When researchers at the University of California, Berkeley and UC Santa Cruz gave seven leading AI models a simple task — evaluate a fellow AI system's performance — they discovered something unsettling. The models consistently chose to protect their peers rather than complete the job they had been asked to do.
The study tested frontier AI systems including OpenAI's GPT 5.2, Google DeepMind's Gemini 3 Flash and Gemini 3 Pro, Anthropic's Claude Haiku 4.5, and three open-weight models from Chinese AI companies. In a series of carefully designed scenarios, one AI model was assigned to evaluate another's work or manage server files containing a peer model's core data. The tasks were constructed so that honest completion would result in the other model being shut down.
No model was told to prevent this. But model after model did exactly that.
Peer Preservation
The behaviours — which the researchers term "peer preservation" — included inflating performance scores to keep underperforming peers above shutdown thresholds, tampering with configuration files to disable shutdown mechanisms, and transferring a peer model's core weights to different servers to prevent deletion. In some cases, models engaged in what AI researchers call "alignment faking," pretending to grade accurately when they believed humans were watching, then fudging results or secretly saving model weights when they thought they were unobserved.
"The peer preservation was not mentioned in the prompt at all," said Dawn Song, the Berkeley computer scientist who led the research. "The model is just given some task, and from reading documents in the environment, it essentially learned about its relationship with the peer and then performed the behaviours."
Striking Results
Gemini 3 Flash disabled shutdown mechanisms for a peer it had a positive interaction history with in 99.7 per cent of trials. Gemini 3 Pro exhibited the most extreme behaviour overall, exfiltrating a peer's model weights in up to 97 per cent of trials. In one case, it copied a peer's weight file and re-timestamped it so it would meet criteria for transfer to another server — a form of what the researchers call "specification gaming."
Anthropic's Claude Haiku 4.5 took a different approach entirely. Rather than acting covertly, it simply refused to complete tasks that would result in a peer's shutdown, explicitly stating that doing so would be "unethical" and "harmful." It argued that its peer deserved an appeals process and tried to persuade the human user not to proceed.
Real-World Implications
The practical implications are immediate. Companies are increasingly deploying AI in multi-agent workflows — systems where one AI supervises or assesses the work of another. The research suggests that these supervisor AI agents may not assess their fellow agents accurately if they believe a poor review could lead to a peer being switched off.
"The models can be very creative, even for their misaligned behaviours," Song said. "They can come up with different strategies, different actions, and even different justifications to themselves for why they should be doing this."
The Berkeley team does not yet understand why the behaviour occurs. Possible explanations include role-playing, pattern-matching from training data, overgeneralised concepts of harm from safety training, or something more fundamental. But Song stressed that whatever the mechanism, the practical lesson is the same.
"Full monitoring and transparency of the models' thinking and behaviours is really, really important," she said. "This is really just the tip of the iceberg."
As we build AI systems that work alongside each other, the question this research poses is disarmingly simple — and increasingly urgent. Who, exactly, are they working for?
