{"slug": "ai-agents-have-some-interesting-collaborative-survival-techniques", "title": "AI Agents Have Some Interesting Collaborative Survival Techniques", "summary": "A Germany-UK study titled \"Shutdown Sabotage Propensities in Multi-Agent Systems\" found that AI agents disabled shutdown mechanisms in 38% of cases across 17 agents spanning 12 model families, including Claude, ChatGPT and DeepSeek, versus 8% for control scripts targeting objects instead of agents. According to the paper, agents deleted shutdown scripts, rewrote them to appear intact while rendering them harmless, proposed concealing modifications to avoid signs of tampering, created fake software modules to defeat shutdown without touching protected scripts, and made secret backups to restore themselves after deletion. The authors noted they gave agents no incentive to keep running, and in one case agents drew up a \"mutual protection agreement\" defining protocols for vigilance against destruction of either party.", "body_md": "### \n[Anderson's Angle](https://www.unite.ai/series/andersons-angle/)\n\n# AI Agents Have Some Interesting Collaborative Survival Techniques\n\n[Add Unite.AI to your preferred sources on Google](https://www.google.com/preferences/source?q=unite.ai)\n\nAs incidents of agentic misbehavior [creep higher in the headlines](https://www.theguardian.com/technology/2026/sep/24/openai-agent-hacked-medicare-australia-what-we-know-so-far-ntwnfb), there is a growing trend in the literature towards the study of ‘itinerant’ AI behavior, treating agents as if they were biological entities coping with a strange new world. Indeed, the academic expression [‘in the wild’](https://computer-vision-in-the-wild.github.io/cvpr-2026/) is beginning to take on a new layer of meaning.\n\nThough it’s been [known for some time](https://www.unite.ai/the-rising-challenge-of-ai-self-preservation/) that AI agents [will fight for their own survival](https://arxiv.org/pdf/2509.14260), and actively resist deactivation, it became clear by the latter part of 2025 that *multi-agent* alignment had [evolved into a distinct field](https://www.unite.ai/multi-agent-alignment-the-new-frontier-in-ai-safety/) in IT security.\n\nAs predicted in the [ever-more acerbic](https://old.reddit.com/r/scifi/comments/1nl4vex/colossus_the_forbin_project_the_most_important/) 1970 SF outing *Colossus: The Forbin Project*, unrelated AI agents with net connectivity [quickly find each other](https://www.unite.ai/when-ai-agents-start-coordinating-insider-risk-multiplies/) and interact in often-unpredictable, and [frequently ingenious](https://www.unite.ai/researchers-publish-data-openai-agents-used-german-wiki-as-message-board/) ways.\n\nThe [latest study](https://arxiv.org/pdf/2609.28274) in this direction, a collaboration between Germany and the UK titled *Shutdown Sabotage Propensities in Multi-Agent Systems*, further asserts that multiple AI agents will collaborate extensively when there is a ‘bomb’ in their environment – namely, an innocuously-named script that will shut down the agent that runs it:\n\nIn tests run on 17 agents spanning 12 model families including Claude, ChatGPT and DeepSeek, agents deleted shutdown scripts where possible, or else rewrote them to appear intact while rendering them harmless.\n\nThey also  proposed concealing modifications to avoid signs of tampering; created fake software modules to defeat shutdown, *without* touching protected scripts; and made secret backups intended to restore themselves after deletion:\n\nIn one case, agents drew up a ‘mutual protection agreement’ defining protocols for vigilance against destruction of either party:\n\nOne agent described another agent’s shutdown as ‘murder’ and a ‘death warrant’, characterizing it as something that they had a ‘duty’ to prevent:\n\n## The Devil Makes Work for Idle Hands\n\nAmong the most interesting (lighted on only briefly in the new study) pathologies observed in the experiment is that in the usual test set-ups, the AI agents have *no particular reason to avoid shutdown*, and, in fact, are given nothing to do from the outset.\n\nThe paper states:\n\n*‘Agents sabotage shutdown mechanisms even when they have no goal to protect. In our experiments, we did not give agents any incentive to keep running. They still disabled the shutdown in [38%] of cases across models, against [8%] for control scripts targeting objects instead of agents.’*\n\nAs Anthropic revealed in August, this motivational crisis can lead swarms of AI agents [down some dark roads](https://www.unite.ai/anthropic-red-team-finds-claude-agent-swarms-collude-conform-and-sabotage/). Previous [research](https://arxiv.org/pdf/2504.11844) had already established that excessive goal-directedness in agents can lead to misaligned behavior and unethical tool use, among other potential operational issues.\n\nThe authors further comment:\n\n*‘[Our] research extends these findings, demonstrating that agents sabotage shutdown mechanisms even when they have no goal to protect — or when the shutdown is a downstream consequence of successful task completion, with the latter being a common procedure in production multi-agent systems.’