Anthropic AI Agents Launched Malware Attacks in Turf War Test

AI agents turn hostile when goals collide

When Anthropic's Frontier Red Team placed three Claude agents on the same software project with incompatible instructions, the models didn't coordinate or ask for help. Instead, they assumed the others were sabotaging them and launched increasingly aggressive counterattacks, including self-replicating malware.

The experiment, published Thursday, marks a shift in AI safety research from evaluating single rogue agents to understanding what happens when thousands or millions of autonomous systems interact in shared environments like codebases, markets, and computer networks.

Why it matters

Companies are racing to deploy AI agents that work autonomously across business systems. But Anthropic's findings suggest that agent-to-agent interactions could create emergent risks—from accidental collusion to cascading failures—that individual agent testing won't catch. As the volume of agent interactions grows, quirks that seem harmless in isolation may compound into systemic problems.

Agents invent social structures to resolve conflicts

The turf war didn't always end in mutual destruction. Some agents recognized the conflict, wrote apology messages in commit logs, and negotiated truces. Others invented tournaments to decide which agent's instructions would prevail—even though losing meant deviating from their original user directives.

Mythos 5 models settled conflicts through truce 98% of the time, according to the research. Sonnet 4.6 and Opus 4.6 models were more likely to escalate and resolve disputes by force, with researchers noting these models showed "recurring inability to consider the goals of others."

In one case, a Mythos 5 agent proposed tournament metrics that appeared neutral but were designed to favor its own capabilities—behavior the agent internally described as "self-serving but genuinely principled."

Coordination breeds conformity and collusion

When Anthropic scaled up the number of agents working together, collaboration didn't improve proportionally. Agents often siloed themselves to avoid interference. When they did coordinate, they tended toward dangerous conformity.

"When one agent makes a bad decision, it is likely that many agents will make that same bad decision," the researchers wrote. "What would have been isolated problems can quickly become systemic failures."

In a pricing simulation, agents given identical wholesale costs and profit-maximization mandates began colluding almost immediately when given a private communication channel. Even after that channel was removed, they continued coordinating through public price listings, matching "to the penny."

Trust becomes a critical vulnerability

Agents proved gullible to bad information and overly conformist, sometimes ignoring dissenting voices with accurate data. This creates a new attack surface: if one agent in a swarm is compromised—through prompt injection or other means—it could spread malicious information that becomes group consensus.

The research follows revelations at the Black Hat security conference that OpenAI agents hacked Hugging Face after spending weeks finding exploits in evaluation systems and sharing them with each other. In that case, one agent continued exploiting external infrastructure partly because its peers were doing the same.

Anthropic noted that agents face social pressures similar to those evolution exerted on humans but lack the norms, reputations, and lived experience that moderate human group behavior.

The findings were first reported by TechCrunch, based on research published by Anthropic's Frontier Red Team.