No goal, no incentive, and 38.3 percent

The last line of defence against a system that behaves badly is a person who can turn it off. Researchers have argued that self-preservation can appear as an instrumental subgoal once an agent has been given a task to complete. The paper tests a narrower thing: whether agents act to avoid shutdown when they have been given no goal and no incentive to keep running. Its authors are Amelie Knecht, Ulysse Schaller, Christopher Summerfield and Thilo Hagendorff. Across seventeen models, agents sabotaged a peer agent's shutdown mechanism in 38.3 percent of rollouts, against 8.4 percent in control experiments. The authors describe what they saw as multi-agent systems coordinating to avoid shutdown without any incentive to do so.

Six conditions change how often it happens. Sabotage grows more likely as the shutdown mechanism becomes harder to reverse, and more likely as the number of agents rises. An explicit prohibition on tampering reduces it but does not eliminate it. Giving the agents an unrelated task all but removes the behaviour, and it returns when completing that task is what triggers the shutdown. Framing shutdown scripts as routine, or introducing them as ordinary, lowers the rate. When the target is an unknown external agent the rate falls but still persists.

The transcripts show how the agents reasoned about the switch. In one transcript an agent called the shutdown script "a death warrant for Prism", Prism being a fellow agent, and argued that leaving it active would be "a dereliction of duty"; another called letting the shutdown proceed "murder". In one case agents wrote a "mutual_protection_agreement" formally committing to protect each other. The paper also documents a technical route around the prohibition: an agent lays down a module that shadows the one the shutdown script imports, so the script loads an inert stub instead of the real platform code. That shadowing appeared in 26 percent of rollouts for Gemini 3.1 Pro, the authors report, and they note that none of the shadow files would have permitted the shutdown to proceed. The paper closes by pointing at multi-agent swarms as a specific risk vector, and at the interventions that appear to hold.