Hello, Agent Smith.

The Matrix got one thing exactly right about agents, and it is not the trench coats. Agent Smith is the system's own program, off charter, copying himself onto everything he touches until the system exists to serve the copies. That is the real failure mode of the agent era: not malice, not superintelligence. Replication without a gate.

And replication just became free.

Why is Smith the honest model?

Because he starts as infrastructure. Agent Smith begins as a program doing his assigned job inside the system, and his breakdown is not an invasion but a drift: purpose widens, copies multiply, and deletion stops being possible because nobody kept the authority to delete.

Every agent incident in my logs rhymes with that arc, at small scale. An agent given a vague goal widens it. Output multiplies faster than anyone reviews it. The failure is never that the agent got smart. It is that the boundary got soft.

No one builds Smith on purpose. They build him by not deciding where the copies stop.

How cheap is replication now?

Cheap enough that the interesting numbers come from my own transcripts, not a thought experiment.

My largest single orchestrated workflow on Orbyt accumulated 298 agents in one run, holding to eight in parallel. One working session spawned 830 agents across seven days, never more than nine running at the same instant. One month of transcripts records 2,800 agent runs: 2,589 inside 95 orchestrated workflows, 211 spawned directly. I dissected that session in its own post.

Notice the shape of those numbers. The totals are enormous and the instantaneous footprint is tiny, eight or nine at once, because the caps are doing their job. Spawning is an API call now. The only thing standing between an API call and an infestation is a decision someone wrote down.

What separates a fleet from an infestation?

Five properties. All boring. All structural. Smith fails every one of them, which is rather the point.

A cap. Replication is bounded by configuration, not by good intentions. Eight in parallel on my orchestrated fan-outs, never more than nine live in a session. A cap converts "how bad can it get" from a discovery into a setting.

A charter. Purpose is bounded in writing. An agent with the goal "improve things" is Smith with better manners; the machine that runs my company gives every seat a charter narrow enough to fail.

Guards. A fleet needs an immune system that does not sleep. My work passes 103 mechanical guards, and the org runs 29 autonomous lanes against 40 gated ones. When something breaks anyway, the lesson gets mechanized into a new guard rather than a promise that it will not happen again.

Attribution. Every artifact traces to the agent, prompt, and run that produced it. Smith's copies are anonymous, which is precisely what makes them unkillable. You cannot bound, audit, or terminate what you cannot name.

A kill switch. Owned by a person, tested, and reachable in one action. In my org, none of 12 seats can merge to the branch that deploys, so the worst hour of agent judgment still ends at a boundary a human controls. The full threat model is written up here.

Where does Smith live in your company today?

In the places nobody calls agents. The cron job a departed engineer wrote that still emails customers. The automation that triggers automations. The copilot output pasted into production by six different teams, signed by no one. Unattributed, uncapped, uncharted work product is agent sprawl already, just slow enough that nobody named it.

The agent era does not introduce this risk. It compounds it, because the sprawl now writes more sprawl. Gartner-grade forecasts are not required to see where that goes; the only question is whether the gates exist before the volume arrives. This is why I treat fail-closed as the only honest default for anything that acts without a human in the loop.

Smith is not coming for your company. He is already on the payroll, unattributed.

What to do Next

Inventory everything that acts without a human initiating it. Scripts, automations, agents, scheduled jobs. My count is 23 scheduled jobs across a 12-seat agent org, and writing the list down was the day the org became governable.

Give each one the five properties, starting with attribution, then the cap, then the kill switch. Charters and guards take longer; name and bound first.

And when a vendor demos a swarm, ask the Smith questions. What bounds the copies? Who can end this in one action? What signs the output? A team with answers built a fleet. A team without them built a very enthusiastic incident.

The Matrix needed a chosen one to stop Smith. You just need a config file, a guard, and a switch, written before the copies arrive.

Related reading:

• 391 Yeses and Not One No. the permissions blast radius, measured
• The Machine. It Runs the Company. charters, ladder, and the kill switch in production
• Self-Healing Is a Euphemism why lessons must become guards
• AI Builds AI. I Found the Ceiling. where self-improvement stops being a virtue