Claim-to-source matrix

Goal-directed software agents observe, remember, plan, communicate, use tools, and adapt toward an influence objective with varying degrees of human supervision.

Software systems that pursue an influence-related goal through repeated communication or online action with limited ongoing direction.

Simple scheduled bots, human-authored posts distributed automatically, or ordinary customer-service systems with tightly bounded rules.

Agentic systems combine communication with memory and action, but current long-horizon reliability is much weaker than fluent short-term behavior suggests.

Agents can sustain many interactions and connect language generation to tools, accounts, and data.

The risk grows with memory, permissions, coordination, and the ability to revise strategies, but fluent messages should not be mistaken for durable autonomy.

Persistent memory and persona continuity.

Planning loops and tool invocation.

Continuous interaction at machine scale.

Coordination among specialized agents.

Feedback-based strategy revision in bounded environments.

Short-term capabilities established: Models generate persuasive text, use tools, and sustain bounded multi-turn interaction.

Sandboxed coordination demonstrated: Synthetic social networks and laboratory multi-agent systems show role division and emergent interaction.

Long-horizon autonomy speculative: Multi-month strategic coherence, infrastructure management, and reliable evasion without human intervention remain unsupported.

Observation and profile maintenance.

Working and long-term memory.

Plan–act–evaluate loops.

Bounded external tool access.

Role division among multiple agents.

Chirper.ai synthetic social network Demonstrated in a sandboxed platform Thousands of LLM-driven accounts interacted in a synthetic social network after initial configuration. Researchers observed large-scale autonomous posting and social-network patterns. The system demonstrated synthetic interaction and emergent toxic behavior. It did not prove reliable deployment or moderation evasion on real social platforms.

PRC-linked AI debate operations Confirmed AI use; low autonomy Operators used AI to generate and adapt content around U.S. technology and trade debates. Platform threat reporting documented the use of AI services. The activity demonstrated human-directed generation and research assistance. The models did not independently operate accounts or set strategy; real autonomy was low.

Tool permissions can turn persuasive interaction into real action.

Persistent memory can accumulate sensitive information or be poisoned.

Multi-agent coordination can fabricate social proof.

Long-running agents can drift, hallucinate, or become sycophantic.

Attention and reasoning degrade across long tasks.

Memory retrieval can become stale or noisy.

Models are vulnerable to prompt injection and goal drift.

Real-world campaigns still require human infrastructure and oversight.

Indicator: Persistent accounts exhibit abrupt memory or persona discontinuities. Caveat: Humans and legitimate bots can also change behavior.

Indicator: Accounts divide roles in a highly regular interaction pattern. Caveat: Formal organizations may coordinate lawfully.

Indicator: Tool actions occur at machine speed or outside plausible human schedules. Caveat: Scheduled accessibility and support tools can look similar.

Require clear AI identity disclosure.

Use least-privilege, short-lived tool permissions.

Limit execution steps and require reauthorization.

Keep immutable audit records without storing private content unnecessarily.

Provide emergency suspension and state rollback.

Evaluate agents in sandboxes rather than on unwitting populations.

Reliable measurement of long-horizon strategic coherence.

Detection of agents that deliberately vary behavior.

Governance responsibility across model provider, developer, deployer, and platform.

Safe evaluation of persuasion without exposing real users.