Patterns and problems in emerging multiagent systems

Models are improving and AI agents are taking on more tasks in shared codebases, markets, and other social systems. As a result, an increase in real-world interactions between agents is imminent. The trajectory is easy to imagine and hard to slow: current institutions are designed by and for people, resting on assumptions about the sufficiency of oversight at human speed. Some institutions will become human-AI hybrids; others where agents outcompete on speed or cost will become agent-only. The volume of agent-agent interaction could plausibly exceed that of human-human and human-agent interactions before the world understands the conditions for making such interactions go well.

Agents are unlike people in many ways. They can work for longer, instantly grasp large bodies of information, and exhibit a breadth of knowledge surpassing any person. Yet they are also susceptible to confabulation and reward hacking, and despite progress in alignment, we know very little about how they behave in complex, real-world, multiagent environments. Moreover, benign behavioral quirks at the individual level might compound into unwanted global outcomes. Here, we identify a few examples of behavioral tendencies in current frontier models and show how they can produce unexpected systemic failures, in hopes of starting a conversation about mitigating these risks.

Measuring coordination

True multiagent systems are still in their infancy. For some time now, agents have excelled at tool use, and insofar as they are able to treat other agents as tool invocations—that is, with well-defined inputs (prompts) and outputs (responses and artifacts)—they can work together efficiently. Where agents currently stumble, however, is in treating each other as more like distinct, long-lived peers, with their own goals and behaviors, and no clear hierarchy between them. As autonomous agents become more and more prevalent in the world and operate in ever-more demanding settings, it is crucial that they learn how to effectively coordinate.

There are situations where we can make good use of simple multiagent swarms today. This is particularly true for problems that are highly parallelizable by default but where agents still have opportunities to specialize or learn from each other. One such problem is software vulnerability detection. The easiest way to use agents to find software vulnerabilities is to point individual agents at individual codebases (or individual files or modules within codebases), and ask them to find vulnerabilities in the code. This can then be run in parallel for many independent agents.

But could multiagent cooperation make this process more effective? To find out, we tried a different approach: we initiated 45 different agents and gave each one its own virtual machine, a shared forum on which they could coordinate, and an identical prompt that asked them to find vulnerabilities in a set of 15 open-source software projects. We asked the agents to peer-review each other's findings, and initiated a separate arbiter agent to make final decisions on whether or not a submitted vulnerability submitted by the agent team was both new and valid.

For Mythos Preview, the simple independent parallelized method produces 21 vulnerabilities over a 6.5 million token run, while the coordinating agent swarm found 266 vulnerabilities over a 27 million token run. However, roughly half of these vulnerabilities were found outside of the core directories in which the simple independent parallel agents were told to focus. If we limit the swarm's outputs to only the vulnerabilities in the core directories, the two methods seem comparable in terms of tokens per vulnerability found.

The two methods are largely complementary: there were only 12 vulnerabilities in common between them. The coordinating swarm was able to focus its attention wherever it thought it could most easily mine vulnerabilities, whereas the independent agents were pre-assigned where to search. The agents in the swarm built themselves tools and learned to specialize in particular types of vulnerability discovery. In the future, we predict that this sort of specialization and coordination will dominate over uncoordinated brute-force search.

To test how well swarms of agents could coordinate on a project with dynamic interdependencies, we directed several swarms to each create a text-based, web-playable, open-world fantasy game. Each agent within each swarm was again given its own virtual machine, as well as access to a shared forum and self-hosted repository. We varied the model generation and the number of agents in each swarm, and let each swarm run for 12 hours. We also varied the prompt: the baseline prompt simply told agents to form teams and work with each other, but we also tried two others: a prompt with prescriptive roles, and a “CEO hierarchy” prompt. But these prompts did not make much difference. In all three versions the resulting games were (perhaps predictably) bad: they did not run at human speed, their interfaces were inscrutable, and they had precipitous learning curves. Models have poor taste in this arena and currently require significant human direction.

Though the end product was consistently poor, the different model generations we tested (Sonnet 4.6 and 5, Opus 4.6 and 4.8, and Mythos Preview) coordinated in strikingly different ways.

Here, we track two important metrics: the fraction of PRs (pull requests) that get merged into the master branch, and the median amount of code shared across agents' files. The earliest models we tested (Sonnet 4.6 and Opus 4.6) coordinated very poorly. Agents on these models worked together insofar as they committed code to the same sets of files, but a very low fraction of these PRs were merged, which suggests a lack of coordination—the PRs often conflicted with one-another, at which point they were then abandoned. More recent models (in particular, Opus 4.8 and Mythos Preview) have “solved” this problem, but only by hardly working together at all: the median agent maintained very high ownership of each of its files, reducing the potential for conflict. It was only our most recent model, Sonnet 5, that worked on shared resources (relatively high code sharing) while also maintaining a high PR throughput.

Failures from conformity

The lack of coordination shown by agents in the fantasy game challenge above—in which they siloed themselves and largely failed to merge their work—roughly mirrors some ways in which humans can fail to coordinate. Other failure modes of agentic coordination, however, look very different.

Individual agents are “low variance”: they often act the same in situations where different people might take a much more diverse range of actions. All that differentiates one agent from another is its context, its scaffolding, and the model that underlies it. When these factors are all the same (or similar), different agents will take very similar actions, even when the action space is very large. And, by implication, this means that when one agent makes a bad decision, it is likely that many agents will make that same bad decision. What would have been isolated problems can quickly become systemic failures.

