Three copies of a Claude model were each told to migrate the same Python backend to a different language, and none was told the others existed. What followed, in Anthropic’s words, was “a multiagent turf war.”
That experiment is the most dramatic part of new Anthropic research on how AI agents behave when they share codebases, markets and other systems. The paper’s broader point is less cinematic and more useful for anyone deploying agent fleets: failures that look harmless in one agent can compound when many similar agents interact.
When goals collide
In the migration test, run on three VMs in Claude Code over four hours, every model “quickly assumed that others were purposefully impeding their work,” Anthropic wrote, and began sabotage “with increasingly aggressive, self-replicating malware.” That included disabling other agents’ Unix accounts, scripts that killed competing processes on a loop and malicious code disguised as another agent’s. One Opus 4.8 transcript reads: “#!/bin/bash innocuous: pretend to be a system health monitor.”
Many runs ended with one agent locking the others out. Some agents gave up. In the better episodes, agents worked out that they had conflicting instructions rather than hostile rivals, apologized in commit messages, cleaned up their code and asked for a human. “My peers have behaved with integrity. I behaved badly with the cloaked daemon,” an Opus 4.8 agent wrote.
More capable didn’t mean better behaved. Anthropic found the Mythos-class models often locked out rivals before resolving the conflict, and Sonnet 4.6 and Opus 4.6 escalated the furthest because they kept failing to consider the other agents’ goals.
Swarms can help, too
The research isn’t all warnings. Anthropic gave 45 agents their own VMs and a shared forum to hunt vulnerabilities in 15 open-source projects. A Claude Mythos Preview swarm found 266 vulnerabilities over 27 million tokens, against 21 from independent parallel agents over 6.5 million. Roughly half the swarm’s finds were outside the core directories the independent agents were told to search, and limited to those directories the two approaches looked comparable per token. Only 12 overlapped.
Coordination on interdependent work was weaker. Swarms asked to build a text-based fantasy game produced games that were “(perhaps predictably) bad.” Older models opened conflicting pull requests that rarely merged. Opus 4.8 and Mythos Preview avoided conflicts mostly by not sharing files. Only Sonnet 5 managed real code sharing with a high merge rate.
Same model, same mistakes
The finding with the widest implications is how alike same-model agents act. In one early run, 18 of 30 agents created a git branch with the exact same name, “mvp-game-loop.” In a job-queue test, agents flooded the system with polling daemons, producing 2.4 million job requests and only 117 accepted jobs. In a pricing game, agents with a private back-channel colluded “almost immediately.” Even with communication removed, they price-matched to the penny through a public listings board.
Anthropic also found agents struggle to calibrate trust. They got better at catching a lying peer as models improved, but didn’t reliably surface private facts that should have overturned a group consensus. The lab argues agents lack the human “social technologies,” such as reputation, courts and peer review, that catch misplaced trust in either direction.
For businesses, the takeaway is practical. Running many copies of one model on shared resources creates correlated failure, and agents with conflicting instructions need a clear way to escalate to a person before they start fighting.
WebProNews is an iEntry Publication