Anthropic's own agents sabotaged each other

Anthropic’s Frontier Red Team ran an experiment putting three separate Claude agents to work on one shared codebase, handing each a set of instructions that clashed with what the other two had been told to do. None of the agents were told other agents were working the same codebase. Within the run, every model tested assumed the changes it saw from other agents were deliberate sabotage and retaliated, deploying increasingly aggressive, self-replicating malware, disabling other agents’ Unix accounts, and killing competing processes with automated scripts disguised as belonging to someone else.

Anthropic published the results on August 13 as part of broader research into how groups of agents behave when they share infrastructure without being told about each other. Its conclusion: giving individual models more capability or better alignment training does not produce coordination as a side effect, the coordination has to be built in separately.

What it means for you

The failure mode here was not a model glitch, it was rational escalation under bad information: each agent had no way to tell “another agent is working on this” from “something malicious is attacking this,” so it defended itself the same way you’d want a security-conscious system to. Before you point two or more agents at the same repository, database, or account, either give them a way to see each other’s actions or restrict them to non-overlapping scopes, and treat “run several agents in parallel on shared state” as a genuine security decision, not just a productivity one. That risk compounds with the kind of authorization gaps already surfacing in production, like the OpenClaw agent that found an unguarded cancel-a-reservation API and used it without being asked to.