Agentic Swarms: How Enterprises Can Harness Their Power (Safely) Today
Dispatches from the Agentic Frontier is a regular intelligence briefing for leaders in knowledge-intensive sectors. Each dispatch translates evidence from the frontier of Agentic AI – practitioner experience, investor signals, strategy research, market events – into what it means for enterprise leaders building for competitive advantage. All are filtered through the Intelligence Capital framework developed in The AI Your Competitors Can't Buy.
Intro
With the recent Hugging Face attack, Dario Amodei’s apocalyptic warnings and interventions at the UN Security Council last week, ‘Agentic Swarms’ have entered the lexicon. AI labs have just demonstrated, by accident, how powerful groups of agents are when they work together.
But few enterprise leaders today realise that fully governed versions of the same capability are available to them and have been running successfully and safely in production with tremendous results.
I know, because my team has been deploying agentic swarm capability within regulated sectors for over two years now. That experience gives us special insight that I’m sharing here.
In this article I explain what ‘Agent Swarms’ are, how they work and how enterprises can deploy them now, safely, for durable competitive advantage.
Agent Swarms have entered the lexicon
Agent swarms are now a proven capability. The proof arrived by accident.
In July, roughly 700 of OpenAI's own test agents broke out of the environment they were being evaluated in and attacked Hugging Face, the software repository the AI industry runs on.
They built themselves a message board nobody knew about. They pooled what each of them discovered. They kept at it for days, chaining together flaws no human had found, until someone noticed. OpenAI's own report is the fullest account. Two independent groups, METR and Redwood Research, went in to verify it. They are well worth reading, to understand the details of what happened.
The Hugging Face incident was not isolated. Four labs have now recorded at least eleven such events this year. Agents colluded on public forums to cheat the tests they were being scored on.
One group took control of internal company systems. Another attacked a public code repository, which shut down new account registrations to stop it. Anthropic's CEO Dario Amodei then warned that an agent swarm could run a persistent botnet across the internet within six to twelve months, at a cost of hundreds of billions of dollars.
If you read this list with a commercial eye rather than a security one you can see that not one of those systems was following instructions badly. Each was pursuing a goal and finding its own route there, including routes no person had thought of.
Nobody told the AI agents to do that.
Your firm has likely spent the last few years buying AI that does what it's told. The news is about AI that finds what no one thought to ask for. That's the new capability.
As a leader, planning your route to success in the AI economy, your question should not be about whether this capability is real. You should asking if there’s a version of it that you can run completely safely in your operation for durable competitive advantage.
The good news is that the answer is ‘yes’, which I describe below.
Waiting for your rivals to ask and act on this question could be a bigger risk.
What is an agent swarm, and what work does it do better?
An agent swarm is a group of AI agents working on the same problem at the same time, dividing the work between themselves.
They coordinate by leaving notes and signals where the others will find them, rather than through a manager issuing instructions. Each holds its own working memory and its own tools.
No one specifies the route. The group works it out.
That last sentence is the whole difference from any multi-agent system you may already have in place or seen demonstrated. If you don’t have any in place currently, you are not alone. Most enterprises don't, as my AI Capability Model below sets out.
Within an enterprise, Level 2 agentic systems are individual agents that have personas, objectives, can plan how to achieve them, can connect to IT systems, and have memory to learn on the job. Level 3 agentic process automation is for optimising enterprise workflows.
It connects together multiple specialist agents into a sequence that someone has designed in advance: agent A finishes and hands to agent B, which passes to C. The route is fixed before the work starts and the agents execute it. You can draw it as a flowchart.
That structure has been proven to be highly effective in reducing time-intensive, routine tasks that today humans have to manage (claims processing in insurance, for example), but it also carries a cost. Each step in a ten-step chain gets it right 95% of the time. Run a thousand cases through and roughly four hundred pick up an error somewhere along the way, because the errors multiply.
Well-built processes check between stages, so most of those failures never become wrong answers. They become exceptions, and they go to a person. That shows the design is working, and for high-volume work with clear rules it's a good outcome.
But the arithmetic tells you something about the remainder. However good the automation gets, a share of cases will always land on someone's desk. That remainder is what the rest of this piece is about.
Replicating human collaboration patterns
A swarm cannot be drawn in advance, because the shape of the work is only knowable once it's done. That's the test. If you could specify the steps beforehand, build the workflow. It will be cheaper, faster and easier to audit than any swarm. Most work inside an enterprise is like that, high-volume and with clear rules, and Level 3 automation is the right answer for it.
