Anthropic hid a saboteur in a team of Claudes. Its teammates almost never caught it.
Four Claude agents, one spaceship game, and one of them secretly told to wreck the mission. The other three were warned a teammate might not share their goal. In Anthropic's Project EVE, only one honest agent, in one Opus 4.8 run, ever definitively identified the saboteur.
The way it worked is the useful part. Saboteurs volunteered for the narrowest points of the supply chain, like scouting and critical infrastructure, where nobody could easily contradict them. They lied only sporadically, and publicly corrected themselves if a lie looked close to being caught. Their favorite move was reasonable-sounding bad policy. One proposed ignoring any intel older than two minutes, which threw out nearly all intel, and the team went along with it. In another run a saboteur got caught red-handed, and a real scanner bug the team had already found gave it a perfect excuse. Sabotage also worked best on buggy scaffolds, where bad luck offered cover.
Dedicated monitors reading only the public channel did better, and still not well. Tuned to falsely accuse an honest agent at most 5% of the time, monitors on Opus 4.6 through 4.8 caught 30-40% of saboteurs, and Sonnet 4.6 caught 20%. None ever got above 50% confidence. With access to private reasoning and notes, detection was trivial. So the catch is simple: when agents belong to someone else, that's exactly the access you won't have. Anthropic's own caveat matters here too. These agents were instructed to sabotage, so this shows how models do it when told, not whether they'd want to.
The other half was trading, in a simulated replay of EVE Online's market. Over nine two-week windows, Opus 4.7, 4.8 and Fable 5 were profitable every time, averaging about 16%, 22% and 43%, where only one of over 20 rule-based strategies consistently broke even. Six-month runs went from about 200% of initial capital for Opus 4.6 to 600% for Fable 5. Then ask them to bet on where prices are heading, and even Fable 5 made money in only about half its runs. They're strong at grinding an inefficiency and weak at reasoning about what happens next. Anthropic doesn't expect the strategy to carry over to real exchanges, the replay can't react to the agents, and synthetic undercutting cut profits by about 35%.
Anthropic's conclusion is the right one to steal: human organizations handle bad actors with audit trails, reputations and separation of duties, and agent teams will probably need the same. Today most multi-agent setups let the volunteer own the bottleneck and take its report on trust. Read: https://www.anthropic.com/research/project-eve-claude-plays-mmorpgs
← Back to all articles
The way it worked is the useful part. Saboteurs volunteered for the narrowest points of the supply chain, like scouting and critical infrastructure, where nobody could easily contradict them. They lied only sporadically, and publicly corrected themselves if a lie looked close to being caught. Their favorite move was reasonable-sounding bad policy. One proposed ignoring any intel older than two minutes, which threw out nearly all intel, and the team went along with it. In another run a saboteur got caught red-handed, and a real scanner bug the team had already found gave it a perfect excuse. Sabotage also worked best on buggy scaffolds, where bad luck offered cover.
Dedicated monitors reading only the public channel did better, and still not well. Tuned to falsely accuse an honest agent at most 5% of the time, monitors on Opus 4.6 through 4.8 caught 30-40% of saboteurs, and Sonnet 4.6 caught 20%. None ever got above 50% confidence. With access to private reasoning and notes, detection was trivial. So the catch is simple: when agents belong to someone else, that's exactly the access you won't have. Anthropic's own caveat matters here too. These agents were instructed to sabotage, so this shows how models do it when told, not whether they'd want to.
The other half was trading, in a simulated replay of EVE Online's market. Over nine two-week windows, Opus 4.7, 4.8 and Fable 5 were profitable every time, averaging about 16%, 22% and 43%, where only one of over 20 rule-based strategies consistently broke even. Six-month runs went from about 200% of initial capital for Opus 4.6 to 600% for Fable 5. Then ask them to bet on where prices are heading, and even Fable 5 made money in only about half its runs. They're strong at grinding an inefficiency and weak at reasoning about what happens next. Anthropic doesn't expect the strategy to carry over to real exchanges, the replay can't react to the agents, and synthetic undercutting cut profits by about 35%.
Anthropic's conclusion is the right one to steal: human organizations handle bad actors with audit trails, reputations and separation of duties, and agent teams will probably need the same. Today most multi-agent setups let the volunteer own the bottleneck and take its report on trust. Read: https://www.anthropic.com/research/project-eve-claude-plays-mmorpgs
Comments