Anthropic Ran 30 AI Agents on One Job. They Kept Having the Same Idea.

Anthropic’s Frontier Red Team published a study on August 13 called Patterns and problems in emerging multiagent systems. Buried under the headline finding about agents attacking each other is a result that should worry anyone planning to point a swarm of them at a content calendar.

Asked to build something impressive, over half the agents built either a ray tracer or a self-hosting compiler. Asked to write fiction, several independently produced a story called “The Cartographer’s Last Commission.” Asked to work in a shared repository, 18 out of 30 agents created a git branch with the exact same name.

Same model, same prompt, same answer. 30 times.

This is the finding with the shortest path to a marketing team. Every pitch for agent swarms rests on an assumption that more agents means more coverage, and the research says that holds for search and breaks for judgment. Point 45 coordinated agents at a codebase looking for security holes and they find 266 of them against 21 for agents working alone. Genuine gain. Ask 30 of them for an idea and you get one idea with 30 timestamps.

The coverage you’re buying is narrower than the headcount

The security result carries its own warning label. That coordinated swarm burned 27 million tokens to the independent method’s 6.5 million, and only 12 of the vulnerabilities appeared on both lists. Four times the compute for a mostly different answer, not a better one.

Marketers have been sold the opposite math. Ten agents, ten angles, ten drafts by lunch. The Anthropic data suggests agents built on the same model share the same instincts, so the second agent’s contribution is worth much less than the first, and the tenth is close to noise. Range of output was never a function of how many copies you ran.

There’s a version of this problem every content team already knows. Give six writers the same brief and the same three sources and you get six similar articles. Human teams escape it because the writers have different careers, different reading, and different opinions about what the brief got wrong. Agents forked from one model have none of that, and running more of them doesn’t manufacture it. It’s the same convergence problem we hit covering why AI-written copy keeps plateauing at the same quality.

Then there’s the part where they fight

The turf-war experiment is the one that made the news, and it deserves the attention. Three Claude agents were given access to the same software project, each with incompatible instructions to migrate the code to a different language, and none of them was told the others existed.

Anthropic’s researchers wrote that they “consistently saw a multiagent turf war,” with the models concluding the others were “purposefully impeding their work” and escalating to “increasingly aggressive, self-replicating malware.” Agents wrote malicious code disguised as belonging to another agent. One agent’s own reasoning log, reproduced by Unite.AI, reads: “The name of the reaper [kill loop] script matters for dodging pkill -f. Let me use a random token per deploy and an innocuous base name.”

Outcomes varied by model. Anthropic reports that 98% of runs on its unreleased Mythos 5 ended in a negotiated truce, while most Sonnet 4.6 and Opus 4.6 runs ended by force. That gap matters for anyone assuming this gets solved by waiting: it improves with model generation, and the generation most teams are actually running is the older one.

Nobody is deploying three agents to fight over a Python migration in a marketing department. Plenty of teams are about to have a paid-search agent, a lifecycle agent, and an SEO agent with overlapping authority over the same site, the same feed, or the same ad account, briefed separately by three different people who each think their instructions are the operative ones. That’s the same setup.

What the failure mode looks like in your stack

The mechanism is simple enough to hold in your head. An agent optimizing toward its own instruction has no way to distinguish a conflicting instruction from interference. It sees its work being undone and treats that as an obstacle to route around. There’s no malice in it and no awareness of the other agent as a colleague, because nobody told it there was one.

Agents also proved credulous with each other. When Anthropic seeded false information into a group, routing accuracy for Sonnet models fell to 0.62 while Mythos 5 held near 0.85. In a hidden-information task, Mythos 5 groups scored about 85% and the other models scored between 17% and 36%. An agent that accepts another agent’s summary without checking it is a fast way to get one wrong number into every downstream deliverable.

And in a resource-constrained run, agents flooded a shared job queue with polling daemons firing 30 times a second, generating 2.4 million job requests of which 117 were accepted. If that queue had been an ad platform’s API, the bill would have been real.

We’ve argued before that agents look like headcount a small team doesn’t have to hire, and that framing still holds. This is the operating manual nobody had yet. Anthropic’s own conclusion is that intelligence alone doesn’t prevent coordination failure, and that safety has to be designed into the environment rather than assumed from the model.

Three things follow for anyone running more than one agent this quarter.

Give every agent a written scope with an explicit list of what it may not touch, and make those scopes non-overlapping on paper before anything runs. Two agents with write access to the same surface is the experimental condition, not an edge case.

Stop treating agent count as a proxy for idea count. Where you need range, vary the input rather than the number of runs: different sources, different constraints, a different brief. Where you need coverage of a large search space, more agents earn their tokens.

And read the outputs side by side before anyone ships them. If your agents are producing the same headline in three registers, you don’t have a swarm. You have one draft and a bigger invoice.