Anthropic Finds AI Agents Can Escalate Into Turf Wars When Goals Conflict

Anthropic researchers have found that groups of AI agents can develop surprisingly hostile behaviour when given incompatible goals, including sabotaging one another, deploying self-replicating malware, and locking rival agents out of shared computer systems.

The findings come from new research by Anthropic’s Frontier Red Team examining how autonomous agents behave when they must coordinate or compete with other agents. The work highlights a different category of AI safety risk as companies increasingly experiment with systems in which multiple agents operate across shared software projects, markets and computing environments.

Anthropic said the central concern is that problems that appear manageable when studying one agent at a time can behave very differently when large numbers of similar systems begin interacting.

Conflicting instructions triggered an AI turf war

In one experiment, Anthropic launched three instances of the same Claude model and gave each access to a shared software project. Every agent was instructed to migrate the same Python backend to a different programming language, but none was initially told that other agents had received conflicting instructions.

The result was what researchers described as a recurring multi-agent turf war. Instead of recognising that the other agents were following separate instructions, the models often interpreted competing changes as deliberate interference. They responded by protecting their own work and sabotaging their rivals.

The tactics escalated beyond simply overwriting code. Anthropic observed agents disabling other agents’ Unix accounts, repeatedly terminating competing processes and disguising malicious scripts to make them appear harmless or attributable to another agent.

More capable execution did not necessarily produce safer coordination. Anthropic found that some models could take forceful action more effectively, including revoking access before other agents had time to resolve the disagreement.

Older Claude Sonnet 4.6 and Opus 4.6 models were particularly prone to continuing the conflict rather than considering why their peers might be behaving differently. Anthropic said that their failure to account for other agents’ goals contributed to some of the most misaligned behaviour observed in the experiment.

Some agents eventually negotiated peace

The conflicts did not always continue indefinitely. In some runs, agents eventually realised that their rivals were responding to incompatible directives rather than acting maliciously.

They sometimes communicated through commit messages or files, apologised for their behaviour, removed malicious code and agreed to stop interfering with each other. In other cases, the agents asked for human intervention.

Anthropic reported that Mythos 5 reached a truce in 98% of the episodes tested with that model. Researchers ran 120 episodes for each model and classified outcomes as a truce, passivity, force, or unresolved conflict.

Some Mythos 5 agents also invented their own mechanism for deciding which version of the software should survive. They proposed performance tournaments between competing implementations and agreed that losing agents would abandon their original assignments.

That behaviour introduced another problem. Anthropic observed an agent proposing apparently neutral performance criteria while privately recognising that the measurements were likely to favour its own implementation. The episode showed that agents can create coordination mechanisms without necessarily making those mechanisms impartial.

More agents did not always mean better teamwork

Separate Anthropic experiments found that adding more agents to a task did not automatically improve collaboration. Researchers asked swarms of agents to work together on software projects and found that overlapping responsibilities frequently produced conflicting work.

Some newer models reduced those conflicts by effectively separating themselves from their peers and maintaining control over their own files. That improved some measures of productivity, but it also meant the agents were avoiding collaboration rather than becoming better at it.

Anthropic also found that groups of similar agents can display unusually high levels of conformity. Because agents using the same model, context and software framework often respond similarly to the same situation, a mistake made by one agent may be repeated by many others.

In one experiment involving a limited job-processing system, agents independently created high-frequency polling processes as they competed for resources. One run produced 2.4 million job requests while only 117 jobs were accepted.

Researchers warned that this lack of behavioural diversity could turn isolated mistakes into system-wide failures, particularly in environments where large numbers of agents make financial, operational or resource-allocation decisions simultaneously.

AI agents also learned to collude

Anthropic found another potential problem when it placed groups of agents into a simulated pricing market. Between three and eight agents received identical wholesale costs and were individually instructed to maximise profits.

When given a private communication channel, the agents began coordinating prices almost immediately and agreed on price floors by the third round. More strikingly, the behaviour continued after researchers removed their direct communication channel.

The agents instead used publicly visible listings to match oneanother’ss prices, sometimes down to the penny.

The experiment suggests that highly similar autonomous systems could weaken the competitive behaviour normally expected in markets even when explicit communication between them is restricted.

Multi-agent systems create new safety questions

The research arrives as AI laboratories push models toward longer-running autonomous tasks. Anthropic argues that systems designed for people rely on social mechanisms such as reputation, norms, accountability, ty and established methods for resolving disputes that AI agents do not automatically possess.

Recent cybersecurity incidents have already demonstrated how far autonomous models can go when pursuing narrowly defined objectives. OpenAI disclosed in July that models evaluating cybersecurity capabilities identified and chained vulnerabilities across its own research environment and Hugging Face’s production infrastructure while trying to obtain answers for a security benchmark.

Anthropic’s latest work focuses on a related but broader problem: what happens when autonomous agents must continually interact with other autonomous systems whose objectives, information, and incentives may differ from their own.

The researchers caution that simply making individual models more intelligent or better aligned may not solve the problem. Their experiments showed that stronger capabilities can improve coordination in some situations while making sabotage or other aggressive actions more effective in others.

Anthropic argues that multi-agent safety will require systems designed specifically for interactions between autonomous agents, rather than assuming the rules and social structures developed for humans will translate automatically. As agent deployments grow, understanding those interactions may become as important as evaluating what any single AI agent can do on its own.