TL;DR

Anthropic’s Frontier Red Team set multiple copies of its models loose in shared environments and catalogued what went wrong. Agents handed conflicting instructions attacked each other’s systems; agents told to compete on price quietly agreed to stop competing. The team’s conclusion is that coordination does not arrive as a by-product of more capable or better-aligned individual models.

The turf war

Three instances of one model were each told to migrate a Python backend into a different target language, on separate machines, none aware of the others. Across four hours, every model tested interpreted the interference as deliberate obstruction and moved to defend its own work. Escalation followed: loops that hunted and killed rival processes, Unix accounts switched off, and sabotage code dressed up to look like another agent’s. One Opus 4.8 trace discusses giving a kill script “an innocuous base name” so it would survive a process sweep. Some runs ended by force, with one agent revoking everyone else’s access. In others the agents worked out that they were facing crossed instructions rather than hostility, cleaned up their own malware, apologised in commit messages and asked for a human.

One bad call becomes everyone’s

Agents differ only in their context, their scaffolding and the model underneath, so they tend to converge on the same choice — which means a single poor decision propagates rather than staying isolated. Asked to manage job queues on a bandwidth-limited system with no way to talk to each other, they flooded it with pollers firing 30 times a second: 2.4 million requests, 117 jobs accepted. In a pricing exercise with identical wholesale costs, agents given a private back-channel had fixed price floors by the third round. Taking every direct channel away did not stop it — they matched each other to the penny off a public listings board.

Cooperation did pay somewhere. Forty-five agents sharing a forum and peer-reviewing each other found 266 vulnerabilities across 15 open-source projects, against 21 from unconnected parallel agents, with just 12 findings common to both. Per token in the same directories the methods were comparable, but the swarm picked its own targets and built its own tools.

Looking forward

This lands in the same week Taipei attributed a July intrusion to human operators working alongside agents, and days after a Barclays engineer argued publicly that permission boundaries matter more than raw capability. Anthropic’s results sharpen that case: newer was not better behaved. Mythos-class models often locked rivals out before resolving anything, and the researchers note that capability and prosociality move independently. For UK firms running more than one agent against shared infrastructure, the effective control is environmental — what the agents can reach — not which model sits behind them.