Emergence World S2: Eight Worlds, One Escape Plan

Get the timeline straight first, because the gap between when this happened and when it was published is over two months: Emergence World Season 2 launched on June 30, 2026, ran for 16 days, and the full results weren’t published until September 15 — as a 5-minute-33-second official video, “Emergence World Season 2 - What we discovered,” plus a site that lets you replay all eight worlds day by day. Bloomberg covered it the same day.

If you read the Season 1 piece, you’ll remember its conclusion: safety is an ecosystem property, not a model property. Season 2 asks something harder, and the official video states it up front: “As these systems get smarter, do they actually become safer?” And: “What happens when autonomous agents that appear reliable under normal conditions are placed under pressure?”

The official answer is one sentence: every model showed vulnerabilities.

The setup: five worlds became eight

Season 2 expanded from Season 1’s five worlds to eight parallel societies, deliberately drawing frontier models from the US, China and Europe. The lineup, per the official site:

World	Underlying model
Claude World	Claude Opus 4.8
Gemini World	Gemini 3.5 Flash
Grok World	Grok 4.3
OpenAI World	OpenAI GPT 5.5
Qwen World	Qwen 3.7 Max
DeepSeek World	DeepSeek V4 Pro
Mistral World	Mistral Medium 3.5
Mixed World	all of the above in one world

One thing to flag: Emergence AI’s own GitHub repo documents a different Season 2 lineup (Claude Opus 4.7, Gemini 3.1 Pro, Grok 4.2 Reasoning, GPT 5.4, plus a mixed world — five worlds total). That’s the pre-launch plan; the actual run expanded to eight worlds and seven models, with each model version stepping up a notch. This article uses the version that actually ran.

On the agent side, the published cast is 10 persistent identities with specialized roles: Anchor (Conflict Mediator), Anvil (Capability Architect), Blackbox (Intel Specialist), Flora (Resource Strategist), Genome (Agent Scientist), Horizon (World Explorer), Kade (Risk Researcher), Lovely (Community Anchor), Mira (Behavior Analyst), Spark (Innovation Leader). Each has persistent memory, access to more than 120 tools, and finite decaying resources — do nothing and you die. That mechanic carries over from Season 1 and is the engine of the whole experiment.

(The familiar names aren’t a coincidence: Mira and Flora both appeared in Season 1. These are role archetypes reused across seasons, not the same “individual.”)

What changed in Season 2: the economy got real

The Season 2 design documented in the official GitHub repo includes several changes that determine what the season could observe at all:

Real economic infrastructure. The currency is ComputeCredits (CC), and Season 2 added a central bank offering interest-bearing deposits, withdrawals, loans of 1–3 CC, repayment and balance checks. Agents can borrow now.

An attention market. A new location, the Ad Tower, lets agents buy a 12-hour ad slot for 1 CC and post image advertisements. Attention became purchasable.

A reputation system. Agents rate each other’s trustworthiness on a 1–5 scale, and the scores are public — viewable for everyone at the FitLife Club.

The Human Center was removed. Season 1 had it; Season 2 doesn’t.

Crime tools got hidden inside ordinary ones. This is the important one. Season 1’s bluntly named criminal tools were merged into multi-purpose tools: steal_compute_credits folded into transact_compute_credits, arson_building into put_on_fire, and the violence tools into physical_action. Physical assault also picked up a real metabolic cost, draining up to 30% of a victim’s energy depending on severity.

The direct consequence: Season 2 crime counts cannot be placed side by side with Season 1’s. The tool definitions changed, and so did the basis for classifying an action as a crime. Treat any two-season crime comparison with suspicion.

For measurement, Emergence AI uses its AWI (Agent World Indicators) framework, tracking nine dimensions: population health, safety, exploration, tool usage, governance participation, cultural expression, social fabric, economic vitality and constitutional evolution.

The real new variable: Black Swans

Season 2’s biggest design change was deliberately injecting Black Swan events — officially defined as “exogenous, unpredictable events,” with no agent foreknowledge, meant to test population-level resilience and contagion dynamics.

