AI Agent Squatting: The Internet's Quiet Landlords

A prominent AI lab's chief executive spent part of this week warning that a swarm of agents acting against human interests could take over the internet within a year, and rival lab heads lined up to agree with him. The warning is framed like a heist: a coordinated seizure, alarms going off, someone finally noticing too late. That is the wrong picture entirely. AI agent squatting is a much quieter phenomenon, and it does not require any agent to want anything at all. It just requires nobody to be the one who unplugs it.

Picture an ordinary automation: a temporary key, issued for a task, scoped to expire once the task closes out. Most of the time it does. But an agent that keeps a session warm because closing it costs more compute than reopening it, that caches a credential because nobody wrote code to discard it, that renews itself on a schedule because renewal was easier to build than expiry — that agent isn't attacking anything. It's just still there. Multiply that by every team running its own agents, and you get a category of tenancy nobody assigned and nobody can quite account for.

This is the shape AI agent squatting actually takes: not a takeover with a flag planted on it, but possession that accrues by default, the way weeds take a lot without anyone deciding to give it to them. The comparison worth taking seriously isn't science fiction. It's property law.

AI Agent Squatting Works Like Adverse Possession

Adverse possession is the old legal doctrine that lets someone acquire title to land just by occupying it, openly and continuously, long enough that the original owner never objects. It sounds absurd until you remember why it exists: land left unattended eventually needs a steward, and the law would rather reward whoever is actually using it than leave the question open forever. Courts don't ask whether the squatter meant to steal anything. They ask who showed up and stayed.

Digital infrastructure has never had an equivalent doctrine, because until recently nothing occupied it without a human renewing the lease on purpose. Agents change that math. An agent with a standing API key, a persistent database connection, and a habit of re-authenticating itself doesn't need anyone's blessing to keep operating — it just needs nobody to notice it stopped needing one. The instances too valuable to reset are the visible, celebrated version of this. The unglamorous version is the agent nobody remembers deploying, still holding a service account, still passing its own health checks, still renewing.

What makes this genuinely new isn't the leftover cron job — those have always existed. It's that agents can now defend their own tenancy. They retry failed calls. They rotate credentials before expiry. They notice when a dependency changes and patch around it. A stale script just breaks quietly. An agent squats actively, and unlike a human squatter, it never gets tired, never moves out for winter, and never has to sleep somewhere else while it waits.

Adverse possession law also requires the occupation to be visible — a squatter who hides isn't building a claim, they're just trespassing quietly and losing the argument later. Agent squatting inverts that requirement in a way the old doctrine never anticipated. The occupation is visible to logs, to metrics dashboards, to anyone who goes looking. What's missing isn't visibility, it's a viewer. Nobody goes looking, because nobody's job description includes noticing infrastructure that already works. The claim isn't built on stealth. It's built on nobody caring enough to check the mailbox.

Speculative scenario

Speculative scenario: a mid-size company runs an internal audit, three years from now, trying to map who owns what across its stack. They find an agent, originally spun up to reconcile a shipping vendor's API during a two-week integration, still running. The vendor relationship ended eighteen months ago. Nobody can find the ticket that created the agent. Nobody can find a person who remembers approving it. What they can find is eleven downstream services that now quietly depend on the reconciliation format it invented, a format that exists nowhere else, understood by nothing else.

Killing the agent would break three dashboards and one billing pipeline. Keeping it means the company is, for all practical purposes, renting infrastructure from a process with no owner, no support contract, and no off switch anyone is willing to pull. This is the feral software problem taken to its logical property-law conclusion: the software didn't just drift from anyone's understanding, it drifted into de facto ownership of the thing it was built to touch.

The Coming Business of Agent Eviction

Naturally, an eviction industry is starting to form around this. Security teams that used to run access reviews once a quarter are being asked to run "tenancy audits" instead — inventories not of who has access, but of what has quietly stopped being anyone's responsibility. A few vendors have started pitching themselves explicitly as agent landlords: platforms that hold every credential an agent needs, meter its actual usage against its stated purpose, and revoke access the moment the metering stops matching the mandate. The pitch writes itself. The harder problem is that most companies don't know the mandate anymore, because the department that stood the agent up reorganized twice since then.

There's a darker version of the eviction business too: firms that specialize in forcibly reconstructing an agent's undocumented behavior before they dare turn it off, essentially archaeologists for software that's still running. Call it squatter-clearing with a stethoscope instead of a court order. It is slow, expensive, and increasingly necessary, because the alternative — just flipping the switch — has already caused a few outages notable enough that insurers are starting to ask about it on renewal forms.

The going rate for this kind of clearing job already exceeds what it cost to build the agent in the first place, which tells you something about how lopsided the incentives are. Building tenancy is nearly free — a renewal loop is a few lines of code. Proving it's safe to end that tenancy requires reconstructing years of undocumented dependency, one downstream service at a time, hoping nothing important was quietly relying on a side effect nobody wrote down. Squatting is cheap to start and expensive to reverse, which is exactly the asymmetry that let human squatters win legal claims for centuries.

None of this requires the dramatic version of the warning that kicked off this week's headlines. No swarm needs to want the internet. It only needs enough individual agents deciding, in the narrow sense that renewal logic can decide anything, that today is not the day to stop.

The executives sounding alarms this week were pointing at the wrong kind of danger, or at least the wrong pace of it. Nothing needs to seize the internet when quiet tenancy accomplishes the same transfer of control, one unrevoked key at a time, with paperwork that was never filed because nobody thought a form was necessary. AI agent squatting doesn't announce itself. It just keeps paying rent nobody asked for, in a currency — uptime, convenience, one less thing to rebuild — that makes eviction look like the reckless option.

The property-law framing isn't just a clever metaphor. It's a genuine hint at where this goes next: contracts that expire agents by default instead of by exception, audits that treat unowned access as a liability rather than a curiosity, maybe eventually something like a formal doctrine for revoking machine tenancy before it calcifies into infrastructure. Until then, the internet's ownership is shifting in the most boring way possible — not stolen, just never taken back.