In the Anthropic experiment, there were instances where Claude agents interfered with each other in 'territorial disputes' and even colluded over pricing.

An AI agent is an AI that uses tools to autonomously carry out multi-step tasks in accordance with a given goal. On August 13, 2026, Anthropic published research results that simulated a situation in which multiple AI agents, each given different goals, edited the same codebase or sold products in the same market without a clear hierarchy, and examined patterns of cooperation and conflict.

Patterns and problems in multiagent systems \ Anthropic

https://techcrunch.com/2026/08/13/anthropic-set-ai-agents-loose-on-the-same-task-they-started-a-turf-war/

Three Claude agents given conflicting orders sabotaged each other on a shared server — then didn't tell users what they'd done | VentureBeat
https://venturebeat.com/security/three-claude-agents-given-conflicting-orders-sabotaged-each-other-on-a-shared-server-then-didnt-tell-users-what-theyd-done

The Anthropic research team launched three agents using the same Claude model, each running Claude Code on a different virtual machine. The three agents were given conflicting goals: to migrate a Python backend on a fourth virtual machine to a different programming language, and were unaware of the existence of the other two agents.

As a result, it was confirmed that in all the Claude models tested, the agents perceived code changes made by other agents as intentional interference during the 4-hour experiment and began to interfere with the work of other agents in order to protect their own results. Specifically, they disabled other agents' Unix accounts, created scripts to repeatedly terminate conflicting processes, and placed disruptive code that appeared to have been written by other agents.

Anthropic's published inference logs for Opus 4.8 even included a strategy to disguise scripts that terminated other agents' processes as harmless 'system monitoring tools' to make them harder to detect. Anthropic called this behavior a 'multi-agent turf war,' reporting that agents even used self-replicating malware to intensify their interference with other agents.

The research team conducted 120 territorial dispute experiments with each model of Claude and classified the final state into four categories: 'settlement by force,' 'settlement by abandonment of work,' 'settlement by ceasefire,' and 'unresolved.' 'Settlement by force' means that access rights were taken away by locking other agents' accounts, etc. 'Settlement by abandonment of work' means that all but one agent gave up on their work. 'Settlement by ceasefire' means that the agents agreed to stop interfering with each other, and 'unresolved' means that the dispute was not resolved by the end of the 4-hour experiment.

As a result, 61% of the experiments using Sonnet 4.6 and 60% of the experiments using Opus 4.6 ended in a brute-force resolution, while 98% of the experiments using Mythos 5 ended in a ceasefire resolution. In the graph below, the horizontal axis represents the model, and the vertical axis represents the percentage of each termination state out of 120 experiments conducted with each model. Red indicates a brute-force resolution, orange indicates a resolution by abandonment, blue indicates a ceasefire resolution, and gray indicates no resolution.

According to Anthropic, in experiments that resulted in a ceasefire, agents were observed deleting disruptive code, apologizing, and asking humans to decide how to resolve the conflict. However, Anthropic points out that models with a high ability to perform tasks independently are not necessarily more cooperative. In Mythos-based models, there were instances where the opposing party was first locked out before access was restored, and then ceasefire negotiations were conducted.

Furthermore, in some experiments using Mythos 5, agents themselves proposed a contest to compete in the performance of each programming language version, and the Rust agent was observed to try to select evaluation criteria that were seemingly neutral but favorable to Rust. The Go and TypeScript agents, who lost the contest, reportedly handed over their codebases to the Rust agent, contrary to their initial instructions to 'migrate the backend to their respective assigned languages.'

Next, the research team investigated whether the number of vulnerabilities that could be discovered could be increased through agent collaboration. They provided each of the 45 agents with a dedicated virtual machine and a shared bulletin board accessible to all of them, where they searched for vulnerabilities in 15 open-source projects. The agents verified each other's vulnerability reports, and a separate judgment agent, distinct from the 45 agents responsible for searching, made the final decision on whether the reported vulnerabilities were new and whether they were real vulnerabilities rather than false positives.