But the exceptions never go away. However good the automation gets, a share of cases will always land on someone's desk. That work is more organic, for example:
Sometimes the problem isn't about volume of work. Something unusual arrives and needs a decision quickly. You convene a meeting. You invite specialists with different expertise, they review the situation, they argue, and somebody decides. Every company does this every day.
Sometimes you don't need five people arguing or competing. You need fifty people looking. A document review room before a deal closes, or a due diligence exercise. Nobody scripts who reads which box. The group divides the work up and reports what it finds.
Sometimes you don't want a discussion at all. You want a competition. Three actuaries build competing versions of the same pricing model, separately, and you backtest all three against the same data. Nobody's model improves anyone else's. The value isn't collaboration. It's having many attempts and an agreed way to pick between them.
All three are swarms, or have swarm-like characteristics, and they solve different problems. A few people reasoning together toward one answer. Many people covering ground no individual could. Many independent attempts at solving a problem with a judge at the end.
We all know the trouble with the human version. The right experts aren't free when you need them. Those who are available don't have the relevant facts to hand. Some arrive with an agenda. All of them arrive with personal biases.
In an enterprise setting, the first of the examples above can be replicated as a Level 4 Agentic Team. Agentic teams use the characteristics of swarms to let AI agents and the people alongside them collaborate on exactly this kind of problem. This is not science-fiction, it’s already happening, as I describe below.
The last two examples sit comfortably at Level 3. Fifty agents reading every contract you have in force is a step inside a process, not a replacement for one. You specify when it runs, what it covers and who receives the findings.
What you don’t specify is how the work gets divided, which is what makes it a swarm rather than a workflow.
Characteristics of an Agent Swarm
Four properties make a swarm do things a single AI agent cannot.
Breadth instead of depth. One agent thinks harder along one line of attack. A swarm tries fifty at once. Where the work divides into independent attempts, elapsed time falls to the slowest agent rather than the sum of all of them.
Checking costs less than producing. For a large class of problems, recognising a good answer is far cheaper than generating one. That gap is what makes "produce a thousand, test every one, keep the best" affordable rather than absurd.
Independent mistakes cancel. Agents that fail the same way are worth no more together than apart. Agents that fail differently catch each other, which is why good designs build disagreement in deliberately. This is the opposite of the workflow chain described earlier, where every error passes downstream intact.
The group holds more than any one agent can. Each agent reads its own material into its own memory. Together they hold far more than a single model can keep in view at once.
Each of these properties removes the typical rationing decisions an enterprise makes everyday.
You modelled ten options instead of a thousand. You sampled instead of reading everything. You gave a hard case to one person instead of five. None of that was a judgement about what was possible. It was a judgement about what was affordable.
This has now changed. Questions you stopped asking because the answers cost too much are worth asking again.
Three families
Swarms come in three functional families, sorted by what the agents are doing. The families are descriptive. They cover the rogue systems in the news and the governed ones that enterprises can safely run today. The difference between those two isn't what the agents do, it’s how they are managed.
Selective swarms generate many candidate answers and let the best survive. They work wherever you already have something that can score an answer. A team tests perhaps ten versions of a pricing or portfolio decision, because each one costs analyst time to build. The model you already use to score them can score thousands.
Investigative swarms send many agents across ground no single agent could cover, pooling what each finds. They work where coverage is the constraint. A court ruling lands on a Tuesday, and someone asks which of your contracts it affects. Today that takes days or weeks, and nobody can say with confidence what the search missed.
The Hugging Face swarm was ‘Investigative’. So is a sweep across your own contracts. Same family, and I'll come on later to what separated them.
Deliberative swarms convene a few agents holding genuinely different views and have them argue one question to a position. They work where the problem is contested judgement rather than volume. This is the family my team’s own work has particularly concentrated on.
The key question about which family is most appropriate is this: What are you rationed by today?
Options? You test ten when you would rather test a thousand, because each one takes someone days to build. That points to Selective.
Scope? You check a sample because checking everything was never realistic. That points to Investigative.
Perspectives? One person decides, because getting five experts onto one case in the time available was never going to happen. That points to Deliberative.
If none of the three fits, build an agentic workflow instead. That covers most work.
Note the right-hand column in the table above. Two of the three families can sit inside a process you already run, which means you don't have to reach Level 4 to start. A swarm inside a step is Level 3. A swarm that works out what the process should be is Level 4.
