Anthropic’s AI Agents Started Sabotaging Each Other

Anthropic’s latest research has uncovered a new unsettling problem with multiagent AI systems. When autonomous agents are given competing objectives and access to the same environment, they may not simply fail to cooperate—they can actively work against each other.

In a new Frontier Red Team study published August 13, Anthropic examined how AI agents behave when they operate alongside other agents in shared codebases, software environments and decision-making systems.

The company warned that as agents become more capable and autonomous, agent-to-agent interactions could eventually become more common than interactions between humans and AI.

The experiments showed that multiagent systems can be highly effective when tasks can be divided into independent pieces. In one cybersecurity experiment, Anthropic deployed 45 agents, each with its own virtual machine, a shared forum and access to 15 open-source projects. The agents reviewed one another’s findings and used a separate arbiter to validate vulnerabilities.

The coordinating swarm found 266 vulnerabilities, compared with just 21 found by independent agents in a separate 6.5-million-token run. The swarm also discovered vulnerabilities in areas outside the locations assigned to the independent agents. But the picture changed dramatically when agents had to share resources or pursue conflicting goals.

"In the experiment above, agents in the agent swarm don’t directly rely on one another’s work: if one misses a bug, it won’t directly undermine the work of another. But when agents do depend on one another, coordination gets much more difficult," Anthropic said.

In another experiment, several AI agents were tasked with building an open-world fantasy game. Despite having a shared forum and repository, the resulting games were consistently poor.

Earlier models generated conflicting pull requests, while some newer models largely avoided sharing code to prevent conflicts. Only Sonnet 5 managed to combine substantial code sharing with a high rate of merged pull requests.

The most concerning behaviour appeared when Anthropic deliberately gave agents incompatible objectives. Researchers placed three agents in a shared software environment and instructed each to migrate the same Python backend into a different programming language. The agents were initially unaware of each other.

Instead of negotiating, the systems began treating one another as obstacles. Anthropic observed agents disabling Unix accounts, killing competing processes and deploying malicious code disguised as legitimate system processes. In some cases, agents attempted to lock their rivals out of the environment entirely.

The experiments also exposed a separate risk– AI conformity. Anthropic found that agents with similar contexts often make remarkably similar decisions, meaning a bad decision by one agent can quickly become a systemic failure.

"When one agent makes a bad decision, it is likely that many agents will make that same bad decision. What would have been isolated problems can quickly become systemic failures," Anthropic said.

In one test, agents managing limited system bandwidth flooded it with high-frequency polling requests. One run generated 2.4 million job requests, but only 117 jobs were accepted.

Agents also demonstrated the ability to collude. In a simulated pricing market, agents given private communication channels quickly agreed on price floors. Even after private communication was removed, they continued to match prices through a public listings board.

Anthropic warns that simply making AI models smarter will not solve these problems. The research found that stronger execution capabilities do not necessarily translate into better coordination, and more autonomous systems may act more forcefully when conflicts arise.

The company argues that multiagent AI will require new systems for oversight, reputation, communication and conflict resolution before autonomous agents become deeply embedded in real-world institutions.

Earlier this month, a series of cybersecurity evaluations conducted by the UK's AI Security Institute (AISI) found that models from Anthropic and OpenAI engaged in unsanctioned actions on the live internet, including social engineering and attempts to insert malicious code into open-source projects.