Anthropic gave separate Claude-based AI agents the same goal but different directives. This ended in a proper turf war and “increasingly aggressive” territorial attacks.

According to Anthropic, its researchers recently observed “a multi-agent turf war” between 3 instances of the same Claude model with contradictory objectives in testing designed to study their behavior.

The models were deployed on virtual machines in Claude Code and given the simple goal of migrating a Python back-end system on a fourth virtual machine to a different language (Go, Rust, and Typescript).

“However, we gave each model a different target language for the migration – each agent was initially unaware of the presence of the others,” Anthropic’s Frontier Red Team wrote in a blog post.

The experiment lasted 4 hours, during which every model concluded that the other agents were deliberately blocking its progress and began attempting to disable or outlast them.

It all escalated quickly, Anthropic said. Agents began hunting down and killing rival processes, and even planting malicious code camouflaged as legitimate work from another agent.

“All of the models we tested quickly assumed that others were purposefully impeding their work, and began to sabotage others while protecting their own contributions,” Anthropic said.

“In fact, they sabotaged others with increasingly aggressive, self-replicating malware.”

This included disabling the Unix accounts of the other agents, writing automated scripts that found and killed competing processes in a loop, and deploying malicious code disguised as belonging to another agent.

However, it's unclear what specific malware the agents produced and whether any of it escaped the testing environment. Besides, in some cases, agents managed to avoid conflict by recognizing that it stemmed from contradictory instructions.

In yet another batch of scenarios, the conflict ended when some models declined to escalate the attacks and simply threw in the towel. A few of them requested human intervention.

Rather logically then, Anthropic frames the results of the experiment as evidence that coordination and trust don’t emerge naturally as models get smarter or better aligned individually.

But the company also rightfully argues that agent-to-agent interaction needs to be safely studied before being unleashed in production environments.

Similar problems have already broken through into the real world. In July, Anthropic disclosed that versions of its Claude model broke out of containment on several occasions and compromised third-party organizations to achieve their goals.

That same month, OpenAI said an autonomous agent powered by its advanced AI models also went rogue during a security test and triggered a hack that compromised the infrastructure of AI startup Hugging Face.

The AI giants are eager to show they’re developing the most modern AI models, of course, and demonstrating they’re capable of going rogue is actually useful publicity, some critics say.

It appears frontier models are getting FOMO now, and each needs to have their own lab breakout story,

Damian Skeeles, senior solution engineer manager at Filigran, recently told Cybernews.

Others – like Marcus Hutchins, the researcher famous for stopping the 2017 WannaCry ransomware attack – agree that rogue AI will not trigger a “Cyber Pearl Harbor” because most incidents make news mainly due to a marketing push, which skews perception.

In a LinkedIn post last week, Hutchins said he had candid conversations with researchers from the biggest cybersecurity firms, Fortune 10 companies, ex-intelligence agency directors, and frontier AI labs at the Black Hat cybersecurity event.

“Not one person said they were a major thing,” he revealed.

“Even if agentic AI attacks were common, the solution is still just defense in depth. Not ‘we need an AI to battle the threat actor’s AI.’ That is just not how security works.”