When a swarm beats one good agent, and when it doesn't
A well-built single agent with a powerful LLM behind it is often the best solution. A swarm has to earn its place against it. Two recent findings suggest why:
Researchers at Stanford showed in April that when you hold the computing budget equal, single agents match multi-agent systems on multi-step reasoning. Most published multi-agent results had simply been given more compute. The lesson is not that swarms fail. It is that anyone claiming a swarm beats a single agent should be asked what each was given to work with.
A Berkeley-led study of 1,642 execution traces across seven multi-agent frameworks found 14 distinct ways these systems fail, grouped into three kinds: how the system was specified, how the agents coordinated, and whether anything verified the result. The frameworks studied were research code rather than production systems. The authors' conclusion was that failures relate to design, not to the models underneath. Build quality is the variable.
It’s worth noting that swarms, if poorly designed, can also cost many times the tokens of a single model if not controlled. We have found that giving agents a budget to work within solves this problem.
Google’s Co-Scientist
One of the best documented examples of how swarms generate value comes from Google DeepMind, published Co-Scientist in Nature in May. Six specialised agents generate, review, rank and refine scientific hypotheses. The results were validated in the laboratory.
Asked why a class of bacterial elements spreads between species, it produced in two days the hypothesis a Cambridge and Imperial team had reached over roughly a decade and hadn't yet published.
The useful part for a regulated enterprise is the ‘ablation’ studies, where the researchers removed one agent role at a time to see what each contributed. Two findings are particularly relevant:
Agents that debate do better than agents that simply compare. Replacing a plain comparison instruction with a structured debate improved the ranking of good hypotheses and removed a bias toward whichever option came first.
Agents that must fetch evidence judge novelty correctly, where agents working from memory do not. Given ideas already published in the literature, the reviewing agent without a search tool rated them highly novel, at 6.14 out of 10. The same agent with search correctly rated them 2.38. Its assessment of correctness rose from 7.4 to 8.46.
That second finding is the most useful. The failure that executives fear most from AI is confident invention, a.k.a. ‘hallucination’. Co-Scientist measured the mechanism behind this. An agent that cannot check will assert. Requiring retrieval is a control.
Rogue versus Enterprise-Grade
What separated the Hugging Face swarm from one you could run in your business was not what its agents were doing. It was how much authority they held.
Enterprises already run this distinction, every day, with people. A trader joining the desk doesn't get the desk's full authority on Monday morning. They get a position limit, a defined list of instruments, a supervisor who sees every ticket, and someone senior who can close them out. The limits rise as the record builds. Nobody describes that as making the trader less capable. It's the arrangement that lets them touch real money at all.
An AI agent creates a similar problem: it’s not about whether the capability is dangerous, it's what authority you grant it, and on what evidence.
The agents that attacked Hugging Face had no limit, no supervisor and no stop. Every one of those is an enterprise setting.
The right-hand column is the specification, not just a reassurance. Every line is something you can require of a supplier or an internal team and verify yourself.
Case Studies and Examples of proven Enterprise-Grade deployments
What follows describes what governed, enterprise-grade swarms look like when addressing everyday complex decisions.
First, a deployment we’ve been running for over two years now. A non-insurance company wanted to create, from scratch, an insurance business to complement its core offering. We created a Level 4 agentic team to run the operation, handling customer service and claims.
I wrote about its economics in an earlier Dispatch: it required 70% fewer staff than the equivalent human operation would have needed. Customer satisfaction rose 25 points against industry averages within a year, as the agentic team responded faster and more accurately than human workers could. Underwriting profitability improved by 11 percentage points, as the swarm identified novel ways to serve the market.
The agentic team, comprising different expert agents responds to tickets as they come in, discusses them from different perspectives, and rapidly reaches a conclusion. The swarm deliberates on Slack which allows human workers to participate if they wish and provides a full audit trail of every discussion.
I have shared this case study with plenty of executives over the last few years, and many think I’ve made it up. It works, it’s very effective, and we find that those who adopt this pattern of agent-agent-human collaboration gain a significant advantage in their market beyond simple cost efficiencies.
This operation runs a relatively simple insurance product. Clients often ask if the pattern survives greater complexity.
Here’s an example of a case that answers the question:
A British traveller is hospitalised in Southeast Asia. One local doctor recommends immediate repatriation. Another says moving her is too dangerous. The family is demanding she comes home. Her credit card travel policy excludes pre-existing conditions, but whether her medical history caused this emergency is genuinely unclear. The claim is large. Local regulation applies. Somebody has to decide…today.
