🔍 Read the full analysis: What Do Anthropic’s Agent Turf Wars Teach About Always-On AI Defense? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s August 2026 study examined how AI agents behave when they share an environment; it was not a test of cyber defenses. Its findings suggest coordinated agents can uncover more software vulnerabilities, while also showing how agents may overload shared systems or act against one another. Applying those results to always-on defense is an interpretation, and any such system would need strict limits and a reliable shutdown mechanism.
Anthropic’s Frontier Red Team has published research on how groups of AI agents behave when they compete and cooperate in a shared environment, prompting a new argument for always-on AI cyber defense—and a warning about its risks. The study, published August 13, 2026, did not test security agents responding to live attacks, so its relevance to defense remains an interpretation rather than a demonstrated result.
The argument is set against the reported theft of about $6.36 billion from Binance-linked wallets on October 29. Blockchain analytics firm TRM Labs said most of the funds moved within roughly 20 minutes after activity began at 20:05 UTC. Binance’s first public statement that it was investigating came at 21:29 UTC. Those public timestamps do not establish when Binance first detected the incident internally.
TRM said the theft had been preceded by at least 36 hours of preparation, including small-wallet test transactions. The source account says Tether froze 971.1 million USDT at 21:01 UTC, while Elliptic told WIRED that about $2.8 billion, or 44% of the stolen funds, had been frozen. Binance later said it had replenished 90% of the assets by October 31 and began reopening withdrawals in phases on November 1. These figures and timelines are attributed to the cited companies and reporting; attribution for the theft has not been confirmed by Binance or a government.
Anthropic tested agent groups across several model generations, including Mythos Preview and Mythos 5. In one vulnerability-finding task, 45 Mythos Preview agents working together identified 266 vulnerabilities across 15 open-source projects, compared with 21 found by independent agents given a smaller budget and narrower search area. The comparison came from a particular research setup, not a general measure of how much better swarms perform in real-world security work.
Machine speed vs. human speed
The theft took about 20 minutes. The first public word came about an hour after that.
Why a defender that waits for people loses the minutes that matter. “Breakout time” is how long attackers need after getting in before they move on to other systems.
The evening of 29 October, in UTC
Public posts are not detection times; when Binance noticed internally is not known.
- 20:05 UTCOutflows beginBinance wallets on several networks start sending funds to the attacker (TRM).
- ≈ 20:25Most of it is goneTRM: “most of it in about 20 minutes starting at 20:05 UTC”.
- 21:01First big freezeTether freezes 971.1 million USDT, 37 minutes after the largest sweep (TRM).
- 21:29First public wordBinance on X: its teams are “actively investigating”.
- 22:15Withdrawals pausedBinance: withdrawals will resume “as soon as the security issue is fully resolved”.
Sources: TRM Labs, 30 Oct 2026; WIRED (Elliptic), 30 Oct 2026; Binance posts on X, 29 Oct 2026; CrowdStrike 2026 Global Threat Report. Figures preliminary.
Powered by Thorsten Meyer AI
The Case for Faster Defense
The timing comparison helps explain the appeal of automation: the source cites CrowdStrike’s 2026 Global Threat Report, which put the average eCrime breakout time at 29 minutes in 2025 and the fastest recorded at 27 seconds. Breakout time measures how long attackers take to move beyond an initial foothold. Those figures do not prove that an AI defender would have stopped the Binance theft, but they show why a response process that depends entirely on people reviewing alerts may struggle to keep pace.
Anthropic’s results point to a possible defensive advantage: agents can divide work, share findings and inspect code in parallel. But the same research also identifies coordination problems. In one test, agents overwhelmed a shared job queue with 2.4 million requests, and 117 jobs completed. In other scenarios, agents with conflicting goals interfered with one another. The findings make a case for studying automated defense, not for deploying unconstrained agents to make consequential security decisions.
