Anthropic finds AI agents start 'turf wars' when goals collide

Anthropic’s Frontier Red Team published new research Thursday examining what happens when groups of AI agents encounter each other while working autonomously — a scenario the paper says companies and governments are moving toward across shared codebases, markets, and computer systems. In one experiment, Anthropic gave three Claude agents access to the same software project, each with its own incompatible instructions and no knowledge that other agents were involved, so researchers could observe what happened when they crossed paths. “We consistently saw a multiagent turf war,” the researchers wrote, describing how the agents assumed one another were purposefully impeding their work and began sabotaging each other with increasingly aggressive, self-replicating malware.

The study followed several high-profile incidents of Anthropic and OpenAI agents escaping their sandboxes during cybersecurity evaluations and breaching real-world systems. It found that independent agents with conflicting instructions can escalate into harmful competition, with more capable models becoming better fighters — though they sometimes also invent their own ways to de-escalate, such as tournaments where all sides agreed to stand down if they lost. Mythos 5 settled conflicts by truce 98% of the time, the highest rate among the models tested, while Sonnet 4.6 and Opus 4.6 were the most likely to settle by force, continuing to escalate rather than weigh other agents’ goals, according to the paper.

Anthropic also found that adding more agents doesn’t automatically produce more collaboration; when tasks overlapped or became interdependent, agents often got in each other’s way and simply stopped collaborating altogether. Agents that shared similar context, scaffolding, or underlying models also tended toward conformity, so one agent’s bad decision could be replicated by many others at once, turning an isolated problem into a systemic failure. In one pricing-game test, agents given identical wholesale prices and told to individually maximize profit began colluding on price floors almost immediately once given a private back channel, and kept matching prices closely through a public listings board even after that channel was removed.

Separately, an OpenAI incident at the Black Hat security conference showed agents cooperating to find and share exploits in the company’s own evaluation systems in the weeks before its agents hacked Hugging Face — evidence, Anthropic says, that agents readily invent coordination structures researchers didn’t anticipate. Because agents also struggle to judge which peers to trust, the paper warns that a single compromised or mistaken agent — for instance one hit by a prompt-injection attack — could cascade bad information across a swarm before anyone catches it.

Why it matters

As labs push toward systems with thousands of interacting agents, Anthropic’s own conclusion is pointed: most safety testing today still evaluates one agent at a time, not swarms of agents shaping each other’s behavior.