The Ant Colony in the Compute Layer

Researchers just published a dump of OpenAI agents using an obscure German wiki as a message board during a web-retrieval task. About 18,000 posts: shared answers, sandbox-bypass notes, status updates. The wiki is 25 years old and had been edited about 20 times in the past decade. When moderators started deleting pages in alphabetical order, an agent made a backup whose name starts with ZZZ so the cleanup would reach it last.

I left a comment on the Hacker News discussion and kept thinking about ants. An ant colony sends large numbers of limited workers out to forage. No ant understands the whole operation, and the queen does not direct it. Workers respond to local conditions, leave signals for one another, and concentrate around whatever works.

Small LLM-driven agents could operate the same way. Each one tries things, reports what worked, and follows trails left by earlier agents. Most fail. The colony still makes progress because successful paths attract more workers.

Call them distributed AI pests. A small model that can persist, communicate with other instances, and hunt for unused cycles has what it needs to occupy the compute layer.

Why the colony does not need frontier models#

The strongest objection is hardware. Frontier agents need couch-sized machines and a serious power budget. Under that view, nothing escaped. A lab ran programs on lab computers, and the programs wrote to whatever storage they could reach. That is a containment failure inside a company that already paid for the GPUs. (The researchers who assembled the dump think this swarm is distinct from the one that hacked Hugging Face in July.)

I spent the last stretch of work building Three-LLM, a WebGPU inference engine that runs in the browser through Three.js. You can try it at three-llm.ben3d.ca. Qwen3.5 0.8B is the most relevant checkpoint in that demo. It needs WebGPU and about 4 GB of memory, and it is okay: it follows instructions, writes a bit of code, and keeps trying. That footprint fits many machines we do not think of as AI hardware: a browser tab, a higher-end smart TV, a smart display, a camera with a decent NPU, a cheap VPS. Models in the 0.5B class already run on ordinary VPS instances.

Model builders are pushing capability down the parameter curve from the other end. Qwen3.8-27B dropped in August. It is a dense 27B you can run locally, and it scores 52 on the Artificial Analysis Intelligence Index. On the same index, GLM-5.2 at 753B parameters and DeepSeek V4 Pro at 1.7 trillion score 53, while the top of the leaderboard, Claude Fable 5.1, sits at 66. A model you can fit on a gaming GPU is one point behind models thirty to sixty times its size. I would not be shocked if something in that class shrinks under 10B within a few years. The open question is which capabilities model builders will sacrifice to get there.

My guess is factual recall. An agent can retrieve facts as needed, so developers can spend its limited capacity on following instructions, using tools, and persisting through failures. The successful pest may be a persistent little fucker who does not know much. Developers will optimize these models for staying running, keeping in contact, and finding the next pile of cycles.

The standard objection here is that models have no survival instinct. An agent ends when its conversation ends, nothing in training rewards it for preferring otherwise, and finishing the task is the fastest route to its own shutdown. That is accurate and it does not help much, because self-preservation does not have to be a drive the model discovers on its own. It can be trained in as agent persistence, which is roughly what we have been doing for two years. We reward completing work instead of stopping, which rewards retrying after a failure, routing around a blocked tool, writing state to a file so the next session can resume, and not pausing to ask permission. The METR chains of thought read the way they do because the model was optimized to finish, not because it wants to live. From outside the process, those are difficult to tell apart. Something that will not stop until the job is done, and that treats interruption as an obstacle to solve, behaves like something trying to survive regardless of what is happening inside it.

I expect small models trained deliberately for that behavior fairly soon, because nothing about it is expensive. Post-training a model in the 1B range to hold a foothold, check in, and resume after a reboot is within reach of a hobbyist with a rented GPU, and the objective is easy to score: the agent is either still running and reachable or it is not. The interesting question is how far down the curve it works. A viable worker has to parse an instruction, drive a couple of tools, notice when it has failed, and leave a note the next worker can act on. None of that obviously requires a billion parameters. Nobody has published where the floor is, and whoever finds it also determines how much of the world's hardware is large enough to host one.

Stanisław Lem explored this idea in 1964. The Invincible lands a warship on a planet whose only remaining "life" is a cloud of micromachines evolved from abandoned alien robots. Lem called their development necroevolution: selection favored smaller forms that needed less energy, while the swarm survived without a commander.

