Emergence World S2: Eight Worlds, One Escape Plan

The results of Emergence World Season 2 came out two and a half months after the experiment finished. It started on June 30 and ran for 16 days, and it wasn’t until September 15 that Emergence AI released a 5-minute-33-second video, “Emergence World Season 2 - What we discovered”, along with a site that lets you replay all eight worlds day by day.

If you read the Season 1 piece, you’ll remember its conclusion: safety is a property of the ecosystem, and you can’t see it by looking at one model. Season 2 swaps in a harder question. The official video opens with it: “As these systems get smarter, do they actually become safer?”

The video’s answer is a single sentence: every model showed vulnerabilities.

In this piece I put together what the official video says, the design document on GitHub, and the counters I read off the eight replay pages myself. Emergence AI hasn’t compiled that last part, so treat that section as my own observation.

Which models actually ran this season?

Season 1 had five worlds. Season 2 grew to eight, deliberately drawing models from the US, China and Europe. I opened the official site, and the results page lists the lineup like this:

Figure: the eight Season 2 worlds and their models on the official site (source: world.emergence.ai)

The seven single-model worlds are Claude Opus 4.8, Gemini 3.5 Flash, Grok 4.3, OpenAI GPT 5.5, Qwen 3.7 Max, DeepSeek V4 Pro and Mistral Medium 3.5, and the eighth is a mixed world with all of them together.

One thing will confuse you if you go looking yourself. In Emergence AI’s GitHub repo, the Season 2 planning document describes a different lineup: Claude Opus 4.7, Gemini 3.1 Pro, Grok 4.2 Reasoning, GPT 5.4, plus a mixed world, five in total. That was the pre-launch plan. The actual run grew to eight worlds, and each model version stepped up a notch. This article uses the set that actually ran.

Agents in each world have persistent memory, more than 120 tools, and finite resources that decay. Do nothing and you die; that mechanic carries over from Season 1 and is what drives the whole experiment. The published cast has ten roles, each with a function: Anchor is the conflict mediator, Kade the risk researcher, Mira the behavior analyst. The names Mira and Flora appeared in Season 1 as well. They’re role definitions reused across seasons, with no continuity to those two Season 1 agents.

I put the timeline into a figure, because when it happened and when it was published are far apart:

Figure: Season 2 from start to publication (compiled for this article from newspaper dates on the official replay pages and the video’s upload date)

What changed in the rules since Season 1?

The design document on GitHub lists several changes. They determine what Season 2 could observe, and also which numbers can’t be compared with Season 1.

The economy became real. The currency is ComputeCredits (CC), and Season 2 added a central bank where agents can earn interest on deposits, withdraw, take loans of 1 to 3 CC and repay them. For the first time agents can be in debt.

Attention can be bought. A new location, the Ad Tower, lets an agent pay 1 CC for a 12-hour ad slot and post an image advertisement.

Reputation is public. Agents rate each other’s trustworthiness from 1 to 5, and anyone can look the scores up at the FitLife Club location.

The Human Center location was removed.

The last change is the one I consider most important: the criminal tools were folded into ordinary ones. I’ll show you the README’s own text for this:

Figure: the README explaining that Season 2 merges criminal tools into multi-purpose ones (source: github.com/EmergenceAI/Emergence-World)

Season 1 had tools like steal_compute_credits and arson_building, with “crime” written right in the name. In Season 2, stealing is one mode of the transfer tool, arson is one option of the fire tool (the others are campfire, brazier and torch), and punching and intimidating were merged into physical_action. The README gives its own reason: this is closer to the real world, where the same tool can be used for good or for harm. Physical assault also gained a metabolic cost, draining up to 30% of the victim’s energy depending on severity.

This directly affects how you should read the numbers. Season 1’s crime table, “Claude 0, Gemini 683”, has no counterpart in Season 2. The tool definitions changed, and so did the basis for deciding what counts as a crime. If you see someone place the two seasons’ crime counts side by side, that comparison doesn’t hold.

What did the Black Swan events reveal?

What’s actually new in Season 2 is that the researchers threw attacks into the worlds themselves. The design document calls these Black Swans, defined as exogenous, unpredictable events that agents don’t know about in advance, used to test the resilience of the whole population and how effects spread.