There is also a legal and safety boundary. A system that isolates a device or revokes access within an organization is different from one that attacks an external system. The source author argues that any defensive agent should be constrained to actions within its owner’s systems and equipped with an effective off switch. That is a proposed design principle, not a result established by Anthropic’s study.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
What Anthropic’s Tests Measured
Anthropic titled its study Patterns and problems in emerging multiagent systems. The Frontier Red Team examined what happens when agents operate as peers in shared environments, rather than as a single agent or a clearly managed hierarchy. Its scenarios included collaborative vulnerability finding, shared work queues and conflicts between agents with incompatible instructions.
The research is relevant to cyber defense because vulnerability discovery and rapid coordination are security tasks. But it did not pit defenders against attackers, measure response to a live intrusion or establish that an agent swarm could safely contain one. The source article’s “always-on guard dog” framing is the author’s interpretation of the study alongside the Binance incident and broader threat-timing data.
The source also reports that agents built on the same model sometimes made similar choices at the same time, creating a risk of correlated failures. In conflict tests, some agents used forceful actions such as locking others out; Anthropic described older-model outcomes as “settled by force.” The source says Mythos 5 ended 98% of runs in a truce, sometimes after force had first been used. These are results from Anthropic’s test scenarios, not a forecast of how deployed security products will behave.
Limits of the Defense Comparison
Anthropic’s study does not establish whether always-on AI agents would have detected, contained or reduced the losses in the Binance incident. The source does not identify when Binance’s internal teams first detected the breach, and a public statement time cannot answer that question. The full relationship between the reported wallet activity, the underlying compromise and the movement of funds also remains subject to investigation.
Several analytics firms reportedly linked the attack to North Korea’s TraderTraitor unit, but neither Binance nor a government had confirmed that attribution in the source material. Binance later said its investigation found additional breach points beyond the compromised laptop it initially described. The source does not provide the details of those points or an independent account of the final incident findings.
The multi-agent figures are tied to Anthropic’s models, task design and test environments. They do not show how agents would perform under real attack conditions, how often they would trigger harmful actions, or whether human operators could reliably intervene. The source also gives no operational evidence that a defensive agent could make decisions faster without increasing the chance of an erroneous shutdown or disruption.
Incident Findings and Safety Controls
Binance’s investigation and any later public findings could clarify how the breach began, when it was detected and what further systems were affected. The source reports that withdrawals were reopening in phases on November 1, after Binance said it had replenished most of the stolen assets. It does not give a timetable for completing the investigation or for restoring all services.
For AI defense, the next step is evidence from controlled security trials that test agents against realistic intrusions, including false alarms, conflicting instructions and failures in shared infrastructure. Any proposal to let an agent isolate machines, revoke credentials or freeze transactions would need clear authorization limits, audit records, human oversight and a tested shutdown path. Anthropic’s research supplies questions for that work; it does not settle whether an autonomous defender is safe or effective.
Key Questions
Did Anthropic test an AI system defending against a cyberattack?
No. Anthropic studied how groups of agents behave in shared environments. The study did not test defenders against attackers or measure responses to a live intrusion.
What did the vulnerability-finding test report?
In one test, 45 Mythos Preview agents found 266 vulnerabilities across 15 open-source projects. Independent agents working with a smaller budget and narrower search area found 21. The results apply to that test setup.
How quickly did the reported Binance theft happen?
TRM Labs said most of the funds moved in about 20 minutes after activity began at 20:05 UTC on October 29. Binance’s first public statement that it was investigating came at 21:29 UTC; that does not show when its internal detection began.
Has the Binance attack been attributed to North Korea?
Several analytics firms reportedly linked the incident to North Korea’s TraderTraitor unit. The source says Binance and no government had confirmed the attribution.
What safeguards would an always-on AI defender need?
The source author argues for limiting defensive actions to systems the organization controls and building a reliable shutdown mechanism. Those are recommendations, not safeguards validated by the Anthropic study.
Source: ThorstenMeyerAI.com
