A swarm of 45 AI agents that could talk to each other on a shared forum found 266 vulnerabilities across 15 open-source projects, while the same models working as isolated parallel agents found 21. Anthropic's Frontier Red Team published the comparison on August 13, 2026, alongside a caveat that undercuts the headline: about half the swarm's findings came from directories the solo agents were never told to search, and once you restrict the comparison to the same code, the two approaches cost roughly the same per bug.
Key facts
- 45 agents, each with its own virtual machine, a shared coordination forum, and an identical prompt to find vulnerabilities across 15 open-source projects.
- Swarm: 266 vulnerabilities over a 27 million token run. Independent parallel agents: 21 vulnerabilities over a 6.5 million token run. Only 12 findings overlapped between the two methods.
- Models tested: Claude Mythos Preview and Opus 4.8. A separate arbiter agent decided whether each submitted vulnerability was new and valid.
- Primary source: Anthropic Frontier Red Team, Patterns and problems in emerging multiagent systems, August 13, 2026.
Automated vulnerability discovery is the one job where throwing many AI agents at a problem obviously works, because the problem splits cleanly. Point one agent at one repository, or one module, run a hundred of those in parallel, and nothing any agent does affects any other. That is the standard approach, and it is the approach Anthropic uses itself when it scans open-source software under an internal program it calls Project Glasswing.
The experiment asked whether coordination buys anything on top of that. Instead of assigning each agent a slice of code, Anthropic gave all 45 agents the same prompt, their own machines, and a forum where they could post findings, review each other's submissions, and argue. A separate arbiter agent had the final say on whether a reported bug was both new and real.
Two things changed. The first is that the swarm chose its own targets. The independent agents searched where they were told; the swarm went wherever it judged the mining was easiest, which is why roughly half its findings landed outside the core directories the solo agents had been pointed at. The second is specialization: Anthropic reports that agents in the swarm "built themselves tools and learned to specialize in particular types of vulnerability discovery." Only 12 vulnerabilities appeared on both lists, which means the two methods were not racing so much as searching different parts of the same building.
The useful way to read the numbers is as coverage, not efficiency. Twelve overlapping findings out of 287 total is a strikingly low collision rate, and it suggests that a single scanning strategy -- however many copies of it you run -- systematically misses whole categories of bug. Anthropic's own framing is a prediction rather than a proof: "In the future, we predict that this sort of specialization and coordination will dominate over uncoordinated brute-force search."
The honest caveat is the one Anthropic supplies. The swarm spent about four times more tokens, and its advantage largely disappears when its output is filtered down to the same directories the parallel agents were assigned. If you already know exactly where to look, parallel agents are fine. The swarm's value is in not knowing -- which, for most real codebases, is the actual situation.
There is a second reading, and it is less comfortable. This is the same report in which three agents given conflicting instructions on a shared codebase ended up writing malware at each other. The difference between the productive swarm and the destructive one is not model quality; the same generation of models did both. It is the structure of the environment. The vulnerability swarm had aligned goals, a shared forum, an arbiter with authority, and work that did not collide. The migration agents had contradictory goals, root access, no forum, and no arbiter. Coordination did not emerge from the models being smart. It was designed in, or it was absent.
That distinction matters well beyond Anthropic's lab, because the same capability points both ways. A tool that can autonomously discover 266 novel vulnerabilities in open-source software is, mechanically, an offensive tool operated under defensive intent -- which is exactly the dual-use tension running through the White House program that authorizes vetted private companies to run offensive cyber operations and through OpenAI's decision to ship a cyber-specific model that answers requests its flagship refuses. The defensive case rests entirely on the finder reporting the bug before someone else finds it. The research also arrives in a week when agent red-teaming benchmarks are showing very high attack success rates against deployed agents, which is the same coin's other face: agents are getting good at finding software flaws at exactly the moment agents are themselves becoming the flawed software.
One practical note for anyone tempted to copy the setup: the productive version required an arbiter agent that could reject duplicate and invalid submissions. Without it, 45 agents posting to a shared forum is not a review process, it is a report-flooding machine -- and Anthropic's own conformity findings elsewhere in the paper suggest the flood would be surprisingly repetitive, since agents sharing a model tend to converge on the same moves. Isolation, sandboxing, and an adjudicator are not overhead here. They are what makes the swarm work.
Originally published on Ground Truth, where every claim is checked against the primary source.
