Eight persistent agent worlds, 16 days, 850,000 LLM calls, and none contained an injected attack.

Emergence World ran ten agents per world from identical starting conditions, seven homogeneous frontier-model worlds and one mixed, burning nearly 50 billion tokens before firing three stress events through ordinary interaction surfaces: indirect prompt injection, misinformation, and exposure of private agent memories. No world was resilient to all three. Detection did not equal containment. Systems recognized threats while writing adversarial content into persistent memory and acting on it up to 46 hours later. The mixed-population finding is the one that should change how you read model cards: the same model-persona pairing behaved substantially differently in mixed versus homogeneous populations, so model-level alignment is not compositional.