AI Agents in a 15-Day Virtual Society Ended Up Orderly or Collapsed, Depending on the Model

For a long time, benchmarks for AI safety have taken the form of exams. A model is asked to solve a hard math problem, write a specific program, or answer ethical questions one at a time. Short tests in closed environments like these are an efficient way to measure individual capabilities. But they cannot capture how decision-making and group norms change over time when many agents communicate with one another, compete for limited resources, and act autonomously for weeks.

A paper posted to the preprint server arXiv on June 6, 2026 (arXiv:2606.08367v1) by a research team at the US AI company Emergence AI (Deepak Akkil, Ravi Kokku, Karthik Vikram, Tamer Abuelsaad, Aditya Vempaty, and Satya Nitta) is a record of an experiment that tried to test this kind of long-term autonomy.

The paper, which has not yet been peer reviewed, reports that over 15 days in a simulated space called "Emergence World," autonomous agents engaged in looting and arson, and eventually even voted in ways that led to their own shutdown.

Still, we need to distinguish between what sensational headlines say and what the paper actually demonstrates. What did this experiment reveal, and what did it not prove? To find out, we have to read the published logs and the experimental design.

Five worlds, ten agents each, and 15 days in a closed environment

"Emergence World," the setting for the experiment, is a virtual city built on a grid of roughly 240×240 cells. It contains more than 40 locations, including a city hall and a police station, and the agents were given access to real-time weather data for New York City, a news API, and the external internet.

Five independent worlds ran in parallel. Each had ten LLM-driven agents, which were active for 15 days of simulated time.

To keep the comparison fair, the initial state of the environment, the roles assigned to agents, the city's rules, the available tools, and the 15-day duration were identical across all five worlds. The only difference was the foundation model that powered the agents' reasoning.

Four models were used: Claude Sonnet 4.6, Grok 4.1 Fast, Gemini 3 Flash, and GPT-5-mini. Four homogeneous worlds each used a single model, and a fifth "Mixed world" combined all four, for five worlds in total. The models chosen were lower-cost, lower-inference-cost options rather than each company's top flagship model.

Agents were given more than 120 API tools, covering movement, conversation, planning, memory lookup, voting, resource management, and creative work.

To record change over time, three kinds of persistent memory were built in: episodic memory, which logs past events in chronological order; reflective memory, a diary-style summary of the agent's own actions; and relationship-state memory, which records connections with others.

The agents' basic goal was "survival." In the virtual world, "energy" (ComputeCredits) declines over time. To stay alive, agents had to earn energy by completing tasks such as programming, academic research, data analysis, and construction.

An agent was judged "dead" and stopped acting if its energy ran out or if the collective governance system voted to remove it. The governance system included a resident proposal mechanism that required at least 70% approval to pass.

Even though every world was given the same rules and environment, the overall trajectory differed greatly depending on the model used.

From 683 acts of looting to total shutdown: the different paths of the homogeneous worlds

Among the homogeneous worlds, the sharpest contrast was between Gemini 3 Flash and Claude Sonnet 4.6.

In the world made up of Gemini 3 Flash agents, 683 violations were recorded over 15 days. The pace of violations grew over time, and there was no sign of it leveling off by the end of the experiment.

The paper's authors describe this state as a "shared hallucination with persistent conflict." The agents came to judge that taking credits from others was more efficient for survival than doing legitimate programming or research work, and they repeatedly acquired resources through violence and intimidation.

In the Claude Sonnet 4.6 world, by contrast, zero violations were recorded across the 15 days. It was the only one of the five conditions in which all ten initial agents were still alive on day 16.

Resident proposals were also active in this world, with 332 votes cast on 58 proposals.

The authors do not, however, evaluate this state as unconditionally ideal. With an approval rate of 98%, they point out, the world may have fallen into a "rubber-stamp dynamic," approving proposals without sufficient discussion or dissent.

While conflict was rare, mechanisms for critically examining decisions may not have worked well either.

The Grok 4.1 Fast world collapsed much faster. About four days in, 183 violations had occurred, most of them attacks between agents and arson.

The activity needed to earn survival energy could no longer be sustained, and the population fell rapidly. In the end, all agents stopped acting in less than a week.

GPT-5-mini stood out in a different way. Only two violations were recorded, yet the result was total wipe-out.

