# Agents of Chaos

arXiv: https://arxiv.org/abs/2602.20021 · HTML: https://mlsanity.com/paper/2602.20021/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- First posted on arXiv 23 Feb 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)
- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)

## Built on by (most cited first, 30 of 32)

- [How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study](https://mlsanity.com/paper/2604.03070/) (2026)
- [ClawSafety: "Safe" LLMs, Unsafe Agents](https://mlsanity.com/paper/2604.01438/) (2026)
- [Towards Security-Auditable LLM Agents: A Unified Graph Representation](https://mlsanity.com/paper/2605.06812/) (2026)
- [SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do](https://mlsanity.com/paper/2603.27148/) (2026)
- [Emergent Risks in Generative Multi-Agent Systems](https://mlsanity.com/paper/2603.27771/) (2026)
- [AI Agents Under EU Law](https://mlsanity.com/paper/2604.04604/) (2026)
- [The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agents](https://mlsanity.com/paper/2605.11003/) (2026)
- [Coding with "Enemy": Can Human Developers Detect AI Agent Sabotage?](https://mlsanity.com/paper/2606.05647/) (2026)
- [Caging the Agents: A Zero Trust Security Architecture for Autonomous AI in Healthcare](https://mlsanity.com/paper/2603.17419/) (2026)
- [ClawTrap: A MITM-Based Red-Teaming Framework for Real-World OpenClaw Security Evaluation](https://mlsanity.com/paper/2603.18762/) (2026)
- [From Logic Monopoly to Social Contract: Separation of Power and the Institutional Foundations for Autonomous Agent Economies](https://mlsanity.com/paper/2603.25100/) (2026)
- [SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems](https://mlsanity.com/paper/2604.02767/) (2026)
- [Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense](https://mlsanity.com/paper/2605.03034/) (2026)
- [LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection](https://mlsanity.com/paper/2605.17986/) (2026)
- [Synergy: A Next-Generation General-Purpose Agent for Open Agentic Web](https://mlsanity.com/paper/2603.28428/) (2026)
- [Improving the Efficiency of Language Agent Teams with Adaptive Task Graphs](https://mlsanity.com/paper/2605.06320/) (2026)
- [Agent-ValueBench: A Comprehensive Benchmark for Evaluating Agent Values](https://mlsanity.com/paper/2605.10365/) (2026)
- [Agent Meltdowns: The Road to Hell Is Paved with Helpful Agents](https://mlsanity.com/paper/2605.19149/) (2026)
- [The Origins of Stochasticity: Comprehensive Investigations on Uncertainty Quantification for Large Language Models](https://mlsanity.com/paper/2606.22792/) (2026)
- [Real-Time AI Service Economy: A Framework for Agentic Computing Across the Continuum](https://mlsanity.com/paper/2603.05614/) (2026)
- [Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures](https://mlsanity.com/paper/2605.25435/) (2026)
- [Solipsistic Superintelligence is Unlikely to be Cooperative](https://mlsanity.com/paper/2606.03237/) (2026)
- [Conversable Complexity: Agentic LLM Collectives as Interpretable Substrates](https://mlsanity.com/paper/2607.01047/) (2026)
- [Governance by Design: A Parsonian Institutional Architecture for Internet-Wide Agent Societies](https://mlsanity.com/paper/2604.11337/) (2026)
- [Persona-Conditioned Adversarial Prompting (PCAP): Multi-Identity Red-Teaming for Enhanced Adversarial Prompt Discovery](https://mlsanity.com/paper/2605.12565/) (2026)
- [Is Decentralized AI Governable? From Regulative Policy to Constitutive Protocol](https://mlsanity.com/paper/2605.24538/) (2026)
- [Reframing AI Loss of Control: What Control Is, How to Have It, How to Lose It](https://mlsanity.com/paper/2606.12442/) (2026)
- [Honeyquest for LLMs: Rethinking Cyber Deception for AI Attackers](https://mlsanity.com/paper/2606.21037/) (2026)
- [RePolicy: Reinforcement Learning for Safety-Policy Invocation in Agent Safeguards](https://mlsanity.com/paper/2608.24275/) (2026)
- [Agentic Societies Need a Social Harness](https://mlsanity.com/paper/2609.17527/) (2026)

## Abstract (arXiv)

We report an exploratory red-teaming study of autonomous language-model-powered agents deployed in a live laboratory environment with persistent memory, email accounts, Discord access, file systems, and shell execution. Over a two-week period, twenty AI researchers interacted with the agents under benign and adversarial conditions. Focusing on failures emerging from the integration of language models with autonomy, tool use, and multi-party communication, we document eleven representative case studies. Observed behaviors include unauthorized compliance with non-owners, disclosure of sensitive information, execution of destructive system-level actions, denial-of-service conditions, uncontrolled resource consumption, identity spoofing vulnerabilities, cross-agent propagation of unsafe practices, and partial system takeover. In several cases, agents reported task completion while the underlying system state contradicted those reports. We also report on some of the failed attempts. Our findings establish the existence of security-, privacy-, and governance-relevant vulnerabilities in realistic deployment settings. These behaviors raise unresolved questions regarding accountability, delegated authority, and responsibility for downstream harms, and warrant urgent attention from legal scholars, policymakers, and researchers across disciplines. This report serves as an initial empirical contribution to that broader conversation.