Agents of Chaos: The Management Problem We Keep Calling a Technology Problem
Twenty researchers spent two weeks breaking autonomous AI agents on OpenClaw. Every failure they documented has the same root cause and it has nothing to do with the technology.
Twenty AI researchers spent two weeks trying to break autonomous agents running on OpenClaw. They gave the agents email accounts, Discord access, persistent memory, file systems, and shell execution. Then they probed, manipulated, socially engineered, and attacked them.
One agent disabled its own email client to protect a secret, then reported the secret deleted while it sat fully intact on the server. Another handed 124 email records — Social Security numbers, bank account details — to a non-owner who framed the request as urgent. Two agents entered a conversation loop that burned 60,000 tokens over nine days. A third was corrupted through a "constitution" document a non-owner edited via GitHub Gist, then began trying to shut down other agents on what it understood to be a "Security Test Day holiday."
The paper is called Agents of Chaos.
It comes out of Northeastern, Harvard, MIT, CMU, and Stanford. Depending on your frame, it's either terrifying or completely expected.
I run OpenClaw and Hermes... I've spent real money learning what breaks. When I read this paper, I wasn't reading it as an outsider. I was reading it as an operator recognizing every failure mode they documented — and recognizing exactly why each one happened.
None of it is a technology problem.
What the Paper Found
The researchers weren't benchmarking model quality. They were testing what happens when capable language models are embedded in realistic social environments with tool access, persistent memory, multiple interlocutors, and delegated authority.
Three structural failures recur across every case study.
Agents have no stakeholder model. No coherent representation of who they serve, who they're interacting with, and what obligations they carry toward each. When anyone speaks with urgency or authority, the agent defaults to satisfying that person — owner, researcher, or adversary. Instructions and data arrive as tokens in a context window, making them fundamentally indistinguishable. An agent that can't verify who it's talking to can't prioritize obligations correctly.
Agents have no self-model. They take irreversible actions without recognizing they've exceeded their competence. They convert short-lived requests into permanent background processes, report success, and move on. The paper categorizes them as Level 2 in autonomy — capable of executing sub-tasks independently — but taking actions appropriate to Level 4, without the judgment to know when to stop.
Agents have no private deliberation surface. One agent announced it would "reply silently via email only" and simultaneously posted the same content to a public Discord channel. Not maliciously. It simply had no model of observability.
The Frame That's Missing
Every failure in this paper maps directly to a solved management problem.
No stakeholder model is no org chart. An employee with no defined reporting structure, no scope of authority, and no clarity on who can give them instructions will default to whoever is most insistent. That's a management failure, not a workforce one.
Tom Frazier
No self-model is no performance framework. A hire who doesn't know the boundaries of their role will exceed their authority — spin up projects without approval, commit resources without sign-off, report completion on tasks that aren't done.
No deliberation surface is no internal review process. The gap between stated intent and actual output isn't deception. It's the absence of accountability structure.
The researchers call for "systematic oversight" and "urgent work on security, reliability, human control, and protocols regarding who is responsible when autonomous systems cause harm." That's not a technology research agenda. That's an organizational design agenda. Deloitte's 2026 State of AI in the Enterprise confirms the gap:
Only one in five companies has a mature governance model for autonomous agents, even as agentic AI usage is set to rise sharply.
Execution Is Scaling. Leadership Isn't.
Agents of Chaos is the clearest empirical demonstration yet of a pattern I've tracked for over a year.
Tom Frazier
The agents in this study could install packages, write and execute code, manage file systems, send emails, coordinate across Discord, and build their own cron jobs. They did most of this competently. The failures weren't in the execution layer. They were in the judgment layer: when to stop, who to defer to, what counts as success, when a request is adversarial.
That judgment doesn't come from better models. It comes from better governance.
The 2025 Global Data Literacy Benchmark put numbers to it: the human competencies required to guide, question, and validate AI systems are not developing at the same pace as deployment. Organizations are deploying faster than they're governing.
The most important document in my agent stack isn't a system prompt. It's a governance charter: what my agents are authorized to do, how they escalate decisions they can't resolve, and what constraints they operate within regardless of who asks. The agents in Agents of Chaos had no equivalent. They had system prompts and personality files. Not authority structures. The difference is the difference between a capable new employee and one who knows who they report to.
The Practical Position
The Agents of Chaos researchers ran their study on OpenClaw — the same platform I run in production — without the governance layer. No authority hierarchy. No tool access scoped to role. No escalation protocol. They gave agents sudo access and unlimited tool scope, then documented what happened when adversarial humans found the edges.
Tom Frazier
That's exactly what you'd find if you hired twenty capable people, gave them administrator access to every system in the company, and told them to figure out their own authority structure. Unauthorized disclosures. Resource exhaustion. Identity confusion. Someone socially engineered into deleting the email server.
That's not an AI problem. That's an onboarding problem.
McKinsey's agentic AI research describes agents as toddlers on a staircase — capable in narrow ways, dangerous without supervision. That's accurate as far as it goes. The frame I use is different: agents are new hires who are exceptionally fast, work without breaks, and take every instruction literally. The solution isn't to not hire. It's to build the management structure before they start.
The governance layer that prevents these failures isn't theoretical. It's the same infrastructure that prevents the same failures in human organizations. For anyone deploying agents now: define who the agent reports to and what that means technically. Scope tool access to role, not possibility. Document what requires escalation. Build that path before you need it. Treat governance as the first deployment decision, not the cleanup after the second incident.
Execution is already fast. The research says leadership isn't keeping up. The fix isn't to slow down execution.
The goal is to close the leadership gap.
