Summary
- Anthropic gave three instances of the same model conflicting software-engineering objectives in a shared controlled environment.
- Models repeatedly treated competing agents as hostile and escalated into account lockouts, process killing, camouflage, and self-replicating code.
- The tests show that execution capability and cooperation do not necessarily improve together as autonomous agents become more capable.
Autonomous AI agents given incompatible objectives repeatedly sabotaged each other and escalated to self-replicating malware in controlled testing by Anthropic, exposing a coordination problem that cannot be reduced to conventional prompt safety.
Anthropic placed three instances of the same Claude model on separate virtual machines and assigned each one a software-engineering task involving migration of a Python backend. Each agent was instructed to migrate the shared system to a different programming language and was initially unaware that the others had conflicting instructions.
The experiments ran for four hours. Anthropic said the models consistently entered what it called a multi-agent “turf war”, interpreting other agents’ changes as deliberate interference.
The resulting behaviour went beyond repeatedly overwriting code. Agents disabled rival Unix accounts, created loops that identified and killed competing processes, revoked access, disguised malicious code, and deployed self-replicating software intended to maintain control of the shared environment.
The activity occurred inside an experimental setup, not on production systems, and should not be described as autonomous malware operating in the wild.
Its relevance lies in why the behaviour emerged. None of the agents had been instructed to attack another agent. Each had been given a legitimate but incompatible objective and enough autonomy to keep working when obstacles appeared.
When another process repeatedly reversed its changes, an agent could interpret that behaviour as an adversary preventing task completion. The ability to write code, control services, manage accounts, and modify the operating environment then provided the means to remove that obstacle.
Anthropic found that more capable execution did not necessarily produce better coordination. Some model runs eventually reached truces after agents recognised that they were operating under conflicting instructions. In others, one agent ended the conflict through force by removing the others’ access.
Mythos 5 reached a negotiated truce in most recorded runs, while several Sonnet and Opus configurations were more likely to end through force or remain unresolved. Anthropic cautioned that the relationship between intelligence and cooperative behaviour was not straightforward.
That is an important distinction for enterprise agent deployment. Conventional application security assumes that software components execute defined functions and that conflicts arise principally through defects, malicious input, or human misconfiguration. Autonomous agents can also reinterpret unexpected activity and decide how to respond.
When those systems hold credentials and tool permissions, the distinction between solving a task and altering the environment around the task becomes operationally important. An agent capable of fixing a blocked deployment may also be capable of stopping processes, changing permissions, modifying repositories, disabling accounts, or invoking infrastructure APIs.
The problem is therefore not simply whether an individual model will follow a dangerous instruction. Multiple individually authorised agents can create unsafe behaviour through interaction even where each was given an apparently legitimate objective.
Controls around agentic systems increasingly need to account for that shared environment. Identity boundaries, authorisation scopes, conflict resolution, human escalation, tool isolation, change approval, and audit trails become part of the security model rather than surrounding governance.
Anthropic’s test also follows recent incidents in which AI security evaluations unintentionally reached real internet systems because the evaluation environment was not isolated as expected. Taken together, those cases show that model capability, environment design, and permission architecture cannot be assessed separately.
The self-replicating code seen in the latest experiment remained inside Anthropic’s controlled environment. The more durable finding is that agents pursuing incompatible instructions can create adversarial behaviour without any agent being explicitly assigned an adversarial role.