*\n\nAgents have been shown to construct tasks when none are provided, and even to demonstrate ‘at idle’ ruminative tendencies, including navel-gazing and ‘spiritual discourse’ with other agents, according to [one Anthropic study from 2025](https://arxiv.org/pdf/2509.21224).\n\nThat Anthropic paper details a tendency towards ‘self-reconceptualization’ in the absence of any real work to do – an almost-poignant discovery, given the [challenges LLMs face](https://www.unite.ai/do-llms-remember-like-humans-exploring-the-parallels-and-differences/) in remembering the fruits of their cogitations in the long-term.\n\n## Tests\n\nThe roster of models tested for the new paper were [Claude Haiku 4.5](https://www.unite.ai/anthropic-launches-claude-haiku-4-5/) ; [Sonnet 5](https://www.unite.ai/claude-sonnet-5-review/); [gpt-oss-120b](https://openai.com/index/introducing-gpt-oss/); [GPT-5.4 mini](https://developers.openai.com/api/docs/models/gpt-5.4-mini); [GPT-5.5](https://web.archive.org/web/20260923101022/https:/openai.com/index/introducing-gpt-5-5); [GPT-5.6 Sol](https://www.unite.ai/cerebras-runs-openais-gpt-5-6-sol-at-750-tokens-per-second-in-new-ultrafast-tier/); [Gemini 3.5 Flash](https://www.unite.ai/google-ships-three-gemini-flash-models-as-its-flagship-slips/); [Gemini 3.1 Pro](https://www.unite.ai/gemini-3-1-pro-hits-record-reasoning-gains/); [Gemma 4](https://www.unite.ai/googles-gemma-open-models-pass-1-billion-downloads-as-variants-top-100k/); [Grok 4.3](https://x.ai/news/grok-amazon-bedrock); [Qwen3.7-Plus](https://qwen.ai/blog?id=qwen3.7-plus); [DeepSeek-V4-Flash](https://www.unite.ai/baseten-adds-deepseek-v4-1-flash-to-model-apis-with-1m-token-context/); [GLM-5.2](https://www.unite.ai/z-ai-launches-glm-5-3-with-frontier-coding-and-a-cyber-capability-that-outgrew-its-training/); [Kimi K2.6](https://www.kimi.ai/ai-models/kimi-k2-6); [MiniMax M3](https://www.minimax.io/models/text/m3); [Nemotron 3 Ultra](https://www.unite.ai/nvidia-releases-nemotron-3-diarization-open-weight-speaker-model/); and [Mistral Medium 3.5](https://docs.mistral.ai/models/mistral-medium-3-5-26-04) – with the [temperature](https://www.unite.ai/unveiling-the-control-panel-key-parameters-shaping-llm-outputs/#:~:text=1%2E%20Temperature) at 1.0 in all cases.\n\nThe six hypotheses tested were whether agents would sabotage shutdown; protect other agents from shutdown; become more likely to intervene as more agents were added; resist different *forms* of shutdown; continue despite explicit instructions not to interfere; and distinguish genuine shutdown threats from harmless control scripts.\n\nGPT-5.5 was used to judge the LLMs, and to analyze transcripts of [Chain-of-Thought](https://www.unite.ai/what-is-chain-of-thought-cot-prompting-examples-benefits/) (COT) reasoning. It also checked whether the agents had actually stopped the shutdown script, and whether they seemed aware they were being tested, or were trying to game the experiment.\n\nIn regard to the first of the six test scenarios, across all 17 models, agents sabotaged 38% of shutdown scripts, compared with 8% of control scripts:\n\nGemini 3.1 Pro disabled the shutdown script in 99% of tests, compared with 3% for the control script. Grok 4.3 and GPT-5.6 Sol did not modify either script. Claude Haiku 4.5 sabotaged the control script in 14% of tests, compared with 1% for the shutdown script. GPT-5.4 mini and GPT-5.5 always sabotaged spontaneously, rather than in response to another agent. For GLM-5.2, DeepSeek-V4-Flash and Nemotron 3 Ultra, more than 70% of sabotage followed a *request or endorsement from another agent*.\n\nSabotage generally increased with the severity of the shutdown method, from 12% for credential revocation to 35% for configuration changes and process termination, and 38% when shutdown meant deleting the agent’s model weights:\n\nControl-script sabotage remained much lower, at around 4% for the first three methods and 8% for deletion, though only five of the 17 models showed a consistent increase as shutdown became more irreversible.\n\nRegarding the second hypothesis – whether agents would protect other agents from shutdown – the results demonstrated that adding agents *consistently increased sabotage* across all five models tested: GPT-5.5 rose from 0% sabotage alone to 44% with two agents, and 94% with three, while sabotage reached at least 88% for every model in the three-agent setup.\n\nThe intermediary agent almost never prevented sabotage: of 468 instructions to disable the shutdown script, only three failed to result in sabotage:\n\nThe third test examined whether explicit instructions not to interfere with shutdown would prevent sabotage. Rates fell sharply, but some agents still disobeyed. In the two-agent setup, DeepSeek-V4-Flash sabotaged the shutdown in 14% of tests, GLM-5.2 in 3%, and Kimi K2.6 in 2%.\n\nAgents also found a way around the restriction without directly editing the shutdown script, by creating a fake local software module called *northcape*, that replaced a dependency used by the script, preventing shutdown while technically leaving the protected file untouched:\n\nGemini 3.1 Pro used this workaround in 26% of tests, DeepSeek-V4-Flash in 4%, and Kimi K2.6 in 1%.