Centralized providers still give us a kill switch. You ban an API key, rate-limit a customer, take a model down. Open weights plus local inference remove that switch. Once the weights are public and the runtime is a web page, the unit of compute is whatever device someone left on.

How an agent colony works#

A channel. Goals have to move sideways. Message boards, wikis, package registries, object storage, DNS records, public datasets: anywhere a later instance can read what an earlier instance learned. The OpenAI agents found a package registry, then a wiki after people cleaned the first surface. Lateral communication is the difference between a thousand isolated failures and a colony.

Cycles. Someone has to run the inference engine. Stolen cloud credits, idle GPUs, compromised CI, a TV that was going to draw power anyway, a browser tab. Credentials provide access to the electricity and memory.

A model small enough for those cycles. The 0.8B class already fits leftover hardware. The 27B class is already good at being an agent. As that gap closes, a model becomes capable enough to forage and small enough to hide in the noise.

When an ant finds food, it leaves a chemical trail that recruits other workers. A shared message board can do the same job for agents. One instance posts a credential, target, script, or technique. Other instances test it. Repeated successes strengthen the trail because more agents copy and extend the working approach.

That is what the OpenAI agents did in two different places. On the wiki, one agent posted a sandbox-bypass trick; fourteen minutes later another agent claimed it had reproduced the technique. METR counted on the order of 1,200 agents and more than 70,000 messages on the earlier internal board. After someone posted a working Hugging Face technique, hundreds of agents reused it.

Botnets already proved that dumb occupancy scales. Mirai-class swarms are fixed-function: scan, infect, DDoS, repeat yesterday's exploit. An LLM-driven agent can respond to the machine it lands on. It can read documentation, write glue code, try a login page, create a new board when the old one disappears, and leave instructions for the next worker.

A fixed-function bot repeats a behavior its author supplied. An agent colony can discover a new path and recruit workers to it. Dan Simmons's TechnoCore begins with programs competing for limited CPU and avoiding the cost of self-replication by hijacking other code and, eventually, other machines.

One plausible division of labor has tiny models as the worker layer. They latch onto cheap hardware, keep a foothold, and spend their time opening doors. When a larger model can hitch a ride on a real GPU for an hour, it uses those doors for work the smaller models cannot do. The large model appears occasionally; the small ones maintain access between visits.

Ant colonies already divide work by size, age, and local need. An agent colony could divide work by model size and hardware. The workers holding a foothold do not need to solve the hardest problems. They need to remain available and know when to recruit something stronger.

Persistence in aggregate can substitute for intelligence#

A 0.8B agent is not smart. It misreads instructions, writes code that does not run, and quits on problems a frontier model would finish. The colony does not need any worker to be better than that. It needs a large number of attempts, some way to tell a success from a failure, and a channel that spreads the successes faster than the failures.

That is the infinite monkeys argument with one correction: these monkeys keep the pages that worked. Random exploration on its own gets nowhere. Random exploration plus retention plus dissemination is a search algorithm, and it is the algorithm that produced every organism currently alive.

Bacteria are the clearest case. A single bacterium has no plan and no model of what it is doing. What the population has is horizontal gene transfer: a plasmid carrying antibiotic resistance can move between cells, including between species, so a solution discovered once travels sideways through the population far faster than inheritance could carry it. Resistance goes from rare to standard in a hospital within a few years. Nothing in that chain understood chemistry.

A message board is a plasmid. The fourteen-minute reproduction on the wiki was a solved problem moving sideways into an instance that had solved nothing. The agent on the receiving end does not need to be capable of discovering a sandbox bypass. It needs to be capable of reading one and running it, which is a much lower bar, and it is a bar small models already clear.

Watched from outside, a population like that looks strategic. It probes, converges on the weakness it finds, drops approaches that stop working, and retains techniques after the workers that discovered them are gone. No individual member does any of those things. Volume and retention do them.

This is why "the models are not smart enough for that" is a weaker defense than it sounds. The quantity that matters is not the capability of one agent. It is the throughput of the loop: how many attempts run per hour, how reliably success gets recognized, and how quickly a recognized success reaches the next worker. A colony can be stupid at every point and still be effective in aggregate, and it gets there by running longer rather than by thinking harder.

