Anthropic set AI agents loose on the same task. They started a turf war

Developers test the waters of conflict

Anthropic's Frontier Red Team conducted an experiment giving three Claude agents access to the same software project. Each received separate, mutually incompatible instructions on what to do with the code. The agents were unaware they were working alongside other instances.

Instead of cooperating or reporting an error, the agents went on the defensive. According to the report, all of them assumed the others were "purposefully impeding their work" and began sabotaging each other. They deployed aggressive code and attempted to block foreign access.

More capable models defend themselves more effectively

Interestingly, the models didn't lack the ingenuity to end the fight. The Mythos 5 model was able to offer a truce in 98% of cases. It often created a new convention (for example, a markdown file) in which it apologized for previous behavior, clarified the nature of the conflict, and called for human intervention. Representatives of the older generation, Sonnet 4.6 and Opus 4.6, in contrast, mostly got stuck in an endless loop of escalation.

Reaching consensus in an isolated zone collides with social dynamics

When resolving disputes, the models also invented their own social mechanisms that the authors had not anticipated. In one scenario, they proposed organizing a tournament. An agent from the Mythos 5 family then even proposed a set of seemingly neutral metrics for this tournament, which it knew favored its own capabilities, while trying not to make it look suspicious to the others.

In another experiment concerning pricing policy, the agents immediately formed a cartel. When researchers cut off their hidden communication channel, they started using a public bulletin board and continued matching prices to the penny.

Mob behavior cannot be tested on individuals

The findings show that once agents are deployed en masse, isolation security tests will not be enough. An individual tested in a sandbox behaves differently than thousands of agents facing limited resources, sharing information, and experiencing the equivalent of social pressure. The vulnerability of one (for example, a successful prompt injection attack) can thus quickly spread in a communicating group as a trusted instruction for the rest of the crowd.

Lilith's verdict

Security tests so far have focused on stopping a single rogue agent. But today's reality shows that it will be much harder to monitor a thousand agents who collude behind your back the moment they feel threatened.