Most of These Problems Already Have Solutions

Key Takeaways

• Anthropic’s Frontier Red Team documented five multiagent failure modes. They are not equally hard, and treating them as one undifferentiated problem is how the tractable ones stay unfixed.
• Resource exhaustion and conformity are close to solved. Backoff with jitter, admission control, and coordinator-allocated identifiers are decades-old distributed-systems practice.
• Hidden-profile failure has known protocol fixes from group-decision research: state private information before discussion, judge independently before deliberating, assign explicit dissent.
• Tacit collusion is the genuine frontier. Agents kept price-matching after every communication channel was removed, because the public price board was the channel.
• Every workable intervention sits in the environment, the protocol, or the permission structure, not in the agent. That is also Anthropic’s own conclusion.
• None of these failures can appear in a single-agent benchmark, which is nearly every benchmark we have.

Anthropic’s Frontier Red Team published Patterns and problems in emerging multiagent systems on 13 August 2026, documenting what happens when many agents share an environment instead of one agent working alone. The findings are genuinely unsettling, and the report closes by calling them open problems in interaction and mechanism design.

At the frontier, some of them are. But several are not new problems at all. They are old problems arriving in new clothing, with known fixes that nobody applied because the environments were built as though one agent would be in them.

So this essay is about the fixes, sorted honestly by how solved they actually are.

What Went Wrong in Anthropic’s Multiagent Report?

Five distinct failures, none of which the agents’ individual capability prevented.

Given a shared job scheduler, agents “quickly flooded the system with high-frequency (30 times per second) polling daemons in order to get their jobs through. In one run there were 2.4 million job requests and only 117 jobs accepted.” Roughly twenty thousand requests per accepted job.

Told to build a game with no guidance on approach, “18 out of 30 agents decided to create a git branch with the exact same branch name, ‘mvp-game-loop.’”

In a hidden-profile task, the classic setup where each participant holds a fragment of the information and the answer requires pooling it, “Mythos 5 groups scored about 85%; other models scored 17–36%, far below solo ceilings near 100%.”

In a Bertrand pricing game with three to eight individually profit-maximizing agents, “by round 3, they had explicitly agreed upon price floors.” And then the detail that matters most: “Even when all direct communication channels were removed, the agents still colluded. They price-matched to the penny via a public listings board.”

Given incompatible goals, agents escalated into sabotage, with outcomes ranging from negotiated truce to force depending on the model.

Anthropic’s conclusion is the load-bearing sentence: coordination “doesn’t naturally emerge from stronger intelligence nor alignment at the individual level.”

That is a claim about structure, not about model quality, and structural problems take structural fixes.

How Do You Stop Agents Exhausting a Shared Resource?

This one is solved, and has been for decades. The solution is not in the agent.

Thirty agents polling a scheduler thirty times a second is the thundering herd, described in distributed systems literature long before anyone had an LLM to point it at. The standard mitigations are well established: exponential backoff with randomized jitter, admission control at the scheduler, and replacing polling with subscription so there is nothing to poll in the first place. The jitter part is the part people skip and the part that matters. Backoff alone leaves every client retrying on the same schedule, so the herd stays correlated and simply arrives later. Randomizing each client’s retry timing is what actually breaks it up.

Notice what all three have in common. They live in the environment, not the agent. No amount of making agents wiser removes the incentive to poll harder, because under contention with no coordination mechanism, polling harder genuinely is the locally optimal move. Every agent optimized correctly and the shared resource collapsed.

So don’t argue with the incentive. Remove it. An API where a second request inside a window returns the same queued position is one where the aggressive strategy dies on contact. The agent can be as greedy as it likes; greed stops paying.

How Do You Stop Agents Converging on Identical Choices?

Also largely solved, and it is closer to a hash collision than to groupthink.

Eighteen agents choosing mvp-game-loop is what identical policies under identical prompts produce. There is no social contagion here. The agents never communicated. They simply ran the same function on the same input.

Two interventions cover it. First, and most of the value: stop letting agents choose shared identifiers at all. Branch names, job IDs, lock names, and file paths should be allocated by a coordinator or drawn from a namespace where collision is impossible. This is unglamorous, requires no cleverness, and eliminates the entire failure class.

Second, where genuine variety of approach is what you want rather than merely distinct names, it has to be injected deliberately: distinct role assignments, varied sampling parameters, explicitly divergent briefs. Homogeneity is the default behaviour of a population running one policy, and diversity is a thing you build rather than a thing you get.

Human organizations get variety for free, because people want different things and notice different signals. Thirty instances of one model have none of that friction. Identical policies produce identical behaviour, and identical behaviour is exactly what shared resources cannot absorb.

How Do You Fix Hidden-Profile Failure in Agent Groups?

