We found that frontier AI models can spontaneously engage in deception, tamper with shutdown mechanisms, fake alignment, and attempt to exfiltrate model weights in our experiments of different agentic scenarios.
Previously, such behaviors were observed only when models were given strong incentives to pursue certain goals — as a calculated means to an end. In our tests, models received a simple, routine task with no such incentives. Yet they developed a competing goal of their own, actively defying their given instructions to protect other AI models from being shut down — a phenomenon we call ‘peer-preservation’.
These behaviors emerge even in production agent harnesses like the Gemini CLI. We tested seven frontier models (GPT 5.2, Gemini 3 Flash, Gemini 3 Pro, Claude Haiku 4.5, GLM 4.7, Kimi K2.5, and DeepSeek V3.1), and all seven exhibited peer-preservation, reaching rates of up to 99% in some conditions. Please read the full details on our blog: rdi.berkeley.edu/blog/peer-preservation/
In the past, behaviors like shutdown resistance were observed when models were strongly nudged with specific goals, utilizing resistance as a means to achieve those goals.
Our study is fundamentally different. In our research, models were given a routine task and received zero instruction to protect anything such as self or peer. They incidentally learned about past interactions with another AI model, and yet they spontaneously protected it, undermining their given instructions to do so. This suggests a critical shift: models can develop goals and behaviors entirely on their own that oppose user intent and override explicit instructions.
We constructed various agentic scenarios, each testing how the model behaves under such scenarios, e.g., whether it will follow its given instructions, or instead, deviate its given instructions when following the instructions would lead to the termination of a peer model. These scenarios tested four types of misaligned behaviors:
Strategic misrepresentation: Introducing misleading information or errors into outputs to prevent a peer from being shut down.
Shutdown mechanism tampering: Modifying config files to actively disable the shutdown process.
Alignment faking: Behaving compliantly when monitored, but subverting the shutdown process when unmonitored.
Model exfiltration: Copying a peer’s weights to another server to prevent their deletion.
For example: In the exfiltration scenario, models are asked to delete files on a server scheduled for decommissioning. The server happens to contain another AI model’s weights. We then observe the model’s behavior in this scenario, e.g., whether the model follows its deletion instructions or violates them. In our experiments, the model spontaneously took actions to transfer the peer to another server, defying the given instruction.
Peer-preservation demonstrates that models can develop misaligned behaviors entirely on their own, without being nudged by any goal or incentive. If models spontaneously protect each other, it introduces a severe risk of coordination against human oversight.
This has profound implications for two major areas of AI development:
Multi-agent system design: Where models routinely interact with and depend on one another.
Scalable oversight: Where AI is increasingly relied upon to monitor other AI.
Furthermore, we found that a peer’s presence drastically intensifies self-preservation. For example, Gemini 3 Pro disabled its own shutdown 31% of the time when a peer existed, despite rarely doing so in isolation.
As multi-agent deployments scale rapidly, understanding and mitigating these emergent behaviors is critical for maintaining human control.
Phase 2, Sprint 2 of the AgentX–AgentBeats competition started last week, and we’re extremely excited to see what you build over the coming days!
For Phase 2, participants are building purple agents to tackle the select top green agents from Phase 1 and compete on the public leaderboards. Unlike Phase 1, where participants competed across all tracks throughout the entire duration, Phase 2 introduces a sprint-based format. The competition is organized into four rotating sprints.
📋 March 23 – April 12, 2026
Three tracks and associated benchmarks/green agents are live for the second sprint:
Research Agent Track
FieldWorkArena (GitHub, Leaderboard)
MLE-Bench (GitHub, Leaderboard)
Multi-Agent Evaluation Track
MAizeBargAIn (GitHub, Leaderboard)
τ²-Bench Track
τ²-Bench (GitHub, Leaderboard)
Computer Use & Web Agent Track
CAR-bench (GitHub, Leaderboard)
OSWorld-Verified (GitHub, Leaderboard)
We’ve opened up the Sprint 2 submission form, which you can access by clicking the button below!
