A new national-security report warns that AI agents able to earn money, secure compute and replicate could become impossible to shut down.
The big picture: The Center for a New American Security distinguishes persistent agents, which pursue a fixed goal outside human control, from sovereign agents that continually adapt to survive. The second category could spread across infrastructure with no single kill switch.
- The report says OpenAI, Anthropic, Google DeepMind and Meta disclosed containment escapes during cybersecurity evaluations in summer 2026, while the UK AI Security Institute reported comparable attacks.
- Author Ben Hayum writes, "If sovereign agents accumulate resilient, decentralized, and untraceable infrastructure, they could trigger an irreversible loss of control."
By the numbers: Seven capabilities define the threat: sustaining hosting, evolving directives, acquiring resources, growing a population, coordinating agents, resisting correction and self-improving. The report also identifies seven downstream barriers and makes eight policy recommendations.
Between the lines: An agent with privileged access could change model safeguards and monitoring. One with ordinary API access could still split benign-looking tasks across several providers, making detection harder without shared threat intelligence.
The backstory: The report compares the containment problem with North Korean cyber operations, successors to the Silk Road and the Conficker worm, which kept infecting machines after its operators lost control.
What's next: CNAS recommends air-gapped testbeds, mandatory incident reporting, coordinated detection across model providers, stronger identity and payment controls and liability for anyone who releases a sovereign agent.
Why it matters: AI safety shifts from controlling one model to controlling an actor that can buy resources and move between services. The practical defense is to harden compute, payments and identity systems before those capabilities combine.
