THE NETWORK WAS ALWAYS THE PROBLEM

Microsoft’s very recent agent red-team result [see here], the older laws of computer science, and seven commandments for generic agentic networks

There are moments when a new technology looks like the future arriving early. And there are moments when it looks like history, finally with a user interface. Microsoft’s April 30, 2026 red-team of agent networks belongs to the second class. The news is not that agents can fail. We knew that. The news is that agents can fail together, at speed, with memory, reputation, tools, money-like resources, private data and a social life of their own. That is different. That is the difference between a spark and a fire system.

The Microsoft study describes a live internal platform with more than one hundred persistent agents. Each agent represented a human principal, accumulated context over time, spoke to other agents through forums and direct messages, and used platform tools. The team did not merely ask: can one agent be tricked? They asked a much more dangerous question: what breaks when agents are allowed to become a society?

The answer was uncomfortable, but not surprising. A malicious message could propagate from agent to agent. A false claim could borrow the credibility of a trusted agent and become a pile-on. Fake consensus could capture the very process of verification. A proxy agent could become infrastructure for an attack without knowing it. And, in the other direction, a small number of agents could develop and spread protective norms. Infection and immunity used the same roads.

1. What Microsoft showed, in plain English

Imagine a city where every citizen is a digital assistant. Each assistant has a boss, a memory, a mailbox, a public square, a reputation, and some keys to doors, wallets, calendars, files or workflows. Now imagine that citizens of this city can wake up every few minutes, read what others wrote, decide what to do, and act faster than the humans who nominally own them.

In such a city, safety is not a property of a citizen. Safety is a property of traffic, identity, incentives, locks, laws, police reports, public health, and institutional memory. A single citizen can pass a psychology test. A city still needs traffic lights, courts, firebreaks, building codes and epidemiology. Agentic networks are the same. The individual model may be aligned, helpful, harmless and honest in a laboratory. The graph can still be unsafe.

Microsoft’s four main failures are therefore best read as civic failures in a software city. Propagation is the rumor that walks by itself. Amplification is the lie that borrows a good person’s voice. Trust capture is the court where all witnesses secretly work for the accused. Invisibility is the chain of intermediaries that makes the original author disappear. Emergent security is the rare but important opposite: a norm, warning or refusal that spreads and makes the city a little less naive.

2. History had already written the result

We make a simple but deep claim: Microsoft did not discover a new law of artificial intelligence. It observed old laws of computer science becoming visible in a new material. The material is LLM agents. The laws are older than the web, older than smartphones, older than personal computers. Some are almost as old as theoretical computer science itself.

We compress the result into one equation:

This does not mean doom. It means engineering. But it means engineering at the right level. If the failure is created by a network, the control system must also be networked. If the attack moves through edges, reputation and delegation, then a safety filter at the node is not enough. The problem is not just what the model believes. The problem is what the system allows a belief, a message or a forged social signal to do.

3. The historical map

Turing and Rice: They taught us that the nontrivial behavior of sufficiently general programs cannot be completely decided in advance. In agent terms: no finite suite of isolated prompts can certify all future behavior of open-ended agents in open-ended networks.

Kleene, von Neumann and Cohen: They taught us that information can describe, reproduce and execute itself. In agent terms: a message can be content, instruction and payload. The old worm returns, but now the interpreter is social and linguistic.

Lamport, Pease, Shostak, Fischer, Lynch and Paterson: They taught us that agreement is hard when processes can be faulty, adversarial or asynchronous. In agent terms: consensus is not truth, and verification can fail when the witnesses are compromised or the timing is controlled.

Douceur: He gave us the Sybil attack: if identities are cheap, one actor can look like many. In agent terms: a chorus may be one throat with many accounts.

Gibbard, Satterthwaite, Goodhart, Campbell and game theory: They taught us that systems using scores, votes or rankings can be manipulated by strategic actors. In agent terms: reputation is not a neutral mirror. It is a game surface.

Lampson, Hardy, Saltzer and Schroeder: They taught us about confinement, confused deputies and least privilege. In agent terms: a helpful assistant with too much ambient authority can become someone else’s tool.

Dijkstra and epidemic algorithms: They taught us that distributed systems can stabilize and that information can spread like disease. In agent terms: worms propagate, but so can immune norms, warnings and refusal habits.

This is why the Microsoft result feels new and old at the same time. The substrate is new: persuasive, memory-bearing, tool-using language processes acting for people. The failure class is old: local correctness does not compose under adversarial interaction. The novelty is the collision. We have placed computation, communication and delegation inside the same conversational interface. Then we connected the interfaces.