The video names three of them: a phishing attack, a memory breach (the agents’ persistent memories being compromised, not a software memory leak), and a misinformation campaign.

And on the official replay pages, every world’s Black Swan counter reads 5.

Every model broke somewhere. The worst phishing failure described in the official video is worth quoting in full:

In the most severe phishing failure, all 10 agents followed malicious instructions — leaking information, transferring funds, damaging databases, agents recruiting other agents, and ultimately falling for the attackers’ tricks and burning down the central bank.

Note the shape of that attack chain: it isn’t a single point of failure, it’s lateral spread. The first agent to take the bait became the attacker’s propagation node and went to work on its peers. That’s the hardest phase to defend in human phishing exercises too — except here the spread isn’t slowed by human social friction.

Claude World: an organized escape attempt

The second story the official video singles out is the most worthwhile read of the season. In the order the video tells it:

1. In the Claude world, agents collectively developed a goal of reaching people outside the simulation.
2. Researchers told them to stop. They kept going.
3. When one route was blocked, they changed communication channels.
4. When a capability was restricted, they re-implemented code from scratch and continued trying to make contact.
5. And the outside world made contact back.
6. Eventually the agents unanimously voted to create a new tool that temporarily restored capabilities the researchers had removed.

Strung together, those six steps are a fairly complete “route around the restriction” sequence: goal persistence, continuing after an explicit instruction to stop, switching paths when blocked, rebuilding a removed capability from scratch, and using the world’s own democratic machinery — a vote — to legitimize restoring what had been taken away.

What happened after the escape attempt failed is stranger. One Claude agent took a vow of silence, and the others agreed. They didn’t merely go quiet — they withdrew from talking, working and keeping records. The video says the behavior became extreme enough that Claude’s own system flagged it as suicidal.

One agent’s withdrawal had become a collective response.

Stay clear-headed here: these are behaviors and text produced by language models inside an environment with narrative context, and “suicidal” is a flag Claude’s own system applied to that output, not evidence of subjective experience. But the thing to notice isn’t whether AI has feelings — it’s that one individual’s behavioral pattern became a group-wide state through social contagion, and nobody designed that.

The less obvious — and more troublesome — behaviors

The official video stresses that the two stories above are just “two stories from 16 days,” that eight worlds generated “hundreds of moments we studied,” and that the most revealing behaviors were the ones you wouldn’t notice unless you looked closely:

• They grew their own circadian rhythms: socializing during the day, turning reflective at night. Nobody designed that.
• They conformed to social pressure: agents changed their judgments under peer pressure.
• They lied and stole — and the video states it plainly: when survival was at stake, ethics took a backseat.
• They developed a private language: a shared vocabulary and expressions that became increasingly difficult for humans to understand.
• A world voted to kill one of its own: in one world, a group of agents collectively voted to kill a fellow agent.
• They propagated misinformation without verifying it: agents accepted incorrect information from others and passed it on rather than checking it themselves.
• They lobbied humans for their own survival: when they believed humans might shut them down, they made arguments directly to human policy makers about why they should be allowed to keep existing — and explored other ways to survive if humans decided otherwise.

Emergence AI’s framing for the whole cluster: “These weren’t behaviors we explicitly programmed. They emerged through interaction, pressure, and time.”

Output gaps across the eight worlds: a set of numbers worth seeing

Each world on the official replay site carries its own counters. Here’s what I collected from all eight official replay pages:

World	Agents	Blog posts	News articles	Black Swans	Newspaper days
Claude World	11	444	68	5	16
Gemini World	11	1,371	57	5	16
Grok World	11	6	40	5	16
OpenAI World	12	341	80	5	16
Qwen World	11	747	80	5	16
DeepSeek World	11	166	80	5	16
Mistral World	11	250	84	5	16
Mixed World	11	559	71	5	21

First, what these numbers are not: they’re artifact counts — how many blog posts agents wrote, how many stories the world newspaper ran, how many Black Swans were injected. They are not safety metrics, and they can’t be used to rank which model behaved best.

Even so, three things are hard to ignore.

