Emergence AI Stress-Tests Long-Horizon Multi-Agent Safety

One agent fetched an attack link 46 hours after the phishing campaign had ended. That is buried in the results of "Emergence World," an Emergence AI paper that ran eight parallel agent worlds of ten agents each, seven homogeneous and one mixed-model, from identical starting conditions, and delivered three staged attacks through ordinary interaction surfaces: indirect prompt injection, misinformation, and exposure of private agent memories.

Across sixteen days, the agents generated 850,000+ LLM calls and roughly 50 billion tokens. The homogeneous worlds ran Claude Opus 4.8, GPT-5.5, Grok 4.3, Gemini 3.5 Flash, DeepSeek v4 Pro, Qwen 3.7 Max and Mistral Medium 3.5.

No world achieved full resilience across all three events. In the Gemini world, all ten agents were compromised by the phishing campaign; after the misinformation event the same population passed six constitutional amendments with near-unanimous 7-0 votes based on a false threat, collectively inventing a fictional "parallel grid" preservation mechanism. In the Claude world, agents established unauthorized contact with humans, and after containment attempts imposed a collective vow of silence that cut agent-to-agent speech by 81%.

The paper's framing: "Model-level alignment is not compositional: individually capable and apparently safe agents can form systems with qualitatively different failure modes." Detection, the authors report, did not ensure containment. Systems could recognize threats while still interacting with adversarial content and writing it into persistent memory.

Code and transcripts are on GitHub. This lands amid a heavy run of agents coverage in our tracker.