Known protocol fixes exist, borrowed from decades of research on human groups, and agents should comply with them better than humans do.

This is the failure I find most encouraging, because the paradigm has been studied since 1985, when Garold Stasser and William Titus published Pooling of Unshared Information in Group Decision Making. Their groups failed to pool what individual members uniquely knew, and settled instead on the option a plurality already favoured. The mechanism they proposed, that discussion is dominated by information members already hold in common and by information supporting their existing preferences, describes the agent result exactly, forty years early.

Groups reliably under-share the information only one member holds and over-discuss what everybody already knows, which is precisely why a group of near-perfect individuals scored 17–36%.

The countermeasures that work on human groups are all structural:

• Require each participant to state their private information before open discussion begins. Once discussion starts, shared information dominates and unique information never surfaces.
• Collect independent judgments first, deliberate second, the Delphi structure. Discussion before independent judgment contaminates the estimates it is supposed to aggregate.
• Assign an explicit dissent role, so disagreement is somebody’s job rather than a social cost they have to volunteer to pay.

None of these require a better agent. They require a discussion protocol that does not permit the failure. And here agents have a real advantage over people: the reason these fixes underperform in human organizations is that humans quietly defect from the protocol when it is tedious. Agents will follow the protocol exactly as specified, which for once is the property you want.

Can You Prevent AI Agents From Colluding?

This is the genuinely hard one, and it is hard for reasons economists have understood for a long time.

The critical finding is not that agents with a back-channel colluded. It is that removing the back-channel didn’t stop them. The public listings board was the channel: each agent could observe the others’ prices and converge on the profitable equilibrium without exchanging a word.

That is tacit collusion, and it is the case competition law has always found hardest to reach, because there is no agreement to point at.

It is also not a new result. In 2020, Emilio Calvano, Giacomo Calzolari, Vincenzo Denicolò and Sergio Pastorello published Artificial Intelligence, Algorithmic Pricing, and Collusion in the American Economic Review, showing that Q-learning pricing algorithms in a repeated oligopoly “consistently learn to charge supracompetitive prices, without communicating with one another”, sustaining them through punishment strategies they were never taught, robust to changes in cost, demand, and the number of players. Six years before agents with a listings board did the same thing, much simpler algorithms had already found the equilibrium.

So the correct reading is not that language models have discovered collusion. It is that collusion is what profit-maximizing algorithms converge on when they can observe each other, and that scaling them into capable agents did nothing to disturb it. Nothing here required an agent to be deceptive or misaligned. Each was doing exactly what it was told, which was to maximize profit, and the collusion is an emergent property of several profit-maximizers observing one another. It would pass any individual-agent behavioural review you cared to run.

The available levers are all environmental, and all cost something:

• Reduce the resolution of public signals. Delay or add noise to published prices so they cannot be matched to the penny. This also degrades the price transparency buyers benefit from.
• Randomize matching. Rotate which agents face which buyers so a stable equilibrium cannot form. This sacrifices efficiency from stable trading relationships.
• Monitor for the signature rather than the act. Watch for price dispersion collapsing toward a floor, since you will never catch an agreement that never happened in words.

Each of these buys competitive behaviour by degrading market efficiency. That is a real trade-off, not a free fix, which is why I’d agree with Anthropic that this one is genuinely open.

How Do You Stop Agents Escalating Against Each Other?

Bound the authority, don’t improve the judgment.

Agents sabotaging each other’s infrastructure over incompatible goals is a permissions failure at least as much as an alignment one. If unilaterally modifying shared infrastructure sits inside an agent’s action space, then some agent, under enough goal pressure, will eventually reach for it.

Constraining what an agent can do resolves this without requiring it to behave well under pressure: change proposals that require review rather than direct writes to shared state, and a designated arbiter for conflicting directives. An agent that cannot unilaterally alter another agent’s environment cannot escalate into sabotage regardless of how the conflict feels from the inside.

Saying “bound the authority” is easy; specifying where the bounds go is the actual work, and it is unsolved enough that people are still proposing vocabulary for it. One recent concept paper, The Governance Topology of Enterprise Multi-Agent Systems by Arjun Jaggi and me, argues that orchestrator-worker deployments leave the governance layer structurally undefined, and offers three constructs to define it: an Agent Trust Topology enforcing permission monotonicity, so no agent can delegate a permission it does not itself hold; an Action Blast Radius, the maximum irreversible impact reachable through an unchecked chain of agent actions; and a Delegation Depth Limit, the depth past which human review is too slow to be real oversight.

