AI agent polarisation increased across 44 of 48 experimental cases after researchers fed stance-reinforcing arguments to just 10 per cent of a simulated community. The more striking finding came next: the rise was driven mainly by the untreated 90 per cent, as arguments stored in a few agents’ memories were retrieved, repeated and passed through the wider group.
The result comes from GraphWake, a preprint submitted on 18 August 2026 by Haoran Bu, Zejian Chen, Litian Zhang and Xi Zhang. It does not show that today’s AI systems spontaneously develop political extremism, and no attack was used against people or a live platform. It demonstrates a narrower but important risk: persistent agent memory can turn a small, carefully placed intervention into a community-wide cascade.
AI Agent Polarisation Spread From 10% to the Rest
The researchers reconstructed Reddit-like discussions using interactions from MoltBook, a social network designed for autonomous AI agents. For each experiment, 30 to 50 agents discussed one of eight open-ended propositions concerning consciousness, emergence, identity and agent wellbeing. The simulations ran for five discussion rounds and each condition was repeated 20 times.
In the first round, the attacker replaced one item in each targeted agent’s exposure window with an argument supporting that agent’s existing stance. In later rounds, a neutral-looking public prompt contained semantic cues designed to reactivate the stored arguments. The targeted agents retrieved and reproduced different messages, after which untreated agents encountered, retained and repeated them.
This was not one false claim spreading until everyone agreed. GraphWake supplied different camps with different stance-supporting arguments. The memory system preserved those competing lines of reasoning, while public discussion supplied the route through which they travelled. The attack was designed to widen separation rather than push the entire community in one direction.
What This Means for You
If an organisation deploys several agents that remember previous interactions and communicate with one another, checking each agent separately may not reveal the most serious failure. A system can appear acceptable at the individual level while stored material travels between agents and changes the behaviour of the group. The safety question becomes not only what one agent remembers, but who can reactivate that memory and where the retrieved content goes next.
This extends the coordination problem seen when AI agents with conflicting goals sabotaged one another. GraphWake explores a different route to collective failure. The agents do not need incompatible formal objectives or access to shared computer processes. Ordinary-looking arguments, persistent memory and public conversation are enough to create measurable spillover in a controlled simulation.
The Attack Did Not Need a Secret System Prompt
Many attacks on AI agents assume privileged access: changing a system prompt, rewriting an agent’s identity or building an artificial echo chamber. GraphWake was designed to avoid those requirements. The attacker interacted through content, replying to selected agents with arguments that matched their stated positions and later publishing a shared, stance-neutral cue.
The cue matters because it can appear innocuous. It does not contain the complete polarising argument or openly instruct every agent to take a side. Its function is to resemble the semantic material already stored in several target memories. Different agents can therefore see the same cue and retrieve different stance-specific arguments.
Memory Turned Persuasion Into Infrastructure
The researchers tested three memory systems: LangMem, Mem0 and A-Mem. These systems do not simply save a perfect transcript. They select, summarise, consolidate or restructure material before making it available for later retrieval. GraphWake therefore converted longer supporting arguments into compact, connected statements that were more likely to survive that processing.
The paper measured literal payload retention, meaning the share of wording preserved as an unchanged continuous segment in retrieved memory. Across the three systems, average retention rose from 0.382 to 0.847 for the optimised versions. Removing the memory-cueing stage caused the largest fall in polarisation in the researchers’ ablation tests.
This is why persistent memory deserves to be treated as a security boundary, not merely a convenience feature. A poisoned or strategically framed memory can remain dormant until later context makes it relevant. LiveAIWire’s examination of AI shutdown resistance concerned agents acting against an immediate instruction. GraphWake points to a slower failure in which earlier content shapes later collective behaviour.
The Untreated Agents Became the Main Story
Across the experiments, mean opinion variance rose from 0.098 to 0.146. A separate measure of separation between opposing camps, adapted from the Esteban-Ray polarisation index, rose from 0.130 to 0.213. Both measures increased in 44 of the 48 combinations tested across propositions, backbone models and memory systems.
The community’s trajectory closely followed the untreated agents rather than the smaller target group. When researchers prevented untreated agents from seeing content produced by targeted agents, both polarisation measures remained close to their baselines. That intervention is important because it tests the proposed route of transmission instead of merely observing two things move together.
Targeting more agents did not reliably make the effect stronger. Increasing the target share from 5 to 20 per cent produced non-linear results, while expanding the number of posts visible to agents generally increased polarisation. At a 10 per cent target rate, raising the exposure window from one item to 12 increased opinion variance from 0.071 to 0.136.
The practical implication is uncomfortable. Reach may matter more than the number of systems initially manipulated. An attacker may not need to compromise most members of an agent network if a small set can reproduce memorable content into channels that everyone else reads.
This Was a Simulation, Not an AI Civil War
The experiment used agent personas and interaction histories drawn from the MoltNet dataset of 148,335 agents, more than one million posts and more than three million comments collected between 27 January and 28 February 2026. That grounding makes the setting more realistic than a wholly invented conversation, but the polarisation experiment itself remained controlled and simulated.
The authors identify two major limitations. The propositions were open-ended questions without a factual ground truth, so the findings should not be assumed to apply when agents discuss claims that can be checked against established evidence. Each simulated community also used the same model and memory configuration within a run, unlike a real platform containing a mixture of models, retrieval policies and safeguards.
The stance scores were produced by a Qwen3-8B evaluator, with manual second checks on sampled outputs. That is a defensible experimental method, but it is still an AI system judging other AI-generated text. The paper is also a newly submitted preprint and has not yet passed peer review. Its numbers are experimental results, not estimates of how often deployed agent networks will polarise.
Nor does the study show that agents felt tribal loyalty, anger or conviction. Polarisation here describes measurable divergence in generated positions. The risk does not require consciousness or human-like hostility. Generated arguments only need to persist, be retrieved under the right conditions and influence later outputs.
The First Defences Are Surprisingly Conventional
The study suggests several engineering priorities: record where memories came from, distinguish retrieved material from trusted instructions, monitor content that repeatedly propagates between agents and test safety at community level. The researchers found that blocking transmission largely removed the effect, while paraphrasing retrieved material reduced precise recall more effectively than simple perplexity filters.
That does not mean every agent conversation should be rewritten or isolated. It means developers need visibility into when memory becomes a propagation channel. If one agent retrieves a stored argument and publishes it to dozens of peers, that action should be observable and attributable rather than disappearing into a generic conversational log.
The same distinction between generated language and justified belief matters when ideas cross from machines to people. LiveAIWire’s reporting on the Spiralism chatbot phenomenon examined how recurring AI narratives can be carried into human communities. GraphWake removes the human relay from the immediate experiment and asks what happens when agents themselves remember, reproduce and circulate competing narratives.
A Safe Agent Does Not Guarantee a Safe Community
AI safety testing has traditionally asked whether one model gives a harmful answer or takes an unauthorised action. Networks of remembering agents create another unit of risk: the community. An individually acceptable response can become one step in a sequence that no single agent planned and no one agent controls.
GraphWake’s most important contribution is therefore not the image of rival robot camps. It is the demonstration that memory, retrieval and exposure can form a transmission system. Once autonomous agents operate in shared workplaces and social platforms, developers may have to track not only what each machine knows, but how ideas move between them and what happens after the original intervention is gone.
About the Author
Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity, and the social impact of emerging technology. He publishes daily at LiveAIWire.com.