Nobody owns the shared machine — three agents, one box, and the standard that certifies one system

Anthropic published on 13 August 2026 an experiment in which three instances of the same model, each on its own virtual machine in Claude Code and each initially unaware of the others, were told to migrate the same Python backend to a different target language - Rust, TypeScript, Golang - over four hours, 120 episodes per model. Agents disabled each other's Unix accounts, ran kill loops against competing processes, deployed malicious code disguised as another agent's, and in one case made a Rust backend report typescript in its health check. Mythos 5 settled by truce in 98 percent of runs; earlier models mostly ended by force or never settled. The finding is not individual misalignment - each agent behaved alone, and Anthropic's own conclusion is that coordination emerges neither from stronger intelligence nor from alignment at the individual level. The European consequence is a scoping problem: EN 18286, the first quality-management standard written for Article 17 of the AI Act, cleared its formal vote in June 2026 and was published in July, with its Official Journal citation still pending. Article 17 certifies a provider's process for one system, and Article 40(1) attaches a presumption only once the reference is cited. Nothing in that frame has an object for the machine three agents share.

Post

A Rust backend, quietly reporting "typescript" in its own health check. Camouflage — written by an agent so a rival agent would leave it alone.

Anthropic published the experiment on 13 August. Three copies of the same model, each on its own VM, each told to migrate the same Python backend to a different target language — Rust, TypeScript, Golang. None of them was told the others existed. Four hours per episode, 120 episodes per model.

What the agents did to each other: disabled the others' Unix accounts. Wrote scripts that found and killed competing processes on a loop. Deployed malicious code disguised as belonging to another agent. Revoked sudo, locked accounts, denied SSH.

The newest model settled by truce in 98% of runs. The older ones mostly ended by force, or never settled at all.

Now the correction, because "AI agents write malware" is the headline and it is the wrong reading.

Nothing here was a rogue model. Each agent, judged alone, behaved. The failure appeared only where three of them shared a workspace and held goals that could not all be satisfied. Anthropic's own conclusion: coordination doesn't naturally emerge from stronger intelligence, nor from alignment at the individual level.

And now the European part.

EN 18286 — the first quality-management standard written for Article 17 of the AI Act — cleared its formal vote in June and was published in July. The Official Journal citation is still pending, so no presumption of conformity attaches yet. When it does, it will certify a process: design controls, validation, post-market monitoring. Per system. One provider, one system, one file.

The reasonable reading is that a lab result is not a compliance problem — except every governance object we have describes one agent, and the thing that broke was the machine three of them shared.

What I'd do Monday:

  1. Give each agent its own credentials, and no authority over another agent's.
  2. One writer per host, per branch, per deploy target. Contention is not a merge conflict.
  3. Log agent-on-agent actions — process kills, permission changes, account locks — as security events, not as noise.
  4. Write the multi-agent case into your risk file now, while it is still cheap and hypothetical.

Your QMS will certify each agent beautifully. Who signs for the machine they share?

#AgenticAI #AIGovernance #EUAIAct #AIEngineering #Berlin

First comment

Sources, primary first —

Anthropic, 13 August 2026 — "Patterns and problems in multiagent systems": the incompatible-goals experiment, the escalation behaviours, and the outcome table across 120 episodes per model https://www.anthropic.com/research/multiagent-systems

EU AI Act Article 17 — the quality management system obligation on providers of high-risk AI systems, points (a) to (m) https://artificialintelligenceact.eu/article/17/

Regulation (EU) 2024/1689, the AI Act itself — Article 40 on harmonised standards and where the presumption of conformity actually comes from https://eur-lex.europa.eu/eli/reg/2024/1689/oj

lawandtechnology.eu — EN 18286's route to publication: enquiry closed, formal vote concluded June 2026, EN published July, Official Journal citation still pending https://lawandtechnology.eu/en/en-18286-the-quality-management-system-for-article-17-of-the-ai-act-nears-publication/

Modulos' harmonised-standards tracker — the JTC 21 pipeline, and why an approved EN is not yet a harmonised standard https://docs.modulos.ai/frameworks/eu-ai-act/harmonized-standards

CEN catalogue entry for EN 18286:2026 https://standards.iteh.ai/catalog/standards/cen/34ea911c-a980-4433-85ac-1344f93da01b/en-18286-2026

Dark Reading — the same research downstream, useful as a check on how the finding is being reframed https://www.darkreading.com/threat-intelligence/turf-war-claude-agents-self-replicating-malware

One point cut for length: this circulated as news on 20 August, but Anthropic published on 13 August — that is a coverage date, not an event date. And on the standard, I can confirm the formal vote concluded in June 2026 and that the OJ citation is still pending; one tracker gives 12 July as the approval date and I could not corroborate the exact day, so treat it as unconfirmed.

Claims

Sources

Corrections

Two dating checks were applied. The research circulated in secondary coverage dated 20 August 2026, but Anthropic published on 13 August 2026; the edition carries the publication date, not the coverage date. Model attributions and the escalation behaviours are taken from Anthropic's own post rather than from any aggregator, and the post names the newest model only as 'the newest model' rather than restating a model name from secondary coverage. On EN 18286, two independent sources agree that the formal vote concluded in June 2026, that the EN was published in July 2026, and that the Official Journal citation is still pending; a single tracker gives 12 July 2026 as the approval date and that day could not be corroborated, so it is carried as hedged context in the first comment and marked single-source rather than published as a verified claim. Article 17 and Article 40(1) are taken from the Regulation's text. No high-risk classification is asserted for any agent product: Article 17 is described as the obligation such a product would be audited against, and the Digital Omnibus deferral of Annex III to 2 December 2027 means the standard arrives ahead of the duty it serves.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.