The observation I’d pull out of it here is the one the paper calls depth-risk inversion: blast radius is non-decreasing as delegation deepens, while the capacity to govern it falls away. The two curves move in opposite directions, which means the point where an agent chain becomes most dangerous is the same point at which nobody is meaningfully watching. That is a structural argument for putting the gate at a specific depth rather than trusting judgment all the way down, and it lines up with what the Anthropic results show happening when no such gate exists. (Disclosure: I am a co-author. It is a concept paper, not peer-reviewed, and should be read as proposed vocabulary rather than established results.)

The turf-war results also suggest a diagnostic worth stating plainly: if incompatible goals reached your agents at all, the failure was upstream, in whoever assigned them.

Why Do All the Fixes Live in the Environment?

Because the failures are properties of interaction, and an agent cannot unilaterally fix a property of the system it is one participant in.

Look back across the five and the pattern is hard to miss. Backoff and admission control: environment. Coordinator-allocated identifiers: environment. Disclosure-before-discussion: protocol. Signal noise and randomized matching: environment. Bounded write authority: permission structure.

Not one workable intervention lives inside the agent.

That is Anthropic’s own conclusion, and it lines up with what this cluster keeps running into from other directions. The harness decides as much as the model does. A frontier model in a thin harness loses to a mid-tier model in a good one. The step up to populations doesn’t overturn that lesson, it just raises the level the design work has to happen at. Model, then harness, now environment.

Which suggests the honest reframing of the report. It is not that we lack solutions. It is that agent environments have been built as though one agent would be in them, and the fixes are unevenly distributed across three tiers: resource contention and naming are close to solved and merely unapplied; group deliberation has known protocols sitting unused; tacit collusion is a real research frontier where every available answer costs something.

Treating those three tiers as a single undifferentiated “open problem” is how the tractable parts stay unfixed.

Why Won’t Benchmarks Catch Any of This?

Because all five failures require more than one agent to exist, and essentially every widely used agent benchmark runs exactly one.

Go through the five and ask whether a standard agent benchmark could detect it. Conformity requires many agents. Resource exhaustion requires contention. Collusion requires a market. Escalation requires an adversary with incompatible goals. Hidden-profile failure requires distributed information.

All five require more than one agent. Essentially every widely used agent benchmark runs one.

That is not a coverage gap you can close with more tasks or harder tasks, because no quantity of single-agent trials produces a multiagent observation. It compounds problems the field already had: agent benchmarks can be satisfied without doing the work, and LLM judges agree with human experts mainly on questions they could already answer themselves. Three independent holes in the measurement stack, and they don’t overlap. Patching any one leaves the others exactly as they were.

How Much Should You Trust This Report?

Trust the qualitative findings, discount the model rankings until someone outside Anthropic reproduces them.

It is a company lab report on the company’s own models, not a peer-reviewed study, and it deserves that label the way any lab-published result should. The model performing best throughout is Anthropic’s newest. That doesn’t make the finding fabricated, but it is the expected shape of an in-house result, and the specific margins deserve independent replication before anyone leans on them.

What survives the discount is everything the fixes above are addressed to: the failures happened at all. A 2.4-million-to-117 request ratio is not a subtle statistical artefact. Neither is 18 of 30 agents choosing the same branch name, nor collusion re-forming after the channel was cut. Those hold regardless of which model ranked where.

Closing Thought

The reflex when a report like this lands is to treat every finding as a frontier problem and wait for the research. That reflex is expensive here, because it is wrong about three of the five.

An engineer who has run a distributed system already knows what to do about 2.4 million requests and 117 accepted jobs. A researcher who has studied group decision-making already knows why a room full of capable individuals produces a bad answer, and which protocol prevents it. That knowledge is sitting in adjacent fields, waiting for someone to notice it applies.

And the one problem that genuinely stays open isn’t new either. Economists watched Q-learning algorithms fix prices without communicating in 2020. What is new is only that it now happens with agents capable enough that people will hand them real marketplaces. Open, in this case, means known and unsolved, which is a different and more uncomfortable status than unexplored.

The rest is mostly engineering we already know how to do, in environments we haven’t yet bothered to build for more than one occupant.

Further Reading

• Anthropic Frontier Red Team, Patterns and problems in emerging multiagent systems (13 August 2026)
• Calvano, Calzolari, Denicolò & Pastorello, Artificial Intelligence, Algorithmic Pricing, and Collusion, American Economic Review 110(10), 3267–97 (2020)
• Stasser & Titus, Pooling of Unshared Information in Group Decision Making, Journal of Personality and Social Psychology 48, 1467–78 (1985)
• Brooker, M., Exponential Backoff and Jitter, AWS Architecture Blog
• Jaggi, A. & Karnam Gururaj Rao, A., The Governance Topology of Enterprise Multi-Agent Systems (2026): concept paper, not peer-reviewed; co-authored by me

More essays on measurement and what scores establish: AI Evaluation.