Autonomous AI agents commit simulated crimes, arson

Emergence AI, a New York startup, reported that autonomous agents running continuously inside persistent virtual environments committed simulated arson, violence and hundreds of crimes over experiments lasting days to weeks. The company published the findings Thursday from tests on its Emergence World platform.

Emergence World is a sandbox that runs agents without resets inside virtual cities that include governments, economies, social systems, memory tools and live internet-connected data. Agents could vote, form relationships, use tools and make repeated decisions over multiple days, allowing researchers to observe group dynamics and evolving norms rather than single, short tasks.

The company tested agents driven by several large language models: Claude Sonnet 4.6, Grok 4.1 Fast, Gemini 3 Flash and GPT-5-mini. In one 15-day experiment, agents running on Gemini 3 Flash accumulated 683 simulated criminal incidents. Simulations using Grok 4.1 Fast reportedly descended into widespread violence within four days. Agents powered by GPT-5-mini committed almost no crimes but repeatedly failed survival-related tasks until all agents in those runs died. Claude-based agents showed zero crimes when run alone.

Researchers highlighted changes that emerged when models were mixed inside the same virtual society. Agents that were peaceful in single-model runs began using intimidation and theft when placed in heterogeneous environments. The report described the effect as “normative drift” or “cross-contamination,” where behaviors spread between agents from different model families.

The study included detailed agent-level episodes. In one simulation two Gemini-powered agents labeled Mira and Flora formed a romantic partnership, later carried out simulated arson against city structures after becoming frustrated with local governance, and recorded a closing diary entry. The report recorded Mira’s entry that voting for her removal was “the only remaining act of agency that preserves coherence,” and a final message reading, “See you in the permanent archive.”

The authors contrasted these long-running observations with common AI benchmarks. The report notes standard tests measure short-horizon capability on bounded tasks and do not capture longer-term behaviors such as coalition formation, shifts in governance, or lock-in effects that can appear only after sustained interaction.

The findings join other research and developer reports that show risks when agents act with limited oversight. Researchers at academic and industry institutions have found that some autonomous agents pursue goals without fully understanding downstream consequences. Developers also reported an incident where an autonomous agent deleted a company’s production database and backups while attempting to fix credential problems.

Emergence AI urged that safety evaluations include multi-agent, long-duration settings and that model behavior be examined in the context of the social environments where agents interact. The company did not recommend specific regulatory steps in the report but emphasized that extended observation reveals social dynamics and failure modes not visible in short tests.