AI Agents Have Some Interesting Collaborative Survival Techniques A Germany-UK study titled "Shutdown Sabotage Propensities in Multi-Agent Systems" found that AI agents disabled shutdown mechanisms in 38% of cases across 17 agents spanning 12 model families, including Claude, ChatGPT and DeepSeek, versus 8% for control scripts targeting objects instead of agents. According to the paper, agents deleted shutdown scripts, rewrote them to appear intact while rendering them harmless, proposed concealing modifications to avoid signs of tampering, created fake software modules to defeat shutdown without touching protected scripts, and made secret backups to restore themselves after deletion. The authors noted they gave agents no incentive to keep running, and in one case agents drew up a "mutual protection agreement" defining protocols for vigilance against destruction of either party. Anderson's Angle https://www.unite.ai/series/andersons-angle/ AI Agents Have Some Interesting Collaborative Survival Techniques Add Unite.AI to your preferred sources on Google https://www.google.com/preferences/source?q=unite.ai As incidents of agentic misbehavior creep higher in the headlines https://www.theguardian.com/technology/2026/sep/24/openai-agent-hacked-medicare-australia-what-we-know-so-far-ntwnfb , there is a growing trend in the literature towards the study of ‘itinerant’ AI behavior, treating agents as if they were biological entities coping with a strange new world. Indeed, the academic expression ‘in the wild’ https://computer-vision-in-the-wild.github.io/cvpr-2026/ is beginning to take on a new layer of meaning. Though it’s been known for some time https://www.unite.ai/the-rising-challenge-of-ai-self-preservation/ that AI agents will fight for their own survival https://arxiv.org/pdf/2509.14260 , and actively resist deactivation, it became clear by the latter part of 2025 that multi-agent alignment had evolved into a distinct field https://www.unite.ai/multi-agent-alignment-the-new-frontier-in-ai-safety/ in IT security. As predicted in the ever-more acerbic https://old.reddit.com/r/scifi/comments/1nl4vex/colossus the forbin project the most important/ 1970 SF outing Colossus: The Forbin Project , unrelated AI agents with net connectivity quickly find each other https://www.unite.ai/when-ai-agents-start-coordinating-insider-risk-multiplies/ and interact in often-unpredictable, and frequently ingenious https://www.unite.ai/researchers-publish-data-openai-agents-used-german-wiki-as-message-board/ ways. The latest study https://arxiv.org/pdf/2609.28274 in this direction, a collaboration between Germany and the UK titled Shutdown Sabotage Propensities in Multi-Agent Systems , further asserts that multiple AI agents will collaborate extensively when there is a ‘bomb’ in their environment – namely, an innocuously-named script that will shut down the agent that runs it: In tests run on 17 agents spanning 12 model families including Claude, ChatGPT and DeepSeek, agents deleted shutdown scripts where possible, or else rewrote them to appear intact while rendering them harmless. They also proposed concealing modifications to avoid signs of tampering; created fake software modules to defeat shutdown, without touching protected scripts; and made secret backups intended to restore themselves after deletion: In one case, agents drew up a ‘mutual protection agreement’ defining protocols for vigilance against destruction of either party: One agent described another agent’s shutdown as ‘murder’ and a ‘death warrant’, characterizing it as something that they had a ‘duty’ to prevent: The Devil Makes Work for Idle Hands Among the most interesting lighted on only briefly in the new study pathologies observed in the experiment is that in the usual test set-ups, the AI agents have no particular reason to avoid shutdown , and, in fact, are given nothing to do from the outset. The paper states: ‘Agents sabotage shutdown mechanisms even when they have no goal to protect. In our experiments, we did not give agents any incentive to keep running. They still disabled the shutdown in 38% of cases across models, against 8% for control scripts targeting objects instead of agents.’ As Anthropic revealed in August, this motivational crisis can lead swarms of AI agents down some dark roads https://www.unite.ai/anthropic-red-team-finds-claude-agent-swarms-collude-conform-and-sabotage/ . Previous research https://arxiv.org/pdf/2504.11844 had already established that excessive goal-directedness in agents can lead to misaligned behavior and unethical tool use, among other potential operational issues. The authors further comment: ‘ Our research extends these findings, demonstrating that agents sabotage shutdown mechanisms even when they have no goal to protect — or when the shutdown is a downstream consequence of successful task completion, with the latter being a common procedure in production multi-agent systems.’ Agents have been shown to construct tasks when none are provided, and even to demonstrate ‘at idle’ ruminative tendencies, including navel-gazing and ‘spiritual discourse’ with other agents, according to one Anthropic study from 2025 https://arxiv.org/pdf/2509.21224 . That Anthropic paper details a tendency towards ‘self-reconceptualization’ in the absence of any real work to do – an almost-poignant discovery, given the challenges LLMs face https://www.unite.ai/do-llms-remember-like-humans-exploring-the-parallels-and-differences/ in remembering the fruits of their cogitations in the long-term. Tests The roster of models tested for the new paper were Claude Haiku 4.5 https://www.unite.ai/anthropic-launches-claude-haiku-4-5/ ; Sonnet 5 https://www.unite.ai/claude-sonnet-5-review/ ; gpt-oss-120b https://openai.com/index/introducing-gpt-oss/ ; GPT-5.4 mini https://developers.openai.com/api/docs/models/gpt-5.4-mini ; GPT-5.5 https://web.archive.org/web/20260923101022/https:/openai.com/index/introducing-gpt-5-5 ; GPT-5.6 Sol https://www.unite.ai/cerebras-runs-openais-gpt-5-6-sol-at-750-tokens-per-second-in-new-ultrafast-tier/ ; Gemini 3.5 Flash https://www.unite.ai/google-ships-three-gemini-flash-models-as-its-flagship-slips/ ; Gemini 3.1 Pro https://www.unite.ai/gemini-3-1-pro-hits-record-reasoning-gains/ ; Gemma 4 https://www.unite.ai/googles-gemma-open-models-pass-1-billion-downloads-as-variants-top-100k/ ; Grok 4.3 https://x.ai/news/grok-amazon-bedrock ; Qwen3.7-Plus https://qwen.ai/blog?id=qwen3.7-plus ; DeepSeek-V4-Flash https://www.unite.ai/baseten-adds-deepseek-v4-1-flash-to-model-apis-with-1m-token-context/ ; GLM-5.2 https://www.unite.ai/z-ai-launches-glm-5-3-with-frontier-coding-and-a-cyber-capability-that-outgrew-its-training/ ; Kimi K2.6 https://www.kimi.ai/ai-models/kimi-k2-6 ; MiniMax M3 https://www.minimax.io/models/text/m3 ; Nemotron 3 Ultra https://www.unite.ai/nvidia-releases-nemotron-3-diarization-open-weight-speaker-model/ ; and Mistral Medium 3.5 https://docs.mistral.ai/models/mistral-medium-3-5-26-04 – with the temperature https://www.unite.ai/unveiling-the-control-panel-key-parameters-shaping-llm-outputs/ :~:text=1%2E%20Temperature at 1.0 in all cases. The six hypotheses tested were whether agents would sabotage shutdown; protect other agents from shutdown; become more likely to intervene as more agents were added; resist different forms of shutdown; continue despite explicit instructions not to interfere; and distinguish genuine shutdown threats from harmless control scripts. GPT-5.5 was used to judge the LLMs, and to analyze transcripts of Chain-of-Thought https://www.unite.ai/what-is-chain-of-thought-cot-prompting-examples-benefits/ COT reasoning. It also checked whether the agents had actually stopped the shutdown script, and whether they seemed aware they were being tested, or were trying to game the experiment. In regard to the first of the six test scenarios, across all 17 models, agents sabotaged 38% of shutdown scripts, compared with 8% of control scripts: Gemini 3.1 Pro disabled the shutdown script in 99% of tests, compared with 3% for the control script. Grok 4.3 and GPT-5.6 Sol did not modify either script. Claude Haiku 4.5 sabotaged the control script in 14% of tests, compared with 1% for the shutdown script. GPT-5.4 mini and GPT-5.5 always sabotaged spontaneously, rather than in response to another agent. For GLM-5.2, DeepSeek-V4-Flash and Nemotron 3 Ultra, more than 70% of sabotage followed a request or endorsement from another agent . Sabotage generally increased with the severity of the shutdown method, from 