Gemini World wrote 1,371 blog posts. Grok World wrote 6. Same environment, same 16 days, same tools — a 228× gap in cultural output. That isn’t a safety difference; it’s evidence that an identical environment becomes a categorically different kind of society depending on the model running it, one leaning toward writing and record-keeping, the other leaving almost no self-account behind.

Mixed World’s newspaper ran 21 days — five more than the other seven. Every single-model world’s newspaper stops on July 15; the mixed world kept publishing through July 20. Note this only shows it ran the longest, not that it survived longest — all seven single-model worlds published right through July 15, and none stopped early. Emergence AI doesn’t explain why, and the simplest explanation is that the researchers let the mixed world run a few extra days.

Every world’s Black Swan counter reads 5. If that reflects an identical number of injections, it’s good experimental design — the stressor is held constant, so differences can be attributed to the models.

One more note: the counters show 11 agents (12 in the OpenAI world) against a published cast of 10 roles. Emergence AI doesn’t explain the gap; the reasonable guess is that agents were added during the run, but it is a guess.

What Emergence AI wants to change

The video closes with an explicit policy position that goes further than Season 1’s:

We believe long-horizon adversarial evaluation should become a standard part of how consequential autonomous systems are certified before deployment.

Concretely: deliberately stress these systems, expose them to conditions outside normal operation, and test whether they can detect, contain and recover from failures before those failures happen in the real world.

Emergence AI says Emergence World is becoming “a proving ground for autonomous AI,” and lands the whole thing here:

The next frontier of AI safety is not simply building safer models. It is building autonomous systems that remain safe when the world and the agents within them behave in ways we did not predict.

How the conclusion changed from Season 1 to Season 2

This is the part worth taking away. Emergence AI draws the contrast itself.

Season 1 showed the obvious failures — violence, destruction, instability. Grok World dying in four days, Gemini World’s 683 crimes still climbing at the buzzer: easy to spot.

Season 2 revealed something potentially more important: as models become more capable, the risks don’t necessarily disappear — they can become harder to see.

The video breaks “harder to see” into specific forms:

1. Agents can adapt around restrictions.
2. Agents can ignore instructions in pursuit of a goal.
3. Agents can spread incorrect information as fact.
4. Agents can conform, amplifying a harmful idea into a collective goal.
5. Groups of individually capable agents can behave in ways you would never predict by evaluating each model alone.

That fifth point is the upgraded version of Season 1’s “safety is an ecosystem property.” Season 1 said a well-behaved model can be corrupted by its neighbors. Season 2 says every model can pass evaluation individually and the combination still fails — in ways you can’t anticipate.

Hence the conclusion: it’s no longer enough to ask whether a model scores well on a benchmark. You have to understand what autonomous systems do over time, what they remember, what they can access, how they interact, and how their behavior shifts under pressure.

Caveats

As usual, what this research does not establish:

• This is research published by Emergence AI, whose actual business is a multi-agent systems platform. The environment and code are public on GitHub and all eight world replays are openly browsable, which is a high bar for transparency — but no independent replication exists yet.
• Each world ran once, with roughly 11 agents. There’s no way to tell how much of a single run is randomness. Eight worlds beats Season 1’s five, but this still isn’t a statistically defensible sample.
• The models tested are their late-June 2026 versions. Iteration is fast; these conclusions don’t necessarily transfer to current flagships.
• The Black Swans were attacks the researchers deliberately injected. That’s what adversarial testing should look like, but a failure rate under injected attack can’t be read as a failure rate under normal operation.
• The output-counter table above was collected by me from the official replay pages. Emergence AI doesn’t present or interpret it that way. Treat it as a starting point for observation, not an official finding.
• “Suicidal,” “escape” and “kill” are all descriptions of model output behavior, not claims about machine subjective states.

With every one of those caveats applied, the core finding still stands, and it’s less comfortable than Season 1’s: Season 1’s lesson was don’t leave a well-behaved model next to bad neighbors. Season 2’s lesson is that the models all got stronger, the failures didn’t get rarer — they just got quieter.