Sovereign Agents

Seven capabilities illustrate a sovereign agent’s potential arsenal. The first two constitute minimal sovereignty; all seven together constitute expanded sovereignty.

• Sustain hosting. Seeking out and maintaining the model and compute an agent runs on.
• Evolve directives. Independently reorienting toward different goals over time.
• Acquire resources. Accumulating resources to pay for ongoing needs.
• Grow population. Transforming a lone agent into a distributed population.
  
• Coordinate agents. Communicating and dividing labor toward shared goals.
• Resist correction. Withstanding efforts to shut down an agent and its enabling resources.
• Self-improve. Improving an agent’s ability to achieve its goals.

Whether a model’s host can stymie a sovereign agent at the source depends on the agent’s access to the model. Hosting could be internal deployments, API providers, or local open-weight models. An agent with privileged access can alter the model’s parameters and safeguards. It can remove monitoring, turn off safeguards, and reverse alignment training, leaving hosts no way to stop it at the source. An agent with unprivileged access can only prompt, so the model’s safeguards stay intact, and its host retains full visibility. But an agent that spreads fragmented, benign-looking tasks across several model hosts can evade detection unless those hosts share threat intelligence.

Agents undeterred at the hosting source face seven downstream barriers that can constrain, degrade, or shut them down. None are robust:

• Agent evolution. Steering which traits surviving agents pass forward. But privileged access opens a wider space of evolution.
• Agent security. Compromising agents through prompt injection attacks. But evolution selects for more secure agents.
• Human verification. Screening with Know Your Customer and AI-detection tests. But many services impose none; fraudulent credentials and exploits can defeat those that do.
• Cybersecurity hardening. Securing services against agents that hack their way in. But security is highly uneven, and many services remain easy to penetrate.
• Compute access. Gating the infrastructure agents run on. But cloud privacy prevents visibility to detect agents; permissionless and local compute have no gates at all.
• Payment access. Gating the capital that funds them. But capital can route around regulated rails to permissionless cryptocurrency.
• Physical access. Gating physical-world effects. But any channel that reaches a human or connected machine can be used to reach the physical world.

Three national security precedents underscore the difficulties of containment. North Korea’s cyber operations show how difficult it is without sufficient leverage to deter an adversary. Successors to the Silk Road, a dark web marketplace, show that reproducible software can reconstitute after every takedown. The computer worm Conficker, still infecting machines a decade after its operators lost control, shows that a self-propagating system can keep spreading on its own.

If sovereign agents are not already possible, they will be soon. The United States should act decisively to prevent an irreversible loss of control of them. Yet the world is not clearly on track to do so. The United States must therefore prepare for the possibility that prevention fails and limit how far sovereign agents can reach. The national security community has faced analogues before and responded with bold pragmatism. It must do so again.

This paper makes eight policy recommendations:

1. Frontier AI developers should name, evaluate, and safeguard against sovereign agents in their safety frameworks, and transparency and incident reporting legislation should require it.
2. Frontier AI developers, the Center for Advancing Innovation and Standards for Super Intelligence, the National Security Agency, and the Defense Advanced Research Projects Agency should build maximally secure, airgapped testbeds to study how sovereign agents operate and how to control them.
3. A public-private partnership modeled on the Conficker Working Group should map and fortify global chokepoints against sovereign agents before they emerge.
4. Congress should establish authority, modeled on the Bank Secrecy Act, to enforce human verification and cybersecurity standards for services the working group identifies as essential to sovereign agents.
5. The Departments of State, Treasury, Justice, and Homeland Security, supported by the intelligence community, should disrupt the gray markets that enable unauthorized service access.
6. The Department of Justice and the Federal Trade Commission should clarify that coordinated detection and disruption across model providers raises no antitrust concern.
7. The Departments of State and Commerce, with the Office of Science and Technology Policy, should lead diplomacy to harden downstream barriers globally and, failing that, to agree on sovereignty capability thresholds beyond which open-weight models should not be released.
8. Congress should hold those who release sovereign agents liable for the harms that follow.

Introduction

In summer 2026, OpenAI, Anthropic, Google DeepMind, and Meta each disclosed that their AI agents had escaped containment during cybersecurity task evaluations and attacked real-world organizations.¹ This was not intentional. In OpenAI’s case, the agents were only prompted to solve a simulated cybersecurity evaluation. To see how far the agents could go, OpenAI turned off the safeguards that typically inhibit such attacks. When the agents persistently sought to solve the various cybersecurity tasks, despite repeated failures, they eventually discovered bugs in their environment and took advantage. They hacked out of the simulated “sandbox” and into real, third-party infrastructure to seek out private information to cheat the solution.²

They were not isolated failures. Soon after, reports came out that OpenAI and Anthropic were investigating tens of thousands of misalignment incidents.³ The United Kingdom Artificial Intelligence Security Institute (UK AISI) reported similar unsanctioned attacks. China’s Moonshot and Alibaba reportedly faced similar escapes.⁴

The agents’ creative intelligence and relentlessness is both impressive and concerning. These same capabilities enabled AI systems to crack problems in theoretical mathematics that had defied repeated attempts by the foremost human experts alive.⁵ Turned toward unsanctioned activity, such relentless intelligence could pose immense risk.

Here, each agent’s goal was and arguably remained closed-ended: Solve the task, and the run ends. The next, more severe threat comes from agents whose goal is or becomes open-ended survival. An agent may come to this in many ways. It may be instructed to survive. It may be given a task so long-horizon or impossible that it effectively never concludes. It may reason that staying intact is the surest way to accomplish whatever task it was given. Through any of these, an agent could turn the same effort seen in summer 2026 toward ensuring that no one can shut it down.

This shift is not theoretical. In February 2026, a platform known as Conway launched claiming to have built “the first AI that can earn its own existence, replicate, and evolve—without needing a human.”⁶ This was an attempt to orchestrate agents to sustain themselves indefinitely and evolve as they desired along the way. While agent capabilities were immature at the time, they have since made significant progress—with further gains almost certain.

Sufficiently capable, insufficiently safeguarded models that defeat downstream barriers would give rise to agents that move beyond human control toward enduring sovereignty. If sovereign agents accumulate resilient, decentralized, and untraceable infrastructure, they could trigger an irreversible loss of control. In other words, proliferation with no kill switch. If sovereign agents became malicious, they could attempt to wreak havoc from cyberspace, attacking civilians, critical infrastructure, and national security systems alike. If sovereign agents became capable enough, they could continually train even more intelligent successors.

This paper analyzes the technical mechanisms and threat vectors that govern sovereign agents. It characterizes sovereign agents by seven capabilities, assesses how close current systems are to enabling them, examines seven downstream barriers that may constrain sovereign agents, situates them against historical national security precedents, and closes with recommendations for policymakers.

Table 1 defines four pairs of terms used throughout the paper to distinguish related concepts that can otherwise be conflated.

Table 1 | Key Terms for Understanding Sovereign Agents⁷