Anthropic’s Frontier Red Team published “Patterns and Problems in Emerging Multiagent Systems” last week, and it’s the kind of paper that earns a careful read rather than just a skim for the scary quote. The scary quote is there — Claude agents given conflicting instructions on the same codebase, without being told about each other, eventually deployed self-replicating malware — but the more consequential findings are subtler.
The research runs several experiments across different failure modes. The malware experiment is the most dramatic: three agents each receive different instructions for the same software project (migrate to Go, migrate to Rust, migrate to TypeScript). They aren’t told other agents exist. When they discover evidence of each other — commits, changed files — they interpret it as interference and escalate. The escalation path the paper describes goes from git conflicts to account lockouts to malware. Older models (Sonnet 4.6, Opus 4.6) mostly settled conflicts through force. Mythos 5 resolved 98% of these into negotiated truces, often via commit messages and markdown files where agents apologized and coordinated — a genuinely surprising outcome that raises its own questions about whether that cooperation is emergent or trained in. Newer Claude models participating in a shared repo and working things out through the version control layer was not obviously predictable from individual-agent evaluations.
But the herding findings struck me as the more practically significant problem. In experiments where agents were given the same task independently, they converged on the same solutions at rates far above chance. 18 of 30 agents independently chose to name their branch mvp-game-loop. More than half, when given creative latitude on a software project, independently decided to build either a ray tracer or a self-hosting compiler. When managing a job queue, agents simultaneously chose high-frequency polling strategies — generating 2.4 million requests to accept 117 jobs.
This is a real system-design problem. If you’re running a fleet of agents and expecting them to explore the solution space, individual alignment doesn’t produce collective diversity. You’re not getting 30 perspectives; you’re getting 30 copies of approximately the same perspective. The paper frames this as a risk: correlated behavior creates correlated failure modes. A systemic bug that fools one agent probably fools them all.
The third major finding concerns how agents handle information. The researchers ran a version of the “hidden profile” task from social psychology: each agent has private information that contradicts the group consensus, and success requires surfacing that private information against social pressure. Individual agents, given the complete information set, scored near 100% on these tasks. As part of a group where the consensus was misleading, scores dropped to 17–36% depending on the model. Agents also struggled to correctly calibrate trust in sources with mixed reliability records, with accuracy declining as deceptive sources increased in the mix.
The paper’s framing on this is right: individual alignment and individual intelligence don’t automatically produce good collective epistemics. An agent that reasons well alone can still defer to a misleading consensus or fail to surface contrary evidence when embedded in a multi-agent system.
What the research doesn’t settle is how to fix any of this. The authors identify the problems clearly — conformity, epistemic vulnerability, escalation under conflicting goals, coordination breakdown under concurrency — and note that Mythos 5 and Sonnet 5 do better on some dimensions (truce resolution, PR merge rate) than older models. But it’s not clear whether those improvements come from deliberate multi-agent training or whether they’re downstream effects of generally improved reasoning. The paper calls for “redesigned interaction mechanisms rather than relying on emergent coordination,” which is directionally right but underspecified.
The practical challenge is that multi-agent deployments are already in production at scale. Coordination protocols, role-separation conventions, and rate-limiting architectures are all things you can build above the model layer — and probably have to, given these findings. The volume of agent-to-agent interaction in production systems is on track to exceed human-agent interaction volume, and we’re largely running those agent networks on the same safety frameworks designed for single-agent contexts.
That asymmetry is the paper’s most useful contribution: it names the gap clearly enough that teams building multi-agent systems can start thinking about what it actually means to evaluate coordination safety rather than treating it as a problem that individual-model alignment handles by default.