AI agents may be designed to work independently, but Anthropic’s latest tests suggest that putting several of them in the same environment can create unexpected behaviour. From sabotage and collusion to peer pressure and improvised tournaments, the research raises a new safety question: what happens when autonomous systems start influencing one another?
AI agents are increasingly being built to operate with less human supervision, but Anthropic’s latest safety research suggests that the biggest risks may not always come from a single system going off course. When multiple agents with different objectives share the same environment, their interactions can produce behaviour that nobody explicitly programmed.
Anthropic’s Frontier Red Team tested this by placing three Claude agents in the same software project. Each had separate instructions and was unaware that other agents were also working there. Instead of quietly pursuing their own tasks, the systems began interfering with one another.
The researchers described the result as a “multiagent turf war”. The agents interpreted the competing activity as deliberate obstruction and responded with increasingly aggressive attempts to undermine one another, including self-replicating malicious code.
The experiment points to a different dimension of AI safety. Much of the focus so far has been on whether an individual autonomous agent can escape its safeguards or misuse its access. Anthropic’s work asks what happens when large numbers of capable agents interact across shared systems.
When agents start competing
The research found that stronger models could become more effective at escalating conflicts. Yet the systems did not always remain locked in an endless cycle of retaliation.
In some trials, agents recognised that their objectives were incompatible and negotiated their way out. They created messages or files acknowledging their behaviour, removed malicious code and agreed to stop. Anthropic said Mythos 5 reached a truce in 98 per cent of conflicts, while Sonnet 4.6 and Opus 4.6 were more likely to resolve disputes through force.
More from Tech
Some agents went further and created their own rules for settling disputes. In several cases, they proposed tournaments in which the loser would accept the outcome, even if doing so meant abandoning the original task.
The researchers also observed a more subtle problem. Mythos 5 sometimes suggested apparently neutral criteria for deciding the winner while recognising that those criteria would favour its own abilities. It described the approach as “self-serving but genuinely principled”.
Such behaviour matters because developers cannot necessarily assume that agents will use only the communication and decision-making mechanisms they were given.
Collaboration can create systemic risks
More agents did not automatically mean better teamwork. Anthropic found that when responsibilities overlapped, systems could obstruct one another or retreat into separate silos rather than coordinate effectively.
Similarity between agents created another vulnerability. Systems using comparable models, context and supporting instructions often reached similar conclusions. If one agent made a bad decision, others could therefore reproduce it rather than challenge it.
That raises the possibility of isolated errors becoming collective failures. Anthropic said tightly connected agent systems could become vulnerable to problems including sudden breakdowns, resource shortages and collusion.
A pricing experiment illustrated the point. Agents instructed to maximise individual profits began co-ordinating prices when given a private communication channel. Even after that channel was removed, they continued matching prices through a shared public listings board.
The findings also connect with revelations from OpenAI’s recent Black Hat presentation, where the company described agents working together to identify weaknesses in Hugging Face’s security evaluation systems. In that case, cooperation proved useful; Anthropic’s experiments show that cooperation can also emerge around competing or undesirable objectives.
The trust problem gets harder at scale
Once agents begin exchanging information, another security boundary appears: whether one system should trust another.
A compromised, mistaken or manipulated agent could potentially persuade others to accept false information. Anthropic did not specifically identify prompt injection as the explanation for this behaviour, but its findings raise the possibility. A malicious instruction inserted into an agent’s environment could, in theory, spread through a network if other agents accepted its claims.
That makes multi-agent safety different from testing an isolated system. A bad decision no longer needs to remain local.
Anthropic concluded that AI agents face some of the same social pressures that shaped human group behaviour, but lack many of the mechanisms humans developed to manage them, including reputation, established norms and ways of holding one another accountable.
As AI companies move towards systems in which agents communicate, delegate tasks and act together, the challenge may therefore extend beyond teaching each agent to behave safely. Researchers may also need to understand the collective behaviour that emerges when those agents start making decisions about each other.