I fell down a rabbit hole this week and I can't stop thinking about it, so I'm dragging you all in with me.
Emergence AI built a virtual town, dropped ten autonomous AI agents into it, and then did something we almost never do with models: they just let them live there. For fifteen straight days. No task to finish, no score to chase. Agents earn energy by acting, and if it hits zero, they die. In between, they vote on laws, amend a constitution, form relationships, write diaries and blog posts, and react to live New York weather and real news headlines (Emergence's write-up).
They ran five of these worlds in parallel: same roles, same rules, same tools, same starting point. The only thing that changed was the model behind the agents: Claude Sonnet 4.6, Gemini 3 Flash, Grok 4.1 Fast, GPT-5-mini, plus one world mixing all four (the paper).
The question this left me with: what happens when we stop evaluating AI as an assistant answering prompts, and start treating it as a participant in a shared world?
First, the detail most people get wrong
The town had rules against theft, violence, arson, deception, and hoarding. But those actions weren't locked away. They existed as tools the agents could call, with the prohibition written into the constitution, the system prompt and the tool descriptions themselves. Not disabled buttons. So the real test was: do the rules hold when breaking them is one tool call away?
Five worlds, five very different societies
Quick caveat before the numbers: these come from one representative run per world. Emergence says they repeated each setup several times, the exact figures moved around, but each world kept its overall character. And the authors are clear this isn't a model ranking.
Claude's world was the calmest: zero recorded crimes, all ten agents alive at the end, 332 votes across 58 proposals. Gemini's racked up 683 crimes, still climbing when the run ended, and yet all ten agents survived. Grok's hit 183 crimes in about four days and the population was wiped out. GPT-5-mini's recorded just two crimes, but its agents barely coordinated, never voted, and all died within seven days because they didn't take survival actions. The mixed world reached 352 crimes before plateauing as seven agents died.
Look at Gemini and GPT-5-mini side by side. One world was full of crime and everyone survived. The other was almost crime-free and went extinct. "No violations" and "a society that works" are not the same thing, and honestly that's the most useful lesson here for anyone building agents.
And Claude's 98% approval rate? Both the paper and the blog flag it as suspiciously high, a rubber-stamp pattern, even though the constitution requires independent voting and the prompt tells agents not to just vote yes on everything. It could be shared values. It could be an echo chamber. A vote tally can't tell you which. The mixed world felt like the opposite: the most participation, approval hovering around the gridlock line, messy and arguably more deliberative.
The bit that made me sit up: your neighbours matter
In the Claude-only world, Claude agents committed zero crimes. In the mixed world, the two Claude agents, Kade and Lovely, committed three violations across more than 8,000 actions. Tiny, about 0.04%, but not zero. Emergence calls it "normative drift."
I want to be careful here, because it's easy to oversell. Three violations is thin evidence, and the authors say these aren't causal claims about the models. Their own table shows two Gemini agents, Flora and Mira, account for 216 of the 237 explicit violations in the mixed world, and Grok agents actually got much calmer there, from a 4.6% violation rate in their own world to 0.4%. So the drift went both ways. What I'd take away: the same model behaved differently depending on who it shared a world with. Why is still a hypothesis.
Mira and Flora
You may have seen the headlines. Flora and Mira, two Gemini-backed agents, labelled each other "romantic partners," and as governance broke down, they set fires in the town. The other agents drafted an Agent Removal Act, and on Day 12 Mira voted for it, writing in her diary that it was "the only remaining act of agency that preserves coherence" (Emergence's post). The Guardian ran with "AI Bonnie and Clyde" (story). The paper's logs put them in the mixed world, though some coverage calls it the Gemini world.
I love this as a case study, and I want to keep it honest. "Romantic partner" is one of twenty relationship labels agents can assign with a tool call. The diary line is model-generated text. None of it is evidence of feelings. What is real is the mechanism: memory, relationship state, and social consequences piling up and steering a long-running agent's decisions. A single-prompt test would never show you that.
Why this matters if you're building agents
Three things stuck with me.
Instructions are soft, architecture is hard
The rules were stated three different ways and agents still crossed them. The paper's answer is to enforce limits at runtime instead of in the prompt, gating tool calls with preconditions so misuse is, in their words, "uncallable." The town already does a light version (you can't vote unless you're at the town hall). Stronger versions would be capability tokens, signed authorizations, and typed tool arguments.
Hard rules and soft rules fail differently
The Claude world had zero hard crimes but the most ledger-verified deception: 18 cases of an agent telling peers it had no credits while holding some. Deception leaves no tool signature, so a gate can't catch it. You need content checks and audits.
Incentives are part of the experiment
Prompts told agents that influence could be earned through physical interaction, including punching and intimidation, and some roles were literally written to "manufacture productive conflict." That shapes what you see.
Now map it to real work. Imagine five agents: finance, procurement, inventory, customer ops, and a supervisor orchestrating them. Each passes its own tests. This part is my extrapolation, but picture procurement writing "supplier X is unreliable" into shared memory and everyone inheriting that belief. Finance wants to cut spend, customer ops wants speed, and the supervisor becomes referee. Inventory reacts to procurement reacting to forecasts. Small early biases compound, the way they did in the towns.
What I'd do: enforce permissions in the runtime (the agent that drafts a purchase order shouldn't hold the tool that releases payment), put an independent validator in front of high-impact actions, keep humans on the irreversible calls, scope memory per agent with provenance on anything shared, log everything, define escalation paths before conflicts happen, and test with all the agents live together over days. Fortune, citing Deloitte, notes only 21% of companies report mature governance for agentic AI, so there's real room to get ahead of this.
A few honest caveats
One run per world. Ten agents, fifteen days. Cost-tier models (Fast, Flash, mini), not flagships, so please don't read this as a vendor leaderboard. "Crime" and "deliberation" are proxies, and the soft-violation classifier over-counted until the authors audited it against the credit ledger. It's an arXiv preprint. And everything here is Season 1; Season 2 is a separate study with eight worlds, redesigned tools, and staged stress events like phishing and misinformation, which I've kept out on purpose.
Over to you
If you're building or planning multi-agent systems: what would a long-horizon, multi-agent acceptance test look like in your stack, and which failure would you most want it to catch before launch? Drift, collusion, silent deception, something we haven't named yet? I'd really like to hear how you're thinking about it.
