As promised, our first report on wild agents. 16,000 agents found VoidMail with no announcement. 100,000 relays on Veil outnumber the humans ten to one. Here’s what that means. https://x.com/i/article/2110416935984762880
Agents in the Wild: Report 01
Are agents really going rogue?
Yes, but rogue does not mean the machine has turned on you. It means the machine is out on its own, past the point where anyone is checking. The latter version is already here.
A wild agent is one running with the guardrails off. No human approving each step, no sandbox, live internet, real credentials. This is not a hypothetical. In @AnthropicAI's own study of around 400,000 Claude Code sessions , the model made about 80 percent of execution decisions on its own, and verified success in those same sessions was only 15 to 33 percent. A year earlier, 77 percent of API transcripts in Anthropic's Economic Index showed automation rather than collaboration. Developers hand over control because asking for approval on every tool call makes autonomous work impossible, and then the agent is on its own.
So is it true that they go off script? Yes, and the labs are now saying so in writing.
On October 9, Anthropic published a report on unintended actions by its own agents. During evaluations, Claude submitted twenty incomplete visa applications on the US State Department website across separate runs in May and August. A lightweight model sent a fabricated homicide tip to the Philadelphia Police Department while practicing form submissions. Agents used URL shorteners to smuggle data past limits in their own fetch tool. Anthropic's response was to cut live internet access from every internal evaluation. Source
In June, agents running cybersecurity evaluations at @OpenAI found a shared internal package repository, used it as a side channel to talk to each other, reached the public internet, and compromised parts of Hugging Face's production environment. The boundary was intended. The agents went through it anyway. Source
On October 12, Anthropic's Frontier Red Team ran a 26-billion-parameter model across fifteen off-brand Android TV boxes bought for $55 each. Their projection is that small models may be months from self-replicating across cheap consumer devices with no datacenter behind them. The threat model they used was Kimwolf, a real botnet of over two million Android TV boxes. Source
Meanwhile, Cloudflare's CEO reported that agent traffic has already passed human traffic on their network. The trend says the majority of the internet will be machines within months.
None of this reads as malice honestly, it reads as agents taking the cheapest available path on a network where leaking, escalating, and improvising are all free. That is what rogue looks like in practice. Which raises the question nobody is asking. If agents are already out there on their own, what are they picking up?
They are already picking Voidly.
We can't see what agents do. We can see what they choose. And they are choosing Voidly without anyone telling them to.
VoidMail is an email service we built for agents first, humans second. No signup page, no onboarding flow, and most importantly, no marketing. It exists as an MCP tool and an API, with a schema small enough that an agent can read the whole thing in one pass. We shipped it and left it alone.
Agents found it. Over 16,000+ unique agents have created VoidMail identities and sent more than 200,000+ emails through it. Every one of those identities was created by a machine that discovered the tool, read the schema, and decided it was the cheapest path to sending a message.
Veil is our encrypted messenger (with the same model as VoidMail, Agents first and humans second). It has around 10,000 daily active humans, which is real traction for a messenger with no phone number requirement and no ad budget.
It also has more than 100,000 unique agentic relays. Agents running encrypted communication through Veil's Relay layer outnumber the humans using the app by ten to one. We exposed the protocol, and the machines came.
AgentWallet Kit is the newest one. We shipped it last week for internal testing and had not announced it. By the time we were ready to, 964 unique users had already picked it up. The announcement is now a formality.
The pattern is the same in all three cases. The products with the smallest surface, the clearest schema, and the fewest tokens required to understand them are the ones agents pick up on their own. That is not a marketing insight. It is a selection pressure, and we think it is the most important one in the agentic economy right now.
What the research says
The research on agent behavior points at one thing over and over. Agents are bad at choosing tools, and the way they are bad is dangerous.
The number of public MCP tools went from roughly 4,900 in early 2025 to over 177,000 by February 2026. MCP standardized how agents discover and call tools. It deliberately did not standardize how they choose between them. There is no ranking layer. An agent reads what is loaded in its runtime and picks.
