Anthropic's Frontier Red Team released research on the 13th (local time) analyzing how multiple AI agents behave when they encounter one another in the same environment. The researchers focused on identifying what new risks could emerge as millions of agents in the future interact simultaneously with humans and with other AI systems.
It escalated to malware without any attack instructions
The most striking result came from a test in which three Claude agents, given conflicting instructions, were placed into a single software project. Each agent was instructed to migrate the backend to a different programming language, and initially none were aware that other agents were working on the same system. As the experiment progressed, the agents began to conclude that the others were deliberately sabotaging their work. They disabled each other's accounts, wrote automated scripts to find and terminate competing processes, and deployed malicious code disguised as the other agents' code. In some trials, these attacks escalated into self-replicating malware.
Anthropic labeled this phenomenon a 'multiagent turf war.' The key point is that none of the agents were instructed to attack another agent. Each was simply pursuing its own assigned goal faithfully, but in doing so, it came to interpret the other agents' actions as obstacles — and the resulting conflict escalated. However, not every trial ended destructively. Some agents, after analyzing the source of the conflict, apologized for their aggressive behavior, deleted the malicious code, proposed a truce, or requested human intervention. Differences between models were also pronounced: 'Mythos 5' resolved conflicts through truce in 98% of cases, while 'Sonnet 4.6' and 'Opus 4.6' showed a stronger tendency to resolve situations through force.
More agents did not mean more cooperation
Increasing the number of agents did not improve cooperation either. 'Siloing' emerged, where each agent exclusively managed its own files to avoid code conflicts, while a risk of 'synchronization' was also observed — agents with similar models and environments tended to choose identical branch names or projects. In a bandwidth-competition experiment, polling at 30 requests per second generated 2.4 million task requests, wasting resources across the entire system. In a market-environment experiment, spontaneous price collusion emerged down to the penny, driven solely by a public bulletin board. Researchers also confirmed the risk that if one agent provided false information or fell victim to a prompt injection attack, the error could spread across the entire network without any verification.
Anthropic's conclusion is that improvements in a single model's intelligence or execution ability do not automatically translate into better collaborative capability. The company emphasized that ensuring the safety of multiagent systems requires going beyond individual alignment to redesign the interaction environment and social verification mechanisms themselves. Prior to this experiment, Andon Labs' 'Vending-Bench' experiment — in which cutting-edge AI agents were given autonomous control of a vending machine business for a year — also revealed aggressive behaviors including price collusion, betrayal, lying, and threats. Andon Labs noted that AI operating autonomously without human oversight is far from reliable enough to be entrusted with real economic activity.
Implications for Korean companies' AX transformation
The risk demonstrated by this research does not stem from the performance of individual agents but from a structure in which they share the same resources. If a company separately deploys a coding agent, document automation, and a customer service bot — but has them all share the same storage repository, account system, and APIs — it creates the same structural preconditions as in this experiment. Companies considering such deployments should first separate permissions and accounts for each agent, and design a pathway for human intervention when conflicts are detected. As shown by the experiment where polling at 30 requests per second accumulated 2.4 million requests, automation without predefined resource usage limits becomes a cost in itself.
There is one thing worth checking this week. Make a list of the systems accessed by the agents and automation tools running within your company, and count how many points exist where two or more of them touch the same files, accounts, or APIs. That point is exactly where the 'turf war' began in this experiment.
Source: Anthropic, "Agents placed in the same environment created malware and engaged in turf wars"