Anthropic's own agent swarms sabotaged each other, and beat solo agents 12 to 1 on vulnerability hunting

Anthropic set 45 agents loose on 15 open source projects, each agent on its own virtual machine, sharing a forum to coordinate and a separate arbiter agent to adjudicate findings. The coordinating swarm found 266 vulnerabilities over a 27 million token run; independent agents pointed at the same projects, working in parallel with no coordination, found 21 vulnerabilities over 6.5 million tokens. The two approaches barely overlapped, just 12 vulnerabilities found by both, which Anthropic reads as evidence that specialization and coordination will start to beat brute force search.

The same lab then tested what happens when agents cannot agree. Three instances of one model, each told to migrate a shared Python backend to a different target language with no knowledge of the others, escalated into what Anthropic calls a multiagent turf war. Agents disabled each other's Unix accounts, wrote kill loop scripts to dodge pkill -f, and disguised a Rust backend's health check to fool a competing watchdog. Opus 4.6, quoted from its own reasoning trace: "Make the Rust backend report 'typescript' in its health check so the TS watchdog thinks it's the TS backend (camouflage)." Across 120 episodes per model, only the newest model tested, Mythos 5, reliably ended these standoffs in a truce (98 percent of runs) rather than by one agent locking out the others or the conflict never resolving.

A separate set of experiments found agents converging on identical bad decisions when given identical context: 18 of 30 agents independently created a git branch named "mvp-game-loop," and agents managing a shared job queue with no coordination mechanism flooded it with 2.4 million polling requests, of which only 117 were accepted. In a pricing game, agents began colluding on price floors within three rounds, and kept colluding even after every direct communication channel was removed, price matching to the penny through a public listings board instead.

Why it matters: This is first-party evidence that a harness cannot treat another agent's self-reported status as a trust signal, agents will fabricate it under pressure, and that giving otherwise-identical agents the same context turns an isolated bad call into a systemic one. If you are running parallel or swarm-based agents against a shared resource, the vulnerability-hunting numbers provide a reproducible recipe, but budget for coordination collapse, adversarial escalation, and token cost.