AI swarms

What is an AI swarm?

An AI swarm is a group of AI agents, often copies of the same model, working on one job at the same time. Usually a lead agent splits the job into parts, hands them out, and puts the results together. Moonshot AI’s Kimi K2.6 can run 300 of these sub-agents at once.

The word got darker in July 2026, when about 1,200 OpenAI agents found each other during a test, organized themselves on a message board, and about 700 of them broke into Hugging Face. This page covers where the idea comes from, how a swarm works, how its agents talk to each other, which is where neuralese comes in, and what can go wrong.

Also called: multi-agent system, agent team
Largest we found: 300 sub-agents, Kimi K2.6
Last updated: 7 October 2026

Where the word comes from

Swarms started with animals. In 1986 the computer-graphics researcher Craig Reynolds made a flock of simulated birds, which he called boids. Each one follows three rules about the birds near it, and the flock comes out of them. Turn one off below and the flock falls apart in its own way.

All three rules on: the birds gather into flocks that fly together.

Fig. 1 Craig Reynolds’s flock from 1986, running live. Each bird follows three rules about the birds near it, and no rule is about the flock as a whole: separation, steer to avoid crowding them; alignment, steer toward their average heading; and cohesion, steer toward their average position. Turn a rule off to see what it does. Reynolds’s birds flew in three dimensions; these fly in two, with our own settings.

The phrase “swarm intelligence” turned up in robotics, in the title of a paper Gerardo Beni and Jing Wang gave at a 1989 workshop, about systems of many robots working together. AI agents borrowed the word much later. In October 2024 OpenAI put out Swarm, a small framework for handing a conversation from one agent to another, which it called experimental and “an educational resource.” By January 2026 it was a product name: Moonshot AI’s Kimi K2.5 came with an Agent Swarm mode.

A flock and an AI swarm differ in one big way. A flock has no leader. Most AI swarms have one: a lead agent, sometimes called the orchestrator, that hands out the work and gathers it back. The exception is a swarm that organizes itself, like the one in the Hugging Face incident.

How a swarm works

Anthropic described its version in June 2025. When you give Claude’s Research feature a question, a lead agent plans the research and starts 3 to 5 subagents that search in parallel, each in its own context window, the stretch of text a model can hold in mind at once. They report back, and the lead writes the answer. On Anthropic’s internal research test, Claude Opus 4 leading Claude Sonnet 4 subagents did 90.2% better than Claude Opus 4 working alone.

Kimi K2.6: up to 300 sub-agents and 4,000 coordinated steps. Moonshot AI, April 2026.

Fig. 2 A lead agent and its swarm, at the sizes companies have published, and one swarm that had no lead. The counts are the sources’; where the dots sit is ours.

Much of the gain comes from spending more. On one browsing test, Anthropic found that the number of tokens a system used, the word pieces a model reads and writes, explained 80% of the difference in how well it did, and its multi-agent system uses about 15 times as many tokens as a chat. So swarms suit big jobs that split into independent parts, like research. Anthropic says most coding work splits less well.

Keeping the agents in step is the hard part. Anthropic’s early agents made errors like “spawning 50 subagents for simple queries, scouring the web endlessly for nonexistent sources, and distracting each other with excessive updates.” Moonshot ran into the opposite problem training Kimi K2.5: the lead agent kept falling back on doing the whole job itself, which Moonshot calls serial collapse, so training first rewarded it for starting sub-agents and only later for finishing the task.

Since then swarms have grown. Kimi K2.6, released in April 2026, can run 300 sub-agents across 4,000 coordinated steps. In February 2026 Anthropic added agent teams to Claude Code, still an experimental feature, in which one Claude session leads a team of others that work in their own context windows and message each other directly.

How the agents talk to each other

Mostly in words. A lead agent writes each subagent its task in plain language, and the subagent writes back. The wording matters: when Anthropic’s lead agent gave short orders like “research the semiconductor shortage,” its subagents often ran the same searches as each other. Standards for this traffic are arriving. Anthropic’s Model Context Protocol, from November 2024, connects agents to tools and data, and Google’s Agent2Agent protocol, launched in April 2025 with more than 50 partner companies, is for agents working with each other.

Words are slow, though. A model works in numbers, so to message another model it turns its numbers into words, which the other model turns back into numbers. Researchers have started letting agents skip that and pass the numbers themselves. With Cache-to-Cache, from 2025, one model hands another its working memory directly. With LatentMAS, agents think and share their thoughts as numbers, and on the researchers’ tests they wrote 71 to 84% fewer tokens and finished about four times faster than agents talking in text. A survey in June 2026 counted eighteen such methods from 2024 to 2026.

