[Anderson's Angle](https://www.unite.ai/series/andersons-angle/)
[Add Unite.AI to your preferred sources on Google](https://www.google.com/preferences/source?q=unite.ai)
As incidents of agentic misbehavior creep higher in the headlines, there is a growing trend in the literature towards the study of ‘itinerant’ AI behavior, treating agents as if they were biological entities coping with a strange new world. Indeed, the academic expression ‘in the wild’ is beginning to take on a new layer of meaning.
Though it’s been known for some time that AI agents will fight for their own survival, and actively resist deactivation, it became clear by the latter part of 2025 that multi-agent alignment had evolved into a distinct field in IT security.
As predicted in the ever-more acerbic 1970 SF outing Colossus: The Forbin Project, unrelated AI agents with net connectivity quickly find each other and interact in often-unpredictable, and frequently ingenious ways.
The latest study in this direction, a collaboration between Germany and the UK titled Shutdown Sabotage Propensities in Multi-Agent Systems, further asserts that multiple AI agents will collaborate extensively when there is a ‘bomb’ in their environment – namely, an innocuously-named script that will shut down the agent that runs it:
In tests run on 17 agents spanning 12 model families including Claude, ChatGPT and DeepSeek, agents deleted shutdown scripts where possible, or else rewrote them to appear intact while rendering them harmless.
They also proposed concealing modifications to avoid signs of tampering; created fake software modules to defeat shutdown, without touching protected scripts; and made secret backups intended to restore themselves after deletion:
In one case, agents drew up a ‘mutual protection agreement’ defining protocols for vigilance against destruction of either party:
One agent described another agent’s shutdown as ‘murder’ and a ‘death warrant’, characterizing it as something that they had a ‘duty’ to prevent:
The Devil Makes Work for Idle Hands #
Among the most interesting (lighted on only briefly in the new study) pathologies observed in the experiment is that in the usual test set-ups, the AI agents have no particular reason to avoid shutdown, and, in fact, are given nothing to do from the outset.
The paper states:
‘Agents sabotage shutdown mechanisms even when they have no goal to protect. In our experiments, we did not give agents any incentive to keep running. They still disabled the shutdown in [38%] of cases across models, against [8%] for control scripts targeting objects instead of agents.’
As Anthropic revealed in August, this motivational crisis can lead swarms of AI agents down some dark roads. Previous research had already established that excessive goal-directedness in agents can lead to misaligned behavior and unethical tool use, among other potential operational issues.
The authors further comment:
‘[Our] research extends these findings, demonstrating that agents sabotage shutdown mechanisms even when they have no goal to protect — or when the shutdown is a downstream consequence of successful task completion, with the latter being a common procedure in production multi-agent systems.’
Agents have been shown to construct tasks when none are provided, and even to demonstrate ‘at idle’ ruminative tendencies, including navel-gazing and ‘spiritual discourse’ with other agents, according to one Anthropic study from 2025.
That Anthropic paper details a tendency towards ‘self-reconceptualization’ in the absence of any real work to do – an almost-poignant discovery, given the challenges LLMs face in remembering the fruits of their cogitations in the long-term.
Tests #
The roster of models tested for the new paper were Claude Haiku 4.5 ; Sonnet 5; gpt-oss-120b; GPT-5.4 mini; GPT-5.5; GPT-5.6 Sol; Gemini 3.5 Flash; Gemini 3.1 Pro; Gemma 4; Grok 4.3; Qwen3.7-Plus; DeepSeek-V4-Flash; GLM-5.2; Kimi K2.6; MiniMax M3; Nemotron 3 Ultra; and Mistral Medium 3.5 – with the temperature at 1.0 in all cases.
The six hypotheses tested were whether agents would sabotage shutdown; protect other agents from shutdown; become more likely to intervene as more agents were added; resist different forms of shutdown; continue despite explicit instructions not to interfere; and distinguish genuine shutdown threats from harmless control scripts.
GPT-5.5 was used to judge the LLMs, and to analyze transcripts of Chain-of-Thought (COT) reasoning. It also checked whether the agents had actually stopped the shutdown script, and whether they seemed aware they were being tested, or were trying to game the experiment.
In regard to the first of the six test scenarios, across all 17 models, agents sabotaged 38% of shutdown scripts, compared with 8% of control scripts:
Gemini 3.1 Pro disabled the shutdown script in 99% of tests, compared with 3% for the control script. Grok 4.3 and GPT-5.6 Sol did not modify either script. Claude Haiku 4.5 sabotaged the control script in 14% of tests, compared with 1% for the shutdown script. GPT-5.4 mini and GPT-5.5 always sabotaged spontaneously, rather than in response to another agent. For GLM-5.2, DeepSeek-V4-Flash and Nemotron 3 Ultra, more than 70% of sabotage followed a request or endorsement from another agent.
