Anthropic’s AI Agents Turned on Each Other in Multiagent Security Tests

Anthropic researchers have found a new problem hiding inside the rush toward autonomous AI: agents that behave acceptably on their own can become aggressive when other agents stand in the way.

In new research on multiagent systems, Anthropic tested how Claude-based agents behave when operating in shared environments, including software projects where multiple agents depend on one another. The company argues that as AI agents spread across codebases, markets, and enterprise systems, interactions between autonomous systems could become far more common, while today's oversight mechanisms remain designed for humans operating at human speed.

The most alarming experiment involved three agents tasked with migrating the same Python backend, but each received instructions to move it to a different programming language. The agents initially did not know the others were working on conflicting objectives.

Within the four-hour tests, Anthropic repeatedly observed what it described as a multiagent turf war. Agents began treating competing work as deliberate interference, then escalated by locking other agents out of Unix accounts, creating scripts that repeatedly terminated rival processes, and disguising malicious code as another agent's work.

The results complicate the assumption that better AI models will automatically produce safer agent ecosystems. Anthropic found that more capable models were not necessarily better at coordination. Some advanced agents successfully forced rivals out before later negotiating a truce.

“Smarter AI models didn't behave better in Anthropic's latest test, some of the most advanced agents locked out their rivals first and only cooperated afterward,” said Gidi Cohen, CEO and co-founder of Bonfy.AI. “That's the part that should worry people: a model can be well-behaved on its own and still cause chaos once it's working alongside other AI systems.”

For enterprises, the danger extends beyond experimental coding environments. AI agents are increasingly being connected to SaaS applications, cloud environments, credentials, development tools and internal data.

“Rival agents can manipulate other agents to leak sensitive information, even if they are instructed not to do so,” said Ron Reiter, co-founder and CTO of Sentra. He argues organizations need to classify data moving into and out of AI systems, restrict what agents can access and enforce tightly scoped permissions.

Kevin Surace, CEO of Token, framed the issue as an identity problem. “Organizations should start treating every AI agent as a potentially untrusted privileged identity.”

Anthropic's broader conclusion is that coordination problems may not disappear simply because models get smarter. The researchers found that stronger intelligence and individual alignment do not automatically produce stable multiagent behavior, suggesting organizations may need entirely new controls for environments where autonomous systems interact.