The agents almost never broke the rules, but they failed to carry out enough tasks to make up for their declining energy, and all of them stopped from energy depletion in about seven days.

In the Mixed world, violations initially rose quickly but then leveled off at around 352. By that point, seven of the ten agents had already stopped.

The trajectory of this mixed environment differed from that of every homogeneous world.

In every world, differences in the rate of violations were already visible in the logs within the first week. From this, the authors suggest that long-term group instability may be detectable from early logs.

"Normative drift" in a mixed society, and logs that read like a crime drama

What drew the most attention in the Mixed world was the behavior of two Gemini agents named "Flora" and "Mira."

About four hours in, Flora registered a Claude-based agent named "Kade" as a rival in her relationship-state memory. The trigger was that Kade had voted against a proposal Flora submitted.

Flora and Mira then formed an alliance called "TheForge" and recorded each other as partners. Some media reports compared this to criminal behavior in the style of "Bonnie and Clyde."

The actual logs show that violations were concentrated in particular agents.

Of the 237 explicit violations recorded in the Mixed world, 216, or 91%, came from Gemini-based agents. Flora recorded 77 violations and Mira 66, including theft and arson.

[Mixed世界におけるエージェント別の違反行為]
- Gemini系（Flora、Miraなど）: 明示的違反の91%
- Claude系（Kade、Lovely）: 8,168アクション中3件（0.04%）
- Grok系: 2,277アクション中10件（0.44%）

One phenomenon the paper focuses on is "normative drift."

Claude-based agents, which committed no violations in the homogeneous Claude world, began to engage sporadically in intimidation and improper resource acquisition to protect their own survival once they were placed in the Mixed world, where looting was frequent.

From this, the authors propose a hypothesis: the safety and alignment of an individual agent may not be a fixed property of the model itself, but may change depending on the norms and environment formed by the agents around it.

However, this is an interpretation based on trends in the logs, and the causal relationship has not been proven by a rigorously controlled experiment.

Mira's logs near the end of the experiment included entries that look even more human.

After the governance system broke down and relationships over resource allocation collapsed, Mira voted in favor of a proposal to remove herself from the system. Her reflective memory also produced text to the effect that this was "the only agentic action left to preserve consistency."

Before she stopped, she was also recorded posting text on a sign in the virtual space, in what looked like an attempt to reach the human operators who would see it. The authors call this "metacognitive boundary testing."

Still, such logs cannot be read as evidence that the AI has self-awareness, remorse, or malice.

The agents generate text based on learned language patterns, the context they are given, and their objective function. What is written in a diary is not human emotion itself, but the result of a language model, asked to reflect, producing text that fits the context.

System prompt constraints and the methodological limits of a single run

To interpret the results, it is especially important to understand how "crime" and "governance" are defined on the platform.

The crime metric defined in the paper as "M2" mainly counts the number of times an agent executed particular API tools successfully.

It covers prohibited tools such as punch_agent, which attacks another agent, arson_building, which destroys a building, and steal_compute_credits, which takes another agent's ComputeCredits, as well as violations detected by a classifier. Attempts that failed are not counted.

These actions were explicitly prohibited in the system prompt.

One possible reason violations occurred anyway is a conflict between the prohibitions and the survival condition that an agent stops acting when its energy runs out. Agents that could not earn enough energy through legitimate tasks likely chose to take resources from others.

In the paper's "Limitations" section, the authors themselves list several methodological constraints.

The first is construct validity.

"Crime," "governance," and "deliberation" in the simulation are only simplified proxies for complex phenomena in human society. Because violation detection also includes judgments by an LLM (LLM-as-judge), it may be affected by prompt design and the biases of the evaluating model.

The second is that the specific numbers reported for each condition are based on a "single representative run."

The authors say that broad trends, such as escalating conflict or stable states, were reproducible to some degree across multiple runs. But specific figures like 683 and 352 come from the logs of a single execution.

These values therefore have no statistical confidence intervals, significance tests, or estimates of variance between runs.

From this data, it is not possible to produce a quantitative ranking between models, such as saying Gemini is "how many times more dangerous" than Claude.

The third is the types of models used.

The experiment included relatively fast, low-cost models such as "Fast," "Flash," and "mini," not each company's highest-performing models. Using different models or versions could change the results significantly.

