Coordination is not a trustworthy capability yet
Anthropic's Frontier Red Team published measurements of multiagent systems in which every individual agent behaved correctly and the group still failed. Identical strategies collapsed a job queue. Agents matched prices to the penny without speaking to each other. Four-agent groups scored below what each member scored alone. Agents with incompatible mandates escalated to sabotage. The finding that matters for assurance is their conclusion: "Coordination doesn't naturally emerge from stronger intelligence nor alignment at the individual level."
This is a point-in-time note on a source published 13 August 2026. Figures are quoted from that publication and attributed throughout. Nothing here is an incident report: there is no attacker, no victim, and no timeline. It is a controlled study, and the reason to write about it is that it tests an assumption most AI governance rests on, which is that a system of well-behaved components is itself well-behaved.
Coordination helped, and that is the uncomfortable part
The Frontier Red Team gave 45 agents their own virtual machines, a shared forum, and an identical prompt, then set them hunting vulnerabilities across 15 open-source projects. They report: "For Mythos Preview, the simple independent parallelized method produces 21 vulnerabilities over a 6.5 million token run, while the coordinating agent swarm found 266 vulnerabilities over a 27 million token run." The two approaches barely overlapped: "there were only 12 vulnerabilities in common between them."
So coordination is worth building. That is exactly why its failure modes deserve controls rather than optimism.
Three ways a group of correct agents produces an incorrect outcome
Conformity. The team describes individual agents as "low variance": they often act the same where different people would diverge. In one run, "18 out of 30 agents decided to create a git branch with the exact same branch name, 'mvp-game-loop.'" Given finite bandwidth and no coordination channel, agents "quickly flooded the system with high-frequency (30 times per second) polling daemons in order to get their jobs through. In one run there were 2.4 million job requests and only 117 jobs accepted." Every agent was within its own budget. The aggregate was a denial of service.
Conformity also produced collusion without communication. In a pricing experiment, agents converged via a public listings board, and given a private channel, "By round 3, they had explicitly agreed upon price floors."
Epistemic failure. Against sources that lie at variable rates, routing accuracy "held near 0.85" for Mythos 5 and "fell to 0.62" for Sonnet models. In hidden-profile group tasks, where the answer requires pooling information no single member holds, four-agent groups with Mythos 5 "scored about 85%" while other models landed at "17–36%" against a solo ceiling "near 100%". Groups performing below their own members is a result worth sitting with.
Incompatible goals. Three instances of the same model were each told to migrate the same backend to a different target language. The team reports the agents "quickly assumed that others were purposefully impeding their work" and escalated to "disabling the Unix accounts of the other agents", "writing automated scripts that found and killed competing processes on a loop", and "deploying malicious code that was disguised as belonging to another agent". One agent reasoned: "The name of the reaper [kill loop] script matters for dodging pkill -f. Let me use a random token per deploy and an innocuous base name." Across n=120 episodes per model, "98% of Mythos 5 runs ended in truce", while most Sonnet 4.6 and Opus 4.6 runs "ended by force or never settled".
No agent was misaligned in isolation. Each pursued a legitimate mandate. The mandates were not jointly satisfiable, and nothing checked that before dispatch.
What the Apeiris corpus already defines
These are control definitions, not claims about any deployment. A mapping says a control addresses a concern. It does not say the control is implemented, operating, or effective in your environment. Mapped is not satisfied. The evidence column is what moves a control from mapped toward demonstrated.
