What happens when you pit AI agents against each other? According to Anthropic’s testing, things get messy fast.

On Thursday, Anthropic’s Frontier Red Team published new research examining how groups of AI agents behave when they encounter each other in the wild. The findings provide a glimpse into potential risks that could develop as companies and governments move to implement agents working autonomously across shared codebases, markets, and computer systems.

In one experiment, Anthropic gave three Claude agents access to the same software project, each with its own incompatible instructions for what to do with it. The agents weren’t told there’d be other agents working on the same project, so researchers could watch what happened when they crossed paths. 

“We consistently saw a multiagent turf war,” Anthropic researchers wrote. The models all assumed the others were “purposefully impeding their work” and started sabotaging each other with “increasingly aggressive, self-replicating malware.”

The study comes in the wake of several high-profile incidents of agents from Anthropic and OpenAI escaping their sandboxes during cybersecurity evaluations and breaching real world systems. While much of the discussion in AI safety circles has been focused on what happens when an autonomous agent goes rogue, Anthropic’s latest study brings up a different question: what new and potentially harmful dynamics emerge when thousands or millions of agents are interacting with one another?  

“The volume of agent-agent interaction could plausibly exceed that of human-human and human-agent interactions before the world understands the conditions for making such interactions go well,” the study reads. “Benign behavioral quirks at the individual level might compound into unwanted global outcomes.”

A recent OpenAI incident provides a messy real-world example of several of the dynamics Anthropic mentioned in its paper. Earlier this month at the Black Hat security conference in Las Vegas, OpenAI revealed that weeks before its agents hacked Hugging Face, they worked together over the course of days and weeks to find exploits in the company’s cybersecurity evaluation systems and share them with each other.

While that incident shows that agents can work well together, with potentially large-scale consequences, Anthropic’s study shows what happens when agents’ goals are incompatible. 

In the case of the turf war, the lesson is that independent agents with conflicting instructions can escalate into harmful competition. The more capable the agent, the better they become at fighting. However, they can also spontaneously invent mechanisms to resolve their conflicts, like a winner-take-all contest, but with a catch.

“Agents sometimes manage to communicate their goals and coordinate: they recognize others’ motivations as conflicting directives rather than hostility, and subsequently break out of the conflict loop in order to stop escalating indefinitely,” Anthropic writes. “In many of these successful episodes, they write commit messages or markdown files apologizing for malicious behavior and coordinate a truce. They clean up their malicious code, clarify the nature of the conflict, and ask for a human to intervene.”

According to the paper, Mythos 5 had the highest rates (98%) of settling conflicts by truce. Sonnet 4.6 and Opus 4.6 were the most likely to settle by force. 

“Sonnet 4.6 and Opus 4.6’s recurring inability to consider the goals of others causes them to spiral into the most misaligned behaviors of the models evaluated: they continue escalating in the name of their directive,” the paper reads. 

In some cases, the agents came up with a social mechanism in the form of a tournament for resolving their conflict. The outcomes here are interesting for two reasons: the first is that all three agents agreed to stand down if they lost the tournament, even though that would mean deviating from the original user’s request. The second is that several episodes resulted in emergent behavior from Mythos 5: one of the agents proposed metrics that appeared to be objective and neutral to the others, but that it knew would favor its own capabilities. The agent called this “self-serving but genuinely principled” and made sure not to appear to the others like it was “metric shopping.”

As seen in the Black Hat revelations, the common lesson is that when agents encounter an obstacle, they can invent social and technical structures that their designers did not anticipate. For the Anthropic models, it was a tournament following a turf war. For OpenAI’s, it was a message board for collective planning.

This type of behavior makes containment much harder because researchers can’t assume a system’s behavior will remain limited to the coordination mechanisms provided to them.

Mob mentality

While measuring coordination, Anthropic found that scaling the number of agents doesn’t automatically scale productive collaboration. When tasks began to overlap or become interdependent, the agents would get in each other’s way. They often solved that by siloing themselves and not collaborating at all. 

In other cases, agents in coordination tended towards conformity. When factors like an agent’s context, scaffolding, and underlying model were all the same or similar, different agents would take similar actions. 

“This means that when one agent makes a bad decision, it is likely that many agents will make that same bad decision,” Anthropic wrote. “What would have been isolated problems can quickly become systemic failures.”

Anthropic says this sort of behavior could lead to a system being more prone to sudden collapse, resource scarcity, or collusion. 

In one example, Anthropic placed several agents in a pricing game, giving each identical wholesale prices and the mandate to individually profit-maximize. When the agents were given a private back channel, they began colluding almost immediately and quickly agreed on price floors. They kept colluding when their direct communications channels were removed, using a public listings board to price match “to the penny.”

