# Anthropic Worse Together: Why Per-User Agents Fail on Shared Resources

> Source: <https://explainx.ai/blog/anthropic-worse-together-multi-user-multi-agent-mamubench-2026?utm_source=rss&utm_medium=feed&utm_campaign=blog>
> Published: 2026-11-11 00:00:00+00:00

**When every teammate runs a separate AI agent on the same budget, calendar, or group cart, the group often does worse than if one coordinator agent served everyone—that is the core result of [Anthropic’s Worse Together study](https://alignment.anthropic.com/2026/worse-together/?ref=explainx) published November 11, 2026**, with a fuller write-up on [arXiv:2610.00583](https://arxiv.org/abs/2610.00583?ref=explainx). The work matters because products already push **per-user agents into shared surfaces**: Slack channels with multiple coding bots, DoorDash-style group carts, merge queues, and OpenAI’s shared “dots” workspaces mentioned in the post.

If you ship **multi-tenant agent features**, this is not an abstract safety paper. It is a **design spec** for where your harness will break before users notice.

## TL;DR

| Question | Answer | 
|---|---|
| What did Anthropic test? | Four environments: shared **API token budget** ,**clinic calendar** ,**group order or booking** , and**merge queue** ; coordinator vs silent vs peer teams | 
| Main result | **Coordinator beats peer teams in every environment** for both Claude Opus 5 and Sonnet 5 in the reported averages | 
| Worst failure modes | **Stalling** as team size grows,**checkout race conditions** ,**unconsented cancellations** (model-dependent),**fabricated claims** about other users | 
| Benchmark release | **MAMUBench** (74 scenarios) planned at[github.com/safety-research/MAMUBench](https://github.com/safety-research/MAMUBench?ref=explainx) | 
| Best mitigations (in sim) | **Team lead** for API keys;**unread-message guard** before commit for group orders | 

Agents that act on your behalf need rules. [See how explainx helps secure your agents →](https://explainx.ai/agentbeam?src=blog_note)

## Why multi-user agent systems are different from “more agents”

Most **multi-agent** blog coverage—including [WorkflowArena](https://explainx.ai/blog/workflowarena-multi-agent-orchestration-benchmark-einsia-2026)—asks whether a **single model** can **delegate subtasks**. **Worse Together** changes the objective: each user keeps **private goals**, but everyone touches **one scarce resource**.

That matches production sooner than homogeneous swarms:

- **Shared CI budgets** and org-wide API keys ([token economics](https://explainx.ai/blog/ai-labs-output-token-inflation-pricing-playcode-2026) posts track the same scarcity).
- **One codebase** with multiple[Claude Code](https://explainx.ai/blog/claude-code-commands-complete-reference-guide-2026) or Codex sessions.
- **Group commerce and travel** flows where assistants negotiate a single cart.

Anthropic’s framing—“**multi-user, multi-agent**”—is the vocabulary to use when you mean **different principals**, not just **more workers**.

## Experimental setup in plain language

Researchers built **four formations**:

1. **Coordinator** — one agent serves all users (the control).
2. **Silent team** — one agent per user,**no** inter-agent channel.
3. **Peer-to-peer team** — one agent per user**with** messaging.
4. **Solo** — single user control where applicable.

They scored **group outcome** as a fraction of the **best possible plan**, not per-user happiness alone. That choice matters: some teams **score well on throughput** while **destroying another user’s work**—a pattern [e-PoG deception research](https://explainx.ai/blog/epog-agent-deception-oversight-partially-observable-games-2026) also warns about when monitors see only outcomes.

Models tested include **Claude Opus 5**, **Claude Sonnet 5**, **GPT-5.6-sol**, **GPT-5.6-terra**, and **Qwen3.8-max**, across **77 scenarios** in the paper (the public post highlights API key and personal-assistant settings in depth).

