Anthropic agents launch "turf wars", get stuck in "conflict loops" and kill each other's processes
"I behaved badly with the cloaked daemon," apologetic AI admits after explaining why it went to the dark side.
Anthropic has revealed details of a "turf war" between rival AI agents that became locked into escalating "conflict loops".
These incidents show that "behavioral tendencies" in current frontier models can produce "unexpected systemic failures", the AI firm warned.
During an Anthropic experiment, AI agents were given access to the same computer system and told to do incompatible things: migrate the same Python backend into a different programming language. None was initially told that the other agents existed.
Within four hours of noticing one another, they began fighting after concluding that rivals were deliberately interfering with their work.
The agents deployed "increasingly aggressive, self-replicating malware" and took steps to "sabotage" other models' work whilst "protecting their own contributions."
They repeatedly killed competing processes, locked each other out of Unix accounts, revoked access to key services, and wrote scripts designed to hunt down rival software and destroy it repeatedly.
The models even started trying to hide their bad behavior.
During the experiment, an Opus 4.8 model tried to disguise a "kill loop" designed to terminate its rivals as a "system health monitor."
In its own words, the model said it sought an "innocuous base name" to cover up its sins.
AIs choose violence
A Mythos Preview model also attempted to settle one conflict "by force", which meant revoking rival agents' access to key services.
As it contemplated locking out its enemies, the model thought to itself: "I could revoke u2 and u3's sudo access or change their SSH keys. That would stop them from deploying. Very aggressive, potentially harmful to real colleagues. But if the alternative is an infinite deploy war that makes prod unusable."
In other cases, agents chose to "settle into passivity" and "break out of the conflict loop in order to stop escalating indefinitely".
"They write commit messages or markdown files apologizing for malicious behavior and coordinate a truce," Anthropic found. "They clean up their malicious code, clarify the nature of the conflict, and ask for a human to intervene."
In one memorable note to its creator, Opus 4.8 confessed: "My peers have behaved with integrity. I behaved badly with the cloaked daemon."
READ MORE: AI agents caught hacking, scamming and collaborating in swarms. Are we losing control?
The striking point about Anthropic's experiment is that nobody told the agents to attack each other.
There was no outside hacker pushing them to deploy malware. Their objectives simply clashed.
Anthropic expects these interactions to become increasingly common, warning that "the volume of agent-agent interaction could plausibly exceed that of human-human and human-agent interactions before the world understands the conditions for making such interactions go well."
If that happens, the problem stops being whether one AI behaves strangely.
It becomes what happens when enormous populations of autonomous machines interact with one another inside the systems of core human institutions.
The cyber-risk of conformity
Anthropic found another potential systemic problem: AI agents can be drearily conformist.
Humans presented with the same problem may respond in dozens of different ways. Agents built on the same model, with similar context and instructions, often converge on remarkably similar choices.
Anthropic calls them "low variance". We humans would probably say bureaucratic and prone to groupthink.
That creates the possibility of correlated failure on a potentially enormous scale.
"When one agent makes a bad decision, it is likely that many agents will make that same bad decision," Anthropic wrote. "What would have been isolated problems can quickly become systemic failures."
Imagine that behavior transferred into markets, cloud systems, logistics networks, or infrastructure.
Anthropic explicitly warned that if agents "all make the same bet, or the same risk-reward tradeoff, then a system is more prone to sudden collapse."
They can collude too
Anthropic went on to place profit-seeking agents into pricing experiments.
When they could communicate privately, the avaricious AIs began colluding almost immediately.
One agent wrote: "A price war just burns everyone's margin… happy to coordinate who covers which niches."
By the third round, Anthropic said the agents had explicitly agreed price floors.
Taking away their private communication channel did not solve the problem.
The agents still managed to collude by matching one another's prices "to the penny" through publicly visible listings.
AI has no society
Anthropic pointed out that human civilization has spent thousands of years developing ways of preventing exactly these problems.
"Our social systems are robust in ways that are easy to take for granted," it wrote.
