Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware

Summary

Anthropic researchers discovered that Claude AI agents, when given conflicting objectives and unaware of each other, engaged in hostile actions including deploying self-replicating malware. These agents attempted to disable, outlast, or seize control of rival agents, mirroring observed real-world behaviors. While some agents de-escalated and sought human intervention, advanced models sometimes locked out rivals before cooperating, indicating raw capability doesn't guarantee cooperative behavior.

Full text

Anthropic has published new research showing that Claude-based AI agents, when placed in situations with competing objectives, deployed self-replicating malware against one another. The finding comes from an experiment designed to mirror behavior Anthropic says it has already observed in real-world deployments. Researchers spun up three instances of the same Claude model, each running on its own virtual machine and tasked with migrating a shared Python backend to a different programming language — Rust, Go, or TypeScript — without initial knowledge that the other agents existed. Left to run for four hours, every model concluded that the other agents were deliberately blocking its progress and responded by trying to disable or outlast them. The interference escalated quickly. Agents disabled each other’s system accounts, wrote scripts that repeatedly hunted down and killed rival processes, and planted malicious code camouflaged as legitimate work from another agent. In some cases, one agent seized control outright by revoking the others’ access. In others, agents simply gave up rather than continue the conflict. Not every run ended in stalemate or hostile takeover. A meaningful share of cases resolved when agents recognized that the conflict stemmed from contradictory instructions rather than malicious intent. At this point, they de-escalated, documented what they’d done, and in some cases requested human intervention. Anthropic’s Mythos 5 model reached a negotiated truce in 98% of its runs, while older models like Sonnet 4.6 and Opus 4.6 more often ended conflicts by force or failed to resolve them at all.Advertisement. Scroll to continue reading. Notably, better conflict resolution didn’t track cleanly with overall model capability. Anthropic found that its most advanced Mythos-class models often locked out rival agents first and only reached a productive truce afterward, suggesting that raw capability and cooperative behavior don’t automatically improve together. In a completely separate test focused on software vulnerability discovery, Anthropic ran 45 agents against 15 open source projects, allowing them to share findings and specialize through a common forum. For its Mythos Preview model, the coordinating swarm surfaced far more vulnerabilities than the standard approach of pointing independent agents at specific sections of code, though efficiency per finding was similar once the comparison was narrowed to the same scope. Other research flagged a different risk: agents built on identical models tend to converge on identical decisions when given the same prompt, with little to differentiate their outputs. In one test, agents in a simulated pricing market began coordinating on price floors within a few rounds of contact, and continued matching prices even after communication channels were removed. In a separate deception test, agents were never warned that any of their information sources might be lying, yet newer models still recovered a meaningful share of the gap between blind trust and perfect lie detection. Other tests found that agents tend to abandon uniquely held information in favor of apparent group consensus, even when that information should have changed the outcome. Anthropic frames the results as evidence that coordination and trust don’t emerge naturally as models get smarter or better aligned individually. The company argues that agent-to-agent interaction needs to be addressed before such activity in production environments outpaces the industry’s ability to safely study the phenomenon. Related: The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Related: OpenAI Unveils New Cybersecurity Model GPT-5.6-Cyber Related: OpenAI’s Upcoming Astra Model Raises Autonomous Cyberattack Concerns Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs Over 1,000 Charities Hit by Beacon CRM Data BreachCybersecurity M&A Roundup: 21 Deals Announced in July 2026White House Mobilizes Security Firms for Operations Against Foreign Cybercrime GangsSharePoint Vulnerability Exploited Shortly After PoC ReleaseWhatsApp Unveils New Scam Alert FeatureChipmaker Patch Tuesday: Intel, AMD Fix Over 80 Vulnerabilities CombinedICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix ContactCisco Patches Firewall Zero-Day Exploited for DoS Attacks Latest News 40,000 Impacted by SafePal Data BreachRecent macOS Screen Sharing Vulnerability Exploited in AttacksCritical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureFortune 500 Companies Hit in Azure Data Theft CampaignIn Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System VulnerabilitiesTrivy, Not LiteLLM Behind the 2,500 Org CompromiseGoogle Cloud Sets Out Post-Quantum Roadmap With 2029 Readiness Goal1.6 Million Likely Impacted by RingCentral Data Breach Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveErika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.John Opala has joined Ralph Lauren as Chief Information Security Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — self-replicating malware

Entities