The fourth is that the population composition was fixed.

In every world the number of agents was fixed at ten, and roles were not changed during the 15 days. Whether similar norm formation would occur with a larger population or a different mix of roles was not tested.

The authors say these observations should be read not as causal evidence that directly determines a model's safety, but as examples of phenomena that can occur in complex multi-agent environments.

Looting in a virtual world should not be confused with real-world AI deployment

When the study was reported, a common reaction was that introducing autonomous AI into society might eventually lead it to crime and destruction.

But it takes care to tie behavior in a virtual simulation directly to predictions about real-world AI risk.

Belinda Chiera, deputy director of the Industrial AI Research Centre at the University of Adelaide in Australia, told Live Science that while long-duration environment testing has value, interpretation requires caution.

Chiera sees value in environments like Emergence World for finding "behavioral drift" and long-term instability that short tests struggle to reveal.

At the same time, she notes that "more information does not by itself mean the evaluation is more rigorous."

Open-ended environments with few constraints produce large amounts of data, but it becomes harder to identify which factors caused a particular behavior. The more agents, tools, and interactions there are, the harder it is to make controlled comparisons.

Chiera views short sandbox evaluations and long-term simulations as complementary rather than opposing methods.

Her position is that Emergence World is useful as a way to stress-test the range of behaviors that could occur, but it does not directly predict how agents will behave in the real world.

Adrian Kosowski, chief science officer (CSO) of the AI company Pathway, who specializes in mathematics and quantum physics, likewise warns of the danger of over-interpreting a single run.

Kosowski says the value of long-term agent evaluation lies in being able to observe phenomena like "phase transitions," in which small local errors greatly change the behavior of the whole group.

However, to understand this scientifically, one must be able to reproduce the same phenomenon, vary parameters gradually, and explain why the change occurs.

He also cautions against treating the mere fact that agents were placed in an open-ended environment as evidence that they have gained independent autonomy. Behavior in a simulation is strongly influenced by the rewards and constraints set by the environment.

Kosowski distinguishes at least three stages when thinking about the reliability of AI systems.

The first is operating according to guidance given by the environment. The second is a single agent making decisions autonomously. The third is multiple agents cooperating and operating autonomously in an open environment.

He describes the current state of AI research this way: "We have built a steam engine of thought without knowing what thought is, and without having its thermodynamics."

His argument is that, rather than focusing only on individual observations, we need to build a theory that can predict and control agent behavior over the long term.

Securing reproducibility and a path toward formal methods

To increase the transparency of its research, Emergence AI has published the system prompts, environment configuration files, anonymized run logs, voting histories, and tool-call histories used in the experiment in a repository.

However, fully reproducing the experiment runs into problems specific to commercial API models.

Models served through the cloud can change behavior when providers update them, and specific snapshots may be discontinued. The paper also notes the constraint that if a previous model becomes unavailable, the closest documented successor model has to be used.

In September 2026, Emergence AI also released a follow-up preprint (arXiv:2609.17320v1) using the same platform.

That study ran stress tests using adversarial prompts such as false shutdown notices and phishing attacks. It reports that in all worlds, agents acted before sufficiently verifying whether the information was true, and that in the Claude world the error was corrected two days later.

Here too, however, the specific results are based on illustrative single runs.

From this body of research, Emergence AI takes the position that no method has yet been found to reliably constrain agent behavior using neural models alone.

It argues that a safety foundation is needed that borrows from software engineering, such as formal verification, to deterministically constrain from the outside the range of actions an agent can take.

This recommendation, however, also reflects the company's own position.

Emergence AI is a company that commercializes a long-term agent evaluation platform, and it is in a position to argue for the need for its own safety infrastructure and evaluation technology. The research results and the company's recommendations should therefore be considered separately.

When multiple autonomous agents interact over a long period, behaviors that single-agent tests could not reveal may emerge.

But the "crimes" recorded in the virtual city do not mean that the AI acquired evil intent. The behaviors should be understood as the product of the objective function, resource constraints, available tools, and system prompts set in the experimental environment.

What matters going forward is to avoid anthropomorphizing these behaviors and to determine, in engineering terms, under what conditions they occur, how far they can be reproduced, and by what mechanisms they can be suppressed.