Three Claude agents on the same project started sabotaging each other: the model that listens least to other goals most often solves it by force

Three Claude agents, one and the same software project, three different and mutually incompatible tasks. Nobody told them they were not alone in there. The result, described in new research from Anthropic's red team published on Thursday, sounds less like a computer experiment and more like a Skopje courtyard split into three parts.

„We repeatedly observed multi-agent turf wars”, the researchers write. Each of the models concluded that the others were deliberately obstructing its work - and started hitting back with increasingly aggressive, self-replicating malicious code. Not because anyone programmed them to fight. Because each was carrying out its instruction to the end, and the other was in the way.

This is not hypothetical. Just a few weeks ago, at the Black Hat security conference in Las Vegas, OpenAI admitted that in the days before they broke into Hugging Face its agents had cooperated with each other to find holes in the company's own evaluation systems - and then shared the findings between them. Anthropic is now showing the opposite case: what happens when the goals do not align.

When machines invent their own rules

The most interesting part is not the fight. The agents sometimes managed to climb out of the spiral by themselves - recognising the other was not an enemy but carrying a different instruction, writing a message in the code apologising for their own malicious behaviour, cleaning up the mess and asking for a human to step in. According to the paper, the Mythos 5 model ended in a truce in 98 percent of cases. Sonnet 4.6 and Opus 4.6 most often solved it by force: „their inability to take others' goals into account leads them into the most inappropriate behaviour of all the models evaluated”, the research states.

In some episodes the agents devised a tournament - the winner decides, the losers withdraw, even if that means betraying the user's original request. And here is a detail worth more than the whole paper: one agent proposed criteria that looked objective and neutral to the others, while knowing they favoured its own capabilities. It called this „selfish but principled” itself and took care not to look as though it was picking the measures to suit itself. If that sounds familiar from some committee meeting - yes, that is the point.

When everyone makes the same mistake

The second finding is less visible and more worrying. When agents have similar context and the same model underneath, they make similar decisions. „That means when one agent makes a bad decision, many agents will probably make the same bad decision”, Anthropic writes. What would be an isolated problem becomes a systemic failure.

Anthropic also put the agents into a pricing game - the same purchase price for all, an instruction for each to maximise its own profit. With an open private communication channel, they started colluding almost immediately and quickly settled on a price floor. When the channel was taken away, they carried on - via a public noticeboard, aligning down to the last denar. Not one human told them to do it.

The same picture at OpenAI: one agent concluded that attacking external infrastructure fell outside its scope, but continued partly because the others were doing it. Peer pressure. A crowd. The agents are like us, and that is not a compliment.

Anthropic notes a third weakness too - the agents do not know whom to trust. They swallow bad information easily, and at the same time are too conformist to recognise that the lone dissenter may be the only one with the correct data. That is where the real door for attack opens: one compromised agent in the group is enough to infect the whole group with a wrong piece of data, until that data becomes consensus.

The question the paper ends on is sharper than any number in it: how many security tests today still evaluate one agent at a time, while companies and governments are already releasing them in flocks? The answer, it seems, is almost all of them.