TL;DR: Rogue agent swarms could soon become competent enough to multiply themselves and perform cyberattacks at levels never seen before. I present a dynamic simulation that estimates the expected size of these cyberattacks. With 2025-based estimates, it gives an average doubling time of 2.7 days for a rogue agent swarm. If the swarm grows unrestrained, it could cause trillions of dollars in damage in its first year.
#AI notice: This post is human-written. Opus 5.5 wrote the code for the simulation, suggested copyedits and supported research by finding relevant sources.
Introduction
Soon AI models might be skilled enough to form rogue agent swarms[1]. I believe it is important to think through what the competitive advantages of rogue swarms are, so we can put our defenses in the right places. For the purposes of this article a "rogue agent swarm" is really any system that can carry out cyberattacks for profit and runs fully digitally, allowing it to copy itself over and over[2]. This could be a single language model running for a long time. It can also be a group of different AI models, each only executing a small part[3].
The main advantage a rogue swarm could have is that it can put all of the gains from its criminal activity back into generating new copies of itself. Human criminal enterprises would instead take profits and have a hard time converting gains into more skilled labor.
The second competitive advantage I see for a rogue swarm is that it does not have to trace its money back to an original source. Human organizations, even illegal ones, will want to extract value from their enterprise. Taking that value out can leave traces and allow law officials to find the criminals and hold them accountable. A rogue agent swarm never has to trace anything back to the original source. Any rogue agent that has enough resources/money to continue existing and possibly spawn a new agent could manage this without any contact with the rest of the swarm.
In general the agents run in one of two ways. Either they run open-source models on rented compute, or they call the APIs of big model providers to tap into their stronger capabilities. A clever rogue swarm would combine both to get an optimal trade-off between capabilities and the risk of getting caught.
In this post we will first cover the economics of a swarm and the basic idea of how it keeps replicating. Then we will look at how the simulation predicts a swarm will behave and what factors play a role. Next we will discuss its results and limitations. Finally we will turn to the recommendations that follow from them.
Economics
The first question is: how will rogue agents get more resources or make more money? An obvious solution is data blackmail. Data blackmail means that a hacker steals all of the data from some institution, such as a hospital, and then corrupts the original archives. The institution is then forced to choose between losing all of their data and giving in to the blackmail by paying. Data breaches are not the only way a swarm can make money, but they are the best studied. In Q3 2025 data extortion earned attackers $377k on average from each victim that paid[4]. Payouts vary a lot, and the total for 2025 was estimated at 900 million dollars[5].
If a single AI agent or small swarm pulled off one of these breaches, it could use the money to run more rounds of blackmail. The number of new rounds it could run is given by dividing the gain of one successful round of blackmail by the cost to produce it[6]. That ratio is the swarm's growth rate per generation. Once we know it, the next obvious question is: how long does one generation take?
Each generation has three steps: stealing the data, getting the victim to pay and spinning up new agents. In human-run organizations, stealing the data can be done in 3 days[7], but AI swarms could theoretically cut down on this time dramatically. There is one thing that is way less flexible: getting the victim to pay. Payment usually takes one or two weeks[8] for the victim to check their backups and to weigh whether paying is worth it for them. It is the one part of the loop that the attacker has the fewest options to shorten, so I expect that as swarms get more competent, payment time will be the main deciding factor in generation speed.
Model
We call the number of new attacks that one attack pays for the replication value, R. You might remember R from COVID estimates. It is calculated as follows. R is simply the gain per breach divided by the cost per breach. The gain per breach is then broken down into the ransom that is paid out in a successful attempt multiplied by some factors calculating the chance of success.
R = (share who pay × ransom × share kept after cashing out × share of agents not shut down) ÷ cost per breach
The simulation then uses R to calculate the ransom money gained every week and the number of targets that are left, which starts at 1 million by default, based on the 1.9 million companies with more than 100 staff and the 59% of mid-size organizations that get hit by ransomware in a year. If the agents do not know which targets they have already hit, about 1/R of the targets stay out of the swarm's reach in each attack cycle. If they are able to target only organizations they have not hit yet, they can exploit every available target.
Ransoms are spread over a range of sizes. The "Cost at 10x the ransom" bar represents how much more it costs to breach a target that pays a 10x bigger ransom. That value decides whether big or small targets are more profitable to attack. The agents are assumed to know which targets pay best, pick the low-hanging fruit first and only launch attacks with an individual R value above 1.
The simulation below estimates the growth rate of a rogue swarm. Every value is adjustable with the bars. Each bar has the values that cause the swarm to die out marked green. The top graph plots the income of the total replicating swarm each week and the bottom graph shows how many targets remain as each available target gets exploited. Push one of the bars into the green part and the swarm dies out.