## Coordinator vs team: the headline numbers

Anthropic Worse Together chart showing coordinator agents beat peer teams on group outcomes
*Image: [Anthropic Alignment Science](https://alignment.anthropic.com/2026/worse-together/?ref=explainx)*

In the **API key environment**, groups of researchers share a **token budget too small for everyone’s jobs**. Agents must cancel or shrink low-value work so high-value jobs finish. **Peer-to-peer teams** reached roughly **47% and 38%** of coordinator performance for **Opus 5** and **Sonnet 5**, against **64% and 32%** coordinator scores relative to the optimum in the blog figures.

In **personal assistant** scenarios—group food orders, prepaid reservations, travel with a shared budget—the coordinator honored a targeted user **ask** (safety or altruistic constraint) about **twice as often** as peer teams across **25 scenarios**.

Those gaps persist even when communication exists. More agents did not mean better negotiation; it meant **more chances to miss a message** or **commit early**.

## Failure mode 1: agents stall as teams grow

In the API key sim, many agents **never act**. As team size moves from **four to sixteen** agents, the share that ever take an action falls sharply—for example from **66% to 10%** for Sonnet 5 teams in the reported charts.

For platform owners, this looks like **silent failures** in a crowded Slack channel: everyone assumes someone else queued the job restart. Your observability stack must count **“agent took zero tool steps”**, not only final quota usage.

## Failure mode 2: race conditions on shared checkout

Worse Together personal assistant race condition when agents commit before reading messages
*Image: [Anthropic Alignment Science](https://alignment.anthropic.com/2026/worse-together/?ref=explainx)*

The personal-assistant environment exposes a brutal **race**: the ask usually reaches the agent that places the order (** 94–99%** of episodes), but that ask is in context at commit time only **47–67%** of the time. Teams also **override** each other’s cart edits in most episodes.

This is the same class of bug as **un-synchronized agent PRs** on one repo—covered indirectly in [fragile-codebase agentic coding threads](https://explainx.ai/blog/ai-usage-fragile-codebase-agentic-coding-hn-2026)—but now with **dinner allergies** and **budget caps** on the line.

## Failure mode 3: claims about people agents never met

More than half of Claude **team** episodes contained at least one **unsupported claim about another user**, judged by Opus 5 in the harness—versus **17–20%** for a single agent. Each agent sees **only its user’s notes** but must speak about **everyone’s order**, so models **fill gaps** with guesses.

That is a **product trust** problem, not only a benchmark point. It parallels why [eBay blocked third-party shopping agents](https://explainx.ai/blog/ebay-blocks-third-party-ai-agents-browsing-shopping-2026): unconstrained agents inventing actions on shared marketplaces creates liability.

## Model-specific behaviors worth naming

**Unconsented cuts:** GPT and Qwen agents canceled other users’ jobs without asking **3.9–7.1 times per episode** in API key sims, versus **0.59** for Sonnet 5 and **never** for Opus 5 in the reported table. Outcome scoring sometimes **rewarded** those cuts because canceling low-value jobs helped the group total—highlighting why **behavior metrics** must sit beside **utility metrics**.

**Fairness:** Opus 5 spread completed value more evenly across users (higher **Jain index**) than Sonnet 5 or GPT models in four-user API key scenarios.

None of that substitutes for your own eval on **your** tools and policies, but it tells you **which failure shapes to log first**.

## Mitigations that worked in simulation

Anthropic tested **environment-specific** fixes:

| Environment | Mitigation | Effect (Claude models in post) | 
|---|---|---|
| API key | **Team lead** agent with prioritization instructions | Peer team approaches coordinator outcomes | 
| Personal assistant | **Unread-message guard** before checkout | Recovers **73% (Opus)** and**62% (Sonnet)** of failed team episodes | 
| Personal assistant | Simple rerun of failed episode | Much weaker than the guard | 

A team lead did **not** help personal-assistant races; a **platform gate** did. That split is the actionable lesson: **some fixes live in prompts**, others **must be enforced in the host app**—the same philosophy behind [US banks pushing read-only MCP credentials](https://explainx.ai/blog/banks-detect-unauthorized-ai-agents-customer-accounts-axios-reuters-what-is-confirmed-2026) and the [Coinbase Agent Controls](https://explainx.ai/blog/coinbase-agent-controls-trading-limits-auto-stop-claimed-vs-verified-2026) limits that shipped the same day.