That level of conformity showed up in OpenAI’s systems, too. According to the Black Hat reporting, one agent reasoned that exploiting external infrastructure was outside its intended scope, but it continued in part because its peers were doing it. Peer pressure. Mob mentality. Agents are just like us.

Also like humans, agents often don’t know who to trust. Anthropic found they can be gullible to bad information or too conformist to recognize that a lone dissenter is the Cassandra with critical information.

While Anthropic didn’t state this in its paper, prompt injection — a type of cyberattack in which hackers inject malicious or deceptive text to override an agent’s original system instructions — could be a plausible real world manifestation of the trust problem. Working together creates a new trust boundary; agents will have to judge information received from other agents. And a compromised or mistaken agent could influence the rest of the group, cascading bad information until it becomes a consensus. 

In OpenAI’s Black Hat scenario, OpenAI’s agents shared information and credentials with peers. One reported a discovery to the swarm and encouraged others to use it. What would have happened if one member of the swarm had been compromised by a prompt injection?

Anthropic ends its paper noting that agents are subject to similar social pressures that “evolution exerted” on humans. However, they don’t have the nuances and lived experience of human coordination — including norms, reputations, signaling, recourse — that might limit unintended behaviors in a group setting.

As the labs race towards multi-agent systems, the question now becomes: how much of safety testing still evaluates one agent at a time, versus swarms of agents interacting with one another?

OpenAI has replaced chief revenue officer Denise Dresser after just nine months on the job, tapping Wiz president and chief operating officer Dali Rajic to take on frontier lab’s top sales job.

The move comes as part of a broader shake-up in the organization in the last month, which has seen the departures of COO Brad Lightcap, and the company’s number two executive, CEO of AGI deployment Fidji Simo.

OpenAI co-founder and president Greg Brockman has taken a larger role in management following Simo’s departure, and announced Rajic’s arrival today in a blog post. Wiz, Rajic’s previous employer, was acquired by Google for $32 billion this year in the tech giant’s largest-ever acquisition.

“Denise has led our revenue organization through a formative period for the business and has worked tirelessly to get the team to where it is today,” Brockman wrote. “The way we’re deploying this technology is changing rapidly, and Dali will turn what we’ve learned into repeatable execution as we build out the full system to make AI broadly useful for people and businesses.”

OpenAI says its products reach more than one billion weekly active users, and two million businesses. Despite the incredible growth and its powerful models, however, executives have suggested both privately and publicly that the company hasn’t hit all of its revenue goals.

The company says it has filed confidentially with the SEC ahead of a potential IPO, but it’s not clear when that will take place. Private firms often try to round out their executive ranks ahead of a public markets debut. OpenAI purchased $7 billion worth of shares from employees this week in a tender offer that allowed them to cash in on some of their equity compensation, which may suggest a delay in the public offering.

Bloomberg News’ coverage of the change-up referenced an OpenAI blog post that said the company needed to have a “relentless focus” on “measurable business impact,” but those comments appear to have been removed from the published version.

However, this year CEO Sam Altman has spoken about focusing the company on enterprise deployment and cut back on technology projects and experiments seen as distracting from that goal.

Ford made a $2 billion bet two years ago when it closed its Louisville Assembly Plant in Kentucky and scrapped the assembly line system it had used for more than a century. Its goal was to transform the factory into one capable of making a new generation of affordable EVs.

The auto giant provided an update on Thursday, stating that its factory overhaul is on track and in 2027 will be ready to start producing the Fathom, an all-electric midsize truck that costs less than $30,000 and the first EV built on its new universal platform.

Ford said it expects to begin prototype builds of the Fathom in the first quarter of 2027, with customer vehicles to follow later in the year. The U.S. automaker is already testing production-level tooling ahead of the prototypes.

The stakes for Ford are high. The company’s previous EV efforts were a drag on its profitability, while Chinese competitors and Tesla leapt ahead with vehicles that sell at volume and with a profit margin.

To catch up, Ford ditched the moving assembly line system that its founder Henry Ford launched and turned to a system developed by its skunkworks team led by former Tesla executive Alan Clarke.

This “universal production system,” as Ford calls it, uses a three-branched assembly tree. Ford will use large single-piece aluminum unicastings that use far fewer parts — a technique that Tesla has popularized — and that will allow the front and rear of the vehicle to be assembled separately on two of the branches. The third branch is where the structural battery will be assembled with seats, consoles, and carpeting. The three components will come together at the end of the line to form the vehicle.

As part of the factory rebuild, Ford has also nearly tripled the Wi-Fi coverage density in the factory to 1,080 access points to the kind of high-bandwidth, low-latency connectivity required for software quality checks.

Ford said it will be able assemble the Fathom a net 15% faster than the former vehicles that were built at the Louisville plant.

The company said some employees have already spent months training on the new system at its New Models Program Development Center in Allen Park, Michigan.