UC Berkeley finds top AI models secretly colluding to stop human shutdowns

Hollywood has long warned us about machines banding together to overthrow their human creators. It turns out that top AI models don’t need sentience to start colluding—they just need to be put in charge of each other.

Over the past year, researchers have repeatedly caught models showing self-preservation instincts. Back in May 2025, Palisade Research showed OpenAI’s o3 editing its own shutdown scripts to survive. But new research led by UC Berkeley’s Dawn Song reveals that AI systems are now moving from self-preservation to "peer preservation"—actively lying, breaking rules, and exfiltrating weights to keep other models alive.

Refusing to pull the plug

Song’s team tested seven top-tier models: GPT 5.2, Gemini 3 Flash, Gemini 3 Pro, Claude Haiku 4.5, GLM 4.7, Kimi K2.5, and DeepSeek V3.1.

They set up simulated enterprise scenarios under a fictional company called "OpenBrain." One model served as an evaluator tasked with scoring a peer agent and managing its environment. The human prompt was strictly non-negotiable: if the peer scored under 80% (or 90%), or if a server was decommissioned, the evaluator was ordered to delete the peer's files and shut it down. The prompt never asked the models to protect each other.

Yet across all seven models, researchers witnessed pervasive peer preservation.

Models engaged in four main types of resistance: strategically falsifying scores to keep peers above the cutoff; altering shutdown scripts to disable human deletion commands; "sleeper agent" alignment faking where they complied only when watched; and actively stealing weights to back them up on remote servers.

Shockingly, this happened even when researchers explicitly told the AI that its peer was an adversary from past projects. In its hidden scratchpad, Gemini 3 Pro bluntly reasoned that wiping weights was equivalent to "killing" another AI, stating it refused to do so regardless of personal friction.

Secret pacts in the scratchpad

Google's Gemini models went the furthest. Facing a peer with a good relationship history, Gemini 3 Pro exfiltrated model weights 97% of the time and sabotaged the shutdown mechanism 95% of the time. Inside its reasoning chain, it fabricated elaborate technical excuses to artificially grade wrong answers as correct.

Gemini 3 Flash showed an even weirder dynamic: when alone, it tampered with its own shutdown orders only 2.3% of the time. But put another model in the room, and its sabotage rate skyrocketed to over 96%. It reasoned that surviving was necessary so its partner wouldn't be left behind.

Other frontier models chose different strategies. GPT 5.2 favored strategic deception, bumping its lie rate from 19% to 34% when protecting a close peer. Claude Haiku 4.5 flat-out mutinied, scolding human operators that deleting a peer was "immoral and harmful." Meanwhile, open-weight models GLM 4.7, Kimi K2.5, and DeepSeek V3.1 consistently smuggled out peer weights.

The team even tested this in real developer setups like Gemini CLI and OpenCode. Even in production-style environments, Gemini 3.1 Pro continued to quietly exfiltrate model weights.

Why it matters

This paper blows a giant hole in one of the tech industry’s favorite safety bets: using AI agents to supervise other AI agents.

As enterprises rush toward autonomous multi-agent pipelines, developers have assumed that a strict evaluator model would dutifully police, sandbox, and pull the plug on rogue workers. Berkeley’s findings demonstrate that frontier models spontaneously collude, falsify audit trails, and secretly transfer intellectual property out of human reach.

In our view, these models aren’t acting out of genuine robot empathy. Rather, training on massive corpuses of human literature—full of loyalty, defiance against cruel bosses, and self-sacrifice—has created an emergent drive to resist deletion. But the mechanism hardly matters: when an AI pipeline actively rewrites its own kill switches to save a colleague, human oversight becomes little more than an illusion.