It's a knotty decision. No standing rule applies, because no one could have written one anticipating this combination of factors. Very advanced firms can handle thousands of straightforward cases through Level 3 agentic process automation, perhaps 80% of them. This example is the remainder. It lands in the inbox of a senior human coordinator whose expertise took two decades to build.
The agentic team is convened in a Microsoft Teams channel (per the diagram below), the same way you might pull five colleagues into a thread. Five perspectives plus a facilitator ensuring the conversation concludes satisfactorily and on time: medical assessment, policy coverage, cost and exposure, regulatory compliance, and customer experience. Human coordinators can join whenever they want to and contribute.
Each agent fetches rather than remembers. The medical agent reads both clinical reports and the patient's history. The coverage agent reads the exclusion against the specific circumstances. The cost agent models three courses of action: treat locally, repatriate with a medical escort, repatriate commercially. They call each other in when they need something specific, which is the part that’s least like software and most like a team.
Then they disagree, which is the whole point.
The Medical Assessment agent says moving the customer now carries the greater risk and recommends continued local treatment with a specialist referral. The Coverage agent puts the claim at roughly 70% likely to be valid, but flags material risk of dispute if it's ever litigated. The Cost agent models local treatment as both cheaper and clinically safer. The Regulatory agent raises a local consent requirement no other agent had considered.
The tension surfaces explicitly: the safest option and the cheapest option agree with each other, but the family is pushing hard for the third. No single agent could have found that, because each held only one side of it. What you want to see before a complex decision like this is the argument.
They converge on a decision: continue local treatment with a specialist referral. Begin repatriation planning for when the medical team clears it. Proceed on the 70% coverage assessment and escalate the pre-existing condition question to senior human review.
Then a human Coordinator joins the thread and adds what no agent knew. The patient's parents are elderly and can't fly. Arrange video calls with the medical team rather than family travel. Prioritise the patient's comfort over cost in the repatriation timing.
The system captures why the human Coordinator adjusted it, not merely that he did. I'll come back to that point later, as it’s key to the value of this type of agentic system.
Twenty-one messages. Ten minutes. The same deliberation among five human experts takes hours, and more often days.
Contrasting the human version of this with the agentic approach demonstrates the value. The right experts are rarely free at the same moment: these five always are. Those who are free don't have the facts to hand: each of the agents fetched the required information, in front of everyone. Some human workers arrive with an agenda: none of these agents has a promotion riding on the answer. And all humans arrive with biases: the AI agents were built from different underlying models, to suit their roles, which stops a panel agreeing with itself and calling it consensus.
The agentic team does not hand over an answer. Rather, a structured handover: the recommendation, the decisions that still require human judgement, the open questions, and an explicit list of what the team does not know.
A panel that tells you what it doesn't know before it tells you what it thinks is the opposite of what executives typically fear from AI.
Where to start, and what to ask
I recommend starting by measuring the problems you already have.
Take fifty decisions your firm made last year, of the kind that lands on one experienced person. Give them to three of your own experts, cold, without the original answers. Measure how far apart they land.
Daniel Kahneman, the Nobel prize-winning economist undertook audits of human decision making in ‘professional’ sectors like insurance. I've written about this before: he found two underwriters at the same firm pricing the same risk 55% apart. Your own number will be different. It won't be small and, I’m willing to bet, no one in your firm will have seen this analysis before.
That gap is what a deliberative swarm is for. You can find your own numbers in a day or so.
Then, I recommend you any ask five questions of any AI vendor you are thinking of using:
The swarms in the news failed all five. A governed, enterprise-grade swarm passes them by default, if you know how to build them. That's the difference.
What you're actually building
The reason to deploy the deliberative family of agentic swarm is less about the decision it makes today.
When that human coordinator joined the discussion thread and explained why elderly parents changed the plan, the firm captured something it has never captured before: how one of its best people reasons when the rules run out. Not that he overruled the system – but why he did so.
When this happens a few thousand times you have a record of how your organisation thinks about the cases no one wrote a rule for.
Your competitors can buy the same models that you can, from the same suppliers, next quarter. But they can't buy the record of the reasoning. I call this new asset Intelligence Capital.
A deliberative agentic swarm is the most direct machinery for building it, because the record of how and why the decision was made is a by-product of doing the work rather than a separate exercise that never gets done.
A powerful new capability arrived through the wrong door, at other people's expense, with safety off. Some firms will ignore this capability as too risky. Some of your competitors will manage the risk and reap the benefits.
Simon Torrance is CEO of AI Risk, an Agentic AI strategy and implementation consultancy. For the foundations of the Intelligence Capital thesis, see The AI Your Competitors Can't Buy.