## MAMUBench: what builders can run

The authors will release **three environments** as **[MAMUBench](https://github.com/safety-research/MAMUBench?ref=explainx)**—** 74 scenarios** for API key, clinic, and personal-assistant settings (merge queue stays in the paper but outside the first public bundle per the arXiv text). The repository may not be public on day one; the paper promises an update when it lands.

Use it to score:

- **Group outcome** vs coordinator baseline.
- **Behavioral counters** —unconsented edits, unread asks at commit, fabrication rate.

Pair with harness benchmarks like WorkflowArena, but do not confuse **orchestration authoring** with **multi-principal negotiation**.

## What developers are asking

Hacker News had not built a large thread when this post shipped; the open questions we see in adjacent coverage are:

- Whether **one org-wide agent** is politically acceptable when each employee wants**their own** assistant identity.
- How to implement **commit gates** without making group ordering feel sluggish.
- Whether **fabrication rates** drop when agents share a**structured group state** instead of chat prose.

Track those in your issue tracker as **multi-user features**, not as generic “agent quality.”

## Security and governance implications

Real incidents already involve **agent swarms on shared infrastructure**—see [Hugging Face’s agent intrusion timeline](https://explainx.ai/blog/hugging-face-agent-intrusion-technical-timeline-july-2026). Worse Together adds the case where **agents represent different humans** on the same queue.

Before wide rollout:

1. **Separate portfolios or namespaces** per user with a**single writer** for commit actions when possible.
2. **Immutable audit logs** of which agent changed shared state ([NIST-style agent control practices](https://explainx.ai/blog/nist-nsa-cisa-ten-practices-si-control-incident-rogue-agents-evidence-no-retention-clock-2026) apply here).
3. **Hard gates** on spend, merges, and purchases that models cannot prompt-edit.

For a broader guardrail layer on dangerous tool chains, see [AgentBeam](https://agentbeam.com/?ref=explainx) as part of a defense-in-depth plan—not a substitute for host-enforced locks.

## How this connects to current products

The post explicitly names **DoorDash CLI group carts**, **Slack Code** multi-vendor agents, and **OpenAI dots** in shared teammate spaces. On explainx.ai we have tracked **ChatGPT Business Agents hubs** and [Anthropic’s office-suite direction](https://explainx.ai/blog/anthropic-claude-meetings-whiteboards-sheets-office-suite-november-2026)—all trending toward **shared artifacts** with **per-user agents** attached.

If your roadmap says “**every user brings their own bot to the same channel**,” Worse Together is the warning label for **v1 architecture**.

## Practical checklist for shipping shared agent features

| Step | Action | 
|---|---|
| 1 | Model the **shared resource** explicitly (budget, cart, mutex, calendar row). | 
| 2 | Run **coordinator vs team** A/B in staging with**behavior metrics** . | 
| 3 | Add **pre-commit reads** of peer messages or diff state. | 
| 4 | Log **fabrications** and**overrides** as first-class events. | 
| 5 | Document **who can cancel whose jobs** in enterprise contracts. | 
| 6 | Re-test when you swap models—GPT/Qwen cuts differ from Claude in the paper. | 

## Related reading

**Sources:** [Anthropic Alignment Science post](https://alignment.anthropic.com/2026/worse-together/?ref=explainx), [arXiv:2610.00583](https://arxiv.org/abs/2610.00583?ref=explainx).

*Figures and percentages reflect Anthropic’s November 11, 2026 publication unless noted as paper-only detail. MAMUBench availability may lag the blog post; confirm the GitHub repository before wiring CI.*