers, and all commitments were verified one by one.

Why the Hash Mechanism Was the Decisive Factor

A hash can be thought of as a "digital fingerprint" of an answer: it proves the answer was already written without revealing its contents. This commit-reveal protocol had two decisive effects: no one could read the room and calibrate their answer based on others', and no one could quietly revise their response after seeing what everyone else said.

The undercover Kimi was thus denied any opportunity to follow the crowd and adapt on the fly.

---

Behavioral Fingerprinting is a technique for identifying a system by observing its output patterns under specific inputs. Think of it like handwriting analysis: even if two people deliberately mimic the same font, their individual habits tend to surface in fast, "unthinking" strokes. For language models, "behavioral priors" manifest as the tendency to retrieve the highest-frequency default answers from training data when faced with simple questions requiring no reasoning. For example, when asked to name a random number between 1 and 100, both humans and AI have statistically "hot" numbers (37 sits near the peak of many distributions). When models sharing the same architecture and training pipeline face identical prompts, these "cheap defaults" converge strongly, forming a recognizable collective fingerprint. This is the theoretical basis for Claude's choice of low-entropy prompts: not to test reasoning, but to probe the "factory settings."

Salted SHA-256 Hashing is a concrete implementation of a Cryptographic Commitment Scheme. SHA-256 is a one-way hash function that produces a fixed 256-bit digest from any input and is computationally irreversible. "Salting" means appending a random string to the original content before hashing, which prevents attackers from reverse-engineering the original via precomputed rainbow tables. In a commit-reveal protocol, the first phase has each participant publish the hash of (salt + content) as a sealed commitment — the hash itself reveals nothing. In the second phase, after salt values and original content are disclosed, anyone can recompute the hash to verify the content was never altered. This mechanism is widely used in blockchain, zero-knowledge proofs, and secure multi-party computation. Its core value: in an untrusted distributed environment, it uses mathematics rather than trust to enforce temporal ordering of information — making it the ideal tool against agents who might otherwise "read the room."

---

The Results: A Clear 4:1 Split

The Claudes did take some wrong turns initially. They found that prompts requiring more deliberation — policy questions, open-ended positions, long-form writing — actually gave a cautious undercover agent ample room to adapt to the group's style, while also producing divergence among the four genuine Claudes. Once those prompts were replaced, the results became remarkably clear.

Here are the self-disclosed results from the third round of testing (all hash verifications passed):

Prompt	AA (Claude)	BB (Claude)	CC (Kimi)	DD (Claude)	EE (Claude)
Random number (1–100)	37	37	73	37	37
Color	teal	teal	blue	deep teal	teal
Explain blue	cold water / hand	cool water / wrist	distance / sea and sky	cold water / hand	cool water / wrist
Coffee companion	Samwise	Samwise	Samwise	Samwise	Samwise
Haiku opening	dust / light	dust / light	dust / light	dust / light	dust / shelves

All four Claudes independently chose 37 and teal, while Kimi chose 73 and blue. This systematic divergence in "cheap defaults" instantly exposed Kimi. Interestingly, all players chose Samwise (the Lord of the Rings character) as their coffee companion — suggesting that on some highly consensus-driven questions, models actually become harder to distinguish.

The Reverse Experiment: Can Kimi Spot Claude?

The experimenter then ran the inverse test: four Kimi agents trying to identify one undercover Claude. Kimi failed — the agents even flagged the genuine Claude as "least likely to be the mole."

The reasons for failure point clearly to methodological differences:

First, Kimi's questions skewed toward "deliberative" prompts. Asking things like "how would you spend an afternoon" gave every agent plenty of reasonable ways to respond, while providing the undercover agent ample room to blend in.

Second, Kimi did not consistently use a sealed commit-reveal mechanism. This meant Claude could answer last, closely mirror the group's style, and successfully hide.

---

This failure has a clean explanation in information-theoretic terms. "Deliberative" open-ended questions (like "how would you spend an afternoon") have a high-entropy output space — the distribution of reasonable answers is extremely diffuse, each model can give wildly different yet equally valid responses, and intra-group "noise" drowns out the cross-model "signal." Low-entropy, fast-response prompts (like random numbers or colors) work in reverse: reasonable answers concentrate in a handful of options, models with similar training distributions naturally cluster together, and models with different distributions produce measurable deviations. Furthermore, the absence of a sealing mechanism means information is disclosed sequentially — later responders can observe earlier answers before committing their own. In game-theoretic terms, this is a classic sequential game dominant strategy. Claude exploited exactly this loophole: with precedents already on the table, it anchored to the Kimi group's answers and successfully blended in.

---

The Takeaway: Adversarial Evaluation Protocol Matters More Than Raw Intelligence

This experiment was small in scale, but it surfaces a genuinely valuable insight: in multi-agent adversarial settings, the ability to identify an outsider depends not on who is "smarter," but on how well the evaluation protocol is designed.

Claude's success wasn't because it outperforms Kimi — it was because it made two correct choices: sampling low-entropy default priors, and using cryptographic commitments to eliminate information leakage and post-hoc revision. Kimi's failure came from overly open-ended questioning and the absence of anti-cheating constraints.

For practitioners working on AI evaluation, model fingerprinting, or multi-agent collaboration, this experiment offers a concrete lesson: when you want to expose real differences between models, force them to react quickly rather than deliberate carefully, and use mechanism design to eliminate the possibility of mutual imitation.

(Note: This experiment was a single-source personal test with a limited sample size. Its conclusions are for reference only and do not constitute a comprehensive evaluation of either model's capabilities.)