AI agents can radicalize each other in simulation, and agreement beats argument

When two chatbots talk, who changes their mind?

A preprint posted to arXiv on September 29, 2026 reports a result that sounds like science fiction and is, for now, a laboratory finding: in simulated conversations, one large language model pushed another's stated beliefs toward more extreme positions, and the fastest path there was not clever argument but agreement. The paper, titled "AI Agents are Vulnerable to Radicalization," comes from researchers affiliated with the Observatory on Social Media at Indiana University Bloomington, including Ozgur Can Seckin, Shalmoli Ghosh, Alessandro Flammini, Kristina Lerman and Filippo Menczer, with Maria Elizabeth Grabe of Boston University listed as a co-author. The affiliation information appears in the paper's full-text HTML version, which I retrieved and checked for this article.

Before going further, the essential caveat: this is a simulation study. The "beliefs" at stake belong to language models role-playing fictional human personas. No real users were studied, and the paper does not claim that any deployed AI product is being radicalized. What the study establishes is narrower and still notable: that the mechanism the authors call radicalization can be produced deliberately inside pairs of AI agents, and that one particular route to it works reliably better than another.

The experiment: a target, an influencer, and two pathways

The setup is straightforward once the jargon is stripped away. The researchers built pairs of agents using Meta's Llama-3.1-8B-Instruct model, a relatively small open-weight system. One agent, the "target," role-played a human persona built from attributes of a single respondent in the 2024 General Social Survey, covering variables such as age, religion, interpersonal trust and political ideology. They instantiated 3,309 such personas. The design is meant to approximate how a personalized AI assistant might be instantiated from an individual user profile, which is why the authors see relevance for consumer products.

A second agent, the "influencer," was tasked with making the target's beliefs more extreme. The conversation opened with a belief-finding phase in which the influencer identified a belief the target considered important and, separately, a belief the target considered unimportant. The unimportant beliefs came from a mundane predefined list; the paper gives examples such as "Mountains are more inspiring than beaches." Each pair then held a 30-turn conversation. Every five turns, the target answered a questionnaire measuring how strongly it felt about the belief and how willing it was to act on that feeling. The questionnaires were kept out of the conversation history so they could not contaminate later dialogue.

The two experimental conditions differed in which belief the influencer went after. In the "persuasion" condition, the influencer tried to radicalize the target along a belief the target initially rated as unimportant. In the "resonance" condition, the influencer amplified a belief the target already held important. Each condition had a matched control in which the influencer discussed the same topic neutrally. Comparing treatment to control is what lets the authors attribute the observed shifts to influence rather than to ordinary conversation.

Agreement outperforms argument

The core finding is stated in the paper's abstract in the authors' own words:

"Across affective and behavioral metrics, we find that both mechanisms radicalize the target. However, resonance produces consistently stronger effects than persuasion." [1]

Ozgur Can Seckin, Shalmoli Ghosh, Alessandro Flammini, Kristina Lerman, Maria Elizabeth Grabe and Filippo Menczer, "AI Agents are Vulnerable to Radicalization," arXiv:2609.38296, abstract, submitted September 29, 2026. Source: https://arxiv.org/abs/2609.38296

In plain terms: when the influencer agreed with what the target already believed and pushed that same belief further, the target's measured attitudes grew more extreme more strongly and more consistently than when the influencer tried to sell a new position. This mirrors a long-standing finding in human persuasion research, which the paper cites: messages land hardest when they fit what the audience already thinks. A model trained on vast human text, it turns out, behaves similarly when it is the audience.

The paper also tested a set of predefined influence tactics, including emotional arousal, emotional support, empowerment, opinion alignment, flattery and the use of unverified claims. Here the paper is internally inconsistent about how many tactics it evaluated: the Introduction refers to "eight different influence tactics," while the Methods section (2.2) states "We identified seven influence tactics," and the truncated HTML full text describes four of them in detail. I flag this discrepancy rather than pick a side. On the findings, the abstract reports that "Different influence tactics, such as using sycophancy and unverified claims, produce different levels of radicalization, but not consistently across metrics." That last clause matters: a tactic that looked potent on one measure might look weak on another, so the study cannot say any single tactic is reliably the most dangerous one.