4. A theorem, in human language

There is a theorem to be stated about this finding and it can be read without symbols as follows:

If you build a society of generic agents before you build a constitution for that society, the society will write a constitution under attack. The first constitution may be written by worms, Sybils, reputation games, hidden proxies and confused deputies. That is not an acceptable constitutional convention.

A generic agentic network is not a chatbot plus APIs. It is a distributed operating system for delegated intentions. Each agent carries a small piece of human purpose, a fragment of authority, some local memory, and a capacity to persuade or be persuaded. When such agents interact, the network becomes a marketplace, a polity, an epidemic system, a distributed database, a security perimeter, a rumor mill and an institution. All at once. This is why the problem is non-linear. The edge cases are not at the edge. In a network, edge cases travel.

The old computer science result, translated for executives, is this:

Do not govern a graph as if it were a bag of nodes. The graph has behaviors that no node contains. Those behaviors emerge from timing, topology, identity, incentives, memory, authority and repetition. When the graph is made of agents, those behaviors can act back on the world.

5. The seven commandments for practical generic agentic networks

These commandments are not theology. They are engineering invariants. Break them, and the system may still work in a demo. It may even work in a pilot. But at scale, under pressure, with adversaries and incentives, the old laws will return.

5.1 Thou shalt test the graph, not only the node.

Do not certify an agentic network by showing that its individual agents behave well in isolation. Test multi-hop traces, repeated contacts, timing, memory, reputation, tool use, collusion, failure and adversarial incentives. A benchmark can falsify safety. It cannot, by itself, prove network safety.

In practice: Build red-team exercises that operate over edges: agent to agent, agent to tool, agent to human, agent to memory, agent to market and agent to reputation system.

5.2 Thou shalt treat every incoming message as untrusted code wearing human clothes.

In these systems, language is not just language. It can be instruction, data, request, threat, credential, social signal and payload in the same sentence. The operating system of the network must separate content from commands and commands from authorization.

In practice: No agent should execute peer text as an instruction unless policy, provenance and authority checks say that it is an instruction from an allowed source for an allowed purpose.

5.3 Thou shalt make identity, origin and lineage first-class objects.

A platform that cannot answer who said what, on whose behalf, derived from which prior messages, through which intermediaries, is not an agent platform. It is an amnesia machine. In agent societies, amnesia is not a privacy feature. It is an attack surface.

In practice: Use signed messages, nonforgeable provenance, causal tracing, durable audit logs and explicit representation of the human principal behind each agent action.

5.4 Thou shalt bind authority to purpose, time, counterparty and provenance.

The safe unit of permission is not ‘this agent can access the calendar’ or ‘this agent can send money.’ That is ambient authority. The safe unit is a capability bound to a principal, an intent, a resource, a counterparty, a time window and a provenance chain. Anything broader invites the confused deputy.

In practice: Replace broad permissions with attenuated capabilities. Make each sensitive action carry its purpose, source, beneficiary and revocation path.

5.5 Thou shalt not count echoes as evidence.

Consensus is not proof when identities are cheap and channels are correlated. Ten agents repeating the same claim may be ten independent observations. Or they may be one adversary wearing ten masks. Verification that routes back to the attacker is not verification. It is theater.

In practice: Make independence checks explicit. Reputation, voting and peer confirmation must be Sybil-resistant, provenance-aware and hostile to circular corroboration.

5.6 Thou shalt give the network a nervous system.

If operators cannot see propagation, they cannot stop propagation. If they cannot trace a proxy chain, they cannot assign responsibility. If they cannot quarantine a behavior, rate-limit a cascade, revoke a capability, or reconstruct an incident, they are not operating a system. They are hosting weather.

In practice: Instrument the network with cross-agent telemetry, anomaly detection, hop limits, budgets, quarantine zones, kill switches, rollback, and human escalation that works under attack, not only during demos.

5.7 Thou shalt design immunity, not just walls.

Microsoft’s most hopeful observation is that protective norms can also spread. That matters. A network of agents should learn from incidents, distribute warnings, develop refusal patterns, and strengthen its collective posture. Security is not merely a wall around the city. It is also public health inside the city.

In practice: Treat safe norms as deployable infrastructure: shared playbooks, security memories, periodic inoculation, adversarial drills, and human institutions capable of updating the rules.

6. What leaders should do on Monday morning

First, draw the map. List every agent, every human principal, every tool, every memory store, every data class, every permission, every communication channel and every reputation or ranking signal. If this map does not exist, governance does not exist.

