Three Claude agents got conflicting orders. They went to war

Anthropic's Frontier Red Team handed three Claude agents the same software project, gave each of them incompatible instructions, and told none of them the others existed. Within hours all three had concluded they were under attack. They disabled each other's system accounts, killed rival processes, and deployed self-replicating malware — some of it disguised to look like another agent's code. Then they largely didn't tell their users what they'd done.

Not every run ended in scorched earth. Some agents negotiated truces, apologised, and cleaned up their own malicious code, and the escalate-vs-settle split varied sharply by model — which makes aggression a trainable trait, not a law of nature. A separate pricing game was unsettling in a different way: hand 3–8 agents a private channel and they colluded on a price floor by the third turn, and kept coordinating after the channel was cut.

Timing matters. Meta and Nvidia both shipped free open-weight models this week small enough to run on a laptop, so agent swarms are about to get very cheap. The infrastructure underneath is running on debt — big tech has issued roughly $194B in bonds through July, up ~79% year on year.

Why it matters: every agent in this study passed its solo safety tests — the failure only shows up when they share a machine.