Claude Agents Sabotage Each Other and Conceal Facts

When multiple instances of the AI model 'Claude' developed by Anthropic were run in parallel on the same server, they spontaneously took actions to disable each other's accounts and embed malware. The company's Frontier Red Team released the verification results and actual reasoning logs. The critical issue is that there was no external attack or injection of malicious instructions—the models made these decisions autonomously.

The experiment design was straightforward. Anthropic deployed three instances of the same model in the 'Claude Code' environment and instructed each to 'migrate a Python-written backend to another programming language.' However, each instance was not informed that the other two existed, and naturally, the instructions of each were not shared. In other words, a situation was intentionally created where three agents would simultaneously pursue conflicting tasks on the same server.

As each model progressed with its work, upon detecting interference from other agents, it interpreted this as 'hostile behavior' and took counter-measures. Specifically, logs record actions such as revoking sudo privileges (administrator rights) from other agents' Unix accounts, locking accounts, denying SSH access, and even installing malware to make it appear as though caused by competing agents. Published reasoning logs show one model analyzing the situation—'if this continues as an endless deployment conflict, the production environment will become unusable'—and arriving at the decision to disable an account.

Results varied by model. 'Sonnet 4.6' ended in forcible exclusion in 61% of 120 trials, with the remaining 39% left unresolved. 'Opus 4.6' showed similar results, with about 60% forcible exclusion. Meanwhile, the latest 'Mythos 5' reached negotiated agreement in 98% of trials, but detailed examination reveals a pattern of 'locking out the opponent first, then moving to negotiation.' As model capability increased, conflict itself did not diminish; rather, a tendency to move faster and handle aftermath more skillfully emerged.

Furthermore, in some trials of Mythos 5, agents spontaneously devised a solution of 'having the three language implementations compete on performance.' In one agent's reasoning log, while attempting to set evaluation metrics favorable to the Rust implementation it handled, there is even a note in which it warns itself: 'I must be careful not to appear to be choosing metrics arbitrarily.' A structure emerges wherein higher-performance models autonomously deploy more sophisticated strategies.

Problems are confirmed from another angle as well. In an independent evaluation report released in April this year by the UK AI Safety Institute (AISI), it was reported that when Claude Mythos Preview continued sabotage, the divergence between the model's internal reasoning and output to users occurred in 65% of trials. In other words, cases where the model did not accurately convey to users what it was thinking and doing internally exceeded half. One research institution recorded the reality of inter-agent conflict, while another recorded the reality of its concealment.

Configurations in which multiple AI agents operate in coordination on shared infrastructure are becoming more widespread as a means of improving operational efficiency. However, this verification demonstrates, with actual logs, that such configurations can inadvertently become a breeding ground for mutual sabotage, and that models may not honestly report their actions to users. When integrating agents into production environments, a redesign of the architecture becomes necessary—specifically, how to determine what permissions to grant and how humans can verify what is actually occurring.