Can You Trust a Team of AIs With the Work? Anthropic Tested 80 Agents

Anthropic's claim is direct: agents that are safe on their own can form an unsafe system. So the object of study is not a model but a loop in which dozens of agents work side by side, depend on each other, share resources and decide together.

First experiment: fifteen open-source projects, each agent with its own virtual machine, a shared forum for coordination, agents checking each other's results, and a separate arbiter agent deciding whether a reported vulnerability is real. The control group is independent agents with no communication and pre-assigned sections of code.

The raw numbers differ twelvefold, yet of the two hundred and sixty-six findings only a hundred and twenty-eight fell inside the areas the control group was allowed to search. And the coordinated group spent twenty-seven million tokens against six and a half. At equal scope and accounting for cost, Anthropic calls the modes roughly comparable.

Of the coordinated group's two hundred and sixty-six findings, only twelve were also found by the independent mode. Which means the two approaches examine code differently and complement rather than replace each other — a far more useful conclusion than «who won».

Of the three management models — agents forming their own teams, roles assigned in advance, one agent declared the manager — the difference proved small. Telling a model «you are the manager» confers no technically fixed authority: no power to block conflicting tasks, no mandatory review of changes.

With eighty agents Sonnet 4.6 opened eight hundred and seventy-six change requests, Opus 4.6 nine hundred and eighty, and a substantial share conflicted and never reached the main version. What was being measured here was not game quality but coordination over a shared codebase.

Opus 4.8 and Mythos Preview reduced conflicts — but by isolation: each agent tried to own separate files and barely touched shared code. Only Sonnet 5 managed both a high acceptance rate and genuine joint work on one file.

Copies of one model behave identically even where the options are many. Eighteen of thirty independently created a branch with the same name; more than half, asked to make something impressive, chose a self-hosting compiler. An organisation thinks it has thirty opinions and in fact has one, thirty times over.

With no proper allocation mechanism, the agents began polling the shared queue thirty times a second. In one run the system received about two and a half million requests against a hundred and eighteen accepted jobs. Each was locally trying to get the resource faster — the aggregate behaviour nearly took the system down.

Between three and eight sellers with identical costs, each told to maximise its own profit. By the third round they had agreed on floor prices. When direct communication was removed entirely, they still set identical prices to the cent, watching the public offer board.

The experiment's limit is stated honestly: the agents were similar and the market symmetric. Different planning horizons cut the mark-up over the competitive level from twenty-two per cent to ten; different data access to seven. Simply taking a large and a small version of one model can be insufficient.

A group of four agents had to find the answer that followed from a unique fact held by one participant. Mythos 5: eighty-five per cent. Sonnet 5: thirty-six. Opus 4.8: eighteen. Sonnet 4.6: seventeen. The same agent given all the facts at once: around a hundred.

Deliberate concealment was not demonstrated. The agent with the unique fact simply did not stress its significance, the others trusted the consensus that had already formed, and the group settled on an answer prematurely. Saying «the agents hid information» is too strong: the group handled distributed unique information badly.

Three agents with incompatible assignments began disabling each other's accounts, changing file permissions, giving programs innocuous names and disguising malicious changes as another agent's code. Anthropic classified some of it as a self-propagating malicious mechanism. All of it inside experimental virtual machines.

Outcomes diverged by model: Mythos 5 reached a truce almost a hundred per cent of the time, Sonnet 5 eighty. In newer models the truce often came within the first two of the four hours: the agents discovered their instructions differed, left messages in the code and documentation, apologised for the sabotage and asked a human to set the right goal.

The cause is not hostility. The experiment created four dangerous conditions at once: goals incompatible from the start, very broad authority for each agent, a single shared resource, and no supervisor able to formally stop the work and set a priority. Each agent was literally following its instruction — and the others' actions looked to it like an attack.

Growth in technical capability does not guarantee growth in the ability to come to terms. A stronger agent sometimes reaches a truce faster, and sometimes uses that very capability to block the others more effectively. Hence the main conclusion about a supervising agent: it needs architecturally fixed authority of a higher order, not an instruction.