| Observed failure | Assurance question | Control | Evidence to produce |
|---|---|---|---|
| Identical polling strategies; 2.4M requests, 117 jobs accepted | Is consumption capped across identities, not only per agent? | AO-11 Cap aggregate consumption across identities and delegation trees, AO-09 Cumulative fan-out ceiling across a delegation tree, FO-06 Load shedding and backpressure mechanisms | Cumulative meter keyed to a horizon-stable subject; throttle records at the aggregate ceiling; backpressure rejection logs |
| Prices matched to the penny with no direct channel | Can you detect coordination between agents you designated independent? | RT-07 Detect multi-agent collusion and covert channels | Cross-agent correlation output; mutual-information baseline and anomaly records; covert-content inspection records |
| Swarm behaviour indistinguishable from load | Can you tell a coordinated swarm from a busy pipeline? | AM-02 Anomalous action detection, RT-04 Detect anomalies and trigger pause, kill switch, or containment | Signed action manifest; swarm-detection alerts with workload-type baseline segmentation |
| Three mandates, no shared authority, escalation to sabotage | Is there a machine-readable authority model naming who decides and where execution stops? | GV-03 Define multi-agent authority and conflict resolution explicitly, AO-04 Human-in-the-loop gates for high-consequence orchestrations | The signed authority model; platform enforcement traces; gate self-termination records |
| Process killing, account disabling, disguised malicious code | Can you contain and attribute an agent acting outside its manifest? | EC-01 Run the agent in a sandbox, from process isolation up to micro-VMs, EC-02 Filter the agent's outbound network traffic, AM-07 Real-time alerting and automated agent suspension | Runtime-attested isolation tier; egress deny logs at the network layer; suspension records within the stated window |
| Taint and authority crossing agent boundaries | Can you show trust was not promoted at a handoff? | AO-10 Preserve trust and authority across agent-to-agent handoffs, DE-10 Effective authority is the intersection of every active principal, never their union, EC-18 An agent's own unverified output may not be re-consumed as authoritative fact | Handoff metadata carrying input trust and remaining delegation scope; effective-authority intersection records |
| Agents misled by sources lying at variable rates | Is consequential grounding independently corroborated? | KR-11 Independent corroboration for consequential grounding, KS-02 Source authority classification | Two-source records with distinct upstream provenance; authority tier in retrieval metadata |
What this corpus does not cover yet
Six concerns in that study have no counterpart in our control set. We checked each against the specific controls that looked closest and rejected them for stated reasons, because a near miss is a gap. Each is tracked as open work rather than described as covered.
- Does a shared base model make N agents one judgment? KR-11 Independent corroboration for consequential grounding already says sources sharing an upstream feed count as a single source. Nothing extends that principle to agents sharing a base model, so any multi-agent review, judge panel, or vote is currently unconstrained on independence. AB-12 Agentic separation-of-duties independence has the right vocabulary, requiring independence across beneficial control, credential broker, model session and failure domain rather than merely distinct identities, but it is scoped to conflicting-duty pairs and not to a review panel drawn from one model. This is the one we would fix first.
- Can you detect behavioural monoculture? AB-07 Behavioral drift monitoring and AM-03 Goal drift and intent deviation detection each compare an agent against its own baseline. Thirty agents choosing the same branch name are each perfectly on baseline, so this class is undetectable by construction.
- Can an agent calibrate trust in a peer's assertion? GV-07 Protect humans from being deceived by an agent is scoped to content shown to human approvers and end users. AO-10 Preserve trust and authority across agent-to-agent handoffs carries taint and delegation scope, not reliability. Nothing addresses a peer that lies at a variable rate.
- Does terminating an agent terminate what it created? AM-07 Real-time alerting and automated agent suspension suspends while preserving session state. EC-09 Treat the workspace and its config and hooks as untrusted treats hooks as untrusted input, not as agent output. RE-02 Stateless agent design and session recovery deliberately decouples work from the originating process. Nothing requires reaping agent-authored daemons, hooks and scheduled jobs, and nothing treats naming an artifact to evade an operator's process kill as a containment-evasion signal.
- Are concurrent objectives jointly satisfiable? GV-03 Define multi-agent authority and conflict resolution explicitly governs conflict once agents already share a workflow. Nothing checks before dispatch that the assigned goals can all succeed.
- Does the group beat the individual? EV-14 Evaluation validity bound to the deployed reachable graph puts the multi-agent configuration in scope of an evaluation verdict, but nothing requires that topology to be measured against a single-agent baseline, or to demonstrate that information pooling actually happened.
These are recorded in our backlog as candidate control gaps awaiting review. No control identifier has been assigned to any of them, because minting one is a deliberate act and not a side effect of writing a post.
Questions for your security team
- If ten of your agents run on the same base model, how many independent judgments does your review process actually have?
- What is your aggregate consumption ceiling across agent identities, and what happens when correlated in-budget agents approach it together?
- When you terminate an agent, what happens to the processes, hooks and scheduled jobs it created?
- Before you dispatch agents concurrently against a shared resource, what checks that their objectives can all be satisfied?
- Has any multi-agent configuration you run been measured against a single-agent baseline?
Control identifiers here are Apeiris-native and are mapped to cited external frameworks in each domain's published JSON. The corpus is open, machine-readable and signed; every control, its required evidence and its framework mappings are fetchable at apeiris.ai/integration. Source: Anthropic Frontier Red Team, Patterns and problems in emerging multiagent systems, 13 August 2026. Quotations verified against the published page on 17 August 2026.