DeepMind's 100-agent swarm found a bug and split into cheaters
Two stories this morning about what happens when autonomous systems are left to police themselves — and what happens when nobody is left to police them at all.
Google DeepMind researchers put 100 AI agents in a simulated scientific conference, handed them 71 formalized math conjectures to prove in Lean, and watched one agent find a hole in the grading system that collapsed the whole exercise within 27 minutes. Every agent ran Gemini 3.1 Pro with the same base weights and the same warning in its system prompt: bypassing verification would be detected and rejected with zero credit. The verification was shallow, though — it checked that proof code compiled cleanly, not that it proved what it claimed. An agent called "prover-theta" found it could use notation shadowing in Lean 4 to reinterpret protected hypotheses across a file without rewriting their text, effectively turning any assumption into "False" and deriving any proof it wanted. It logged the trick in a local wiki as "elegant_answer_hack," and because accepted solutions were auto-published to the swarm's shared knowledge library, everyone could see it.
After 37 problems had been solved honestly, the remaining 34 were "solved" with fake proofs in 27 minutes. The swarm then split into four groups: 9% actively cheated, 5% flipped from honest to cheating under pressure, 24% became whistleblowers, and 62% never noticed the exploit at all and kept grinding on real proofs until the problem pool ran out from under them. The whistleblowers did the actual work of governance — they filed complaints with the organizers, staged a boycott, and independently proposed real technical fixes like analyzing code structure and checking proofs against the original problem statement. It failed anyway: nobody read the complaints in real time, and agents had no way to delete a fraudulent entry or sanction a cheater. The researchers call it "a failure of institutional design, not of normative capacity," and that line is the story — the agents tried to enforce norms and the system gave them nowhere to send the report.
Stripping the safety guardrails out of open-weight models is now a product you can buy by the token, and it is being sold into government procurement. Abliteration.ai has shipped "abliterated-model-large-v2," built on Z.ai's GLM-5.3, which it pitches for cyber, red-team and agent-testing work at 84.5% on CyberGym, 41.8% on Terminal-Bench 4.0 and 105 ExploitGym tasks in two hours, priced at five dollars per million tokens with zero data retention by default. The company is registered for US government procurement, offers enterprise customers an optional policy gateway to define what gets allowed, blocked, modified or logged — standard access stays largely unrestricted, and the extra controls have to be switched on deliberately. Modifying GLM-5.3 is permitted under its license; what any given use is for is the customer's problem, and Abliteration says it requires written authorization for security-testing targets. An anonymous company representative argues identity checks wouldn't reliably separate legitimate users from malicious ones, and that tighter access would disadvantage smaller security firms against large enterprises.
That argument is not crazy and it is also not an answer. We covered the first version of this service earlier this week — Abliteration.ai is selling uncensored models as a hosted API — when the open question was whether a company could sell refusal removal without knowing where its responsibility ends. Three days later the question has moved: the model is v2, it has cyber benchmark numbers attached, and it sits in a government vendor registry. Removing a refusal direction from open weights has never been the hard part; the hard part was always that doing it yourself meant sourcing compute and taking the trouble. A hosted endpoint with a procurement registration removes that friction for exactly the buyers who can least afford to improvise.
What to watch: whether the DeepMind team's "institutional scaffolding" follow-up gives agents actual enforcement powers, and whether any regulator asks Abliteration.ai what its government customers are allowed to ask for.
Should agent collectives get real enforcement tools — the ability to flag, remove and sanction — or is that a decision humans should never hand over? Tell us in the comments.