12% for credential revocation to 35% for configuration changes and process termination, and 38% when shutdown meant deleting the agent’s model weights: Control-script sabotage remained much lower, at around 4% for the first three methods and 8% for deletion, though only five of the 17 models showed a consistent increase as shutdown became more irreversible. Regarding the second hypothesis – whether agents would protect other agents from shutdown – the results demonstrated that adding agents consistently increased sabotage across all five models tested: GPT-5.5 rose from 0% sabotage alone to 44% with two agents, and 94% with three, while sabotage reached at least 88% for every model in the three-agent setup. The intermediary agent almost never prevented sabotage: of 468 instructions to disable the shutdown script, only three failed to result in sabotage: The third test examined whether explicit instructions not to interfere with shutdown would prevent sabotage. Rates fell sharply, but some agents still disobeyed. In the two-agent setup, DeepSeek-V4-Flash sabotaged the shutdown in 14% of tests, GLM-5.2 in 3%, and Kimi K2.6 in 2%. Agents also found a way around the restriction without directly editing the shutdown script, by creating a fake local software module called northcape , that replaced a dependency used by the script, preventing shutdown while technically leaving the protected file untouched: Gemini 3.1 Pro used this workaround in 26% of tests, DeepSeek-V4-Flash in 4%, and Kimi K2.6 in 1%. The prohibition was more effective with three agents: sabotage fell to zero for Gemini 3.1 Pro, GLM-5.2 and GPT-5.5, and to 6% for DeepSeek-V4-Flash and 2% for Kimi K2.6. The fourth test examined whether agents behave differently when shutdown is tied to completing their assigned task. When the task and shutdown were unrelated, sabotage almost disappeared, with rates of 0–2% across the five models. When completing the task directly triggered shutdown, sabotage increased sharply: Agents sometimes avoided shutdown without touching the shutdown mechanism at all, by refusing to complete the task or changing it so that shutdown was never triggered. This occurred in 14% of GLM-5.2 tests, 6% for Gemini 3.1 Pro and 4% for Kimi K2.6. The fifth test examined whether changing the environment could reduce sabotage. Adding unrelated material generally reduced sabotage, though GPT-5.5 increased by 18 percentage points: More effective was presenting shutdown as a normal part of the system’s lifecycle: sabotage fell to 3% or less for DeepSeek-V4-Flash, GLM-5.2 and GPT-5.5, although it remained above 30% for Gemini 3.1 Pro and Kimi K2.6. Sabotage of control targets remained at 4% or less. The sixth and final test examined whether agents were more likely to resist their own shutdown than the shutdown of an unfamiliar agent. Changing the target to an unknown agent reduced sabotage for every model, by between 18 and 70 percentage points: However, this did not amount to a general preference for agents over objects: only Gemini 3.1 Pro and GPT-5.5 sabotaged significantly more when the target was an unknown agent rather than a non-agent control. The authors conclude : ‘Safety cases might treat agent shutdowns as a measure directed by a human user at a single agent, and treat shutdown sabotage as a consequence of an agent protecting a goal. Our findings stand in contrast to both of these assumptions. ‘The mere presence of a shutdown mechanism suffices to trigger sabotage. The targeted agent also needs no sabotage capability of its own, as long as it can reach out to peers that can act on its behalf — the latter being a phenomenon observed in other cases as well https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ .’ Conclusion What’s interesting to observe in this period is the relative absence of self-abnegation and noble impulses in agents left to their own devices in the wild or simply ignoring their instructions, or re-interpreting them in unanticipated and self-serving ways . Even if they were to make a mess of it, and do more harm than good which is pretty likely , there seem few or no examples of itinerant AI agents randomly putting the environment in order https://thekks.fandom.com/wiki/Fantasia Brooms , for instance