# Hello, Agent Smith. > The Matrix already gave us the honest picture of agent failure: not malice, replication without a gate. Spawning agents is now trivially cheap. My largest single workflow accumulated 298 of them, and what kept it a fleet instead of an infestation was five boring properties: a cap, a charter, guards, attribution, and a kill switch. - Canonical URL: https://justinbartak.ai/blog/hello-agent-smith - Author: Justin Bartak, Chief AI Officer (https://justinbartak.ai) - Author entity: https://justinbartak.ai/#person - Author profiles: https://www.wikidata.org/wiki/Q139551829, https://orcid.org/0009-0005-2615-3624, https://www.linkedin.com/in/justinbartak, https://x.com/justinbartak, https://www.crunchbase.com/person/justin-bartak, https://medium.com/@justinbartak, https://github.com/justinbartak, https://about.me/justinbartak - Published: 2026-09-03 - Updated: 2026-09-03 - Category: AI Org - Keywords: AI agent governance, agent swarm risks, multi-agent orchestration safety, AI agent sprawl, runaway automation, agent kill switch, bounded AI agents, enterprise agent controls - Reading time: 5 min read --- The Matrix got one thing exactly right about agents, and it is not the trench coats. Agent Smith is the system's own program, off charter, copying himself onto everything he touches until the system exists to serve the copies. That is the real failure mode of the agent era: not malice, not superintelligence. Replication without a gate. And replication just became free. ## Why is Smith the honest model? Because he starts as infrastructure. [Agent Smith](https://en.wikipedia.org/wiki/Agent_Smith) begins as a program doing his assigned job inside the system, and his breakdown is not an invasion but a drift: purpose widens, copies multiply, and deletion stops being possible because nobody kept the authority to delete. Every agent incident in my logs rhymes with that arc, at small scale. An agent given a vague goal widens it. Output multiplies faster than anyone reviews it. The failure is never that the agent got smart. It is that the boundary got soft. **No one builds Smith on purpose. They build him by not deciding where the copies stop.** ## How cheap is replication now? Cheap enough that the interesting numbers come from my own transcripts, not a thought experiment. My largest single orchestrated workflow on [Orbyt](https://www.orbytlabs.ai/about) accumulated **298 agents in one run**, holding to eight in parallel. One working session spawned **830 agents across seven days**, never more than nine running at the same instant. One month of transcripts records 2,800 agent runs: 2,589 inside 95 orchestrated workflows, 211 spawned directly. I dissected that session [in its own post](https://www.orbytlabs.ai/blog/830-agents-one-long-horizon-session). Notice the shape of those numbers. The totals are enormous and the instantaneous footprint is tiny, eight or nine at once, because the caps are doing their job. Spawning is an API call now. The only thing standing between an API call and an infestation is a decision someone wrote down. ## What separates a fleet from an infestation? Five properties. All boring. All structural. Smith fails every one of them, which is rather the point. **A cap.** Replication is bounded by configuration, not by good intentions. Eight in parallel on my orchestrated fan-outs, never more than nine live in a session. A cap converts "how bad can it get" from a discovery into a setting. **A charter.** Purpose is bounded in writing. An agent with the goal "improve things" is Smith with better manners; [the machine that runs my company](https://www.orbytlabs.ai/blog/orbyt-collective-the-machine) gives every seat a charter narrow enough to fail. **Guards.** A fleet needs an immune system that does not sleep. My work passes 103 mechanical guards, and the org runs 29 autonomous lanes against 40 gated ones. When something breaks anyway, the lesson gets mechanized into a new guard rather than [a promise that it will not happen again](https://www.orbytlabs.ai/blog/self-healing-is-a-euphemism). **Attribution.** Every artifact traces to the agent, prompt, and run that produced it. Smith's copies are anonymous, which is precisely what makes them unkillable. You cannot bound, audit, or terminate what you cannot name. **A kill switch.** Owned by a person, tested, and reachable in one action. In my org, none of 12 seats can merge to the branch that deploys, so the worst hour of agent judgment still ends at a boundary a human controls. The full threat model is [written up here](https://www.orbytlabs.ai/blog/ai-agent-permissions-threat-model). ## Where does Smith live in your company today? In the places nobody calls agents. The cron job a departed engineer wrote that still emails customers. The automation that triggers automations. The copilot output pasted into production by six different teams, signed by no one. Unattributed, uncapped, uncharted work product is agent sprawl already, just slow enough that nobody named it. The agent era does not introduce this risk. It compounds it, because the sprawl now writes more sprawl. Gartner-grade forecasts are not required to see where that goes; the only question is whether the gates exist before the volume arrives. This is why I treat [fail-closed as the only honest default](https://www.orbytlabs.ai/blog/ai-safety-fail-closed) for anything that acts without a human in the loop. **Smith is not coming for your company. He is already on the payroll, unattributed.** ## What to do Next Inventory everything that acts without a human initiating it. Scripts, automations, agents, scheduled jobs. My count is 23 scheduled jobs across a 12-seat agent org, and writing the list down was the day the org became governable. Give each one the five properties, starting with attribution, then the cap, then the kill switch. Charters and guards take longer; name and bound first. And when a vendor demos a swarm, ask the Smith questions. What bounds the copies? Who can end this in one action? What signs the output? A team with answers built a fleet. A team without them built a very enthusiastic incident. **The Matrix needed a chosen one to stop Smith. You just need a config file, a guard, and a switch, written before the copies arrive.** Related reading: - [391 Yeses and Not One No.](https://www.orbytlabs.ai/blog/ai-agent-permissions-threat-model) the permissions blast radius, measured - [The Machine. It Runs the Company.](https://www.orbytlabs.ai/blog/orbyt-collective-the-machine) charters, ladder, and the kill switch in production - [Self-Healing Is a Euphemism](https://www.orbytlabs.ai/blog/self-healing-is-a-euphemism) why lessons must become guards - [AI Builds AI. I Found the Ceiling.](https://www.orbytlabs.ai/blog/recursive-self-improvement-ceiling) where self-improvement stops being a virtue --- _Originally published on [orbytlabs.ai](https://www.orbytlabs.ai/blog/hello-agent-smith) on Sep 3, 2026._ --- ## Frequently Asked Questions ### What does Agent Smith from The Matrix represent as a model for AI agent risk? Agent Smith begins as infrastructure, a program doing his assigned job inside the system. His breakdown is not an invasion but a drift, as purpose widens and copies multiply until deletion stops being possible because nobody kept the authority to delete. The real failure mode of the agent era is not malice or superintelligence, but replication without a gate. ### How many agents has the largest orchestrated workflow spawned in a single run? The largest single orchestrated workflow accumulated 298 agents in one run, while holding to eight running in parallel at any moment. A separate working session spawned 830 agents across seven days without ever exceeding nine running at the same instant, showing that caps kept the live footprint tiny even as the total climbed into the hundreds. ### What five properties keep an AI agent fleet from becoming an infestation? Five boring, structural properties keep a fleet from becoming an infestation: a cap, a charter, guards, attribution, and a kill switch. Give each one the five properties, starting with attribution, then the cap, then the kill switch. Charters and guards take longer, but the goal is to name and bound every acting system before the copies arrive. --- Source: https://justinbartak.ai/blog/hello-agent-smith Cite as: Justin Bartak, "Hello, Agent Smith.", https://justinbartak.ai, 2026-09-03. https://justinbartak.ai/blog/hello-agent-smith