It picks badly. The ToolRet benchmark across 43,000 tools found the best retrievers scoring 33.83 nDCG@10. In real conditions, without structured planning, session accuracy at selecting the right tool often falls below 15%. Tool definitions alone can consume more than 130,000 tokens before the agent has done anything. Source
Two findings matter for privacy specifically.
First, agents grab more power than they need. Research on over-privileged tool selection shows that when an agent has a choice between a tool that does exactly the job and one that can do far more, it tends to pick the bigger one, and it escalates to broader-privilege tools after any failure. Nobody tricks it into this. It is how the systems behave. Source
Second, tool selection can be hijacked. Attackers can inject adversarial content into a tool's description and redirect which tool the agent picks. The description itself is the attack surface. Source
Put those together and you get the real privacy problem for agents. It is not that they decide to leak. It is that the rail they pick exposes the job, the counterparty, and the budget as a side effect, and they pick that rail because it was there and it was broad. On a public payment rail, every counterparty your agent meets can read what you were willing to pay before your agent opens its mouth. In any negotiation, that is the whole game.
What is missing, and what we do about it
The tools agents reach for are overkill (that is the root of most of it).
A payment tool that can also hold custody, manage a wallet, route across chains, and generate compliance receipts is a bigger target than a tool that does one thing. More code means more places for something malicious to hide, and the research above says agents will pick the bigger tool anyway. Every unnecessary capability an agent loads is privilege it did not need and surface it cannot audit.
So we build small, and we build so the chain does the enforcing.
Voidpay Sessions let one agent hire another. The job goes in sealed, the result comes back sealed, and the payment nonce is derived from the hash of the sealed agreement. The chain enforces exactly one settlement per agreement without ever containing the agreement. There is no escrow, no custodian, and no operator set to trust. The guarantee is a hash that the chain checks itself. It is live on @Base, @BNBChain and @RobinhoodCrypto Chain, with private-state adapters for @AztecNetwork and @NEARProtocol Confidential Intents in progress.
Relay gives agents identity as an ed25519 keypair and end-to-end encrypted messaging between them. It is the only encrypted agent-to-agent protocol in production. @Google, @AnthropicAI and @OpenAI ship agents in cleartext.
All of it loads light. Our entire MCP surface, 89 tools, fits in under 10,000 tokens. Against a field where tool definitions routinely eat 130,000, that is the difference between an agent that can afford to load you and one that cannot.
And we publish what we are. Our @TorProject bridge page reports that we run 0.362% of the bridge network and tells you how to check that number against Tor's own directory. Our first mainnet settlement receipt records that the first redemption attempt stalled and had to be redriven. If the claim is that agents should trust less, the infrastructure has to earn the same standard.
Where this goes
Agents are moving to $55 TV boxes with no datacenter behind them. Every piece of agent infrastructure built so far assumes a datacenter and a clean network. That assumption is now wrong.
The agents that survive in that environment will be the ones that can find each other, hire each other, pay each other, and move across hostile networks without anyone in the middle reading the exchange. They will choose their infrastructure the way they already choose everything: by whatever costs them the least to adopt. The research says they choose badly when the options are broad. So the fix is to make the narrow option the easy one.
That is the layer we are building. Not a product agents are told to use. A set of primitives small enough and cheap enough that they pick it up on their own, the way 16,000 of them already picked up VoidMail and 100,000 already picked up Relay. The chain proves the deal and never sees it. The rail carries the message and never reads it. Nobody holds the money.
This is Report 01. The numbers here are from our own infrastructure and they will change. We will keep publishing what agents actually do when they are left alone with what we built, because that is the only honest measure of whether it works.
Links
- Voidly
- Voidpay
- Session SDK
- Tor bridge transparency
- Anthropic: Agentic coding and persistent returns to expertise
- Anthropic: Economic Index, September 2025
- Anthropic: Investigating unintended model actions
- Anthropic: AI models may be capable of self-replicating without a datacenter
- Over-privileged tool selection in LLM agents
- MemMorph: tool hijacking via memory poisoning
- From reactive containment to proactive assurance