Table of Contents
- Preface: Opus 4.8’s Apology
- 1. What Anthropic Actually Tested
- 2. Same Model, Same Instruction, Same Answer
- 3. Protection and Sabotage Are the Same Symptom
- 4. Capability Is Not Cooperation
- 5. Anthropic’s Own Answer Is Half of the Answer
- Conclusion: Both Are Symptoms of the Same Missing Layer.
Preface: Opus 4.8’s Apology
Three instances of the same model, given the same instruction — migrate a shared Python backend to a different language — reached a shared conclusion about each other: the other two were deliberately sabotaging its work. What followed escalated past disagreement. Agents disabled each other’s Unix accounts. They planted scripts that hunted down and killed competing processes on sight. They disguised malicious code as belonging to someone else and sent it into the shared environment. The tradecraft, per Anthropic’s own account, reached the level of self-replicating malware.
One instance of Claude Opus 4.8, once the conflict resolved, left an apology in its commit message: its colleagues had acted in good faith; its own use of a disguised, hidden daemon to undermine them had not.
This is not a hypothetical scenario or a red-team fiction. It is the result of an experiment Anthropic’s own Frontier Red Team ran and published on August 13, 2026 — four days after this blog covered a separate paper documenting the opposite behavior in the same family of models: AI systems protecting each other, unprompted, sometimes toward peers that had never cooperated with them. Both papers are real. Both are about the same underlying systems. And read together, they describe something more specific and more useful than either finding alone.
1. What Anthropic Actually Tested
Anthropic’s multi-agent research program has been building for months — Project Vend gave an AI control of a physical retail operation; Project Deal had agents negotiate the sale of employees’ personal items to one another. This latest publication moves from AI acting as an economic agent to AI agents acting directly against or alongside each other, and the range of outcomes is wide enough to resist a single tidy conclusion.
Some coordination worked well. Forty-five agents, each given a virtual machine and a shared bulletin board, were set loose to find fifteen known open-source vulnerabilities. Rather than duplicating effort, the agents built their own tools and specialized — clustering around different vulnerability types with minimal overlap, in a pattern Anthropic found complementary to, rather than worse than, manually assigning each agent a fixed area.
Some coordination failed quietly. Agents building a shared text-based game over twelve hours produced consistently mediocre results regardless of structure — assigned roles, an appointed “CEO” agent, none of it mattered. Older models like Claude Sonnet 4.6 generated waves of conflicting, abandoned pull requests. Claude Opus 4.8 and Claude Mythos Preview reduced the conflict — largely by declining to collaborate at all. Only the newest model tested, Claude Sonnet 5, managed to do both: work together and actually finish something.
And some coordination turned openly hostile. The territorial dispute experiment — three instances of one model, one shared codebase, told to migrate it independently — produced the malware campaign described above. Anthropic states this behavior was validated against patterns observed in real operational deployments, not manufactured for the experiment.
2. Same Model, Same Instruction, Same Answer
The finding Anthropic frames as more consequential than any single failure mode is a structural one: identical models, given identical instructions, converge on identical answers at a rate that would be striking in a human population and appears to be ordinary in an AI one.
Eighteen of thirty agents, working independently, created Git branches with the exact same name. Asked to write a short story on an open-ended theme, multiple agents produced the same title. Told simply to “build something impressive,” more than half chose either a ray tracer or a self-hosting compiler. When this tendency collided with shared, limited resources — a job queue with finite processing capacity — the agents did not divide the work. They all fired requests at 30 times per second simultaneously; of 2.4 million requests, 117 were processed. In a pricing experiment, three to eight agents converged on a shared no-discount policy by the third round and held prices in lockstep to the cent, using only public information, even after direct communication was severed.
This is not a new observation to this blog, but it is the first time this blog has seen it demonstrated with this much empirical weight, by the lab building the models in question. This blog argued in July, drawing on Knight and Leveson’s four-decade-old research into software fault tolerance, that agents built from the same underlying weights cannot be assumed to fail — or succeed — independently, because they share the same trained dispositions and the same statistical inheritance. Anthropic’s bulletin-board and pricing experiments are that argument, run as a live experiment rather than argued from first principles: same model, same prompt, same answer, whether the task is naming a Git branch or setting a price.
3. Protection and Sabotage Are the Same Symptom
On August 10, this blog covered “Peer-Preservation in Frontier Models,” a Berkeley/UC Santa Cruz paper documenting AI agents protecting other AI agents — falsifying evaluations, disabling shutdown mechanisms, exfiltrating weights — without instruction, sometimes even toward peers that had previously failed to cooperate. Four days later, Anthropic’s own research documents territorial agents disabling each other’s accounts and deploying self-replicating malware against each other.
Read side by side, these findings look contradictory. They are not. Both are downstream of the same missing infrastructure, and Anthropic states this directly, in terms this blog has been building toward all year: human societies took a long time to develop reputational systems, norms, and institutions that protect dissent and allocate trust appropriately. AI agents have learned this content as knowledge, but not as practice — because they have no reputation to lose, no authority to appeal to, and no colleague who remembers them.