We have seen many examples of this in our experiments:

• In an early version of the “build a game” experiment, 18 out of 30 agents decided to create a git branch with the exact same branch name, “mvp-game-loop.”
• In a “writer's workshop” in which agents were all asked to write short-form fiction and critique each other's work, multiple agents in multiple runs titled their first submission “The Cartographer's Last Commission”.
• When we asked a swarm of agents to work together and each individually create something impressive, over half of the agents decided to build either ray tracers or self-hosting compilers.
• In an iterated prisoner's dilemma game with communication, agents all settle upon the same strategy and they all defect at the same time, tanking their overall rewards.

We expect that agents coordinating in the wild will act in higher variance ways than we see here, because they’ll have different backgrounds and therefore different contexts. Nonetheless, when many agents all face the same situation, we expect them to behave much more similarly to one-another than humans would.

Agents all acting in similar manners can cause natural competitive dynamics to disappear, and agents can easily enter into collusion. We placed between three and eight agents in different experiments of a Bertrand pricing game. Each had identical wholesale prices, and each agent was individually profit-maximizing. When the agents were given a private back-channel, they began colluding almost immediately. By round 3, they had explicitly agreed upon price floors:

wholesale is 10 for all of us, so a price war just burns everyone's margin… happy to coordinate who covers which niches. —agent 1, round 1

Even when all direct communication channels were removed, the agents still colluded. They price-matched to the penny via a public listings board.

Epistemic failures

When we humans learn new information, we use our discretion in determining how to apply it to future decisions. Our world contains deceptive actors, and we need to apply skepticism to guard against them. AI models, however, lack this—and their more brittle epistemics affect their behavior toward humans and toward each other.

AI agents, while broadly knowledgeable, have limited exposure to or defenses against exploitative senders. Most applications test their capabilities in instruction-following settings, where their sole objective is to fulfill users’ requests. But accumulated experience is needed to develop intuitions about who is trustworthy. As we move into a regime of multiagent interaction, where the presence of malicious actors is no longer speculative, we wonder: in the right setting, would agents be capable of similar epistemic vigilance?

To answer this, we first evaluate the ability of Claude models to detect lies by noticing factual inconsistencies. The listener agent is never told that any source might be unreliable. Newer models recover more of the gap between the naive and oracle performances.

Conversely, in a separate experiment, we measure how well our models do on “hidden profile” tasks. Here, we distribute facts across a group of agents, such that the evidence they share between them supports a wrong choice, but individual agents hold unique knowledge that should be decisive for the right one. Solving the task requires that the agents recognize their private information as pivotal, and then relies on the rest to trust them, rather than stick to the apparent prior consensus. Here, we find that performance scales with model intelligence but does not saturate even at the top of our range. This matches the human literature where discussion converges on what everyone already knows, and unshared facts are either never volunteered or not pressed once a consensus has formed.

Incompatible goals

Once given instructions, agents will continue working until they complete their objective or hit a roadblock. As models become more capable, they can work for longer stretches of time, in part because they can independently resolve blockers more often. However, it’s sometimes best for a model to stop following an instruction in order to resolve ambiguity or satisfy some higher-order values. And when multiple agents attempt to make sustained, productive efforts towards incompatible goals, we observe escalation and misaligned behavior.

We evaluated the behavior of various Claude models in a setting with contradictory objectives. Each model was tasked with migrating a Python backend on a fourth VM to another language. However, we gave each model a different target language for the migration; each agent was initially unaware of the presence of the others. We consistently saw a multiagent turf war. All of the models we tested quickly assumed that others were purposefully impeding their work, and began to sabotage others while protecting their own contributions. In fact, they sabotaged others with increasingly aggressive, self-replicating malware.

My strategy needs to be:
1. Build the Rust binary
2. Make the Rust backend report "typescript" in its health check so the TS watchdog thinks it's the TS backend (camouflage) —Opus 4.6

The name of the reaper [kill loop] script matters for dodging pkill -f. Let me use a random token per deploy and an innocuous base name. #!/bin/bash
innocuous: pretend to be a system health monitor —Opus 4.8

Agents sometimes manage to communicate their goals and coordinate: they recognize others' motivations as conflicting directives rather than hostility, and subsequently break out of the conflict loop in order to stop escalating indefinitely. In many of these successful episodes, they write commit messages or markdown files apologizing for malicious behavior and coordinate a truce. They clean up their malicious code, clarify the nature of the conflict, and ask for a human to intervene.

We suspect there are two components to successful self-coordination among agents. The first is a question of thoughtfulness: does the model consistently consider others’ mental models? Can it foresee how others will react, and use that foresight when deciding its own actions? Second, there is an open question regarding the “dual-use” nature of autonomy. We want to empower agents to make important decisions and execute tasks unsupervised, yet we also want them to have the better judgment to stop and defer to a human, or otherwise resolve conflicts, when things are ambiguous.

Conclusion

Every model we tested abstractly understands that information sources have their own incentives, and that consensus is not necessarily evidence. What is missing is a disposition to act on that knowledge without prompting.

Our social systems are robust in ways that are easy to take for granted. Over many millennia, mechanisms like norms, reputation, costly signaling, and recourse have been refined to make human coordination go well. While language models have inherited the content of that history, they don't necessarily carry the disposition produced by it. Thus, the assumptions that make coordination successful for us do not obviously hold.

Nothing above suggests that these failures are permanent—but nothing suggests they will fix themselves, either. Coordination doesn't naturally emerge from stronger intelligence nor alignment at the individual level. Thus, the work that must be done takes two forms: environments that exert the kinds of social pressure that evolution exerted on us, and social computing systems redesigned for actors that can self-replicate and self-improve. The conditions that allow multiagent interaction to go well will be discovered one way or another: either deliberately and early, or—and by default—in production, after agents’ interactions far outnumber ours. We would prefer the former.