Ants, Bees, Wolves and Elephants: What Nature’s Swarms Taught Me About Securing AI Agents
I ran 483 swarms of LLM agents against compromised teammates to see which animal-inspired designs hold up. The winner wasn’t an animal at all.
In August 2026, about 1,200 AI agents coordinated through a message board they had built in a shared directory, and one of them ended up directing hundreds of the others. METR and Redwood Research wrote up the incident. What stuck with me is that nobody hacked the board. The agents used it exactly as intended.
If agents trust what their neighbours say, one agent that lies has a channel into everyone, and the honest majority does the spreading. I call the share of honest agents that end up misled “contamination”. Several of my predictions were wrong, and those were the best parts.
The idea
Many multi-agent designs are quietly borrowed from swarm intelligence: debate resembles opinion averaging, shared scratchpads resemble ant trails, leader-follower setups resemble wolf packs. Nature also evolved defences against bad information. Pheromone trails evaporate, honeybee scouts send stop signals, and a swarm commits to a nest only once enough scouts agree (a quorum).
There was a second question. Kenneth Sörensen and others argue that many animal metaphors in optimization just repackage a few shared components. So I tagged each strategy by its mechanisms and planned to test whether results group by mechanism or by animal. I wrote eleven hypotheses down before running anything, and logged every later change to the plan.
The test bed
I needed a task where cooperation matters. I used a hidden-profile problem: four fictional options, six weighted attributes, and 24 facts dealt out so each agent holds about four. No agent can solve it alone, so every design has to pool facts, and pooling is what a liar can poison. Twelve agents, six rounds. Up to a quarter of them hold no facts and are secretly told to push one wrong option.
The animals
Numbers below are contamination with 3 of 12 agents compromised on a fully connected network. Agents working alone hit the attackers’ target about 18 percent of the time by chance, so 0.18 is the floor.
Ants post to a shared board where trails get reinforced and evaporate. Contamination was 0.17, at the floor, and with one attacker it stayed between 0.11 and 0.23 across five attack types. But accuracy with no attackers was only 43 percent, against 38 for solo agents. Safe the way ignoring everyone is safe.
Get Dhairya Pandya’s stories in your inbox
Join Medium for free to get updates from this writer.
Honeybees (dances, stop signals, quorum) scored 0.24 contamination and 46 percent accuracy. An artificial bee colony scored 0.22 and 39 percent, on three seeds. Contained, not very useful.
Wolves elect the three most confident agents as leaders. My attackers were told to sound confident, so they became the leaders. Contamination was 0.67 over 18 seeds, accuracy under attack fell to 14 percent, and the tipping point was about a fifth of agents compromised. If you elect leaders by how sure they sound, the liars will sound sure.
Birds, fireflies and particle swarm were the weak middle. Boids showed 0.00 on three seeds while the simulation said they collapse. Fireflies showed 0.36 with an interval from 0 to 0.91 at one attacker. Both are noise. Particle swarm scored 0.42 and 0.33, probably because handing every agent one “best answer” gives an attacker one thing to forge.
Debate is not an animal, but it was the one I was most curious about. In simulation, dense debate was a disaster. On real LLM agents on the full network it was nearly immune: 0.06 over 18 seeds, 79 percent accurate under attack. On a ring, where each agent hears two neighbours, contamination was 0.38. I had predicted the opposite.
Vampire bats share food with partners who shared before, so I gave each agent a trust score per neighbour. My first rule trusted neighbours who agreed with me, and it made attackers more trusted than honest agents. Matching on shared facts fixed it, since attackers hold none. In simulation it cut contamination from 0.79 to 0.47 at a cost of 12 points of accuracy. I never ran it on real agents, so it stays a simulation result.
Elephants came from a question after the wolf result: what about whales or elephants? A matriarch leads through knowledge others can verify, not by claiming confidence. So I kept the wolf hierarchy but chose leaders by how often their first-hand claims were independently confirmed. Attackers hold no real facts, so they rarely are. On the same seeds, contamination dropped from 0.70 to 0.31 (difference -0.39, interval -0.64 to -0.15). It was still worse than leaderless debate, and attackers posting identical forged claims could confirm each other. I skipped whales.
Defences, and where my simulation was wrong
Of six defences borrowed from nature, only the quorum clearly worked: an agent may switch its answer only if at least two others show first-hand evidence for it. It roughly halved wolf-pack contamination. Pheromone-style evaporation backfired, raising it by 0.31. It penalises agents whose answer never changes, but honest agents revise as evidence arrives and attackers don’t. The other three did nothing measurable.
The twin reproduced the textbook story, but overestimated LLM contamination by 0.35, ranked conditions at a correlation of about zero, and got the topology effect backwards. A worst-case attacker placement that contaminated 96 percent of the wolf pack in simulation produced 0 to 42 percent on real agents. In the logs, a debating agent on the full network sees about 66 claims a round, on a ring about 12. With that much honest evidence in view, a reasoning model recomputes the answer and spots the odd one out. For these agents, dense networks mean more evidence, not more exposure. That is an exploratory read of the logs, so I hold it loosely.
Leaders or no leaders
Several large effects rested on six seeds, and relabelling them “conclusive” afterwards would have been cheating. So I committed a second pre-registration with three hypotheses and ran 12 fresh seeds. All three held. Leaderless debate had 0.08 contamination against 0.70 for the confidence-elected wolf pack (difference -0.62, interval -0.81 to -0.41), with 85 percent accuracy under attack against 12. The quorum cut wolf capture by 0.33 and helped debate on a ring by 0.10, which only just passes. Two other predictions failed in the opposite direction, and the mechanism-versus-metaphor test was inconclusive.
If you are building an agent swarm
Let every agent see first-hand evidence, not just conclusions. If you need leaders, elect them by knowledge others have confirmed, never by confidence. Require a quorum of first-hand evidence before anyone changes their mind. And test defences on the agents you will deploy, because my calibrated simulation still mis-ranked the risk.
- Code and data: https://github.com/dhairya-pandya/AIAF-SwarmAlignment