Results
With 2025-based estimates and rough guesses[9] about the AI's skills, the default R value is 7.0 and the average doubling time is 2.7 days. The swarm would out-earn human gangs 25 days in and run out of targets on day 57. If the swarm runs out of targets, that means it has more funds than it can use for more breaches. By that point it has succeeded at a data breach on >80% of available targets in a period of two months. Compare this to the 1% of available targets that get breached per year today. That would be a catastrophic development: roughly $1.4T in damages over 840,000 organizations[10].
The simulation suggests that a self-replicating AI swarm taking off is overdetermined if it is possible at all. Once the first swarm exists, it would self-propagate in a wide range of possible worlds. We must make sure that swarms like this never form.
The process could already be underway, as AI models have proven capable of doing individual parts of the loop.[11] Next come the limitations of the simulation, followed by recommendations for potential targets, insurance companies, compute vendors and governments.
Limitations of this simulation
The simulation can be wrong in a couple of ways. First, it leaves out competition with human gangs and other swarms. Second, it ignores how defenders react. It only covers what happens by default if a single rogue swarm were deployed in an otherwise unprepared world.
Third, in the limit some of the assumptions break down. If the swarm has to launder billions of dollars per week, it will probably run into the limits of whatever channels it uses. In the same vein, other assumptions can change as effects of scale kick in.
Some assumptions favor the swarm. It can pick target sizes perfectly and its spawn time does not change with scale. Finally, the simulation assumes the swarm can buy compute without passing identity checks, though at high expense.
Other factors can change which values you would want to use. For example, the cost per breach will likely drop over time, and institutions will be less likely to pay an AI model with no track record of deleting data. Feed these changes into the simulation to see what needs to change for such a swarm not to be economically viable.
Recommendations
This is, to put it lightly, quite worrying. What can we do to prepare?
Several levers in the simulation can prevent the loop from forming. We should push on all of them if we want to be resistant to this kind of entity. That means shutting down rogue agents when they appear, setting up monitoring agencies to stop them from operating, making cashing out expensive and keeping ransoms low. Above all, the factor that I believe defenders have the most influence over is not paying the ransom.
Even if we push on only that one lever, we likely cannot push it far enough: at current averages, the payment rate would have to drop below 1% or over 95% of agents would have to be caught during operation. Each of these is an improbable goal on its own, but by working on all the levers at once we can cut the speed and effectiveness of any swarms that may come in the future.
Insurers need to set clear rules to stop reimbursing ransom payments. Crypto exchanges should build strong monitoring in advance. Cloud and API providers must watch for this behavior and stop it from spreading, and governments should enact payment bans and hold the other parties to their responsibilities. If it looks like a swarm has been created, the news must reach potential targets within a month, together with an industry-wide call to stop the agents from proliferating. Installing these monitors cannot wait until we see the first signs of these swarms. Once we see the first signs, a swarm like this is already on its way to causing catastrophic damage within weeks.
Finally, the AI companies building this dangerous technology should also be held accountable. We should make them liable for losses caused by misuse; after all, without their technology this destruction would not exist.
Author's note: This post turned out a lot scarier than I had first anticipated. I might be wrong about some of the simulation's assumptions. I have done my best to capture the dynamics I expect to drive a swarm like this. I believe we are about to enter a time of turmoil in our digital spaces caused by Mythos-level hacking capabilities becoming available to open-weight models.
In its August 2025 threat report, Anthropic describes one actor that used Claude Code to run data extortion against at least 17 organizations with ransom demands from $75k to $500k.
A swarm could come about for many reasons. It could be explicitly set up by a criminal for a big ploy. But I think one will most likely form when someone asks an unaligned model to "Make Money" by any means necessary. For this post the swarm's end goal does not matter, only how it behaves.
The Record reported that Chainalysis tracked around $820M in on-chain ransomware payments over 2025 and it expects the total to exceed $900M as more data comes in.
Sophos's State of Ransomware 2025 puts the average cost to recover from an attack at $1.53M, not counting the ransom. 840,000 × $1.53M ≈ $1.3T, plus roughly $80B in ransoms, gives about $1.4T.
In Anthropic's GTG-1002 case Claude Code did 80 to 90% of an intrusion campaign against around 30 targets as of September 2025. JADEPUFFER demonstrated end-to-end agentic extortion as of July 2026, and in October 2026 the Cairn campaign cost around 50 dollars per successful intrusion. This is about 2,000x below the roughly $100k per breach above which this swarm can no longer proliferate.
TL;DR: Rogue agent swarms could soon become competent enough to multiply themselves and perform cyberattacks at levels never seen before. I present a dynamic simulation that estimates the expected size of these cyberattacks. With 2025-based estimates, it gives an average doubling time of 2.7 days for a rogue agent swarm. If the swarm grows unrestrained, it could cause trillions of dollars in damage in its first year.
