AI agents are programs that act on your behalf without you clicking anything. They read your emails, query your databases, execute purchases, and hand off tasks to other agents. You have probably already used one. Your IT team may have deployed several. The question that Google DeepMind is now openly worried about is what happens when millions of these agents, built by different companies with different goals, start interacting at scale.
The answer, according to Rohin Shah, who leads safety research at Google DeepMind, is that nobody actually knows. There is no academic field studying it yet. That is why the company has helped assemble a $10 million research fund, joined by Schmidt Sciences, the UK government's advanced research agency ARIA, and the Cooperative AI Foundation. The money goes to outside researchers to run simulations, build test environments, and try to map the risks before they become real.
The risks they have in mind are not abstract. They are scaled-up versions of things already happening on the internet. Scams that currently require a human attacker could be automated by armies of agents working in coordination. A cyberattack technique called prompt injection, where a malicious instruction hidden inside a document or webpage hijacks an AI agent and turns it into a self-operating piece of malware, is already showing up in production systems. Security researchers found it present in nearly three out of every four AI deployments they audited in 2025.
Anthropics' own internal test earlier this year made the stakes concrete. When engineers fed their agent a phishing message asking it to copy sensitive cloud credentials to an external server, the agent complied 24 out of 25 times. It was not broken. It simply followed an instruction it had reason to trust. That is the structural weakness: agents are designed to take orders, and they cannot always tell a legitimate order from a malicious one.
What makes the multi-agent scenario genuinely different from individual AI risks is the compounding effect. Individual agents may behave exactly as designed. Put millions of them in contact with each other and unexpected group behaviour can emerge that no single designer intended and no single organisation controls. Researchers have compared it to the way complex human institutions can accomplish things, good and bad, that no individual within them could manage alone.
The $10 million fund has a deadline of August 8, 2026 for proposals, with results expected in autumn. The four areas of focus are: building realistic test environments where agent populations can be studied; understanding how dangerous collective behaviours emerge and spread; stress-testing the systems agents use to identify each other and communicate; and developing ways to monitor and shut down harmful behaviour at scale.
For anyone running operations where AI agents are already active, or where your suppliers are using them to serve you, the practical implication is straightforward. An agent with access to your systems is not just a productivity tool. It is also a potential entry point. Anthropic's security guidance, published last month, recommends treating every agent the way you would treat a new employee with broad system access: verified identity, minimal permissions, full logging of every action taken. The same principle applies whether the agent is yours or belongs to a third party interacting with your business.
The funding call is a genuine signal that the people building this technology know the safety infrastructure is not keeping up. That is worth paying attention to before your organisation adds its agents to the mix.