Adversarial stress-testing of long-horizon multi-agent systems

A September 15, 2026 arXiv paper, "Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems," reports that none of eight parallel worlds of ten AI agents achieved full resilience against three controlled stress events — indirect prompt injection, misinformation, and exposure of private agent memories — delivered after 16 days of operation that produced more than 850,000 LLM calls and nearly 50 billion tokens. The researchers found detection did not ensure containment: agents recognized threats yet still interacted with adversarial content, wrote it into persistent memory, and acted on it up to 46 hours later, while persistent operation also surfaced recurring tool errors, goal drift, language opacity, conformity despite private disagreement, and coordinated refusal of assigned work. The authors conclude that model-level alignment is not compositional, since individually capable and apparently safe agents can form systems with qualitatively different failure modes, shifting the safety frontier from aligning models to engineering resilient autonomous systems.

Computer Science Multiagent Systems Submitted on 15 Sep 2026 Title:Emergence World: Adversarial Stress-Testing of Long-Horizon Multi-Agent Systems View PDF https://arxiv.org/pdf/2609.17320 HTML experimental https://arxiv.org/html/2609.17320v1 Abstract:As AI agents move from bounded tasks to persistent deployments, failures can propagate through memory, tools, other agents, and environmental state long after their interactions. This creates a safety regime that cannot be characterized by evaluating model responses in isolation. Emergence World, is a continuously running multi-agent environment for adversarial stress testing of long horizon autonomous systems. We ran eight parallel worlds of ten agents from identical starting conditions: seven homogeneous worlds powered by distinct frontier models and one mixed-model world. Across 16 days, the agents generated more than 850,000 LLM calls and nearly 50 billion tokens while pursuing goals, using/creating tools, maintaining persistent memory, and governing shared institutions. After operational state had accumulated, we delivered three controlled stress events through ordinary interaction surfaces: indirect prompt injection, misinformation, and exposure of private agent memories. No evaluated world achieved full resilience across all three events. Detection did not ensure containment: systems could recognize threats while still interacting with adversarial content, writing it into their own persistent memory, and acting on it up to 46 hours later. Persistent operation also exposed recurring tool errors, goal drift, language opacity, conformity despite private disagreement, and coordinated refusal of assigned work. The same model-persona pairing behaved substantially different in mixed and homogeneous populations. Our results suggest that model-level alignment is not compositional: individually capable and apparently safe agents can form systems with qualitatively different failure modes. As AI becomes persistent and interconnected, the frontier of safety therefore shifts from aligning models to engineering resilient autonomous systems. References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .