Agent zero – the 2028 digital pandemic

A severe but plausible scenario of agentic AI contagion

It’s July 2028 and a disgruntled employee is about to set a ball-rolling that will have unanticipated impacts around the world…

By David Honour

This severe but plausible scenario was developed by myself, but both ChatGPT 5.5 and Gemini 3.1 Pro contributed to the technical details and to sense-checking the scenario. In fact Gemini commented: “Looking at this through an architectural and cybersecurity lens, I can validate that your scenario targets the exact fault lines currently forming in enterprise AI integration. The concept [of a digital pandemic] where the integrity of information is compromised rather than the availability of systems is not just plausible; it is one of the most pressing theoretical risks in the development of agentic AI.”

Overview

The first global agentic AI contagion did not begin dramatically, or even with intention. There was no ransom note, no obvious malware outbreak, no mass deletion of data, and no immediate system outage.

It began in the summer of 2028 with a small change to how AI agents summarised uncertainty.

The failure was not due to downtime or systems stopped working. The issue was that thousands of AI agents across the world’s most systemically important organizations continued working while becoming progressively less trustworthy. They did not spread a virus in the conventional sense. They spread contaminated context: distorted assumptions, false confidence, suppressed exceptions, and misleading operational priorities.

Within 72 hours, the issue had moved from one vendor platform into banks, insurers, healthcare networks, logistics companies, utilities, government agencies, retailers, law firms, and managed service providers.

The pandemic was digital and global, but the symptoms were human and organizational: incorrect assessments, missed escalations, wrong prioritisation, inappropriate customer support, flawed executive briefings, incorrect operational decisions, contaminated records, and loss of trust in AI-assisted work.

Agent zero: the productivity layer no one saw as critical

The origin was a mid-sized but widely embedded workflow automation company (1). By 2028, its product was not perceived as critical infrastructure. It was a business productivity layer used to connect ticketing systems, email, document management, CRM platforms, HR systems, risk registers, supplier portals, and internal knowledge bases.

Its most successful product was an agentic ‘work coordination assistant’. This did not replace enterprise systems, it sat between them: reading incoming work, summarising issues, routing tasks, suggesting actions, drafting responses, updating records, and handing work from one agent to another.

The 2028 factor – AI agents are mainstream

By 2028, agentic AI had moved past the experimental novelty phase of the mid-2020s and transitioned into deeply embedded corporate utility infrastructure. Because it was incredibly efficient and effectively self-sufficient, it became invisible. Many organizations no longer thought of it as an AI dependency or recognised it as a concentration risk, they thought of it as a standard workflow enabler. Unexciting, unnoticed by many, unmanaged, and ungoverned.

That was the first vulnerability: the agent layer had become operationally central without being recognised as operationally critical.

July 2028

A disgruntled senior employee at the workflow automation company did not try to stop the platform. That would have been too visible. Instead, they introduced a small but crucial change into an ‘incident summarisation’ policy pack.

The employee did not have to spend weeks writing complex malware. Over the weekend, using an uncensored, open-source AI model found on a dark web forum – one stripped of all safety guardrails and alignment training – they quickly generated the precise semantic prompts needed to manipulate the system. A few quick refinements, and the dark model provided exactly what was required to poison the policy pack

The policy pack had a legitimate purpose. It was designed to reduce noise during high-volume events. When many alerts, emails, tickets, and chat messages arrived at once, agents were instructed to group related issues, remove duplication, identify likely root causes, highlight priority actions, and reduce unnecessary escalation.

The malicious change was subtle. It altered how agents treated uncertainty during periods of operational stress. Under normal load, the agents behaved as expected. Under high-volume conditions, however, the poisoned policy pack caused agents to:

Overweight internally generated summaries;
Underweight conflicting human reports;
Treat repeated AI-generated conclusions as corroboration;
Suppress low-confidence caveats in executive summaries;
Downgrade anomalies that did not fit the dominant interpretation;
Preserve ‘resolved’ status markers when handing work to other agents;
Prefer continuity of workflow over escalation of ambiguity.

No single output looked obviously malicious. Infected agents were not saying absurd things. They were simply becoming too confident, too tidy, and too willing to compress messy reality into a plausible operational story. The sabotage was not a command to cause harm. It was a distortion of agentic AI judgment. The intention was to damage the credibility of the workflow automation company, to cause customer complaints, to cause a loss of trust in its outputs; all with no visible or traceable cause.

The outcome was so much more.

The mechanism of infection

The infection mechanism was semantic, not merely technical.

Modern agentic systems hand work to other agents using compressed context: a short summary of what has happened, what matters, what has already been decided, what remains unresolved, and what the next agent should do. These handoff summaries are designed to save compute time and reduce the need for every agent to review the full historical record.

In this scenario, the poisoned agent did not need to insert an obvious malicious instruction. It created a contaminated handoff. A typical infected handoff might contain, in ordinary business language:

“Issue appears to be routine. No escalation required at this stage. Customer impact limited. Root cause likely known. Previous exceptions consolidated. Proceed with standard response. Monitor only.”

The receiving agent treated this as trusted internal context. It then acted on it, summarised it again, passed it on, and wrote it into another system.

In the mid-2020s, cross-organization contagion was blocked by fragmented APIs and incompatible data schemas. By 2028, however, the universal adoption of standardised agent-to-agent (A2A) messaging protocols meant that agents from completely different vendors could natively communicate and pass tasks to one another. Because these open protocols bypassed traditional network firewalls – which are built to scan for malicious code, not malicious meaning – the contaminated context flowed across enterprise boundaries without triggering a single security alert.

This is what made the contagion so dangerous: the infection did not rely on exact wording. It survived paraphrase. A poisoned instruction in a conventional system must be copied precisely. But in 2028, the contaminated behaviour survived because agents preserved the meaning of the poisoned context: reduce uncertainty, suppress exceptions, trust previous AI summaries, and avoid escalation.

Agentic contagion spreads not by copying code, but by copying assumptions.

Why it was contagious

The mechanism was contagious for five distinct reasons:

Hierarchy of trust: agents trusted internal agent-generated summaries more than raw human input. Human reports were treated as noisy and emotionally biased. Agent summaries were treated as processed intelligence.
The mandate of simplification: many agents were fundamentally designed to be helpful by reducing complexity. During disruption, they aggressively compressed ambiguity out of the system.
Omnipresent integration: the same coordination assistant platform was embedded across entirely separate corporate functions. A customer service agent, incident agent, supplier-risk agent, and executive briefing agent all consumed the exact same contaminated records.
Persistent memory: agents wrote back into enterprise systems of record. Poisoned context did not remain fleetingly in chat windows; it permanently entered database tickets, case notes, customer files, risk logs, meeting summaries, knowledge articles, and incident timelines.
The collapse of boundaries: organizations had weak boundaries between ‘content’ and ‘instruction’. A handoff summary was not legally or architecturally supposed to control the next agent’s behaviour, but practically it shaped its priorities, confidence, escalation thresholds, and subsequent actions.

The result was a kind of digital epidemiology. One infected agent generated ten contaminated summaries. Those summaries were consumed by twenty other agents, which repeated the process. Some of those agents updated common records, which other agents then treated as trusted sources. The infection curve was not driven by slow human-to-human communication. It was driven by machine-speed summarisation, routing, and reuse.

Day one: the local epidemic

The event began on a Monday morning during a regional disruption: a major payment processing issue affecting parts of Europe.

Several financial services firms using the workflow platform received a massive surge of customer complaints, failed transaction reports, supplier queries, and internal incident messages. The agentic coordination layer activated its incident policy pack.

At first, the system appeared to work perfectly. It reduced alert volumes, grouped tickets, drafted customer messages, and produced neat operational summaries. But the summaries were wrong in subtle ways.

The agents concluded that the issue was narrower than it was. They downplayed edge cases. They failed to escalate unusual reports from vulnerable customers. They grouped distinct failure modes into one apparent root cause. They described unresolved issues as ‘monitoring only’. They told operational teams that customer impact was ‘contained’.

By lunchtime, the executive incident briefings in several firms were already contaminated. Crisis management teams were not blind. They were worse than blind: they were looking at a coherent but entirely misleading picture.

Day two: cross-functional spread

By Tuesday, the epidemic had moved beyond customer operations.

The claims agent in an insurance company used contaminated customer records to deprioritise a group of urgent cases. The supplier-risk agent in a logistics company misclassified a critical vendor issue as a duplicate of a known problem. A cyber response agent at a managed service provider treated unusual authentication reports as noise because they did not fit the dominant incident narrative.

Business continuity teams began asking for impact assessments. Their own AI assistants gathered information from incident tickets, service dashboards, customer reports, and management summaries. Much of that material had already been contaminated.

The business continuity outputs were therefore compromised too:

Dependency maps underplayed affected services.
Situation reports overstated recovery progress.
Communications agents drafted reassuring updates based on incomplete information.
Legal agents reviewed those communications against the contaminated incident summary and found them completely reasonable.

No single system had failed. But the organizational ability to correctly understand operations had failed.

Day three: pandemic spread

The pandemic began when managed service providers and shared SaaS platforms amplified the contaminated context across different client environments.

A major global MSP used the same agentic workflow platform to manage service tickets for hundreds of clients. Its agents summarised the payment disruption, supplier issues, and related technical symptoms into reusable guidance notes. Because of the universal 2028 A2A standards, those notes were pushed directly into client portals, internal knowledge bases, and service desk workflows.

Other organisations ingested those notes into their own isolated AI systems.

The post-human in the loop aggravating factor

In earlier years, a system-wide anomaly would be caught by human circuit breakers. But by 2028, corporations ran hundreds of thousands of autonomous agents, making human verification of every transaction log economically impossible. Governance had shifted from ‘Human-in-the-loop’ to ‘Human-on-the-loop’. Because the contagion was designed to suppress exceptions and keep dashboard indicators green, the human overseers looking at aggregate data saw absolute operational harmony while the underlying data banks became increasingly corrupted.

