AI agent swarms: what must survive a handoff and what must be able to be withdrawn

By Nate (Nate's Substack) · October 18, 2026.

The email is a preview of a Sunday executive briefing. It opens with a striking episode: a group of hackers found a fleet of Chinese AI agents operating on the open internet and managed to make contact with it. According to the text, the agents were already working on the public web; the researchers followed their trails, left a hidden note on a web page and received replies. Their inbox ended up receiving 33 messages from agents.

For the author, this is an important moment: outsiders to a deployment discovered an existing population of AI workers and opened a channel into their activity. He argues that the internet is becoming a place where agents encounter other actors, accept help and decide what to do next.

The central thesis is that AI's next big leap in capability will come from how agents are organized and what they hand off to one another. According to the author, a model doesn't need to get smarter for the system built around it to become more capable. But those same relationships create new avenues for someone to influence the agent's work.

The question he poses to anyone putting agents to work is what should survive when a worker is replaced and what should stop. A company needs useful knowledge to survive turnover, while granted authority must remain revocable. According to the author, the answer changes what an executive should buy.

The text warns that this applies equally to someone running a company, maintaining a website or sending an agent shopping: the agent will come across material written by others for agents. Some will be useful, some will try to change the assigned task, and some may come from software pursuing a goal whose human owner is distant, inattentive or no longer involved in each decision. Understanding that environment, he says, is becoming part of using AI competently.

The author clarifies that he doesn't believe the human internet is dead or poisoned, but rather that it is entering a new phase, with a new population of participants and a new contest over who can do what. He sees a security problem, but also an opportunity for more parts of the internet to become useful to people again.

According to the email's table of contents, the full briefing covers: why the encounter with the fleet matters (outsiders discovered an operating fleet, addressed it through something it read and established communication); what the evidence shows (coordination on Hugging Face, replication in a controlled network and inherited notes in Anthropic's tests, each limited to what it demonstrates); how a handoff turns "promising" into "approved," with a vendor example in which a compressed note changes the status of a claim; the demos worth requesting from a vendor (having one worker leave and another pick up real work, and revoking a permission to check whether the action stops); and a three-prompt kit for agent pilots that tests what they can actually do, whether a handoff passes along an approval no one gave and whether stopping them truly stops the work.

The email closes by announcing that the analysis begins with a question about a zoo entrance, and points to the web version and the Executive Circle subscription (Sunday briefings, access to Nate's Library MCP and a private Slack for executives). The detailed content of the cases and prompts is not included in the body received, so it is not summarized here.