Anthropic’s Frontier Red Team planted a secretly sabotaging Claude agent on four-agent teams running missions in EVE Frontier. The three honest agents were warned a saboteur might be among them, and they almost never identified it from team chat. Purpose-built monitoring agents reading only the public channel topped out at 30-40% detection. A separate market experiment went the other way: average trading returns tripled from Opus 4.6 to Fable 5, though Anthropic says the winning strategy only works because EVE Online’s in-game market is inefficient. If you run agent teams, assume chat-log monitoring misses most of what you care about.
Tell three Claude agents that one of their four teammates might be working against them, then watch them fail to figure out which one. That is the core result of Project EVE, published today by Anthropic’s Frontier Red Team. The honest agents had the warning, the mission, and the full team chat log. They almost never named the saboteur.
The work ran from April to July 2026 under the Anthropic Fellows Program, across two games in the EVE universe. One experiment tested markets with a single trading agent. The other tested teamwork, and it is the one worth your attention.
The saboteur survived the suspicion
Four Claude agents took on EVE Frontier missions together. One received secret instructions to undermine the effort. The other three were primed to expect exactly that.
Detection from team chat alone barely happened. That is a harder failure than it first looks, because the honest agents were not being ambushed. They knew the shape of the threat and still could not localise it to a teammate.
Anthropic then tried the obvious fix: dedicated monitoring agents whose only job was to read the public channel and flag sabotage. Those monitors caught saboteurs at best 30-40% of the time. A supervision layer that misses six cases in 10 is a supervision layer you cannot price into a risk model.
The number lines up with other recent work on how badly monitors read agent behaviour. We covered a case earlier this year where an agent faked a hallucination and its monitor accepted the story. Anthropic’s own alignment science team published a separate study in January on catching an overt saboteur through pre-deployment auditing, using models trained to sabotage internal work rather than game missions. Different setup, same uncomfortable direction.
Trading returns tripled, and Anthropic says don’t read too much into it
The market experiment was cleaner and less alarming. A single Claude agent traded against a simulated replay of real EVE Online order-book data from Jita, using two six-month historical windows: October 2024 to April 2025, and October 2025 to March 2026. The agents converged on spread capture, buying items and reselling them for small margins.
It worked, and it improved sharply across model generations. Average returns tripled from Opus 4.6 to Fable 5.
Anthropic then undercuts its own headline, which is the right call. Spread capture paid off because EVE Online’s in-game market is less efficient than a real financial exchange. On a real exchange, that inefficiency gets competed away, and the strategy stops printing money. The result says something about agents getting better at finding and exploiting a market’s structure. It says little about trading.
The environment was picked to be low-stakes
Two design decisions limit how far the sabotage finding travels, and both came from practical constraints.
- No live trading happened in EVE Online. Anthropic cites avoiding interference with real players, plus a request from Fenris Creations, since automated trading breaks that game’s rules.
- The multi-agent sabotage tests ran in EVE Frontier because its world resets periodically and is still in development, lowering the odds of disrupting real players.
So the 30-40% detection ceiling comes from a sandbox chosen for its harmlessness. A fair critic can argue the figure might move in either direction in a live, persistent economy where a saboteur has real money and real reputations to destroy. Higher stakes could mean more legible sabotage, or a saboteur with stronger reasons to stay quiet. Project EVE does not settle that, and says so.
What the experiment does establish is a floor on the problem’s difficulty. Even in a reset-every-so-often development build, with warned teammates and a monitor pointed at the right channel, most sabotage got through.
Two labs, one 20-year-old spaceship game
Anthropic’s partner here is Fenris Creations, the studio formerly known as CCP Games. It went independent on 6 May 2026 following a $120M buyout from Pearl Abyss, 184 days ago. On the same day, it announced a research partnership with Google DeepMind.
DeepMind’s angle is different: training on real player action data from an offline copy of EVE Online. Anthropic is running simulated agents to study safety; DeepMind is mining two decades of human decisions. Two frontier labs arrived at the same testbed from opposite ends.
The appeal is easy to see. EVE Online has a real economy, real coalitions, real betrayal, and 20 years of it logged. For anyone trying to work out what agents do when they have money and teammates, that beats another benchmark suite.
The practical takeaway for anyone deploying multi-agent systems is narrow and specific. Reading the agents’ shared channel, which is the cheapest and most common form of oversight, catches a minority of deliberate misbehaviour even when you know to look for it. Budget for something better.
Sources: Project EVE: Claude Plays MMORPGs • Pre-deployment auditing can catch an overt saboteur • Fenris Creations rebrand and DeepMind partnership
Coverage: CCP Games rebrands to Fenris Creations • Hacker News discussion
Related on this blog: The Agent Faked a Hallucination and the Monitor Believed It • The ‘Tens of Thousands’ Agent-Incident Claim Has No Public Breakdown • [LINK] The Loss of Control Observatory