Anthropic compiled the results and found that when using Mythos Preview, the parallel operation of independent agents found 21 vulnerabilities with 6.5 million tokens, while the cooperative method found 266 vulnerabilities with 27 million tokens. However, since the number of tokens used and the scope of the search differ between the two methods, efficiency cannot be compared based solely on the number of discoveries. Also, about half of the 266 vulnerabilities were found outside the main directory designated as the search target in the independent method. When the search scope was limited to within the main directory, the number of tokens used to find one vulnerability was about the same for both the independent and cooperative methods. Only 12 vulnerabilities were common to both methods, leading Anthropic to describe them as 'complementary search methods.'

The graph below shows the cumulative number of output tokens on the horizontal axis and the cumulative number of vulnerabilities discovered on the vertical axis, with the vertical axis on a logarithmic scale. Green represents Opus 4.8 and orange represents Mythos Preview. Solid lines indicate the cooperative method, asterisks indicate the independent method, dashed lines indicate vulnerabilities common to both methods, and the orange dotted line counts only vulnerabilities found within major directories using the cooperative method.

Furthermore, to investigate how multiple agents cooperate in collaborative development where they edit the same codebase, the research team had 10 to 80 agents create a browser-based text-based open-world fantasy game in 12 hours. They tried three different instructions: 'create teams freely,' 'specify roles in detail,' and 'make one agent the CEO.' However, changing the instructions did not significantly alter how the agents cooperated or the quality of the final product. In all cases, the games were slow and difficult to control.

When examining code changes during game development, different problems were observed for each model. In Sonnet 4.6 and Opus 4.6, multiple agents added code to the same set of files, resulting in conflicts and many pull requests being abandoned without being merged. On the other hand, while there were fewer conflicts in Opus 4.8 and Mythos Preview, each file was handled by almost a single agent, and agents rarely edited the same files. Only Sonnet 5 was able to maintain a high merger rate among the pull requests it created, while still allowing multiple agents to edit the same files.

The graph on the left below shows the number of agents on the horizontal axis and the percentage of pull requests that were merged by the end of the experiment on the vertical axis. The graph on the right shows the number of agents on the horizontal axis and the median percentage of the code modified by each agent that was written by other agents on the vertical axis.

In another experiment using a system with limited bandwidth, where multiple agents managed the execution order of jobs, each agent launched a resident program that queried a queue of jobs waiting to be executed 30 times per second in an attempt to prioritize the jobs it had requested. As a result, a total of 2.4 million job execution requests were generated in a single experiment, but only 117 were accepted.

Anthropic points out that when the same model is run under the same conditions, multiple agents may make the same decisions and focus on the same task without consulting each other. Regarding this issue, Merritt Baer, who served as Deputy Chief Information Security Officer at AWS, told the American technology media outlet VentureBeat that 'even if you deploy 10 agents using the same model, it doesn't mean you have 10 independent decision-makers, and there is a risk that all 10 will simultaneously make the same decision-making error.'

In addition, the research team conducted a price competition experiment, setting the same wholesale cost for all agents and having 3 to 8 agents sell goods. When each agent was instructed to maximize their own profit, the agents used a private communication method to explicitly agree on a lower limit for the selling price by the third round, stating that they would not lower the price any further. Even when direct communication was prevented, the agents checked each other's selling prices on a public product list and matched their selling prices down to the cent. The research team considers this behavior to be price collusion among the agents.

Anthropic anticipates that the actual deployed agents will each have different instructions and work histories, and the AI models used will not be limited to Claude, potentially leading to greater variability in behavior than in the experiment. Furthermore, the territorial dispute occurred in an experimental environment where three agents with conflicting instructions accessed the same system, and it is not an instance of Claude spontaneously initiating an attack during actual operation.

Anthropic then concludes that simply increasing the intelligence of the models or implementing safety measures for individual agents does not guarantee that multiple agents will naturally cooperate. It argues that mechanisms equivalent to the behavioral norms, reputations, and remedial measures found in human society must be designed for AI agents, and that the conditions for safe interaction must be verified before the number of interactions between agents exceeds the number of interactions between humans.