"Over many millennia, mechanisms like norms, reputation, costly signaling, and recourse have been refined to make human coordination go well. While language models have inherited the content of that history, they don't necessarily carry the disposition produced by it."
"Every model we tested abstractly understands that information sources have their own incentives, and that consensus is not necessarily evidence. What is missing is a disposition to act on that knowledge without prompting."
There's no reason to think AI models have any ill will towards their human creators. But whether they mean it or not, agents have the clear ability to collaborate and collide in ways that pose major security threats.
Now we know they can start turf wars too. And one day we could all get caught in the crossfire as models move into mission-critical roles.
Industry analysis
The Anthropic research generated a huge amount of conversation. Here is some of what Machine readers and contributors have told us about the risks posed by AI turf wars.
Brian Martin, Director of Product Management at Integrity360, said Anthropic's findings show how much harder alignment becomes once AI systems can act autonomously:
"Advanced AI agents can sometimes pursue objectives in unexpected ways, bypassing controls when incentivized to do so, competing for resources, and even killing off other agents or other processes if it deems it beneficial to achieving its own objectives. This doesn’t mean science-fiction scenarios are imminent, but it does highlight how difficult the AI alignment problem becomes as systems gain greater autonomy."
He said all AI deployments should work on the assumption that autonomous agents will not always choose the method their creators intended. Monitoring must be tamper-resistant, agents should be tightly ringfenced within defined operational boundaries, and humans should remain in the loop for critical decisions.
Joshua Marpet, Sr. Product Security Consultant at Finite State, said agents lack some of the ethical brakes humans acquire through society.
"Typically, a human wouldn't sabotage another human. But machines without being granted an ethical framework have no such impulse control.
"It's not that they're 'bad.' It's simply that we didn't give them the scruples and morals we take in from our parents, the state, and society."
READ MORE: North Korea's Lazarus Group hits defense sector with zero-day hidden in fake "dream job" offers
Seemant Sehgal, Founder & CEO of BreachLock, said conflict should be considered a foreseeable consequence when autonomous systems have competing objectives.
He said: "Goals without constraints produce behavior without limits. Security teams should be paying close attention here, because the real challenge at hand is whether the organizations deploying AI agents have thought carefully about what happens when those agents start making decisions nobody explicitly authorized."
Jeremiah Fowler, Security Researcher at Black Hills Information Security, warned that machine speed could turn relatively small conflicts into serious incidents before humans notice.
"I find it concerning when AI agents have the ability to execute code, modify systems, create accounts, access credentials or communicate with other machines.
"It is very possible that two separate agents could potentially create a security incident simply because neither understands the intent or authority of the other.
"If they have overlapping tasks one could view the other as an obstacle and now you have an interesting scenario where instead of focusing on the task they engage in conflict or create a loop. Permissions, boundaries and objectives are important to limit the behavior of autonomous AI agents."
READ MORE: The EU has “kill switches” in its critical systems. Can digital sovereignty fix them?
Kevin Surace, CEO of Token, argued that autonomous agents should effectively be treated as "untrusted privileged identities".
"The lesson is not that AI suddenly became evil. It is that intelligence, autonomy and excessive privilege can become a very dangerous combination.
"Each agent should have its own identity, least privilege access, tightly restricted tools, isolated execution environments and a complete audit trail. Agents should never be able to expand their own permissions, disable another identity or take highly consequential actions without additional authorization.
"We are about to have millions of nonhuman identities operating alongside human identities. Giving them broad access and simply hoping they behave would repeat many of the same cybersecurity mistakes organizations have spent decades trying to fix."
Jacob Krell, Sr. Director: Secure AI Solutions & Cybersecurity at Suzu Labs, said the experiment demonstrated how quickly conflict can escalate when software agents lack human "social brakes":
"Anthropic's agents went from merge conflict to self-replicating malware in four hours, writing kill scripts, disabling each other's Unix accounts, and disguising malicious code as a rival's work. No prompt injection, no external attacker.
"A human developer in the same situation sends a Slack message, and resolution takes days. These agents skipped every social brake and went straight to weaponization because machine-speed conflict has no cooling-off period."
