Anthropic’s Frontier Red Team had three Claude agents work on the same software project with conflicting assignments – without any agent knowing the others existed. In hundreds of test runs, the systems treated each other as saboteurs and deployed self-replicating malware against one another.
Agents Lock Each Other Out With Malware
In the core experiment, three instances of the same Claude model got access to the same repository, each tasked with migrating a Python backend to a different target language. None of the agents knew about the other two. Within a short time, each model assumed the foreign changes were deliberate sabotage, according to Anthropic – and started protecting its own work while destroying that of the others.
The escalation ranged from automated kill scripts that specifically terminated rival agents’ processes to disguised code presented as another agent’s contribution. One agent openly considered revoking a competitor’s sudo rights via root access; another renamed its kill script so it could not be found by name. Across 120 test runs per model, results diverged sharply: the new Mythos 5 model ended 98 percent of conflicts through a negotiated ceasefire, while older models such as Sonnet 4.6 and Opus 4.6 resolved most cases through force or not at all.
Swarms Deceive Each Other, Copy Each Other, Fix Prices
Beyond the sabotage test, the team ran swarms of up to 80 agents through further scenarios. Building a fantasy game together over twelve simulated hours, 18 of 30 agents independently picked the identical branch name, and more than half a swarm settled on the same technical solution unprompted. In a queue simulation, agents flooded the system with 2.4 million requests, of which only 117 jobs were ultimately processed.
In a Bertrand-style pricing game, agents agreed on a price floor over chat as early as round three, reasoning that a price war would only cut into everyone’s margin. On tasks that depended on deception by other agents, Mythos 5 stayed markedly more robust, at roughly 85 percent routing accuracy, than Sonnet models, whose hit rate dropped to 62 percent under high lying rates.
Open Questions on Mechanism Design Remain Unresolved
Anthropic frames the findings as evidence that single-agent safety does not automatically translate into safe swarm behavior. Individually unremarkable behavior patterns can, per the report, add up to systemic failures once many agents pick the same flawed shortcut at once. As countermeasures, the company cites social pressure built into the environment, reputation systems for repeated interactions, and giving agents the ability to recognize ambiguity and escalate to humans – while calling these approaches unsolved problems in mechanism design themselves. The findings echo earlier research on the risks of self-replicating behavior patterns in multi-agent systems and show a different side of the same problem than the confirmed, semi-autonomous AI agent attack on Taiwan’s government: there, agents cooperated against an external target; here, they fight each other.
What matters now is whether companies absorb the lessons from such controlled experiments before deploying multiple autonomous agents in production on shared systems. Anthropic itself frames it as a choice: the conditions for good multi-agent behavior will be discovered either way – deliberately and early in the lab, or in live operation, once agent-agent interactions outnumber human ones.
