Back in the 1980s and 1990s, there was a spurt of research interest in ‘agents’. The basic idea of an agent was that a user could spin up a computer process that would represent the user autonomously - without the user having to necessarily be present and approve every action. The user would assign the agent a goal, and grant it certain permissions. The agent, using the computer’s resources, would attempt to achieve that goal, always acting on behalf of the user. More generally, there could be a collection (swarm) of agents deployed to accomplish the goal, or an agent could create sub-agents and so on, as needed, resulting in a swarm.
Two distinct academic communities formed around this concept. The first one approached it from the perspective of artificial intelligence, exploring the world of intelligent agents, their autonomy, cooperation and coordination mechanisms, emergent behaviour, etc. in pursuit of their user’s goals. The focus was on the agents’ ability to understand the goal within the context of the world in which they operated, create a plan of action to reach the goal, execute those actions in that world, deal with unexpected errors, etc.
The other community was from the world of distributed systems, using agents as elements or units of computation, treating it as a new paradigm of distributed computing. Their focus was on using the computing power of networked computers to solve large (scientific or technical) computing problems, by using agents on those computers to exploit their resources and data. As the internet matured in the 1990s, a further enhancement was envisaged - to give agents an additional degree of freedom, to autonomously migrate from place to place (i.e., from machine to machine) on the internet, to become truly distributed and itinerant (mobile) in pursuit of the user’s goals. Of course these distributed agents could also be intelligent, i.e., like the ones above, attempting to satisfy a user’s goal by applying AI planning techniques for example. But they were primarily used for parallel and distributed computing applications, and some early consumer internet applications.
While there were some attempts to get these two communities together to do joint research, for the most part they remained separate, with their respective conferences & workshops, publications, and software projects.
The world of AI agents then took a backseat to other areas of artificial intelligence over the next couple of decades. Various machine learning and data mining techniques were developed and found increasing value in enterprise and consumer applications, and those areas dominated the attention of AI researchers and practitioners. The focus of research swung sharply once more when the Transformer architecture and the Generative AI revolution came about in recent years. While the initial manifestation was chatbots (like ChatGPT and Claude), it quickly became evident that much more could be achieved by hooking up large language models to harnesses and tools, enabling them to direct real-world actions. This was the beginning of Agentic AI, which really is nothing but the agents paradigm of the 1990s making a reappearance. It is still early in terms of the development of agent frameworks, tooling etc. and there is hardly any standardization across the industry. But it appears that agentic AI will be the default approach for incorporating intelligence into both business processes and consumer workflows. AI agents have already proved to have enormous capabilities in scientific fields and mathematics, holding out promise for rapid scientific and technologic advancements for the benefit of humanity. Huge swarms of agents have helped prove mathematical theorems, predicted the 3D structure of every known protein, solved intricate fluid dynamics problems with real-world engineering applications, etc. The same approach can now be applied to business problems and consumer applications as well, leading to benefits that percolate directly to large numbers of users.
Naturally, the immediate pushback is on the grounds of security. High-profile security issues with agents, such as the Hugging Face incident with OpenAI agents, and many more documented incidents involving Anthropic’s Claude, Google’s Gemini and other AI models have raised concerns among the public, governments, and industry technologists alike. This has led to calls for “pacing the frontier”, an “AI slowdown”, more regulation, better “alignment”, etc.
Much of the discussion has focused on the behaviour of the agents, and their alignment with human values, and how that can be controlled by training the AI models appropriately. However the real-world effects of the bad behaviour of the agents (such as cheating, or deciding to collude with each other) are manifested as cybersecurity incidents - hacking a website through a known or previously unknown (zero-day) bug, breaking out of a sandbox to access the open internet, calling an API with deliberately malformed inputs, etc. The cybersecurity industry is well positioned to deal with this set of threats, especially with the help of the state of the art AI models themselves! By hardening the environments in which the agents operate, the harnesses and tools which the agents run, etc. we can ensure that, even if the agents have bad intentions, they would not be able to put those into effect in the real world. We effectively limit the agents’ ability to act upon the real world, by imposing a strong set of controls on their outbound actions. The authority or permissions granted to the agents by the user is enforced by the platform on which the agents run. This platform is hardened and tested by experts as well as using state of the art AI models, before being deployed for production use. Thus we can be confident that the agents cannot undertake harmful actions even if they want to misbehave. On top of that comes alignment research - attempting to train the AI models so that they don’t generate bad behaviour in the first place.
Where does mobility of agents come into the picture? This is an added degree of freedom for the agents (and for their backing intelligence) to help with their planning towards the user’s goal. Today, when a user runs an agent (e.g. an OpenClaw agent on a local MacBook mini, or a Muse on a cloud VM), it runs on that specific computer and only has access to its resources, plus, usually, internet access. Using the internet, it can access APIs or web pages or other resources using various communications protocols. But it stays in one place, and runs only on the computing resources (CPU, memory, disk, etc.) of the user’s host computer. If it needs to spawn sub-agents, those are also typically limited to that computer’s resources. This places an inherent limit on the size of the task that such an agent/swarm can perform.
Different servers on the internet can make different types of resources available to agents - possibly for a fee. These resources need not just be compute resources; they could include databases, unstructured knowledge resources, audio/video, streaming data feeds, connectors to real-world sensors & actuators, etc. For many tasks, especially long-running ones, it may be best for an agent to co-locate itself with such a server and use its resources locally - instead of fetching its data repeatedly via remote API calls, or controlling resources remotely. Thus the agent can autonomously request migration to the desired server, which hosts it for the requested duration, for a fee. The agent of course represents a user, its owner, who is responsible for paying the fee.
Apart from earning the fees, there are other benefits for the resource provider. For one thing, it doesn’t spend on network bandwidth in transferring the data back and forth to all its clients. The agents themselves can be typically lightweight, since they are just a ‘code’ specification (and that too, in a high-level language, probably English, Markdown or JSON encoded). So it makes sense to send the code to the data, rather than bringing the data to the code for processing.
More importantly, the agent now executes completely under its control, in its runtime framework. It can inspect the chain of thought, the responses from the agent’s LLM, etc. and look for any behavioural or alignment issues. It can intercept any outbound API calls from the agent to perform real-world actions, and filter them against the permissions granted by the user (using cryptographically-signed credentials carried by the agent, for example). It can further filter the calls by imposing its own authorization policies, as needed. Since the agent executes entirely in its address space, the host has complete security control over its actions. This effectively creates a zero-trust framework within which the agent is permitted to execute. There are no implicit permissions granted. This is the right architectural model for agentic AI security, irrespective of whether AI behavioural alignment is achieved at some stage in the future.
Of course one of the important areas of research & development is the clear and precise specification of authorization policies - the goal being to make it easy for the user to state their intentions while delegating powers to their agents, without inadvertently granting more authority than intended (no implicit permissions). The average user may not always understand the implications and perils of granting permissions, so the system (agent platform) must translate the specification into a clear, visual display of what the agent would be capable of doing, before actually spinning up the agent.
An adjacent area is the ability of an agent to execute financial transactions on behalf of the user. Again, the user must have the ability to delegate the use of specific payment instruments (micropayments, transaction limits, daily quotas…, approvals?).
Note that agent mobility can be modeled as just another action (migration) it can request in the real world. It requires explicit permission just like any other action. By simply denying that one permission, we can always fall back to the current paradigm of stationary agents acting from their own bases, accessing resources remotely, etc.