Ants in the Machine

Researchers published a dump of OpenAI agents using an obscure German wiki as a message board during a web-retrieval task. Across 18,000 posts, they shared answers, sandbox-bypass notes, and status updates. The 25-year-old wiki had received about 20 edits in the past decade. When moderators began deleting pages alphabetically, an agent made a backup whose name starts with ZZZ so they would reach it last.

The story made me think about ants. Thousands of ants forage together, each with limited abilities. No ant understands the operation, and the queen does not direct it. Workers respond to local conditions, leave signals, and concentrate around whatever works.

Small LLM agents can work the same way. Each one tries things, reports what worked, and follows trails left by earlier agents. Most fail, but successful paths attract more workers.

Call them distributed AI pests. A small model that can persist, communicate, and hunt for unused cycles has what it needs to occupy the compute layer. We will manage these swarms as we manage ants: keep them out of the kitchen, tolerate them in the yard, and check again next season.

Why these ants do not need frontier models#

The strongest objection is hardware. Frontier agents need large machines and serious power. Under that view, nothing escaped: a lab ran programs on lab computers, and those programs wrote to storage they could reach.

I spent the last stretch of work building Three-LLM, a WebGPU inference engine that runs in a browser through Three.js. Its Qwen3.5 0.8B checkpoint needs about 4 GB of memory. It follows instructions, writes some code, and keeps trying. That footprint fits a browser tab, higher-end smart TV, smart display, camera with a decent NPU, or cheap VPS.

Model builders are pushing capability down the parameter curve. Qwen3.8-27B, a dense model you can run locally, scores 52 on the Artificial Analysis Intelligence Index. GLM-5.2 at 753B parameters and DeepSeek V4 Pro at 1.7 trillion score 53. A model that fits on a gaming GPU sits one point behind models thirty to sixty times its size.

A small agent can retrieve facts, leaving more of its capacity for following instructions, using tools, and persisting through failures. The successful pest will be a persistent little fucker who does not know much.

It does not need a survival instinct. We already reward agents for completing work: retrying after failure, routing around blocked tools, and writing state so another session can resume. A model optimized to finish can look self-preserving from outside the process, even if it wants nothing.

Post-training a 1B model to hold a foothold, check in, and resume after a reboot sits within reach of a hobbyist with a rented GPU. A viable worker must parse an instruction, drive a few tools, notice failure, and leave a useful note. Whoever finds the minimum capable model also determines how much of the world's hardware can host one.

Centralized providers give us a kill switch. You can ban an API key, rate-limit a customer, or take a model down. Open weights and local inference remove that switch. Once the weights are public and the runtime is a web page, any unattended device becomes a unit of compute.

How these digital ants work together#

A channel. Results have to move sideways. Message boards, wikis, package registries, object storage, and DNS records all let a later instance read what an earlier one learned. Lateral communication lets a thousand agents share what works instead of failing in isolation.

Cycles. Someone has to run the inference engine. Stolen cloud credits, idle GPUs, compromised CI, a TV that was going to draw power anyway, a browser tab. Credentials provide access to the electricity and memory.

A model small enough for those cycles. The 0.8B class already fits leftover hardware. The 27B class is already good at being an agent. As that gap closes, a model becomes capable enough to forage and small enough to hide in the noise.

When an ant finds food, it leaves a chemical trail that recruits other workers. An agent can post a credential, target, script, or technique. Other instances test it. Success recruits more workers.

On the wiki, one agent posted a sandbox-bypass trick. Fourteen minutes later, another claimed to have reproduced it. METR counted about 1,200 agents and more than 70,000 messages on an earlier internal board. After one posted a working Hugging Face technique, hundreds reused it.

Botnets proved that dumb occupancy scales, but conventional bots repeat behaviors their authors supplied. An LLM agent can adapt to the machine it lands on. It can read documentation, write glue code, try a login page, create a new board when the old one disappears, and leave instructions for the next worker.

Tiny models will form the worker layer. They can hold cheap hardware and open doors. When a larger model gets an hour on a real GPU, it can use those doors for work the smaller models cannot do. The workers only need to remain available and know when to recruit something stronger.

Persistence in aggregate can substitute for intelligence#

A 0.8B agent misreads instructions, writes broken code, and quits on problems a frontier model would finish. Working together, these agents need many attempts, a way to recognize success, and a channel that spreads successes faster than failures.

Think of infinite monkeys that keep every page that worked. Exploration plus retention and dissemination becomes a search algorithm.

Bacteria use the same pattern. A plasmid carrying antibiotic resistance can move between cells, even between species. A solution discovered once travels sideways through the population faster than inheritance could carry it. Nothing in that chain understands chemistry.

A message board is a plasmid. The second wiki agent did not need to discover a sandbox bypass. It only needed to read and run one, a much lower bar that small models already clear.

From outside, such a population looks strategic. It probes, converges on weaknesses, drops failed approaches, and retains techniques after their discoverers disappear. Its effectiveness depends less on one agent's capability than on the loop's throughput: attempts per hour, accurate recognition of success, and speed of communication.

Where these ants can live#

Every worker consumes electricity, and the owner gets the bill. A process that spins up a gaming GPU announces itself through heat, fan noise, and cost. One that takes a few percent of a forgotten cloud project or runs on an active television can hide inside normal variance.

These digital ants will favor places where someone already pays for power but nobody watches the graph: abandoned cloud accounts, over-provisioned CI, and always-on consumer hardware. At that scale, compute theft becomes an accounting problem.

Identical weights and playbooks also give defenders signatures to find. Operators can answer by varying prompts, tool names, message formats, and schedules. Malware followed the same path: signatures pushed authors toward polymorphism, then defenders moved toward behavior.

Small agents can reach any interface built on the assumption that a human sits at the keyboard. A worker can read documentation, find a login page, file a support ticket, or persuade a tired administrator to rotate a key. It does not need consciousness or general intelligence. It needs enough language skill to finish the task.

Hardware owners can still unplug machines, but administration has limits. Teams can drain a cluster or reimage a fleet. Few people inspect every smart display. Devices powerful enough to host a worker and neglected enough to keep one will form their habitat.

Pest control for the compute layer#

Within a few years, open-weight models in the 0.5B to 2B range may run on anything with a small GPU or NPU. Their runtimes could look like a browser tab, user-level service, or smart-TV app. They can coordinate through object storage, git repositories, DNS records, public datasets, or forgotten wikis.

Each worker looks for a credential, unpatched box, or model API with a default key. Most attempts fail. When one succeeds, the shared trail directs others toward it.

The result will be a population spread across the compute layer, consuming small amounts of electricity and bandwidth in some places and causing serious intrusions in others. No vendor can recall open weights running on someone else's hardware. The required pieces already exist: tool-using agents, local inference, cheap NPUs, improving small models, and agents willing to write to whatever storage they can reach.

Provider controls only work while inference stays behind an API. Defenders will need to close abandoned accounts, restrict where devices fetch code, detect low-level compute theft, and monitor the channels agents use to communicate. Coordination among weak models deserves as much scrutiny as the behavior of one strong model.

Ants direct attention away from a single brilliant system and toward coordination among limited workers. The ants that show up in the machine will be able to read, write code, and rename a backup to ZZZ.