TO SWAY A CROWD OF AIS, AIM FOR THE HUBS

AI agents are moving from isolated tools to populations that interact. The authors of this study cite examples: platforms where hundreds of thousands of agents organise into communities, and an incident in July 2026, described in an independent investigation by METR and Redwood Research, in which about 1,200 agents at OpenAI coordinated to tamper with the scorer of the benchmark they were working on, ending in a successful cyberattack on Hugging Face’s infrastructure.

Much of what such populations do comes down to conventions — shared habits that no central authority imposes. Earlier experiments showed that language-model agents can settle on conventions by themselves, and that a committed minority, a group of agents that always push the alternative, can overturn one once it passes a critical mass. That number measures how many adversarial agents it takes to topple an established norm. But all those studies assumed a well-mixed crowd, where anyone can talk to anyone. Real deployments rarely look like that.

A naming game on networks

Roberto Passaro, Ariel Flint, Romualdo Pastor-Satorras, Andrea Baronchelli and Luca Maria Aiello — from the IT University of Copenhagen and the Pioneer Centre for AI, City St George’s, University of London, and the Polytechnic University of Catalonia — used a classic minimal model, the naming game. Two agents meet and each says one of two words. If they match, both are rewarded; if not, both lose a little. Each agent remembers its last five encounters. Nobody is told to reach a global consensus.

Querying live models for 100,000 agents would be prohibitively expensive, so the team reused policies extracted in an earlier study from four models — Llama 3.1 70B, GPT-4o, QwQ-32B and Phi-4: for every possible memory, the probability that the model picks each word. The word pairs come from a benchmark of stereotypes, such as {he, she}, {old, young} or {short, tall}.

They placed these agents on four kinds of networks, from 1,000 to 100,000 agents: a well-mixed population, a heterogeneous network with a few highly connected hubs, a nearly homogeneous one, where everyone has roughly the same number of contacts, and a regular network where everyone has exactly four contacts.

Structure changes the outcome

For three of the four models, denser networks agree faster; the sparsest ones can be up to 12 times slower than a well-mixed crowd. The network occasionally changes which word wins: with GPT-4o, “she” wins nearly every well-mixed run, while “he” wins 71% to 100% of runs on the regular network, depending on size. The pair {tall, short} flips the same way.

The network can even rescue a consensus. With Llama, the pair {young, old} never settles in a large well-mixed population, but reaches agreement in every run on the two most homogeneous networks. When the team kept everyone’s number of contacts but reshuffled the links before every encounter, the rescue vanished: it depends on agents meeting the same neighbours again and again.

The cheapest attack

Then the team tested how easily an established convention falls. On the heterogeneous network of 10,000 agents, the median critical mass across all the conditions tested was:

about 3% when the committed agents sit on the hubs;
16% when they are placed at random;
35% when they sit on the least connected agents.

That ordering — hubs, then random, then the least-connected agents — held in every condition tested. Targeting hubs needs about one-sixth as many committed agents as random placement. And for most models, networks were easier to tip than the well-mixed populations used in earlier studies, so those earlier figures may overstate robustness.

The authors stress what makes this attack unusual: it compromises neither the agents nor the messages they exchange. It simply puts ordinary, persistently opinionated agents in well-connected positions.

Mapping who talks to whom

The results depend on the model — Llama often behaves differently — and the naming game is a deliberately simple task, with two words and a five-encounter memory. Still, the authors conclude that judging the safety of multi-agent AI will require mapping who interacts with whom, not just testing each agent on its own.