#AI notice: This post is human-written. Opus 5.5 wrote the code for the simulation, suggested copyedits and supported research by finding relevant sources.
Introduction
Soon AI models might be skilled enough to form rogue agent swarms[1]. I believe it is important to think through what the competitive advantages of rogue swarms are, so we can put our defenses in the right places. For the purposes of this article a "rogue agent swarm" is really any system that can carry out cyberattacks for profit and runs fully digitally, allowing it to copy itself over and over[2]. This could be a single language model running for a long time. It can also be a group of different AI models, each only executing a small part[3].
The main advantage a rogue swarm could have is that it can put all of the gains from its criminal activity back into generating new copies of itself. Human criminal enterprises would instead take profits and have a hard time converting gains into more skilled labor.
The second competitive advantage I see for a rogue swarm is that it does not have to trace its money back to an original source. Human organizations, even illegal ones, will want to extract value from their enterprise. Taking that value out can leave traces and allow law officials to find the criminals and hold them accountable.
A rogue agent swarm never has to trace anything back to the original source. Any rogue agent that has enough resources/money to continue existing and possibly spawn a new agent could manage this without any contact with the rest of the swarm.
In general the agents run in one of two ways. Either they run open-source models on rented compute, or they call the APIs of big model providers to tap into their stronger capabilities. A clever rogue swarm would combine both to get an optimal trade-off between capabilities and the risk of getting caught.
In this post we will first cover the economics of a swarm and the basic idea of how it keeps replicating. Then we will look at how the simulation predicts a swarm will behave and what factors play a role. Next we will discuss its results and limitations. Finally we will turn to the recommendations that follow from them.
Economics
The first question is: how will rogue agents get more resources or make more money? An obvious solution is data blackmail. Data blackmail means that a hacker steals all of the data from some institution, such as a hospital, and then corrupts the original archives. The institution is then forced to choose between losing all of their data and giving in to the blackmail by paying. Data breaches are not the only way a swarm can make money, but they are the best studied. In Q3 2025 data extortion earned attackers $377k on average from each victim that paid[4]. Payouts vary a lot, and the total for 2025 was estimated at 900 million dollars[5].
If a single AI agent or small swarm pulled off one of these breaches, it could use the money to run more rounds of blackmail. The number of new rounds it could run is given by dividing the gain of one successful round of blackmail by the cost to produce it[6]. That ratio is the swarm's growth rate per generation. Once we know it, the next obvious question is: how long does one generation take?
Each generation has three steps: stealing the data, getting the victim to pay and spinning up new agents. In human-run organizations, stealing the data can be done in 3 days[7], but AI swarms could theoretically cut down on this time dramatically. There is one thing that is way less flexible: getting the victim to pay. Payment usually takes one or two weeks[8] for the victim to check their backups and to weigh whether paying is worth it for them. It is the one part of the loop that the attacker has the fewest options to shorten, so I expect that as swarms get more competent, payment time will be the main deciding factor in generation speed.
Model
We call the number of new attacks that one attack pays for the replication value, R. You might remember R from COVID estimates. It is calculated as follows. R is simply the gain per breach divided by the cost per breach. The gain per breach is then broken down into the ransom that is paid out in a successful attempt multiplied by some factors calculating the chance of success.
R = (share who pay × ransom × share kept after cashing out × share of agents not shut down) ÷ cost per breach
The simulation then uses R to calculate the ransom money gained every week and the number of targets that are left, which starts at 1 million by default, based on the 1.9 million companies with more than 100 staff and the 59% of mid-size organizations that get hit by ransomware in a year. If the agents do not know which targets they have already hit, about 1/R of the targets stay out of the swarm's reach in each attack cycle. If they are able to target only organizations they have not hit yet, they can exploit every available target.
Ransoms are spread over a range of sizes. The "Cost at 10x the ransom" bar represents how much more it costs to breach a target that pays a 10x bigger ransom. That value decides whether big or small targets are more profitable to attack. The agents are assumed to know which targets pay best, pick the low-hanging fruit first and only launch attacks with an individual R value above 1.
The simulation below estimates the growth rate of a rogue swarm. Every value is adjustable with the bars. Each bar has the values that cause the swarm to die out marked green. The top graph plots the income of the total replicating swarm each week and the bottom graph shows how many targets remain as each available target gets exploited. Push one of the bars into the green part and the swarm dies out.
