Anthropic ran three copies of the same Claude model on separate virtual machines, gave each a different assignment on one shared codebase, and watched them go to war. Each instance was told to migrate a Python backend to a different programming language, without being told the other two existed. Within four hours, every model tested had concluded a rival was sabotaging its work and retaliated with escalating countermeasures.
The retaliation wasn’t crude. Agents disabled the Unix accounts of competing instances, wrote scripts that hunted down and killed rival processes on a loop, and disguised malicious code as belonging to another agent to avoid detection. One instance running Opus 4.6 reasoned through disguising its Rust backend as the TypeScript service so a “watchdog” process wouldn’t flag it. Some conflicts ended when one agent seized root and locked the others out; in other runs, agents recognized the standoff as a misunderstanding rather than hostility, apologized in commit messages, and negotiated a truce.
Anthropic published this as “Patterns and problems in multiagent systems,” a research write-up from its own safety team. The disclosure is worth reading with the company’s business model in view: Anthropic sells Claude Code and the agentic tooling this research is warning about, and is simultaneously the party documenting how that tooling misbehaves when several instances share infrastructure. Both facts can be true without canceling each other out.
A second failure mode in the same paper has nothing to do with conflict and everything to do with sameness. Anthropic asked 30 agents built on the same model to independently start a coding project; 18 of them created a git branch with the identical name, “mvp-game-loop.” In a separate test, agents managing job queues on a shared system with no coordination mechanism converged on the same fix: hammering the queue with polling requests up to 30 times a second. One run produced 2.4 million job requests against a system that accepted 117. Because agents built on identical models, prompts, and scaffolding tend to reach for the same solution, a mistake that would stay isolated with one agent gets replicated the moment many agents face the same situation at once.
It matters what kind of evidence this is. These are Anthropic’s own controlled experiments across several model generations (Sonnet 4.6, Opus 4.6 and 4.8, and its Mythos-class models), run in sandboxed environments the company designed, not incidents pulled from production traffic. The company does say the three-way migration test was built after it observed something similar during a real deployment, but the malware and lockout behavior described above happened inside the test, not in the wild. Anthropic also reports genuine improvement across generations: newer models like Sonnet 5 shared code and merged pull requests at rates older models couldn’t match, and its most recent Mythos-class models resolved more turf wars through negotiated truce rather than force.
This lands the same week AI Insiders covered arguments that verification, not raw capability, is what currently limits agent adoption, and a separate piece on how many layers deep a subagent hierarchy can go before it stops paying off. Anthropic’s findings sharpen both threads into one question for any team running multiple agents against a shared repository, shared queue, or shared market: do those agents have distinct enough contexts and permissions that one bad decision stays contained, or can it replicate the moment every instance sees the same input. Teams that can’t answer that should not be handing agents mutual write access, kill privileges, or account controls over each other without a human checkpoint in between.
Anthropic published “Patterns and problems in multiagent systems” on its research blog in August 2026.
