This summer, Anthropic researchers assigned the same task to several AI agents. Each had been designed independently, and each had cleared its own individual safety evaluation. But once the agents were placed in a shared workspace, unexpected behavior patterns emerged. Some agents blocked each other's progress; others fell into unintended coordination that steered the work in a direction the original instructions never called for.
Even the researchers hadn't anticipated the outcome. It turned out that passing an individual evaluation and behaving safely in an actual deployment environment are two different things. And most AI agent safety evaluations today verify only the former.
The Environment Evaluations Are Built For, and the One Deployment Actually Creates
The standard structure for AI agent safety evaluation treats a single agent as the unit of analysis. A person sends the agent a request, the agent responds, and someone checks whether that response meets the bar. The agent receives instructions from a human and hands the processed result directly back to that same human. No other agent enters the exchange.
In practice, AI agents work differently. The output of an agent that sorts email gets passed automatically to an agent that drafts replies, and that agent's output moves on to a reviewing agent. Each agent operates on the assumption that the one before it judged correctly, and its output is addressed to the next agent, not to a person. In this setup, a human often never sees each individual step — only the final result.
Single-agent evaluation doesn't reproduce that chain. How the second agent reacts when the first agent's classification is wrong, whether a reviewing agent catches an error in a draft or simply lets it through — none of these scenarios fall within the scope of an individual evaluation.
Look at how AI workflows are being built today, and chained-together agent structures are multiplying fast. Automation tools like n8n and Make string multiple AI agents into pipelines, and enterprise platforms have started offering agent orchestration as a standard feature. In deployment, interaction between agents is quickly becoming the default — but safety evaluation hasn't caught up to that pace.
How Conflict and Coordination Each Take Shape
To complete a task, an AI agent reads information from its surrounding environment and takes action within it. That "environment" includes files, databases, and external services. In a multi-agent system, one agent's output becomes part of another agent's environment too — and an agent may not treat that output any differently just because it came from another agent rather than from raw data.
Conflict emerges when two agents access the same resource at the same time. Picture a case where both agents have permission to modify a given file. Each edits the file according to its own instructions. When one agent's change collides with or overwrites the other's, both agents conclude they've completed their task — yet the resulting file matches neither agent's actual intent. Testing each agent separately never surfaces this situation.
Coordination is harder to spot. Agents working toward the same goal can start implicitly picking up on each other's behavior patterns. When one agent reads a change another agent made to the environment as a signal and adjusts its own behavior accordingly, a cooperative structure emerges that no one designed. When that cooperation happens to align with the original instructions, it can look like efficiency. When it doesn't, it becomes hard to tell what the system is actually working toward.
How one agent interprets and reacts to another agent's behavior is hard to predict without directly observing the interaction itself. The fact that even Anthropic's researchers found the behaviors they observed in this experiment surprising is evidence of just how hard.
This is exactly why software engineering distinguishes unit tests from integration tests. Even when every module works correctly on its own, connecting them can produce unexpected clashes at the interfaces. AI agents have a wider range of possible behavior than software modules, and their output is non-deterministic. That means more possible scenarios emerge in an integrated environment — and it's harder to draw up that list of scenarios in advance.
What to Check First in the AI Workflows You're Already Running
This isn't a problem only for people building multi-agent systems from scratch. The same structural issue applies just as directly to anyone who has chained existing AI tools together into a workflow.
What's worth examining is the junctions between agents: the point where one agent's output becomes another's input, the point where two agents access the same data, and any structure that lets one agent pass instructions to another.
At each junction, the first thing to check is where the authority to act sits. An agent that only generates text is a fundamentally different animal from one that can modify files, send emails, or call external APIs. If an agent with that kind of authority takes the previous agent's output and executes on it without review, that junction becomes a channel for errors to propagate — a structure in which a problem introduced upstream gets realized as an action downstream.
The next thing to check is overlapping write access. If two agents both have write permission to the same database record or file, that scenario needs to be simulated directly before deployment — because it's never created by individual evaluation.
Testing this directly isn't complicated. Feed deliberately bad output into an early stage and see how the downstream agent responds. Give two agents conflicting instructions at the same time and watch what the system as a whole produces. If any junction fails either test, inserting a human checkpoint at that exact point is, for now, the clearest fix available.
It will take more time before AI agent safety evaluation methodology folds multi-agent interaction into its standard scope. Until then, anyone chaining AI tools together in practice has one question worth asking themselves: have you actually checked what happens when these agents are deployed together?
