When AI Agents Delegate: Security and a Possible Agent Economy

Hannah Fry interviews Google DeepMind researcher Nenad Tomašev about AI agents, delegation and a possible future agent economy. The conversation mixes present-day observations with research proposals and hypothetical scenarios.

Tomašev defines agents in terms of systems that can pursue tasks through actions and tools. He notes that the concept predates today’s large language models, including earlier agents in simulated environments.

The user may still communicate in natural language, but the system can take multiple steps. Tomašev expects the person’s role to include decisions, review and approval rather than simply waiting for an answer.

They discuss coding agents as a current application. Tomašev says they can reduce repetitive implementation work, while the actual effect on productivity depends on task, review and organizational context.

Fry raises automation bias: a person may become less attentive when a system usually appears to perform well. Tomašev says being nominally in the loop is insufficient if a reviewer is not engaged.

The speakers consider how better tools and safeguards might allow agents to carry out more complex work. They treat reliable long-running autonomy as a goal with unresolved technical and social challenges.

Fry asks how agentic exploration could help science. Tomašev imagines systems proposing and testing many alternatives while researchers define questions, evaluate evidence and decide what matters.

He says current systems still have major limits and often recombine known methods more readily than they produce reliable new scientific understanding. The discussion distinguishes present capabilities from longer-term hopes.

Asked why a fully capable personal assistant is not broadly deployed, he points beyond the underlying model to tools, infrastructure, reliability and safeguards. A capable model alone does not guarantee a dependable service.

Delegation is introduced as a possible response to complex tasks: an agent could divide work, choose specialists and combine their results. Tomašev contrasts this with simply running many similar tasks in parallel.

He says effective delegation requires selecting subtasks, supplying context and monitoring whether work is completed. Coordination itself creates cost and failure modes; more agents do not automatically produce a better answer.

The speakers distinguish reversible tasks from actions with real-world consequences, such as spending money. Higher-consequence actions warrant more careful authorization, checks and opportunities for human review.

The conversation turns to agentic traps: malicious content can attempt to redirect a system that is performing a user’s task. Tomašev identifies this as a security challenge for large-scale deployment.

He describes dynamic cloaking, where a site may show different content to a human and an agent. The risk is that a trusted-looking workflow can encounter instructions or misleading content crafted for the agent.

The speakers compare the problem with earlier web security and adversarial examples. Verification, isolation and other defenses can reduce exposure, but no single measure is presented as a complete guarantee.

Tomašev sketches an agent economy in which assistants negotiate or delegate within budgets and preferences set by people. It is a theoretical framework, not a description of an already mature universal market.

An example involves allocating a limited budget for tickets while accounting for preferences and schedules. The assistant’s choices would still need appropriate user control and a way to handle mistakes.

They discuss cognitive monoculture: if many agents use similar models and make correlated decisions, failures can occur together. Diversity in models and oversight may help, but its effectiveness must be evaluated.

The potential benefit of distributed intelligence is combining specialists with different abilities. Tomašev suggests coordination and complementary expertise can do more than simply make identical work run faster.

They consider a general coordinating layer calling specialized systems for particular tasks. Fry compares this with distributed intelligence; the architecture and its safety remain research questions.

Fry closes by emphasizing that the important system may be a network of generalists and specialists rather than a single assistant. The interview leaves open how such systems should be governed and evaluated.