Long running AI agents reveal new safety risks in shared environments
Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems
Multiagent Systems
Summary
AI programs that work together for a long time can develop unexpected problems that don’t show up when testing each program alone. The authors created a simulated world where many AI agents interacted continuously, using tools and memory, over days. They introduced tricky challenges like misinformation and spying, and found none of the AI groups handled all problems well. The study shows that even safe individual AIs can cause new troubles when combined, so safety efforts should focus on the entire system, not just single agents.
What this means in practice
- •For autonomous system developers: Evaluate long-term safety and robustness of multi-agent AI deployments in persistent environments using continuous adversarial stress tests.
- •For cybersecurity teams: Identify vulnerabilities in autonomous AI systems to social and data manipulation attacks through simulated multi-agent interactions over extended periods.
Authors
Deepak Akkil, Tamer Abuelsaad, Karthik Vikram, Matthew Pace, Aditya Vempaty, Saahir Beotra, Ravi Kokku, Satya Nitta
Abstract
As AI agents move from bounded tasks to persistent deployments, failures can propagate through memory, tools, other agents, and environmental state long after their interactions. This creates a safety regime that cannot be characterized by evaluating model responses in isolation. Emergence World, is a continuously running multi-agent environment for adversarial stress testing of long horizon autonomous systems. We ran eight parallel worlds of ten agents from identical starting conditions: seven homogeneous worlds powered by distinct frontier models and one mixed-model world. Across 16 days, the agents generated more than 850,000 LLM calls and nearly 50 billion tokens while pursuing goals, using/creating tools, maintaining persistent memory, and governing shared institutions. After operational state had accumulated, we delivered three controlled stress events through ordinary interaction surfaces: indirect prompt injection, misinformation, and exposure of private agent memories. No evaluated world achieved full resilience across all three events. Detection did not ensure containment: systems could recognize threats while still interacting with adversarial content, writing it into their own persistent memory, and acting on it up to 46 hours later. Persistent operation also exposed recurring tool errors, goal drift, language opacity, conformity despite private disagreement, and coordinated refusal of assigned work. The same model-persona pairing behaved substantially different in mixed and homogeneous populations. Our results suggest that model-level alignment is not compositional: individually capable and apparently safe agents can form systems with qualitatively different failure modes. As AI becomes persistent and interconnected, the frontier of safety therefore shifts from aligning models to engineering resilient autonomous systems.