Agentic World

For a long time, I thought about AI security primarily at the level of the model. Can the model be manipulated? Can an attacker inject malicious instructions into its context? Can sensitive information leak through its responses? Can its behavior be redirected?

These are still fundamental questions. But while thinking about autonomous AI systems, I began to feel that something important changes when we move from one intelligent model to many interacting intelligent agents.

Perhaps the model itself will eventually no longer be the most interesting boundary to defend.

Consider a single AI system receiving an untrusted instruction. The immediate security question is relatively clear: how will that input affect the behavior of the model?

Now imagine a different environment. An agent receives information from an external source. It interprets that information, stores part of it in memory, makes a decision, communicates with another agent, and influences what that agent does next.

The second agent may never have interacted with the original source, yet its behavior has changed.

Add persistent memory, tools, delegated tasks, different levels of authority, and evolving trust relationships, and the problem begins to look fundamentally different.

In conventional security thinking, we often search for boundaries: a host, an application, an account, a network, an API, or a database.

Agentic systems introduce another kind of boundary: the boundary between decisions.

An output generated by one agent can become the context of another. An observation can become memory. Memory can influence a future decision. A decision can trigger a tool. That tool can modify an environment that other agents subsequently observe.

The distinction between compromise and influence is particularly important to me.

Suppose an attacker cannot directly control a highly protected agent. That does not necessarily mean the attacker must attack that agent.

What if they can influence what it observes? What if they can manipulate information supplied by another agent? What if unreliable information gradually acquires trust because several agents repeat it? What if contaminated context becomes persistent memory?

None of these scenarios necessarily begins with complete control of the final decision-maker. The security problem may instead emerge through a sequence of individually plausible interactions.

Agentic systems may increasingly rely on machine equivalents of trust: authorization relationships, confidence signals, provenance information, policy hierarchies, delegated permissions, reputation, or other mechanisms for deciding which information and actors deserve greater weight.

But trust creates its own security problem.

An agent should not trust information merely because another agent produced it. An observation should not become trusted memory merely because it has been seen repeatedly. A message should not become an instruction simply because it entered an agent's context.

This is why I increasingly see trust management as something deeper than an access-control problem. In multi-agent environments, trust can influence the flow of information itself.

Memory introduces another dimension that I find particularly important.

Without persistent memory, malicious context may disappear when an interaction ends. With memory, its consequences may survive.

Information encountered today could influence a decision much later, potentially after its original provenance has become less visible. A security event may therefore have an immediate effect, but it may also leave a behavioral residue.

Securing agentic systems may therefore require protecting not only execution, but also the continuity and integrity of state across time.

Imagine a network containing many agents with different responsibilities. A local anomaly appears at one node. Initially, the event seems isolated.

The affected agent communicates with another agent. That agent changes its behavior. Its decision modifies something in the shared environment. Other agents observe the modification. Their internal states change.

This is why I think propagation deserves its own security perspective. The severity of an event may depend not only on what happens at its entry point, but also on how far its influence can travel.

Topology, influence, trust, and communication patterns may therefore become security variables themselves.

These questions led me to build the experimental environment above: Agentic World.

It is an interactive multi-agent security simulation that visualizes agents with different roles, states, goals, trust levels, activity patterns, and security responsibilities.

The current prototype includes agent interactions, a live decision stream, observable state changes, security-event injection, defensive responses, and system-level metrics.

I want to be precise about what it represents. Agentic World is currently a simulation and conceptual research prototype. It is not a claim that a collection of unrestricted autonomous LLMs is performing real-world reasoning behind the visualization.

Instead of describing trust propagation only with words, I wanted to see a network react. Instead of thinking about an agent as a standalone model, I wanted to place it inside a world.

That shift—from agent to world—is the central idea behind the project.

The model remains important, but it is only the beginning.

Context determines what an agent currently sees. Memory determines what survives. Trust affects which information receives greater weight. Interaction allows decisions and information to move between agents. Collective behavior emerges from those interactions over time.

A context-integrity problem might later become a memory-integrity problem. A memory problem might affect trust. A trust problem might alter communication. Communication can then influence behavior elsewhere in the system.

These layers are not replacements for one another. Each inherits problems from the previous layer while introducing new relationships and dependencies.

Model security asks whether an intelligent component can be manipulated. Agent security adds tools, goals, memory, planning, and action. Multi-agent security adds communication, delegation, coordination, and trust.

Agentic ecosystem security adds something larger: system behavior created by interactions among many autonomous components over time.

Agentic World is still evolving. But building it has helped me formulate the question I actually want to investigate:

I do not expect the answer to come from a single defense mechanism. It may involve context integrity, provenance, memory security, trust calibration, communication controls, behavioral monitoring, containment, verification, and mechanisms for recognizing abnormal propagation.

But before designing those defenses, I think we need better ways to see the problem.