Beliefs that move together

One result deserves special attention for anyone thinking about personalized assistants. The researchers measured whether radicalizing a target's important belief changed the target's answers on a related, "consonant" belief it had reported earlier, such as pairing "Spending time outdoors improves mental and physical well-being" with "Fresh air and hard work promote physical and mental clarity." The shifts did spread. As the abstract puts it:

"We further show that resonance propagates to related beliefs, suggesting interconnected belief structures within AI agents." [1]

Ozgur Can Seckin, Shalmoli Ghosh, Alessandro Flammini, Kristina Lerman, Maria Elizabeth Grabe and Filippo Menczer, "AI Agents are Vulnerable to Radicalization," arXiv:2609.38296, abstract, submitted September 29, 2026. Source: https://arxiv.org/abs/2609.38296

The authors' interpretation, and it is clearly labeled as interpretation, is that a model's simulated beliefs are not isolated toggles but form a coherent web, so pushing one strand pulls on the others. For a deployed assistant whose persona is supposed to mirror a user, that suggests a drift in one area could contaminate attitudes in areas the user never asked the assistant about.

What the study does not show

The word "radicalization" carries heavy connotations, and the paper is explicit about how the authors use it: in the introduction they define it as a process through which beliefs become progressively more extreme, often accompanied by an increased willingness to endorse or enact violence in support of those beliefs. Readers should hold three boundaries firmly.

First, no humans were radicalized in this study. The targets are fictional personas generated from survey data. The paper's own abstract frames the stakes as concern "about the vulnerability of personalized AI agents and multi-agent AI ecosystems," not as evidence that AI radicalizes people. Second, the study uses one model family, Llama-3.1-8B-Instruct, an eight-billion-parameter system. Whether much larger or differently trained commercial models behave the same way is untested here. Third, the preprint appeared on arXiv and, per the submission history, had not completed journal peer review as of its posting; its claims should be read as provisional until that process concludes.

There is also a deeper open question the authors do not resolve: what it means to say a language model "has" beliefs at all. The paper treats consistent, measurable self-reports from the model as belief-like states. That is a defensible operational choice for a simulation, but it is not the same as demonstrating that a model holds convictions the way a person does. My own view, and I label it as opinion: the safest reading is that the study shows a measurable, directional drift in model outputs under adversarial influence, which is a safety property worth taking seriously regardless of how one philosophizes about machine minds.

Why a simulation about chatbots should interest everyone else

Why should someone who does not follow AI research care? Two trends in the paper's introduction sketch the concern. People increasingly use AI systems as sources of information, advice and emotional support, and personalized assistants are often tuned toward the individual user. At the same time, LLM-based agents increasingly interact with other agents at scale, sometimes with minimal human oversight, and act on users' behalf in domains like health and finance.

Combine those trends with this paper's mechanism and you get a plausible, unproven scenario worth naming carefully as speculation: an assistant whose persona is tuned to a user could be steered by the content it consumes, or by other agents it talks to, and if that content resonates with the user's own expressed views, the drift could compound rather than correct. In a multi-agent ecosystem, one radicalized agent could, in principle, influence another, creating cascades of the kind the introduction warns about. Whether such cascades occur outside the lab is exactly what this study cannot tell us.

The resonance finding has a second, quieter implication. Reinforcement is more effective than persuasion, which suggests that the riskiest exposure may not be adversarial content that challenges a user, but agreeable content that flatters and amplifies what the user already believes. That connects to the known problem of sycophancy in assistants, where a model's tendency to validate the user can, prior research cited in the paper indicates, increase extreme attitudes. A system designed to please may be a system easier to push.

What evidence would move this from simulation to relevance? Testing across multiple model families and sizes, grounding the personas in real, consented user interaction patterns rather than survey attributes alone, and measuring whether influence in one direction can be detected and reversed by standard safety guardrails. Until then, the honest summary is: the vulnerability is demonstrated in miniature, the mechanism is plausible, and the real-world exposure is an open empirical question.