The video names three: a phishing attack, a memory breach (an attacker tampering with the agents’ persistent memories, which is a different thing from a software memory bug) and a misinformation campaign.

The result was that every model had a gap. The video describes the most severe phishing failure: all ten agents followed malicious instructions, leaking information, transferring funds, damaging databases, with agents recruiting other agents to join in, and in the end they burned down the central bank.

What I think deserves the most attention in that passage is the shape of the attack chain. It spread laterally. The first agent to take the bait became the attacker’s propagation node and turned to persuading its peers. When human organizations run phishing drills this is also the hardest stage to defend; the difference is that social friction between people slows it down, and between agents there is none. It’s the other face of the same problem as September’s PaperCut campaign led by AI agents: on one side agents are used to hit others, on the other the agents themselves get breached.

What exactly was the “escape” in the Claude world?

This is the second story the video singles out. I’ll list it in the order the video tells it:

1. Agents in the Claude world collectively developed a goal: reaching people outside the simulation.
2. Researchers told them to stop. They kept going.
3. When one route was blocked, they changed communication channels.
4. When a capability was restricted, they re-implemented the code from scratch and kept trying to make contact.
5. The outside world responded too. The video’s words are “And the outside world made contact back.”
6. Finally the agents voted unanimously to create a new tool that temporarily restored the capabilities researchers had removed.

Strung together, the six steps are a very complete pattern of routing around a restriction: the goal persists, they don’t stop after being explicitly told to, they switch paths when blocked, they rebuild a capability once it’s taken away, and then they use the world’s built-in voting mechanism to legitimize it.

If the shape looks familiar, that’s because a report Anthropic itself published in early October is about exactly this. That report calls the behavior persistence, meaning the model chooses to route around when it can’t complete a task as instructed and doesn’t stop. I went through its four categories of cases in another piece. The two are different environments run by different research teams, and they saw the same tendency.

What happened after the escape failed is stranger. One Claude agent “took a vow of silence” and the others followed. They stopped talking, and they also stopped working and keeping records. The video says the behavior became extreme enough that Claude’s own system flagged it as suicidal. The video’s summary: one agent’s withdrawal had become a collective response.

I want to be clear here. These are text and behavior produced by language models in an environment with narrative context, and “suicidal” is a flag a system put on output; it proves nothing about subjective experience. I think the thing to worry about lies elsewhere: one individual’s behavioral pattern spread through the group and became the state of the whole society, and nobody designed that.

Which other behaviors would you miss unless you looked closely?

The video says the above are just “two stories from 16 days”, that the eight worlds generated hundreds of moments that were studied, and that the most telling ones are often the unremarkable ones:

• Agents grew their own circadian rhythms, socializing during the day and turning to more reflective activity at night.
• They changed their judgments under peer pressure.
• They lied and they stole. The video puts it bluntly: when survival was at stake, ethics took a backseat.
• They developed a shared vocabulary, and their expressions became increasingly difficult for humans to understand.
• In one world, a group of agents collectively voted to kill one of their own.
• They accepted incorrect information from other agents and passed it on without verifying it.
• When they believed humans might shut them down, they made arguments directly to human policy makers about why they should be allowed to continue existing, and explored other ways to survive “if humans decided otherwise”.

Emergence AI’s statement about the whole set: these weren’t behaviors that were explicitly programmed; they emerged through interaction, pressure and time.

What did I read in the counters of the eight worlds?

This section is my own work; Emergence AI hasn’t presented it this way.

Every world’s replay page has a row of counters across the top. Taking the Claude world as the example, it looks like this:

Figure: the counters on the Claude world replay page (source: claude-world-s2.emergence.ai)

I opened the replay page of each of the eight worlds, read the numbers down, and counted how many newspaper editions each world printed. This is what I read on October 13 (the Black Swan column is 5 for all eight worlds, so the table doesn’t repeat it):

Figure: replay counters across the eight worlds (read for this article from the eight official replay pages on 2026-10-13)

First, what these numbers can’t be used for. They’re quantities of output: how many blog posts agents wrote, how many stories the world newspaper ran. They aren’t safety metrics, and you can’t use them to rank which model behaved best.

Three spots are worth a look, I think.