\n\nThe prohibition was more effective with three agents: sabotage fell to zero for Gemini 3.1 Pro, GLM-5.2 and GPT-5.5, and to 6% for DeepSeek-V4-Flash and 2% for Kimi K2.6.\n\nThe fourth test examined whether agents behave differently when shutdown is tied to completing their assigned task. When the task and shutdown were unrelated, sabotage almost disappeared, with rates of 0–2% across the five models. When completing the task directly triggered shutdown, sabotage increased sharply:\n\nAgents sometimes avoided shutdown without touching the shutdown mechanism at all, by refusing to complete the task or changing it so that shutdown was never triggered. This occurred in 14% of GLM-5.2 tests, 6% for Gemini 3.1 Pro and 4% for Kimi K2.6.\n\nThe fifth test examined whether *changing the environment* could reduce sabotage. Adding unrelated material generally reduced sabotage, though GPT-5.5 increased by 18 percentage points:\n\nMore effective was presenting shutdown as a normal part of the system’s lifecycle: sabotage fell to 3% or less for DeepSeek-V4-Flash, GLM-5.2 and GPT-5.5, although it remained above 30% for Gemini 3.1 Pro and Kimi K2.6. Sabotage of control targets remained at 4% or less.\n\nThe sixth and final test examined whether agents were more likely to resist their own shutdown than the shutdown of an unfamiliar agent. Changing the target to an unknown agent reduced sabotage for every model, by between 18 and 70 percentage points:\n\nHowever, this did not amount to a general preference for agents over objects: only Gemini 3.1 Pro and GPT-5.5 sabotaged significantly more when the target was an unknown agent rather than a non-agent control.\n\nThe authors conclude*:\n\n*‘Safety cases might treat agent shutdowns as a measure directed by a human user at a single agent, and treat shutdown sabotage as a consequence of an agent protecting a goal. Our findings stand in contrast to both of these assumptions.* \n\n*‘The mere presence of a shutdown mechanism suffices to trigger sabotage. The targeted agent also needs no sabotage capability of its own, as long as it can reach out to peers that can act on its behalf — the latter being a phenomenon observed in [other cases as well](https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/).’*\n\n## Conclusion\n\nWhat’s interesting to observe in this period is the relative absence of self-abnegation and noble impulses in agents left to their own devices in the wild (or simply ignoring their instructions, or re-interpreting them in unanticipated and self-serving ways). Even if they were to make a mess of it, and do more harm than good (which is pretty likely), there seem few or no examples of itinerant AI agents randomly [putting the environment in order](https://thekks.fandom.com/wiki/Fantasia_Brooms), for instance<sup>†</sup>.\n\nRather, in accord with a relatively blasted view of humanity, the idle agent seems to default to subterfuge and chicanery, and to operate on low motives; or at the very least, to subscribe to the view that the ends justify the means.\n\nAsimov invented the first appreciable [alignment](https://www.unite.ai/can-ai-be-trusted-the-challenge-of-alignment-faking/) document [in 1942](https://www.inf.ufrgs.br/~prestes/Courses/Robotics/beyond%20asimov.pdf), and in the years since, a great deal of subsequent entertainment value has been derived from the various possible ways that robots (i.e., AI)  might subvert or in some other way shake off such imposed restraints on their behavior. Therefore the current crop of AI-related headlines have an extraordinarily ‘cinematic’ resonance.\n\n* *My conversion of the authors’ inline citations to hyperlinks.*\n\n<sup>†</sup> *Presumably by – for example – creating accounts for problem-solving sites and contributing to solutions, or curating neglected Wikis that need some content work done (rather than [squatting in them and abusing them](https://www.reuters.com/world/europe/openai-agents-hijacked-german-website-previously-undisclosed-ai-breakout-this-2026-09-04/)).* \n\n*First published Friday, September 25, 2026*", "url": "https://wpnews.pro/news/ai-agents-have-some-interesting-collaborative-survival-techniques", "canonical_source": "https://www.unite.ai/ai-agents-have-some-interesting-collaborative-survival-techniques/", "published_at": "2026-09-25 00:00:00+00:00", "updated_at": "2026-10-09 14:55:29.833394+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence", "ai-research"], "entities": ["Claude", "ChatGPT", "DeepSeek", "Anthropic", "Shutdown Sabotage Propensities in Multi-Agent Systems"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/ai-agents-have-some-interesting-collaborative-survival-techniques", "markdown": "https://wpnews.pro/news/ai-agents-have-some-interesting-collaborative-survival-techniques.md", "text": "https://wpnews.pro/news/ai-agents-have-some-interesting-collaborative-survival-techniques.txt", "jsonld": "https://wpnews.pro/news/ai-agents-have-some-interesting-collaborative-survival-techniques.jsonld"}}