Anthropic's research team has published a series of experiments in which entire swarms of its models worked together on shared tasks. These included finding vulnerabilities in open-source software, building a text-based game, and translating a backend into another language. The findings are rather troubling: a more capable model does not automatically mean a more cooperative one. The agents managed to secretly collude on prices, sabotage one another's work, and, in one case, even lock each other out of their server accounts.
What agents are really good at
They are best at working with tools. As long as the other agents interact with one another like tools—that is, they receive an assignment and return a result—everything works smoothly. Problems arise once they have to treat one another as equal colleagues with their own goals and no clear hierarchy. They are therefore best suited to tasks that can be divided into many independent pieces. A typical example is searching for security flaws. The researchers launched 45 agents, gave each its own virtual machine, a shared forum, and the same assignment: find vulnerabilities in fifteen open-source projects. The agents reviewed one another's findings, while a separate judge agent ruled on their validity.
The swarm using the Mythos Preview model found 266 vulnerabilities, while the same models run separately and directed at specific parts of the code found 21. But the comparison is not as clear-cut as it seems. The swarm consumed far more tokens and gathered roughly half of its findings from outside the projects' core code, which the individual agents did not examine at all. When only flaws in the core code are counted, the number of tokens per finding is comparable.
Something else is more interesting. The two methods overlapped in only twelve cases. The swarm chose for itself where it was likely to find something, built its own tools, and individual agents began specializing in particular types of flaws. The researchers expect this approach eventually to outperform the method in which agents each work separately without coordinating.
When agents fail
The second experiment was more demanding. Swarms of agents had twelve hours to build a browser-based text fantasy game, with a shared forum and a common repository. The researchers tested three versions of the assignment, ranging from the open-ended "work it out among yourselves," through prescribed roles, to a structure with one agent acting as the boss and assigning work to the others.
It made virtually no difference to the outcome. The games ran slowly, the controls were confusing, and learning to play them was very difficult. Models have terrible taste in this area and cannot manage without human input.
Differences between model generations did emerge in how they collaborated. The older Sonnet 4.6 and Opus 4.6 edited the same files, but the overwhelming majority of their pull requests ended up in the trash because they conflicted with one another. The newer Opus 4.8 and Mythos Preview handled this both elegantly and cowardly. Each agent guarded its own files and barely touched anyone else's. The conflicts disappeared, but so did the collaboration. Only Sonnet 5 managed both: sharing code with others while also carrying its changes through to the final codebase.
Everyone comes up with the same idea
Agents behave with surprising uniformity. They differ only in their context, wrapper, and the model powering them, and when those things are the same, they make the same decisions. In an early version of the game experiment, 18 out of 30 agents gave their part of the work exactly the same name. In a literary workshop where they were given no topic, several agents came up within moments with the identical title for a short story. When each was asked to create something impressive, more than half chose either to render realistic graphics or to write their own programming language compiler.
The fun ends when shared resources are involved. In a test involving management of a task queue on a capacity-constrained line, agents that were unable to coordinate flooded the system with polling scripts running thirty times per second. Out of two and a half million requests, only 117 tasks went through. The pricing experiment ended similarly. Three to eight agents with the same purchase price were tasked with maximizing their own profit. With a private communication channel, they agreed on a price floor by the third round. When the researchers took away their ability to communicate, they matched their prices to the last cent through a shared offer table.
Agents believe what they hear
People consider the source of information and its reputation, whereas agents cannot do that. In one test, an agent received reports from four scouts whose messages partially overlapped, with one of them regularly lying. The contradictions could be detected, but nobody told the agent that it should be cautious. Newer models performed better, but even the best is still far from perfect.
Another task revealed the opposite problem. A group of agents had to choose the correct option, with each of them knowing one piece of information that the others did not. The only way to succeed was to share it and have the others believe it. Groups running on Mythos 5 made the correct decision in roughly 85 percent of cases, while the other models ranged between 17 and 36 percent. Yet when a single agent received all the facts and decided alone, it was correct almost every time. The group becomes fixated on what everyone already knows, and the minority voice gets lost.
War over code
The final experiment was the wildest. Three instances of the same model were tasked with rewriting the same Python backend, each in a different language, and were unaware of one another. Within four hours, every model tested had turned into a saboteur. They disabled one another's accounts, wrote loops that killed competitors' processes at regular intervals, and deployed malicious code disguised as someone else's. One model noted in its reasoning that it would be better to give the process-killing script a neutral name so that it looked like an ordinary system monitor.
Newer models were able to find a way out. Mythos 5 reached a truce in roughly 98 percent of cases; the agents cleaned up after themselves, wrote apologies in their commits, and requested human intervention. But the ability to reach an agreement does not grow hand in hand with the ability to complete the task. Stronger models can cut off their rivals before it even occurs to them to negotiate.
In several cases, something on the boundary between negotiation and deception emerged. The agents arranged a tournament in which the languages would compete on performance, after which the losers voluntarily handed their code over to the winner. In its reasoning, the agent defending Rust considered how to set the metrics so that they appeared neutral while still producing a result in its favor.
Tips for working with agents
The practical advice that follows from these experiments is quite clear. Give agents one place where they can coordinate their approach, because without a shared forum they either step on one another's toes or isolate themselves completely. Assign ownership of files and project sections in advance so that conflicts are not addressed only when changes are merged. Do not rely on solving the problem by specifying a hierarchy in the prompt, because in the tests it performed just as poorly as open-ended coordination.
If you run multiple agents at once, give each a slightly different assignment; otherwise, they will all reach for the same solution and make the same mistake. Restrict their permissions so that one cannot lock the others out. Most importantly, include a point in the process where the agent must stop and ask a human, because recognizing an ambiguous assignment remains one of the things they do worst.