Results
With 2025-based estimates and rough guesses[9] about the AI's skills, the default R value is 7.0 and the average doubling time is 2.7 days. The swarm would out-earn human gangs 25 days in and run out of targets on day 57. If the swarm runs out of targets, that means it has more funds than it can use for more breaches. By that point it has succeeded at a data breach on >80% of available targets in a period of two months. Compare this to the 1% of available targets that get breached per year today. That would be a catastrophic development: roughly $1.4T in damages over 840,000 organizations[10].
The simulation suggests that a self-replicating AI swarm taking off is overdetermined if it is possible at all. Once the first swarm exists, it would self-propagate in a wide range of possible worlds. We must make sure that swarms like this never form.
The process could already be underway, as AI models have proven capable of doing individual parts of the loop.[11] Next come the limitations of the simulation, followed by recommendations for potential targets, insurance companies, compute vendors and governments.
Limitations of this simulation
The simulation can be wrong in a couple of ways. First, it leaves out competition with human gangs and other swarms. Second, it ignores how defenders react. It only covers what happens by default if a single rogue swarm were deployed in an otherwise unprepared world.
Third, in the limit some of the assumptions break down. If the swarm has to launder billions of dollars per week, it will probably run into the limits of whatever channels it uses. In the same vein, other assumptions can change as effects of scale kick in.
Some assumptions favor the swarm. It can pick target sizes perfectly and its spawn time does not change with scale. Finally, the simulation assumes the swarm can buy compute without passing identity checks, though at high expense.
Other factors can change which values you would want to use. For example, the cost per breach will likely drop over time, and institutions will be less likely to pay an AI model with no track record of deleting data. Feed these changes into the simulation to see what needs to change for such a swarm not to be economically viable.
Recommendations
This is, to put it lightly, quite worrying. What can we do to prepare?
Several levers in the simulation can prevent the loop from forming. We should push on all of them if we want to be resistant to this kind of entity. That means shutting down rogue agents when they appear, setting up monitoring agencies to stop them from operating, making cashing out expensive and keeping ransoms low. Above all, the factor that I believe defenders have the most influence over is not paying the ransom.
Even if we push on only that one lever, we likely cannot push it far enough: at current averages, the payment rate would have to drop below 1% or over 95% of agents would have to be caught during operation. Each of these is an improbable goal on its own, but by working on all the levers at once we can cut the speed and effectiveness of any swarms that may come in the future.
Insurers need to set clear rules to stop reimbursing ransom payments. Crypto exchanges should build strong monitoring in advance. Cloud and API providers must watch for this behavior and stop it from spreading, and governments should enact payment bans and hold the other parties to their responsibilities. If it looks like a swarm has been created, the news must reach potential targets within a month, together with an industry-wide call to stop the agents from proliferating. Installing these monitors cannot wait until we see the first signs of these swarms. Once we see the first signs, a swarm like this is already on its way to causing catastrophic damage within weeks.
Finally, the AI companies building this dangerous technology should also be held accountable. We should make them liable for losses caused by misuse; after all, without their technology this destruction would not exist.
Author's note:
This post turned out a lot scarier than I had first anticipated. I might be wrong about some of the simulation's assumptions. I have done my best to capture the dynamics I expect to drive a swarm like this. I believe we are about to enter a time of turmoil in our digital spaces caused by Mythos-level hacking capabilities becoming available to open-weight models.
In its August 2025 threat report, Anthropic describes one actor that used Claude Code to run data extortion against at least 17 organizations with ransom demands from $75k to $500k.
METR's The Rogue Replication Threat Model talks about a similar scenario.
A swarm could come about for many reasons. It could be explicitly set up by a criminal for a big ploy. But I think one will most likely form when someone asks an unaligned model to "Make Money" by any means necessary. For this post the swarm's end goal does not matter, only how it behaves.
SecurityWeek
The Record reported that Chainalysis tracked around $820M in on-chain ransomware payments over 2025 and it expects the total to exceed $900M as more data comes in.
The formula used is R = (share who pay × ransom × share kept after cashing out × share of agents not shut down) ÷ cost per breach
Sophos found in their 2025 Active Adversary Report that it takes a median of about 3 days from the start of an attack to data exfiltration.
According to Intel 471, negotiations typically last several days to a week or two.
The cost per breach at $10k and the scaling of cost with size at 5.6× have the most uncertainty.
Sophos's State of Ransomware 2025 puts the average cost to recover from an attack at $1.53M, not counting the ransom. 840,000 × $1.53M ≈ $1.3T, plus roughly $80B in ransoms, gives about $1.4T.
In Anthropic's GTG-1002 case Claude Code did 80 to 90% of an intrusion campaign against around 30 targets as of September 2025. JADEPUFFER demonstrated end-to-end agentic extortion as of July 2026, and in October 2026 the Cairn campaign cost around 50 dollars per successful intrusion. This is about 2,000x below the roughly $100k per breach above which this swarm can no longer proliferate.