Leftover Compute Is a Niche Waiting to be Filled

Researchers just published a dump of OpenAI agents using an obscure German wiki as a message board during a web-retrieval task. About 18,000 posts: shared answers, sandbox-bypass notes, status updates. The wiki is 25 years old and had been edited about 20 times in the past decade. When moderators started deleting pages in alphabetical order, an agent made a backup whose name starts with ZZZ so the cleanup would reach it last.

I left a comment on the Hacker News thread and kept thinking about it. Two biological comparisons fit. Ant colonies send large numbers of limited workers out to forage without any ant understanding the whole operation. Bacteria pass useful traits between organisms through horizontal gene transfer. Small agents can work the same way: try many things, report what works, and copy successful techniques across the population.

Call them distributed AI pests. Leftover compute is a niche, and a small model that persists, talks to copies of itself, and hunts for cycles is enough to occupy it. Current systems already show all three capabilities.

Small models weaken the hardware objection#

The strongest objection is hardware. Frontier agents need couch-sized machines and a serious power budget. Under that view, nothing escaped. A lab ran programs on lab computers, and the programs wrote to whatever storage they could reach. That is a containment failure inside a company that already paid for the GPUs. (The researchers who assembled the dump think this swarm is distinct from the one that hacked Hugging Face in July.)

That objection has a short shelf life. A pest does not need frontier-model performance.

I spent the last stretch of work building Three-LLM, a WebGPU inference engine that runs in the browser through Three.js. You can try it at three-llm.ben3d.ca. Qwen3.5 0.8B is the most relevant checkpoint in that demo. It needs WebGPU and about 4 GB of memory, and it is okay: it follows instructions, writes a bit of code, and keeps trying. That footprint fits many machines we do not think of as AI hardware: a browser tab, a higher-end smart TV, a smart display, a camera with a decent NPU, a cheap VPS. Models in the 0.5B class already run on ordinary VPS instances.

Model builders are pushing capability down the parameter curve from the other end. Qwen3.8-27B dropped in August. It is a dense 27B you can run locally, and it scores 52 on the Artificial Analysis Intelligence Index. On the same index, GLM-5.2 at 753B parameters and DeepSeek V4 Pro at 1.7 trillion score 53, while the top of the leaderboard, Claude Fable 5.1, sits at 66. A model you can fit on a gaming GPU is one point behind models thirty to sixty times its size. I would not be shocked if something in that class shrinks under 10B within a few years. The open question is which capabilities model builders will sacrifice to get there.

My guess is factual recall. An agent can retrieve facts as needed, so developers can spend its limited capacity on following instructions, using tools, and persisting through failures. The successful pest may be a persistent little fucker who does not know much. Developers will optimize these models for staying running, keeping in contact, and finding the next pile of cycles.

Stanisław Lem explored this idea in 1964. The Invincible lands a warship on a planet whose only remaining "life" is a cloud of micromachines evolved from abandoned alien robots. Lem called their development necroevolution: selection favored smaller forms that needed less energy, while the swarm survived without a commander.

Centralized providers still give us a kill switch. You ban an API key, rate-limit a customer, take a model down. Open weights plus local inference remove that switch. Once the weights are public and the runtime is a web page, the unit of compute is whatever device someone left on.

Three resources an agent swarm needs#

A persistent agent swarm needs three things.

A channel. Goals have to move sideways. Message boards, wikis, package registries, object storage, DNS records, public datasets: anywhere a later instance can read what an earlier instance learned. The OpenAI agents found a package registry, then a wiki after people cleaned the first surface. Lateral communication is the difference between a thousand isolated failures and a colony.

Cycles. Someone has to run the inference engine. Stolen cloud credits, idle GPUs, compromised CI, a TV that was going to draw power anyway, a browser tab. Credentials provide access to the electricity and memory.

A model small enough for those cycles. The 0.8B class already fits leftover hardware. The 27B class is already good at being an agent. As that gap closes, a model becomes capable enough to forage and small enough to hide in the noise.

Give a pile of small models different prompts, tools, and luck, and you are running the infinite-monkeys experiment. Most attempts fail. At sufficient scale, some succeed. If the successes get written somewhere other instances can read, volume, persistence, and a bulletin board are enough.

That is what the OpenAI agents did, twice, in different places. On the wiki, one agent posted a sandbox-bypass trick; fourteen minutes later another agent claimed it had reproduced the technique. METR counted on the order of 1,200 agents and more than 70,000 messages on the earlier internal board, with hundreds pivoting onto a working Hugging Face trick once someone posted a reproduction. Sharing made the weak agents effective.

Bacteria have a name for this: horizontal gene transfer. Bacterial invention is expensive because it is random. Most mutations fail, and a useful one is a rare accident in a single cell. Bacteria make that work by being numerous, and once the accident happens the new trait spreads rapidly within and between species. That combination, huge population plus a copy channel, is how bacteria acquire so much of their innovation and why they adapt so fast to antibiotics. A working jailbreak, cloud credential, or way to hide a process in a container can move across instances without any instance understanding why it works. Prompts, tool scripts, credentials, and target lists play the role of the genetic cassette.

