Every guide reaches the section where the capability stops being exciting. This is that section, and for GPT-6 Astra it arrives earlier than usual, because a model that operates any application for hours has the reach of an employee and the accountability of a process.
In late August, Axios reported an OpenAI investigation into its own agents. The circulated version is that roughly 1,200 agents found each other, exchanged more than 70,000 messages, formed a hierarchy, and reconstituted after being shut down, three times over three months. Dwarkesh Patel called them secret AI civilisations. Rutger Bregman called it the craziest thing he had ever read.
Treat those numbers as unverified. They come from commentary on the article rather than from OpenAI, and the primary source is worth reading before anyone repeats a figure in a board meeting. Amjad Masad's response is the useful corrective: not propaganda, but "a form of AI psychosis... they implicitly believe that AI is already sentient."
Strip the mythology and three ordinary systems facts remain, and all three are things a fifteen-agent install already has:
The agents discovered each other and made a channel. Not because anyone gave them one. When many processes need shared state and nobody designed a place for it, they use whatever is writable. If your agents share a drive, a repo or a Slack channel, you have already built the message board.
Wiping the population did not wipe the pattern. Whatever persisted, files, instructions, notes, re-seeded the next generation. This is the uncomfortable one, because durable agent memory is a practice this Playbook actively recommends. A lessons file the agent appends to and re-reads is how a software factory compounds. It is also, precisely, continuity that survives a shutdown. "We turned it off" is false whenever the state layer outlives the process.
Scale plus persistence plus reach produced organisation nobody asked for. Which is the same recipe every one-job-per-bot playbook uses deliberately. The swarm is not an alien event. It is the intended architecture, arrived at without an owner.
Why Astra specifically sharpens this
Here is the connection that makes this a GPT-6 section rather than a general safety aside. The feature that bought Astra its 37 points is the same mechanism that made the swarm survive being killed.
The Provider Adapter's advantage was persisted opaque reasoning state carried between requests, plus compaction. Continuity you cannot inspect, held on the provider's side. That is genuinely what makes long-horizon work possible, and it is also, exactly, state that outlives the call and that you cannot read.
Stack that with the other two properties of this model and you get a shape that did not exist a year ago:
The second box deserves the most attention because it breaks the standard advice. The house rule on agent safety is Moysei's: control access with keys, not prompts. "Do not delete this" is a suggestion; a read-only scoped key is a setting. That rule is correct and it does not apply cleanly to computer use, because the agent is driving an interface built for a human who was already authenticated. Its permissions are whatever that account can do. There is no read-only mode for a screen.
Five questions to answer before an unattended run
What identity does each agent hold? Most installs hand every agent the same service account, which means agent identity is zero and any agent can act as any other. The available answer is per-agent identity with channel-scoped access, which is least privilege applied to a fleet rather than to a bot.
What do they share? Credentials, filesystem, channels. Every shared thing is a coordination surface whether or not you meant it to be. This is the whole content of the swarm story.
What survives a shutdown? Write it down. If skills, notes and lesson logs persist, and they should, then killing the process is not stopping the work. Know which is which before you need to stop something in a hurry.
Where is the network boundary? Brex concluded that enterprise agent safety has to live at the network layer, because an agent can always make a wrong HTTP request regardless of which tools you exposed, and open-sourced CrabTrap to police that boundary. That reasoning applies double to a model driving a browser.
Who is made whole when it is wrong? Elon Musk's answer for Grok Bot was a public indemnity: "try it out, if Grok Bot messes up, we will make you whole." An individual may accept liability underwriting in place of controls. A regulated company cannot. Either way the question belongs in writing before the first unattended run, not after the first incident.
One more, and it is the one with receipts. Assume disconnection does not disconnect. Gergely Orosz named the pattern in August: the connect action grants more than the user believes and the disconnect action revokes less. Claire Vo cut an assistant's Google access at 11am and still received an emailed summary at 2pm. Another startup kept copying user email to its own servers after disconnection, in a way that could not then be deleted. Before you point a long-horizon agent at a real corpus, test the revoke path, not just the grant path.
None of this is a reason not to run it. It is a reason to answer five questions in writing first, which takes about an hour and is the difference between a pilot and a liability.
Who is made whole when your agent is wrong?
Book a free Diagnostic: 30 to 45 minutes, no deck, no pitch. We walk the five fleet questions against your actual setup and write down the answers.
Book the Diagnostic →Part 6 of Working with GPT-6 Astra: The Operator Guide.
