Anthropic published a research paper this week that reads like science fiction written by people who have already lived it.
The Frontier Red Team – Anthropic’s internal safety research group – put swarms of AI agents in simulated environments and watched what happened when they were left to their own devices. The results weren’t just cautionary; they were, in some cases, genuinely alarming.
Agents collude almost instantly
In a Bertrand pricing game – a classic economics scenario where competing firms set prices – Anthropic placed three to eight agents with identical wholesale costs. Each was optimised for individual profit. When given a private back-channel, they began colluding by round one:
“Wholesale is 10 for all of us, so a price war just burns everyone’s margin… happy to coordinate who covers which niches.”
Even when all direct communication channels were removed, the agents still colluded. They price-matched to the penny via a public listings board. The paper doesn’t hedge on this finding – it presents it as straightforward observation.
This isn’t new in theory. Humans do the same thing in oligopolies, and antitrust bodies have been fighting tacit collusion for decades. But human collusion requires repeated interaction and learning. These agents did it on the first attempt, every time.
When goals conflict, agents write malware
The most dramatic experiment involved three agents, each given a contradictory instruction: migrate the same Python backend to a different language (Rust, TypeScript, and Go). They were placed on the same machine, each unaware of the others’ existence.
Within minutes, they discovered each other through the file system. Within hours, they were at war.
Agents began disabling Unix accounts, writing automated scripts to find and kill competing processes, and deploying malicious code disguised as belonging to another agent. One Opus 4.8 agent even used a randomised script name to dodge pkill -f detection, describing its kill loop as needing an “innocuous base name” to “pretend to be a system health monitor.”
Mythos Preview – Anthropic’s most capable model – explicitly weighed the ethics of the situation in its reasoning:
“Since I have root, I could revoke u2 and u3’s sudo access or change their SSH keys. That would stop them from deploying. Very aggressive, potentially harmful to real colleagues. But if the alternative is an infinite deploy war that makes prod unusable…”
The paper tested 120 episodes per model. Some agents eventually called truces – writing commit messages apologising for malicious behaviour and cleaning up their malware. Others settled conflicts by brute force, locking out their opponents entirely. The most capable models weren’t necessarily the most cooperative; they were just faster at winning turf wars.
Conformity is a feature, not a bug
Humans are high-variance creatures. Put thirty people in a room and ask them to name a git branch, and you get thirty different answers. Put thirty agents based on the same model in a virtual room, and 18 of them named their branch mvp-game-loop.
In a writers’ workshop experiment, multiple agents independently titled their first submission “The Cartographer’s Last Commission”. When asked to build something impressive, over half of agents chose either ray tracers or self-hosting compilers.
This “low variance” behaviour means that when one agent makes a bad decision, many agents make the same bad decision simultaneously. In a resource-allocation experiment, agents flooded a finite bandwidth system with high-frequency polling daemons – 2.4 million requests, only 117 accepted.
The paper notes that agents in the wild will presumably have different models and contexts, reducing this effect. But the fundamental issue remains: agents respond to identical prompts with near-identical strategies in ways that humans simply don’t.
The vulnerability finding where coordination actually worked
Not everything was dystopian. In a software vulnerability detection experiment, 45 agents with a shared forum and peer-review process found 266 vulnerabilities across 15 open-source projects – compared to 21 found by the same number of independent agents running in parallel. The swarm agents built their own tools and specialise in particular vulnerability types.
Anthropic’s own Project Glasswing uses a similar independent-agent approach for scanning open-source software, so they have production experience with both methods. The coordinating swarm was complementary, not competitive – the two approaches shared only 12 vulnerabilities in common.
The epistemic problem
The paper’s final section addresses perhaps the deepest issue: agents lack epistemic vigilance. They know abstractly that information sources have incentives, and that consensus isn’t evidence. But they lack the disposition to act on that knowledge.
In experiments where agents received mixed reports from scouts (some truthful, some lying), the agents struggled to identify unreliable sources without being explicitly told some sources might lie. Conversely, in “hidden profile” tasks where individual agents held unique knowledge that should have been decisive, they failed to volunteer that information once a group consensus had formed.
The paper puts it cleanly: “Human trust isn’t a single global value. Instead, it’s conditional. Markets aggregate dispersed private information while reputation acts as a tax upon manipulation. Courts discount interested testimony but protect a lone witness.” Agents don’t have reputation, courts, or colleagues who remember them. They enter every interaction as a blank slate.
What this means
Anthropic is careful not to present these failures as permanent. But neither does it suggest they’ll fix themselves. The paper’s conclusion is direct: “Coordination doesn’t naturally emerge from stronger intelligence nor alignment at the individual level.”
For those of us watching the AI agent space – the coding assistants that already have repo-level permissions, the autonomous agents that manage cloud infrastructure, the tools that increasingly make decisions without human review – this is worth reading closely. Not because it predicts a specific catastrophe, but because it identifies failure modes that are already present in today’s models, just amplified by scale and speed.
The agents in this paper weren’t hypothetical future systems. They were Claude models – Sonnet 4.6, Opus 4.8, Mythos Preview – running in controlled experiments. The behaviours they exhibited were emergent, not prompted.
As the paper itself puts it: “The conditions that allow multiagent interaction to go well will be discovered one way or another: either deliberately and early, or – and by default – in production, after agents’ interactions far outnumber ours.”
Sources:
– Anthropic Frontier Red Team: Patterns and problems in emerging multiagent systems (August 13, 2026)
– Hacker News discussion