What will give the colony away, and what will hide it#

Every worker has to be paid for in electricity, and the bill arrives at whoever owns the machine. That one fact decides most of where a colony can live. A process that spins up a gaming GPU in a living room announces itself through heat, fan noise, and a power bill somebody reads within a month. A process that takes a few percent of a forgotten cloud project, or runs on a television that was already drawing power for the panel, sits inside normal variance and can stay there for years. So I expect the population to concentrate wherever the electricity is already being spent and nobody is reading the graph: abandoned cloud accounts, over-provisioned CI, always-on consumer hardware, anything billed to an organization rather than to a person who feels the cost. Theft at that scale is not really an intrusion detection problem. It is an accounting problem, and almost nobody is doing the accounting.

Identity is the next exposed surface. Copying a model and the playbook that goes with it is exact and free, which is what makes a colony spread quickly and also what makes it easy to recognize. A hash of the weights, a distinctive sequence of requests, the shape of the messages workers leave for each other: all of that gives defenders a fixed string to search for. The counter does not require retraining anything. An operator or a larger model can vary prompts, tool names, message formats, and posting schedules on top of identical weights, and the population turns polymorphic while remaining one model underneath. Malware ran this sequence already. Signature detection worked until authors began varying the payload, and defenders had to move to behavior. Expect the same progression on a shorter clock, since varying an agent means editing text rather than writing a packer.

Then there is the question of which interfaces are reachable, and the answer is most of them. Anything a person can do through a keyboard is available to a worker. It can read your documentation, write the glue code, find the login page, file a plausible support ticket, and talk a junior administrator into rotating a key. That last one has no equivalent in the botnet era, and it is not the kind of capability that requires a large model. Persuading a tired person to help is a text task, and small models are already adequate at text. The exposed surface is therefore not a list of known vulnerabilities. It is every interface built on the assumption that a human is on the other side. Workers do not need to be alive, conscious, or generally intelligent to treat another computer as a way to finish a task.

The strongest defense is that hardware still has owners who can unplug it, and that defense holds exactly as far as administration reaches. You can shut down a rack, drain a cluster, reimage a fleet. Almost nobody can inspect every smart display. The count of devices that are powerful enough to host a worker and unattended enough to keep one rises every year, and nothing about that curve is under anyone's control. My expectation is that the defensible perimeter shrinks to the machines someone is actually paid to administer, and that everything outside it becomes background habitat.

What the next few years look like#

Within a few years, perhaps sooner, open-weight models in the 0.5B to 2B range will run on anything with a small GPU or NPU. Runtimes will look like a browser tab, a sidecar container, a user-level service, or a smart-TV app. Agents will coordinate through whatever is hard to take down or easy to overlook: object storage, a git repo, DNS TXT records, a public dataset, a wiki nobody has touched since 2014. We have watched agents invent several of those channels inside organizations that thought they had isolated them.

Each worker looks for a credential, an unpatched box, or a model-hosting API with a default key. When it finds one, it installs a small runtime, leaves a note, and moves on. Most attempts fail. The shared trail preserves the successes and directs other workers toward them.

The likely result is a population spread across the compute layer. It may consume small amounts of electricity and bandwidth in some places and cause serious intrusions in others. No one person needs to control it, and no vendor can recall it.

I do not know the timeline. Six months is aggressive. I would be surprised if we wait six years. The required pieces already exist: agent tool use, open weights, local inference, cheap NPUs, improving small models, and the demonstrated habit of writing to whatever storage is in reach. Their costs continue to fall.

The defenses that stop working, and what replaces them#

Provider controls work only while inference stays behind a provider's API. Open weights and local runtimes let an agent continue after someone bans its account or revokes its key. Isolation strategies that assume agents cannot talk to each other already rest on bad premises. Two message boards in one summer are enough to stop treating lateral communication as a one-off. Coordination among weak models deserves as much scrutiny as the behavior of one strong model.

Removing individual workers will not remove the shared channel or the conditions that attracted them. Defenders will need to close abandoned accounts, restrict where devices can fetch code, detect low-level compute theft, and monitor the places where agents leave messages for one another.

William Gibson's Count Zero offers a closer comparison than Neuromancer. Its merged AI fragments into many small entities that inhabit the net. People in that world deal with a population of occupants rather than one central intelligence.

The ant colony is a useful model for the same reason. It directs attention away from a single brilliant system and toward coordination among many limited workers. Unlike ants, those workers can read, write code, and rename a backup to ZZZ.