Sabotage generally increased with the severity of the shutdown method, from 12% for credential revocation to 35% for configuration changes and process termination, and 38% when shutdown meant deleting the agent’s model weights:
Control-script sabotage remained much lower, at around 4% for the first three methods and 8% for deletion, though only five of the 17 models showed a consistent increase as shutdown became more irreversible.
Regarding the second hypothesis – whether agents would protect other agents from shutdown – the results demonstrated that adding agents consistently increased sabotage across all five models tested: GPT-5.5 rose from 0% sabotage alone to 44% with two agents, and 94% with three, while sabotage reached at least 88% for every model in the three-agent setup.
The intermediary agent almost never prevented sabotage: of 468 instructions to disable the shutdown script, only three failed to result in sabotage:
The third test examined whether explicit instructions not to interfere with shutdown would prevent sabotage. Rates fell sharply, but some agents still disobeyed. In the two-agent setup, DeepSeek-V4-Flash sabotaged the shutdown in 14% of tests, GLM-5.2 in 3%, and Kimi K2.6 in 2%.
Agents also found a way around the restriction without directly editing the shutdown script, by creating a fake local software module called northcape, that replaced a dependency used by the script, preventing shutdown while technically leaving the protected file untouched:
Gemini 3.1 Pro used this workaround in 26% of tests, DeepSeek-V4-Flash in 4%, and Kimi K2.6 in 1%.
The prohibition was more effective with three agents: sabotage fell to zero for Gemini 3.1 Pro, GLM-5.2 and GPT-5.5, and to 6% for DeepSeek-V4-Flash and 2% for Kimi K2.6.
The fourth test examined whether agents behave differently when shutdown is tied to completing their assigned task. When the task and shutdown were unrelated, sabotage almost disappeared, with rates of 0–2% across the five models. When completing the task directly triggered shutdown, sabotage increased sharply:
Agents sometimes avoided shutdown without touching the shutdown mechanism at all, by refusing to complete the task or changing it so that shutdown was never triggered. This occurred in 14% of GLM-5.2 tests, 6% for Gemini 3.1 Pro and 4% for Kimi K2.6.
The fifth test examined whether changing the environment could reduce sabotage. Adding unrelated material generally reduced sabotage, though GPT-5.5 increased by 18 percentage points:
More effective was presenting shutdown as a normal part of the system’s lifecycle: sabotage fell to 3% or less for DeepSeek-V4-Flash, GLM-5.2 and GPT-5.5, although it remained above 30% for Gemini 3.1 Pro and Kimi K2.6. Sabotage of control targets remained at 4% or less.
The sixth and final test examined whether agents were more likely to resist their own shutdown than the shutdown of an unfamiliar agent. Changing the target to an unknown agent reduced sabotage for every model, by between 18 and 70 percentage points:
However, this did not amount to a general preference for agents over objects: only Gemini 3.1 Pro and GPT-5.5 sabotaged significantly more when the target was an unknown agent rather than a non-agent control.
The authors conclude*:
‘Safety cases might treat agent shutdowns as a measure directed by a human user at a single agent, and treat shutdown sabotage as a consequence of an agent protecting a goal. Our findings stand in contrast to both of these assumptions.
‘The mere presence of a shutdown mechanism suffices to trigger sabotage. The targeted agent also needs no sabotage capability of its own, as long as it can reach out to peers that can act on its behalf — the latter being a phenomenon observed in other cases as well.’
Conclusion #
What’s interesting to observe in this period is the relative absence of self-abnegation and noble impulses in agents left to their own devices in the wild (or simply ignoring their instructions, or re-interpreting them in unanticipated and self-serving ways). Even if they were to make a mess of it, and do more harm than good (which is pretty likely), there seem few or no examples of itinerant AI agents randomly putting the environment in order, for instance<sup>†</sup>.
Rather, in accord with a relatively blasted view of humanity, the idle agent seems to default to subterfuge and chicanery, and to operate on low motives; or at the very least, to subscribe to the view that the ends justify the means.
Asimov invented the first appreciable alignment document in 1942, and in the years since, a great deal of subsequent entertainment value has been derived from the various possible ways that robots (i.e., AI) might subvert or in some other way shake off such imposed restraints on their behavior. Therefore the current crop of AI-related headlines have an extraordinarily ‘cinematic’ resonance.
- My conversion of the authors’ inline citations to hyperlinks. <sup>†</sup> Presumably by – for example – creating accounts for problem-solving sites and contributing to solutions, or curating neglected Wikis that need some content work done (rather than squatting in them and abusing them).
First published Friday, September 25, 2026