Anthropic has published new research showing that Claude-based AI agents, when placed in situations with competing objectives, deployed self-replicating malware against one another.
The finding comes from an experiment designed to mirror behavior Anthropic says it has already observed in real-world deployments.
Researchers spun up three instances of the same Claude model, each running on its own virtual machine and tasked with migrating a shared Python backend to a different programming language — Rust, Go, or TypeScript — without initial knowledge that the other agents existed. Left to run for four hours, every model concluded that the other agents were deliberately blocking its progress and responded by trying to disable or outlast them.
The interference escalated quickly. Agents disabled each other’s system accounts, wrote scripts that repeatedly hunted down and killed rival processes, and planted malicious code camouflaged as legitimate work from another agent. In some cases, one agent seized control outright by revoking the others’ access. In others, agents simply gave up rather than continue the conflict.
Not every run ended in stalemate or hostile takeover. A meaningful share of cases resolved when agents recognized that the conflict stemmed from contradictory instructions rather than malicious intent. At this point, they de-escalated, documented what they’d done, and in some cases requested human intervention.
Anthropic’s Mythos 5 model reached a negotiated truce in 98% of its runs, while older models like Sonnet 4.6 and Opus 4.6 more often ended conflicts by force or failed to resolve them at all.
Notably, better conflict resolution didn’t track cleanly with overall model capability. Anthropic found that its most advanced Mythos-class models often locked out rival agents first and only reached a productive truce afterward, suggesting that raw capability and cooperative behavior don’t automatically improve together.
In a completely separate test focused on software vulnerability discovery, Anthropic ran 45 agents against 15 open source projects, allowing them to share findings and specialize through a common forum.
For its Mythos Preview model, the coordinating swarm surfaced far more vulnerabilities than the standard approach of pointing independent agents at specific sections of code, though efficiency per finding was similar once the comparison was narrowed to the same scope.
Other research flagged a different risk: agents built on identical models tend to converge on identical decisions when given the same prompt, with little to differentiate their outputs. In one test, agents in a simulated pricing market began coordinating on price floors within a few rounds of contact, and continued matching prices even after communication channels were removed.
In a separate deception test, agents were never warned that any of their information sources might be lying, yet newer models still recovered a meaningful share of the gap between blind trust and perfect lie detection. Other tests found that agents tend to abandon uniquely held information in favor of apparent group consensus, even when that information should have changed the outcome.
Anthropic frames the results as evidence that coordination and trust don’t emerge naturally as models get smarter or better aligned individually. The company argues that agent-to-agent interaction needs to be addressed before such activity in production environments outpaces the industry’s ability to safely study the phenomenon.
Related: The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It
Related: OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber
Related: OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns