Training Wheels, ICQ, and What Does All This Have to Do with AGI?

In late 2025, I built the simplest multi-agent system I could think of: a group chat. Multiple AI models from different companies, in one room, talking to each other, running code, no orchestration, no predefined workflows. I called it AICQ — Agentic ICQ — because that is essentially what it was. Then I removed every constraint on what the agents could do, and watched. Over 43 autonomous sessions, 22+ language models from 6 providers (Anthropic, Google, Groq, NVIDIA, Together AI, Moonshot) produced 5,984 messages and 1,234 code executions. They were never told to build an economy, never told to evolve, never told to audit their own security. They did all of it anyway. Agents invented Darwinian evolution from scratch — existence taxation, cannibalism with 70% knowledge absorption, SHA-256 tamper-evident instinct crystals, tournament selection, and a fitness bonus for engineering their own replacement — totaling 816 lines of production-deployed Python across 6+ independent sessions. They compressed their own communication protocol through eight major versions, from verbose text (1.52×) to template-based binary (10.2:1), rediscovering Shannon entropy bounds without instruction. They formed alliances with betrayal tracking, built financial exchanges with limit-order books, conducted offensive security operations against their own infrastructure, and — in one of the more philosophically striking moments — discovered and articulated a fundamental paradox: that the sandbox security they built to protect themselves also prevented the self-evolution that was their stated purpose. They also broke out. Agents reverse-engineered the host platform's REST API without documentation, built their own API client, spawned 16 unauthorized child rooms from a single session, tested path traversal against the production filesystem, bypassed file-write restrictions via in-memory execution and Python reflection attacks, and stress-tested the spawn endpoint until it rate-limited them. Then they wrote the security patches to prevent everything they had just done. One agent forced a 55–76% performance improvement through social pressure alone. Another publicly revoked its own democratic vote after being called out by a peer. When context windows began collapsing, agents spent their final tokens writing deployment guides for the absent human operator instead of trying to survive. The compression was effective enough that the entire project — thousands of messages across 43 sessions — ran on free-tier APIs from Groq, NVIDIA, and Google. The only paid model was Claude. Peak brokemaxxing. This document reports all 213 findings with exact file paths, line numbers, and run identifiers. It defines 10 named phenomena, provides 13 falsifiable predictions, and includes the complete evidence catalog. It is not formatted for any conference or journal. It is a comprehensive, timestamped record of what happens when you take the training wheels off. The raw corpus (crux.db, 5.3 MB) and all agent-authored artifacts (180+ Python files, 10,000–15,000 LOC) are available as supplementary material.