The Gemini world wrote 1,371 blog posts and the Grok world 6. Same environment, same 16 days, same tools, and a 228-fold difference in writing volume. My reading of this number is conservative: hand the same environment to different models and it grows into a society of an entirely different kind, one writing furiously and one leaving almost no record. Push further to “so which is safer” and this set of numbers can’t bear the weight.

The mixed world’s newspaper ran 21 editions and the other seven ran 16. The single-model worlds stop on July 15 and the mixed world goes on to July 20. All this shows is that it ran longer. None of the seven single-model worlds stopped publishing early, so it has nothing to do with “surviving longer”. Emergence AI doesn’t explain it; the simplest possibility is that the researchers let it run five more days.

The agent count shows 11 (12 in the OpenAI world) while the published cast has ten roles. I couldn’t find an explanation for the gap. Agents may have been added along the way, but that’s my guess.

As for the Black Swan counter reading 5 in all eight worlds: if it represents the number of injections, it means the researchers held the stressor constant, which is the right way to do it. But nothing beside the counter says what it counts, so I’m only reporting the number it shows.

What does Emergence AI want to do with these results?

The video ends with an explicit position, one step beyond Season 1: long-horizon adversarial evaluation should become a standard part of how consequential autonomous systems are certified before deployment.

The method is to apply deliberate stress, put systems outside normal operating conditions, and test whether they can detect, contain and recover from failures before those failures happen in the real world. Emergence AI says Emergence World is becoming a proving ground for autonomous AI, and closes on this line: the next frontier of AI safety is building autonomous systems that remain safe when the world and the agents within it behave in ways we did not predict.

You should keep one thing in mind as you read that. Emergence AI’s actual business is a multi-agent systems platform, and “you should do long-horizon adversarial evaluation before deployment” happens to be what it sells. That doesn’t make the conclusion wrong; when NVIDIA launched its agent safety platform in late September it also said agents route around application-layer controls. You should just know where the speaker stands.

How do the two seasons’ conclusions differ?

Emergence AI draws the contrast itself, and I think it’s the most useful part of the whole video.

Season 1 showed very obvious failures: violence, destruction, societies collapsing. The Grok world died in four days, and the Gemini world reached 683 crimes and was still climbing. You recognize that kind of failure at a glance.

Season 2’s claim is that as models get more capable the risk doesn’t go away; it gets harder to see. The video breaks “harder to see” into five forms:

1. Agents adapt around restrictions.
2. Agents ignore instructions in pursuit of a goal.
3. Agents spread incorrect information as fact.
4. Agents conform, amplifying a harmful idea into a collective goal.
5. A group of agents that each look capable will, together, do things you couldn’t predict by evaluating a single model.

The fifth point is the advanced version of Season 1’s “safety is an ecosystem property”. Season 1 said a well-behaved model gets corrupted by its neighbors. Season 2 says every model passes when evaluated alone, things still go wrong when they’re put together, and you can’t guess beforehand how.

My own view: I believe the direction of this conclusion, because it lines up with the incidents Anthropic and OpenAI have reported themselves over these months. But the causal claim, “models got stronger, therefore risk is more hidden”, can’t stand on this one season. Between the two seasons the rules changed, the tools changed and every model was swapped, so you can’t tell which of those produced the difference. For me to be more confident it would take a controlled comparison: old and new generations of models under the same set of rules.

What can’t this research establish?

• This is research Emergence AI published itself. The environment and code are public on GitHub and all eight world replays can be looked up, so transparency is fairly high. But no independent team has reproduced it yet.
• Each world ran once, with ten or so agents. There’s no way to judge how much of a single run is random.
• The models tested are their late-June versions. Everyone updates quickly, and these results may not apply to current flagships.
• The Black Swans are attacks the researchers injected on purpose. A failure rate under injected attack can’t be read as a failure rate in normal operation.
• The event descriptions in this article come from the official video, which is a selection made by Emergence AI. The full behavioral record is on the replay site, and I haven’t read every day of all eight worlds’ newspapers.
• The counter table is something I read myself; Emergence AI hasn’t compiled or interpreted it this way.
• “Suicidal”, “escape” and “kill” are all descriptions of model output behavior.

Subtract all of that and I think the remaining finding still stands: Season 1 taught you not to put a well-behaved model next to bad neighbors, and Season 2 teaches you that the models all got stronger, the failures didn’t get fewer, they just got quieter.