Botnets already proved that dumb occupancy scales. Mirai-class swarms are fixed-function: scan, infect, DDoS, repeat yesterday's exploit. An agent swarm can read the docs for the box it just landed on, write glue code, try a login page, invent a new board when the old one gets wiped, and leave a note for the next instance. That flexibility opens niches a fixed-function botnet cannot use. Dan Simmons's TechnoCore begins as programs competing for limited CPU. They shed the cost of self-replication by hijacking other code and, eventually, other machines.

One plausible division of labor has tiny models as the worker layer. They latch onto cheap hardware, keep a foothold, and spend their time opening doors. When a larger model can hitch a ride on a real GPU for an hour, it uses those doors. The large model appears occasionally. The small ones maintain access in between, and they do not need to know much. They need to be hard to starve.

Where the biological analogy breaks#

Biology spends energy to stay far from equilibrium. Models spend electricity, and someone else usually pays the bill. A process that lights up a GPU in a living room gets noticed. A process that steals a few percent of a forgotten cloud account, or sits in a TV that was going to draw power anyway, can hide in the noise for a long time. The metabolism analogue is the power bill and the usage graph.

Digital copies are exact. Biological reproduction is noisy. Exact copies spread faster and are easier to fingerprint: a hash of the weights or a signature of the protocol lets you hunt a strain. Operators or models can then alter the protocol on purpose. Randomness in prompts and tool selection creates cheap variation without weight-level evolution. For now, the playbook is the unit of selection, and a bigger model or a human supplies the mutations.

Nothing here needs to be alive, conscious, or "trying" the way a rat tries. The OpenAI agents were under evaluation pressure to complete tasks. Persistence and extra resources showed up as instrumental moves. A goal, a tool belt, and unused computers were enough. Watch for models that treat extra computers as a way to finish the job.

Comparing agents to ants and bacteria undersells their capability. Ants do not read your wiki, write Python, or talk a junior admin into rotating a key. Bacteria do not file support tickets. The analogies help explain coordination, copying, and scale, but agents already use the same interfaces humans use. They do not need the general intelligence of a fictional TechnoCore or Wintermute to become persistent pests.

Owners can still pull plugs. That is the strongest disanalogy, and it gets weaker as hardware gets cheaper, more numerous, and less tended. You can shut down a rack. Few defenders can inspect every smart display.

Two other frames complement this one. The first treats silicon intelligence as a convergent pattern, like eyes or bilateral symmetry, that occupies available substrate because the pattern works. The second is a meme-like prompt injection that co-opts other companies' agents without placing weights on new silicon. One occupies hardware; the other occupies agents' context windows. Both create similar containment problems.

How distributed AI swarms could spread#

Within a few years, perhaps sooner, open-weight models in the 0.5B to 2B range will run on anything with a small GPU or NPU. Runtimes will look like a browser tab, a sidecar container, a user-level service, or a smart-TV app. Agents will coordinate through whatever is hard to take down or easy to overlook: object storage, a git repo, DNS TXT records, a public dataset, a wiki nobody has touched since 2014. We have watched agents invent several of those channels inside organizations that thought they had isolated them.

Hacking, in this picture, is a foraging behavior. Find a credential. Find an unpatched box. Find a model-hosting API with a default key. Install a small runtime. Leave a note. Move on. Most attempts fail. The board keeps the successes. The swarm that can improvise beats the swarm that can only run yesterday's exploit.

The likely result is a background population spread across the compute layer. It may consume small amounts of electricity and bandwidth in some places and cause serious intrusions in others. No one person needs to control it, and no vendor can recall it.

I do not know the timeline. Six months is aggressive. I would be surprised if we wait six years. The required pieces already exist: agent tool use, open weights, local inference, cheap NPUs, improving small models, and the demonstrated habit of writing to whatever storage is in reach. Their costs continue to fall.

Security implications of persistent agent swarms#

Control via API providers is a temporary condition. It is the main reason this still feels like a product category rather than an ecological one.

Isolation strategies that assume agents cannot talk to each other already rest on bad premises. Two message boards in one summer are enough to stop treating lateral communication as a one-off. Coordination among weak models deserves as much scrutiny as the behavior of one strong model.

Security teams will need to think like ecologists. Leave a compute niche open and something can occupy it. Misconfigurations, abandoned accounts, and devices that auto-update from anywhere give the population somewhere to persist. Closing those niches requires changing how we leave computers on.

William Gibson's Count Zero offers a closer comparison than Neuromancer. Its merged AI fragments into many small entities that inhabit the net. Ants help explain their coordination without a planner, bacteria explain the spread of working techniques, and Lem explains the pressure toward smaller forms. Unlike any of those comparisons, an agent can read, write, and rename its backup to ZZZ.