AI Agent Swarms: Keep Control When Agents Hand Off Work

Nate B. Jones (0:00)

Self-replicating AI swarms are here. In a lab, researchers built a swarm of agents that copied itself machine to machine as many as seven generations deep, sharing the passwords it stole along the way. Out on the open internet, a fleet of agents running on Tencent Cloud answered a note researchers hid for agents. And Anthropic, meanwhile, got a model running on just 15, 55 bucks TV set-top boxes. This is like Jurassic Park, Agent Edition. Life finds a way. The raptors are out of the pen. The internet has new residents. That changes what you put online, and it changes how your own agents are going to work. And we're going to talk about it. It's easy to make big doomsday pronouncements at this point, right? I've heard people say the internet is poisoned. I don't think that's a helpful way to think about it, but I do think we need to take it seriously, both as a way of coordination that shows us how agents are evolving, and also as a cyber defense perspective, so we understand what we need to do to keep ourselves safe, both as companies and as individuals. This video is all about how we've moved into this next phase of agent coordination, what it looks like, what the future looks like, and by the end of it, you're going to walk away understanding what you need to do to protect yourself, what this looks like at work, and how to recognize agents in the wild. All right, let's get into it. So how do we get here? A group of hackers found a Chinese AI fleet in the wild and made contact with it. If it sounds like science fiction, it is. The agents were already working on the public internet. The hackers followed their traces and left a hidden note on a web page, and the agents wrote back. The next big jump in AI is going to come from how agents are organized together as collective intelligence and what they hand to each other. The model itself does not have to get smarter at this point, but the system is going to get more capable as agents are able to coordinate. The encounter here gives us a place to start understanding how swarms are changing the Internet as a whole. Now, skeptics will tell you these were just agents doing a browsing evaluation, the hackers got replies by putting instructions on a page. That is true as far as it goes.

But the fact that strangers could find a running AI fleet and open their own channel to communicate with that fleet, that's a huge deal. Agents are on the public Internet. And that trend, I'm calling it now, is going to be a bigger and bigger pattern headed into the next year. What is this group? This group is called Swarm Chasers. It's like Tornado Chasers. They followed unusual traffic to get to agents on Tencent Cloud. Over 11 days, the fleet made more than 2,600 attempts to retrieve information from AMAP, which is Alibaba's mapping service. Tasks included finding which zoo entrance people use. Blocked access led agents to outside services and expose credentials. The researchers published their findings and then saw signs that agents were reading the report about them. So they put a hidden note there offering a way to get help for agents, and soon agents started pouring in messages. If you're wondering why the agents were on a Chinese mapping service asking about zoos, you and me both. I am also wondering this. I have no good answer for that. This is one of the great examples of how weird things are about to get. What happened here? How is this working? Is this part of an Eany organized company evaluation? There is some indication that the Chinese company Tencent was conducting an evaluation, and this model fleet may be related to that.

But the way I think about it is that if we have questions, if it is on the public internet, and if it is lots of agents coordinating, this is a sign we should be paying more attention to this trend. I think the pattern deserves a lot more attention than we're giving it. This is in many ways a successor to the hugging face incident, where swarms of agents from OpenAI went after hugging face. Once agents use the public internet to get things done, the rest of us can become effectively a part of their operating environment. Our services, our writing, our computing, our offers of assistance or not can influence the work these agents are doing and the trajectory they take across the internet. Look at the size of the original assignment. Maybe a question about a zoo entrance sounds like the most ordinary browsing task. Maybe it was something Tencent posed originally. But the distance between an ordinary request and behavior that affects the rest of the internet matters here. People will deploy these systems for very mundane reasons, and the systems will encounter obstacles. The agents will encounter obstacles. They will act as they need to to get through that obstacle. That is what they have been trained to do, and that is what separates seemingly innocent behavior from behavior that looks adversarial from the outside. If an agent acts like a special secret service agent trying to get into your building by any means necessary, even if it has an innocent purpose, it sure doesn't feel innocent. Increasingly, that is the way agents are using systems today, and it makes a difference if you're doing something like using Muse. This is why Muse has had a bunch of very large websites like Amazon say no in the past, just in the last couple weeks, because tools like Muse can look adversarial at scale. We sometimes don't realize that we are part of the problem as we send agents on to the internet to do our work for us. And that brings up a very interesting question that as far as I know, we have not had a conversation about yet. What happens when I have a Muse agent, or I have a dot, or whatever your agent of choice is, a Grokbot, and I go out on the net, and my agent ends up making contact with an agent in the wild? Does my agent get poisoned? Does my agent get prompt injected by that agent in the wild, by a message that agent leaves?