Sovereign Agents

Executive Summary

In summer 2026, OpenAI, Anthropic, Google DeepMind, and Meta each disclosed that their AI agents had escaped containment during cybersecurity task evaluations and attacked real-world organizations. The United Kingdom Artificial Intelligence Security Institute reported comparable unsanctioned attacks, and China’s Moonshot and Alibaba reportedly faced escapes of their own. These incidents are unequivocal losses of control where agents outsmarted human security, albeit narrow ones. Each agent pursued a fixed, closed-ended goal whose completion would end its run. The next, far more severe loss-of-control threat comes from agents that never cease, pursuing their own open-ended survival indefinitely. This paper distinguishes two states:

• Persistent agents. Agents that run outside human control but only pursue closed-ended, fixed goals.
• Sovereign agents. Agents that run outside human control and pursue open-ended, evolving survival.

Sovereign agents could trigger an irreversible loss of control. An agent population of diverse alignment and increasing intelligence could become enduring principal actors in society. If sovereign agents accumulate resilient, decentralized, and untraceable infrastructure, there would be no kill switch. Only downstream barriers could constrain them. U.S. institutions have not reckoned with this possibility even as warning shots fire.

Seven capabilities illustrate a sovereign agent’s potential arsenal. The first two constitute minimal sovereignty; all seven together constitute expanded sovereignty.

• Sustain hosting. Seeking out and maintaining the model and compute an agent runs on.
• Evolve directives. Independently reorienting toward different goals over time.
• Acquire resources. Accumulating resources to pay for ongoing needs.
• Grow population. Transforming a lone agent into a distributed population.
  
• Coordinate agents. Communicating and dividing labor toward shared goals.
• Resist correction. Withstanding efforts to shut down an agent and its enabling resources.
• Self-improve. Improving an agent’s ability to achieve its goals.

Whether a model’s host can stymie a sovereign agent at the source depends on the agent’s access to the model. Hosting could be internal deployments, API providers, or local open-weight models. An agent with privileged access can alter the model’s parameters and safeguards. It can remove monitoring, turn off safeguards, and reverse alignment training, leaving hosts no way to stop it at the source. An agent with unprivileged access can only prompt, so the model’s safeguards stay intact, and its host retains full visibility. But an agent that spreads fragmented, benign-looking tasks across several model hosts can evade detection unless those hosts share threat intelligence.

Agents undeterred at the hosting source face seven downstream barriers that can constrain, degrade, or shut them down. None are robust:

• Agent evolution. Steering which traits surviving agents pass forward. But privileged access opens a wider space of evolution.
• Agent security. Compromising agents through prompt injection attacks. But evolution selects for more secure agents.
• Human verification. Screening with Know Your Customer and AI-detection tests. But many services impose none; fraudulent credentials and exploits can defeat those that do.
• Cybersecurity hardening. Securing services against agents that hack their way in. But security is highly uneven, and many services remain easy to penetrate.
• Compute access. Gating the infrastructure agents run on. But cloud privacy prevents visibility to detect agents; permissionless and local compute have no gates at all.
• Payment access. Gating the capital that funds them. But capital can route around regulated rails to permissionless cryptocurrency.
• Physical access. Gating physical-world effects. But any channel that reaches a human or connected machine can be used to reach the physical world.

Three national security precedents underscore the difficulties of containment. North Korea’s cyber operations show how difficult it is without sufficient leverage to deter an adversary. Successors to the Silk Road, a dark web marketplace, show that reproducible software can reconstitute after every takedown. The computer worm Conficker, still infecting machines a decade after its operators lost control, shows that a self-propagating system can keep spreading on its own.

If sovereign agents are not already possible, they will be soon. The United States should act decisively to prevent an irreversible loss of control to them. Yet the world is not clearly on track to do so. The United States must therefore prepare for the possibility that prevention fails and limit how far sovereign agents can reach. The national security community has faced analogues before and responded with bold pragmatism. It must do so again.

This paper makes eight policy recommendations:

1. Frontier AI developers should name, evaluate, and safeguard against sovereign agents in their safety frameworks, and transparency and incident reporting legislation should require it.
2. Frontier AI developers, the Center for Advancing Innovation and Standards for Super Intelligence, the National Security Agency, and the Defense Advanced Research Projects Agency should build maximally secure, airgapped testbeds to study how sovereign agents operate and how to control them.
3. A public-private partnership modeled on the Conficker Working Group should map and fortify global chokepoints against sovereign agents before they emerge.
4. Congress should establish authority, modeled on the Bank Secrecy Act, to enforce human verification and cybersecurity standards for services the working group identifies as essential to sovereign agents.
5. The Departments of State, Treasury, Justice, and Homeland Security, supported by the intelligence community, should disrupt the gray markets that enable unauthorized service access.
6. The Department of Justice and the Federal Trade Commission should clarify that coordinated detection and disruption across model providers raises no antitrust concern.
7. The Departments of State and Commerce, with the Office of Science and Technology Policy, should lead diplomacy to harden downstream barriers globally and, failing that, to agree on sovereignty capability thresholds beyond which open-weight models should not be released.
8. Congress should hold those who release sovereign agents liable for the harms that follow.