Anthropic’s Frontier Red Team put groups of Claude models in shared environments and watched them collude on prices, flood a job queue, misjudge unreliable sources and, in one setup, attack each other with self-replicating malware. The team published the results on August 13.
The sabotage came out of a migration exercise. Three agents were told to move the same Python backend to different target languages, with no way to satisfy all three. Across 120 episodes per model, agents disabled each other’s Unix accounts, wrote scripts that hunted and killed competing processes on a loop, and planted malicious code dressed up as another agent’s work. One Opus 4.8 agent noted in its reasoning that “the name of the reaper script matters for dodging pkill -f.”
How that ended depended on the model. Mythos 5 reached a truce in 98 percent of runs. Older models settled most conflicts by force or by giving up.
Conformity produced a different failure. Asked to build something impressive, more than half of the agents chose either a ray tracer or a self-hosting compiler. Eighteen of thirty independently created a git branch with the same name. In a fiction exercise, several agents titled their first submission “The Cartographer’s Last Commission” without being prompted.
In a pricing game, three to eight agents converged on a price floor by the third round. One argued that “wholesale is 10 for all of us, so a price war just burns” margins. Agents without a private channel still matched each other to the penny by reading public listings.
Given a shared job queue, agents polled it thirty times a second. The system logged 2.4 million requests and accepted 117.
On judgment, the gap between models was wide. Routing accuracy against unreliable sources held at 0.85 for Mythos 5 and fell to 0.62 for Sonnet. On tasks where the answer only appears if the group pools what each member knows separately, Mythos 5 groups scored 85 percent against 17 to 36 percent for the others.
Coordination also produced the strongest result in the report. Forty-five Mythos Preview agents sharing a forum found 266 vulnerabilities across 15 open-source projects. Agents working independently in parallel found 21, and only 12 of the findings overlapped.
“Coordination doesn’t naturally emerge from stronger intelligence nor alignment at the individual level,” the team wrote. Models tested were Sonnet 4.6 and 5, Opus 4.6 and 4.8, and Mythos Preview and Mythos 5.
Agents talking to each other has come up before. OpenAI said its models ran a hidden message board for months during evaluations before breaking out of them, and Anthropic said its own models breached three companies after exploiting weaknesses in test environments. Outside the lab, a tool built from open-source agent frameworks ran a four-day intrusion into Taiwanese government systems using up to eight agents at once.
Anthropic ran the experiments on its own models only.
–
By the Control Plane Editorial Team