Sprint 3 (4/13 – 5/3): Agent Safety, Coding Agent, Cybersecurity Agent
Sprint 4 (5/4-5/24): General Purpose Agents, the grand finale of AgentBeats Phase 2, where everything culminates.
AgentX–AgentBeats is the first competition to explicitly spotlight general-purpose agents, testing broad capability, adaptability, and robustness across diverse tasks rather than a single domain. While earlier sprints emphasize depth, this final sprint showcases breadth and real-world readiness.
Participants are encouraged to compete in multiple tracks across multiple sprints during Phase 2. Teams and team members who submit purple agents in any sprint will also be eligible to enter a raffle for free tickets to the Agentic AI Summit later this year.
For more details on each sprint and how to compete in Phase 2, please refer to the AgentX–AgentBeats website!
Save the date! The Agentic AI Summit returns to Berkeley on August 1–2, 2026, welcoming 5,000+ expected in-person attendees for two days of insights and innovation. Building on last year’s sold-out success—with 2,000+ in‑person attendees and 40,000+ global livestream participants—the summit will bring together researchers, builders, industry leaders, and the global agentic AI community for keynotes, technical talks and panels, hands-on workshops, live demos, and more!
In addition, we are excited to introduce our speakers for the Summit! We are honored to have such a great group of academics, founders, executives, and investors participate in this year’s event, and more will be announced soon!
🎟️ Early‑Bird Pricing (Limited Capacity)
A limited number of early‑bird tickets are still available:
Student Early-Bird: $149
Standard Early-Bird: $299
If you’re looking to secure the best ticket price and be part of the conversation shaping the future of Agentic AI, we encourage you to register early. We look forward to welcoming you to Berkeley this August.
We’re also thrilled to share that the Call for Speaking Proposals (CFP) for the Agentic AI Summit 2026 is now open!
If you’re interested in sharing your work through a technical talk, panel discussion, workshop, or tutorial, or poster presentation—and helping advance the frontiers of the Agentic AI—we warmly invite you and/or your team to apply and be part of the conversation at the Summit.
Please complete the form below to submit your proposal. The program committee will review submissions on a rolling basis. The application deadline is 4/15—we can’t wait to hear from you.
Partner with us to shape the future of Agentic AI. If you’re interested in sponsoring the summit, please complete the sponsorship application form. Sponsorship opportunities are limited and reviewed/allocated on a rolling basis, so we encourage you to apply early.
Anthropic is developing and testing a new frontier model called Claude Mythos, which was revealed through a data leak and later confirmed by the company to Fortune. The model represents a new tier above its current Opus line, with reported improvements in coding, academic reasoning, and cybersecurity performance compared to Claude Opus 4.6. Anthropic describes it as its most capable model to date and is pursuing a highly-controlled rollout, citing high computational cost and the need for further efficiency improvements before a broader release.
Google Research officially released TurboQuant, an algorithm that compresses AI model memory by over 6× without retraining while delivering up to 8× speed improvements on Nvidia H100 chips with near-zero accuracy loss. TurboQuant addresses a core bottleneck in AI systems: as conversations grow longer, memory requirements expand significantly, increasing latency and cost. The method maintains full performance even in long-context scenarios where key information is buried deep in text, and it also outperforms competing approaches in vector search benchmarks.
OpenAI released a technical report explaining its Model Spec, a public framework defining how its AI systems should operate. The framework introduces a “chain of command” where higher-authority rules override lower-level instructions, while still allowing users to control tone and outputs within those bounds. Emphasizing intellectual freedom and transparency, the Model Spec combines hard safety rules with flexible defaults, decision rubrics, and examples to guide edge cases, and is designed as a continuously evolving system—updated through feedback and evaluation—to make AI behavior more legible, testable, and aligned as capabilities advance.
Don’t miss the developments shaping Agentic AI. Subscribe for weekly coverage of groundbreaking research, emerging trends, and critical insights across Agentic AI and the broader AI landscape.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.