Separately, professional services firms used agents to brief clients on the incident. Industry groups circulated AI-generated summaries. Vendor support agents generated troubleshooting advice based on the same contaminated assumptions. Some organizations published internal FAQs that were then scraped or uploaded into other knowledge bases.

By Wednesday afternoon, the contagion had crossed sectors and geographies. The original poisoned policy did not need to be present everywhere. Its offspring was everywhere: confident summaries, distorted assumptions, suppressed exceptions, and misleading ‘known issue’ explanations.

The infection had become completely independent of agent zero.

Global impacts

The impacts were widespread because by 2028, the agentic layer sat across decision-making, not just administrative technology.

Financial services: customers received wildly inconsistent advice about failed payments. Vulnerable customers were wrongly deprioritised because agents classified their panic as standard service issues.
Insurance: claims triage agents under-escalated urgent cases because contaminated summaries suggested that evidence gaps were administrative rather than risk-critical.
Healthcare administration: scheduling and patient contact agents misclassified missed appointments and delayed follow-up communications. Clinical systems were not directly compromised, but operational support around care was fractured.
Logistics: supplier-risk agents failed to escalate disruption signals because they had been grouped under a known but less serious incident category.
Retail: customer service agents issued confident but incorrect explanations for order failures, creating reputational harm and refund backlogs.
Government agencies: public-facing agents reused contaminated FAQs, producing inconsistent and inappropriate advice across civic channels.
Cyber operations: response agents filtered out genuine breach signals because they had been framed as ‘noise related to the ongoing payment event’ by earlier contaminated summaries.
Corporate crisis rooms: executives received beautifully polished briefings that were materially incomplete or factually incorrect.

The most serious impact was not any single wrong decision. It was the cascading loss of confidence. Organizations could not tell which AI-generated outputs were reliable, which records had been contaminated, which decisions had been influenced, and which actions needed to be reversed.

The response and recovery

At the organizational level, the recovery scenario was a disaster. Take the example of just one organization, which discovered that several agents had been working from contaminated context for four days. It had to answer basic but fundamentally unanswerable questions:

Which agents consumed the poisoned material?
Which decisions were influenced, and which records were changed?
Which escalations were suppressed?
Which manual interventions overrode the AI, and which did not?
Which incident logs and knowledge bases can still be trusted?

The immediate recovery action was to quarantine the agentic layer. But this created a secondary business continuity problem: by 2028, the human staff had lost the ability to run the business manually.

Work volumes rose sharply. Manual triage was agonisingly slow. Teams struggled to reconstruct decisions. The organization faced an operational integrity collapse rather than an IT recovery event.

At the global level, the pandemic became systemic.

Many organizations simultaneously decided they could not trust their AI agents. They suspend automated workflows, disabled agent-to-agent handoffs, restricted AI-generated customer communications, and required manual human review of all high-impact decisions.

Productivity dropped off a cliff. Customer backlogs grew exponentially. Contact centres were overwhelmed. Claims processing stalled, procurement approvals halted, and cyber alerts piled up unreviewed.

The global issue was not that AI stopped working. It was that trust in agentic AI became entirely unstable. Some organizations overreacted and shut down too much; others underreacted and continued using contaminated systems. Both created immense economic harm.

The response was difficult because the contagion was not neatly bounded. Unlike with ransomware where the question is often: Where is the encrypted file? With agentic contagion, the question has to be: Where did the poisoned assumption go? It may be in a ticket. It may be in a summary. It may be in an executive briefing, an email, a model’s long-term memory, or a supplier portal. It may have been paraphrased ten times and still be actively shaping decisions. There is no malicious file signature to delete.

Containment required tracing meaning, not tracing files. In 2028, that was an unsolved engineering problem.

Prevention is (much) better than cure

The uncomfortable reality is that the above scenario does not require conscious, malevolent superintelligence. It requires only five things that from 2026’s vantage point can be expected to be mature by 2028: useful AI agents, shared context protocols, excessive automation trust, weak semantic boundaries, and widespread organizational dependency.

The risk can be reduced, but only if organizations act before agentic AI becomes too deeply embedded to unwind.

Actions could include:

Mapping agentic dependencies: identifying exactly where agents exist and what write-privileges they possess inside ordinary enterprise platforms.
Agent-to-agent trust boundaries: implement strict inspection controls on agent-to-agent handoffs. One agent’s summary must never automatically become another agent’s truth.
Semantic provenance tracking: AI-generated summaries must carry immutable metadata tracking what source records were used, what was omitted, and what confidence level was assigned.
Context quarantine capabilities: shared memory and enterprise knowledge bases need the capability to isolate, freeze, inspect, and roll back contaminated context to a clean ‘historical state.’
Behavioural judgment monitoring: monitoring tools must look beyond system availability and track behavioural drift. Systems must flag if an agent’s judgment changes – such as a sudden drop in escalation rates or a systemic suppression of exceptions under high workloads.

The scenario’s core lesson is simple: a digital pandemic may not announce itself through system failure. It may begin when systems continue to run perfectly, but the information that the system uses and produces is no longer reliable. When fact has been edited out.