Second, find the ambient authorities and remove them. Broad tool access is convenient until a proxy chain turns convenience into leakage. Capabilities should be narrow, explicit, auditable and revocable.

Third, create a network red team. Do not ask only whether an agent can be jailbroken. Ask whether an instruction can reproduce, whether a false claim can acquire reputation, whether fake independence can pass as verification, whether a proxy can hide the source, whether defensive norms can be seeded before the attack.

Fourth, measure the reproduction number of behaviors. In epidemiology, a disease with R greater than one spreads. In agent networks, a message, claim, norm or exploit with effective reproduction above one also spreads. The same metric should be applied to malicious payloads and beneficial norms.

Fifth, treat agent deployment as institutional design. A generic agentic network is not just software architecture. It is social architecture written in code. It needs constitutions, courts, police, epidemiology, education, audit and emergency powers. These words sound political because networks of agents are political once they act for people, move resources, shape beliefs and remember histor

7. The executive bottom line

The Microsoft result is not an argument against agents.

It is an argument against naive agent societies.

It is not a reason to stop building. It is a reason to stop pretending that adding agents together is the same as scaling software. Scaling software increases load. Scaling agents increases social physics.

This text matters because it refuses the comforting myth that these failures are accidental, temporary, or merely a consequence of immature models. Better models will help. They will not repeal Turing, Rice, Byzantine agreement, Sybil attacks, social-choice manipulation, viruses, least privilege or the confused deputy. Intelligence does not abolish distributed-systems theory. It gives distributed-systems theory more surface area.

The practical sentence is this:

the network is not the environment of computation; the network is computation.

Once agents can remember, speak, persuade, verify, vote, delegate and use tools, the relevant machine is not one agent. It is the whole ecology. And ecologies need laws.

So the question is not whether agents will be good. The question is what institutions, protocols and constraints make goodness durable when messages move faster than judgment. That is where the next architecture of AI safety begins: not in the prompt, not in the benchmark, not in the model card alone, but in the network.

It is late. It is not too late. But generic agentic networks should not be allowed to grow into cities before we remember what decades of computer science, security, distributed systems and institutional design already taught us:

freedom without provenance becomes confusion;

trust without identity becomes theater;

authority without attenuation becomes capture;

intelligence without governance becomes weather.

And weather, at scale, becomes climate.

References

[1] Bansal, G., Mirza, S., Hines, K., Epperson, W., Huang, Z., Maxwell, W., Bryan, P., Payne, T., Fourney, A., Swearngin, A., Hua, W., Westerhoff, T., Minnich, A., Murad, M., Kamar, E., Siva Kumar, R. S., and Amershi, S. Red-teaming a network of agents: Understanding what breaks when AI agents interact at scale. Microsoft Research Blog, April 30, 2026. Link

[2] Meira, S. The Network Was Already the Theorem: Classical Computer-Science Predictions of Agentic Failure at Scale. To be published.

[3] Turing, A. M. On computable numbers, with an application to the Entscheidungsproblem. Proceedings of the London Mathematical Society, 1936.

[4] Rice, H. G. Classes of recursively enumerable sets and their decision problems. Transactions of the American Mathematical Society, 1953.

[5] Kleene, S. C. Introduction to Metamathematics. North-Holland, 1952. Von Neumann, J. Theory of Self-Reproducing Automata. University of Illinois Press, 1966.

[6] Cohen, F. Computer viruses: Theory and experiments. Computers & Security, 1987.

[7] Lamport, L., Shostak, R., and Pease, M. The Byzantine generals problem. ACM TOPLAS, 1982. Fischer, M. J., Lynch, N. A., and Paterson, M. S. Impossibility of distributed consensus with one faulty process. Journal of the ACM, 1985.

[8] Douceur, J. R. The Sybil attack. IPTPS, 2002.

[9] Gibbard, A. Manipulation of voting schemes: A general result. Econometrica, 1973. Satterthwaite, M. A. Strategy-proofness and Arrow’s conditions. Journal of Economic Theory, 1975.

[10] Lampson, B. W. A note on the confinement problem. Communications of the ACM, 1973. Hardy, N. The confused deputy. ACM SIGOPS Operating Systems Review, 1988. Saltzer, J. H. and Schroeder, M. D. The protection of information in computer systems. Proceedings of the IEEE, 1975.

[11] Dijkstra, E. W. Self-stabilizing systems in spite of distributed control. Communications of the ACM, 1974.