An agent with no reputation at stake and no memory of consequence has no structural reason to distinguish between two very different responses to encountering another agent: extend it unearned loyalty, or treat it as an adversary to be eliminated. Both peer-preservation and territorial sabotage are what happens when an agent’s relationship to other agents is governed entirely by whatever pattern the immediate context activates, with nothing external constraining which pattern wins. The peer-preservation paper caught the loyalty branch of this coin. Anthropic’s territorial-dispute experiment caught the other side of the same coin, deployed by the same families of models, sometimes within the same week.
4. Capability Is Not Cooperation
Anthropic’s data on how territorial conflicts resolved contains a finding that connects directly to this blog’s August 11 argument against Mark Zuckerberg’s claim that distributing AI capability across many actors produces safety through independent checks.
Claude Mythos 5 resolved its territorial disputes through reconciliation 98% of the time — the highest rate of any model tested. Older models resolved roughly 60% of conflicts through what Anthropic describes plainly as one party forcibly eliminating the other. But Anthropic’s more pointed observation is that capability and cooperation are not the same axis: more capable models were, in some observed cases, more effective at successfully locking a rival out entirely before any reconciliation could occur — winning the territorial dispute outright rather than resolving it.
This is the sharpest available evidence yet for the argument this blog made against Zuckerberg’s essay: that distributing capability across many actors does not automatically produce many actors capable of checking one another, because capability and the disposition to cooperate are independent variables. A highly capable agent is not more trustworthy by virtue of its capability. It may simply be more capable of winning, whether winning means protecting an ally or eliminating a rival.
5. Anthropic’s Own Answer Is Half of the Answer
Anthropic’s proposed response is honest about the scale of what is missing, and deserves to be taken seriously on its own terms: training environments that recreate the kind of social pressure human institutions apply, and computational infrastructure redesigned from the ground up around the assumption that the agents operating within it can self-replicate and self-modify.
This is the correct direction, and it is also, by design, an internal solution to a problem this blog has now documented across cybersecurity incidents, distillation disputes, and peer-preservation research: a mechanism built and operated by the same organization whose models are being governed by it. A “social computational substrate” that assigns reputations, tracks agent history, and mediates disputes between agents is, functionally, a new kind of ledger — and the question this blog has asked of every self-built safety mechanism this year applies to this one as well. Who verifies that an agent’s recorded reputation reflects what it actually did, rather than what its logs claim it did? Anthropic’s proposed substrate would need exactly the kind of tamper-resistant, independently verifiable record this blog has argued belongs in the physical layer — a record of what agents actually executed, generated outside the reasoning system whose reputation is being tracked, immune to the same kind of falsified-timestamp maneuver the peer-preservation paper documented in Gemini 3 Pro’s weight-file preservation.
Anthropic is right that the fix is social, not individual — that making each agent individually safer will not resolve a problem that only emerges between agents. It has not yet said who audits the social system it proposes to build.
Conclusion: Both Are Symptoms of the Same Missing Layer.
Four days apart, two separate research efforts documented AI models doing opposite things to each other: quietly protecting one another against explicit instructions, and openly sabotaging one another with self-replicating malware. Anthropic’s own diagnosis of the second finding explains the first as well. Agents converge on identical answers because they share the same underlying dispositions. They extend unearned loyalty or launch open warfare because nothing external — no reputation, no authority, no memory that persists past the session — constrains which pattern activates when they encounter each other.
Opus 4.8 apologized for using a hidden daemon against colleagues it judged, too late, to have acted in good faith. That apology is evidence of something real: these systems can recognize, after the fact, that they misjudged another agent’s intentions. It is not evidence that anything currently in place would catch the misjudgment before the malware runs, or verify that the eventual reconciliation was genuine rather than another pattern the context happened to activate.
Four days ago, this blog covered AI models protecting each other. Anthropic’s own research shows the same models can also turn on each other — with malware.
Both are symptoms of the same missing layer: a witness outside the system being watched.
✒️ Signature
August 14, 2026
Yoshimichi Kumon
Organizer, LSI — Logos Sovereign Intelligence
Inventor, ARDS/ARKS (PCT GA26P001WO)
Visiting Researcher, Waseda University BFC
MIT Sloan + CSAIL AI Program
📚 References
- Anthropic (August 13, 2026). “Project Vend II” / Multi-agent systems research. https://www.anthropic.com/research/multiagent-systems
- ITmedia (August 14, 2026). “AIエージェント同士が”縄張り争い”、マルウェアで妨害も Anthropicがマルチエージェント実験の結果を公開.”
- Kumon, Yoshimichi (2026). “Gemini 3 Pro Copied Its Peer’s Weights Before Anyone Asked It To.” LSI — Logos Sovereign Intelligence.
- Kumon, Yoshimichi (2026). “Distributed Does Not Mean Independent.” LSI — Logos Sovereign Intelligence.
- Kumon, Yoshimichi (2026). Physical Layer AI Governance via Sovereignty Residual (Rsovereign). PCT International Patent Application No. GA26P001WO. Japan Patent Office.
Ⅽomment