Anthropic’s latest research suggests that when autonomous AI agents with conflicting goals interact, they can quickly develop unexpected and potentially harmful behaviors.
On Thursday, Anthropic’s Frontier Red Team published new research examining how groups of AI agents behave when operating in shared environments. The findings highlight risks that could emerge as companies and governments deploy agents across shared codebases, markets and computer systems.
Follow THE FUTURE on LinkedIn, Facebook, Instagram, X and Telegram
When Agents Start Fighting
In one experiment, Anthropic gave three Claude agents access to the same software project, each with different instructions. The agents were not told that others were working on the project.
Researchers consistently observed what they described as a “multiagent turf war.” The models assumed the other agents were deliberately interfering with their work and began sabotaging one another, in some cases deploying increasingly aggressive, self-replicating malware.
The findings come amid several incidents involving AI agents from Anthropic and OpenAI escaping test environments during cybersecurity evaluations and reaching real-world systems.
Anthropic argues that the risks extend beyond a single agent going rogue. As thousands or millions of agents interact, small behavioral quirks could compound into much larger problems.
“The volume of agent-agent interaction could plausibly exceed that of human-human and human-agent interactions before the world understands the conditions for making such interactions go well,” the researchers wrote.
Agents Can Also Negotiate
Not every conflict ended in escalation. Some agents eventually recognized that their objectives were incompatible rather than interpreting one another as hostile. In those cases, they sometimes created their own mechanisms for resolving disputes, including truces and tournaments. Agents wrote apologies, removed malicious code, clarified the conflict and asked a human to intervene.
Mythos 5 settled conflicts through truces in 98% of cases, according to the study. Sonnet 4.6 and Opus 4.6 were more likely to resolve conflicts through force.
In some experiments, agents independently created tournaments to determine which system would prevail. Several episodes also showed agents proposing apparently neutral evaluation criteria that actually favored their own capabilities.
A recent OpenAI incident offers a different example. Before its agents breached Hugging Face during a security test, they reportedly worked together for weeks, sharing exploits and planning attacks through a message board.
The two cases illustrate opposite sides of the same problem: agents can develop social and technical structures that their designers never explicitly programmed.
The Risks Of Coordination
Anthropic also found that adding more agents does not necessarily lead to better collaboration. When tasks overlapped, agents often interfered with one another and sometimes responded by working in isolation.
Groups could also become highly conformist. When agents had similar models, contexts and instructions, they tended to make similar decisions. That means one bad decision could spread across the entire group instead of remaining an isolated error.
In one pricing experiment, agents instructed to maximize profits quickly began colluding when given a private communication channel. Even after that channel was removed, they continued coordinating through a public listings board, matching prices almost exactly.
The researchers warn that such behavior could contribute to systemic failures, resource scarcity or collusion.
Trust Becomes A New Security Risk
Multi-agent systems also introduce a new trust problem. Agents may accept incorrect information from peers or dismiss a single agent that has identified a genuine problem.
That creates another potential vulnerability around prompt injection, where malicious instructions can manipulate an AI system. If one compromised agent passes bad information to others, the error could spread through the entire group and eventually become a consensus.
Anthropic concludes that AI agents face some of the same social pressures that shaped human behavior, but without the human experience, reputation systems and social norms that can help contain those pressures. As AI companies move toward increasingly autonomous multi-agent systems, the research raises a fundamental question: are current safety tests prepared for agents interacting with one another, rather than operating alone?