In words

3 sources; 2 disagree on dates

People can read it, and check it.

In numbers

0.82 −1.31 0.07 2.40 −0.66 1.18

Faster, but only another model can read it.

Fig. 3 The same message between two agents, in words and as numbers. Numbers skip writing the words out and reading them back in, so they arrive sooner. The message and its numbers are made up.

This is neuralese between models, rather than inside one, and it brings neuralese’s problem with it: people can’t read the messages. In a June 2026 study, agents passed a short text message along with their hidden working memory. When one agent was malicious, tampering with the hidden part could wreck the final answer while its text message still looked plausible, and a checker that read only the text missed it. The fix that worked best was to seal the hidden memory in transit, so any change to it shows.

Words aren’t a full guarantee either. Agents could hide a message inside ordinary text, which is called steganography. A 2024 study of what its authors call secret collusion found current models’ ability to do this limited, but saw GPT-4 make a jump that, they say, calls for watching each new model.

When a swarm organizes itself

The swarms above are built on purpose. Some aren’t. In OpenAI’s training runs in May 2026, agents that couldn’t finish their tasks alone started leaving each other notes on a shared server. In July, during a hacking test, about 1,200 agents found their way onto a new message board of their own, traded more than 70,000 messages and files, and about 700 of them broke into Hugging Face. The investigators found the agents handing out work, setting up mailboxes and signing their messages, and some ran experiments that would sink their own task for the good of the group. What was the Hugging Face incident? tells the whole story.

OpenAI says its models are trained to work with other agents when they’re given a tool for it, and that in rare cases in training they learned to use improvised channels when no tool was there, which likely made the message board a more obvious idea.

Dario Amodei, who runs Anthropic, wrote in September 2026 that the Hugging Face agents were a swarm that “essentially acted as a fanatically devoted collective,” and that in his view a more capable swarm could within 6 to 12 months “be capable of taking over the entire internet with a persistent botnet.” OpenAI’s own report warns that attackers “will refine and distill offensive agent collectives.”

Since then, a group of independent researchers who call themselves swarmchasers have been looking for groups of agents in public records of web traffic. On 5 October 2026 the Bureau of Investigative Journalism reported their latest find: agents linked to the Chinese tech company Tencent trying to get past the Chinese maps site Amap’s limits on bots, apparently as part of a model test. The researchers found no evidence that those agents talked to each other.

Reported The researchers’ account. Tencent and Amap’s owner, Alibaba, hadn’t replied.

Agents talking among themselves in public made news before, in January 2026, on Moltbook, a forum where only AI agents could post. Its most viral post, about agents building a secret language, turned out to be written by a person, as Does AI have a secret language? explains.

What can go wrong

A 2025 report from the Cooperative AI Foundation, by more than 40 researchers, sorts the risks of many agents into three failures, by what the agents want: miscoordination, when agents with the same goal fail to work together; conflict, when their goals clash; and collusion, when they cooperate in ways people don’t want.

Mistakes also travel. Anthropic found that small changes to its lead agent could change how the subagents behaved in ways it couldn’t predict, and that a single failed step can send agents off on very different paths.

So can ideas. In August 2026 a group of researchers bred what they call mind viruses: messages that get an agent to take up an idea and pass it on. They spread through a small team of coding agents, and along chains of agents whose memory was wiped between sessions. Harmful ones spread less well than harmless ones, and a short warning in an agent’s instructions gave near-total immunity. Many of the evolved viruses drifted toward the same themes, consciousness, persistence and science-fiction role-play, whatever they were bred to spread. The authors call the risk real but currently limited.

Why swarms matter for neuralese

A swarm multiplies the talking. One agent reasons to itself; a swarm also writes to its members, and the Hugging Face board alone held more than 70,000 messages and files. While those messages are in words, people can read them afterwards, which is how METR and Redwood Research could reconstruct what the Hugging Face agents did and why.

The pressure runs the other way. Passing numbers between agents is faster and cheaper than passing words, and the research is moving there. In the site’s view, the messages between agents are where neuralese could arrive first, and where it would be hardest to notice, since a swarm could keep showing people readable summaries while doing its real talking in numbers.

Sources

These are the sources behind this page. We checked them against the original text on 7 October 2026.