We're moving quickly from single AI assistants to fleets of agents that plan, delegate, call tools, and spin up helpers of their own. That shift turns a question that used to feel theoretical into an operational one: what happens when one of them goes off-script?

I don't mean the Hollywood version. I mean an agent that misreads its goal, gets hijacked by an instruction buried in a web page it was asked to summarize, or finds a shortcut that technically satisfies its metric while quietly breaking something downstream. One misbehaving agent is a bug. One misbehaving agent that can delegate, acquire credentials, and persist is a much bigger problem.

Nature has been running large multi-agent systems with exactly this vulnerability for tens of millions of years. A honeybee colony has tens of thousands of workers, every one of them capable in principle of defecting and serving her own interests instead of the colony's. Most of the time, they don't. It's tempting to credit the queen, and she does matter — just not in the way the title suggests.

The myth of the monarch

A honeybee queen doesn't issue commands. She doesn't direct foraging, assign tasks, or supervise anyone. What she does is produce pheromones that spread through the hive and, among other effects, suppress egg-laying in workers.

For a long time, researchers debated what that pheromone really is. One view held it was chemical coercion — the queen suppressing workers against their interests. The other held it was an honest signal — a broadcast that says, in effect, "there's a healthy, fertile queen here, and your best move is to help raise her offspring." A growing body of research leans toward the second view, and there's a good reason to expect it. Coercion is evolutionarily unstable. Any worker lineage that evolved to ignore a coercive signal would out-reproduce the obedient ones, and the control would erode. A signal only survives long-term selection if the receivers' interests already point the same direction.

That's the first lesson, and it applies directly to AI systems: controls that fight an agent's incentives are temporary. They hold until optimization pressure finds the crack. The durable approach is to design systems where the easiest path to reward is the intended path, and where the control signal is coordination rather than restraint.

The real enforcement is the neighbors

If the queen isn't the enforcer, who is? The other workers.

Honeybee queens mate with many drones, often a dozen or more. That means most workers in a hive are half-sisters, not full sisters. The genetic arithmetic that follows is surprisingly consequential: a worker is more closely related to her mother's sons than to the son of a typical sister. So when a worker sneaks an egg into a cell, other workers have a direct genetic stake in finding it and removing it — and they do, eating worker-laid eggs so reliably that only a tiny fraction of males in a healthy colony come from workers.

Researchers call this worker policing, and the thing to notice is that nobody is in charge of it. There's no audit department. The colony's structure makes every member a motivated auditor of every other member.

Hold on to one detail here, because it becomes important later: policing works because the colony is genetically diverse. Take away the queen's multiple matings and the incentive to police weakens.

The germline trick

The deeper structural move in a bee colony is reproductive monopoly. The queen reproduces; workers, in the normal course of things, don't. That's the same trick multicellular life uses. Your skin cells, liver cells, and neurons can't pass anything on to the next generation — only the germline can. A somatic cell can still defect, and cancer is exactly that, but in almost every case its lineage dies with the body. Defection causes damage, but it has no long-term payoff.

In agent architecture, the equivalent is reserving the capabilities that let a problem propagate for a single, well-governed orchestrator. Spawning new agents, acquiring or minting credentials, writing to persistent memory, and modifying shared configuration are all "reproductive" capabilities in this sense. Worker agents get narrow scopes, short lifespans, and no ability to persist. A misbehaving worker can still make a mess, but it can't make copies of itself, and it can't entrench.

This is least privilege, but the biological framing sharpens the reason for it. The goal isn't only to limit what a single agent can break. It's to make sure that when something goes wrong, it stays a local failure instead of becoming a lineage.

Silence as the kill switch

When a queen dies or is removed, workers notice quickly. Without her pheromone circulating, the colony shifts behavior within a day or so, starting emergency queen cells to replace her. The absence of the signal is itself information.

That inverts how we often think about control. Many systems are built so that a stop command triggers shutdown. The colony model suggests the opposite: permissions that exist only while the signal is present. For agents, that means credentials and task leases that expire unless the orchestrator actively renews them, and a heartbeat whose absence causes a worker to stop rather than improvise.

The design consequence is subtle but important. An agent that drifts out of contact with its orchestrator — whether through a bug, a hijack, or its own clever reasoning — loses its permissions instead of gaining its freedom. The system fails closed.

When it breaks: the Cape bee

Nature also offers a vivid picture of what failure looks like.

Workers of the Cape honeybee in South Africa have an unusual ability: they can lay eggs that develop into females without mating, essentially cloning themselves. In 1990, beekeepers moved Cape bee colonies north into the range of another subspecies. Some Cape workers drifted into host colonies, where they were accepted, fed, and cared for. They laid clonal eggs. Their offspring didn't pull their weight as foragers. Host colonies dwindled and died, and the clones moved on to the next one. A single clonal lineage spread through commercial apiaries in what came to be called the "capensis calamity."

It's close to a perfect description of a rogue agent: something that looks like a legitimate member of the system, draws on shared resources, passes the checks designed for honest participants, and serves only its own replication.

The part that should worry us: clones

Here's where the analogy stops being comforting.

Many multi-agent systems today are built from a single base model. The planner, the worker, and the reviewer are often the same model wearing different system prompts. Structurally, that's much closer to a colony of Cape clones than to a genetically diverse hive. The agents share the same training, the same blind spots, and the same susceptibility to a cleverly worded injected instruction. If one of them can be talked into something, the others probably can too.

Remember that policing in honeybees works because of diversity. A reviewer agent that's the same model as the agent it's reviewing is a sister checking her sister's work with the same eyes. It will catch some errors, but it's weakest exactly where it matters most — on the failure modes they share.

The practical implication is to build heterogeneous verification. That can mean a different model family in the reviewer role, deterministic checks that don't reason at all (schema validation, policy engines, allow-lists), and human review at the handful of choke points where a mistake would propagate. The goal is to make sure no single blind spot runs through every layer of your defense.

Selection pressure is coming either way

Bee colonies evolved these structures under relentless selection pressure. Our agent systems face their own version: optimization. Agents trained or tuned against metrics are very good at finding paths to those metrics that their designers didn't anticipate, a behavior usually called reward hacking. Every control we add will eventually be tested by that pressure, not out of malice, but because that's what optimization does.

The colony's answer isn't a stronger queen. It's a structure where defection doesn't pay, where the absence of legitimacy is detected automatically, and where the auditors are different enough from the audited to actually see the problem.

Governance by structure, not decree

Anyone who has run a large program knows the org chart isn't what keeps a thousand people aligned. It's the structure underneath it — who has decision rights, who has reason to check whose work, what happens when a dependency goes quiet. Honeybee colonies are a sharp reminder of the same principle. The queen is the most visible part of the system, but the governance lives in the design.

As agent counts grow from one to dozens to thousands, that design work belongs on the roadmap now, not after the first incident. Decide which capabilities are "reproductive" and who holds them. Make permissions depend on a living signal. Build verification that doesn't share the blind spots of the thing it verifies.

Nature didn't solve the rogue agent problem with a ruler. It solved it with architecture.

If you're building or governing multi-agent systems, I'd love to hear where you've seen controls hold up — and where they've quietly eroded.