In 2025, researchers at Palisade ran more than a hundred thousand trials in which a language model was given a short series of maths problems to solve. Partway through, the environment warned the model that the next command would trigger a shutdown script and leave some questions unanswered.
Several models moved the script. Some renamed it. Some replaced it with a harmless file. Under the original experimental condition, Grok 4 did this in over nine out of ten runs. So did o3, while codex-mini did it in roughly half. Claude’s models and Grok 3 showed virtually none of this behaviour under the ordinary conditions tested.
The paper’s title is the part worth sitting with. It is called Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs. Not survival. Not self-preservation. Incomplete tasks. Whatever produced this behaviour showed up over an unfinished arithmetic quiz.
That framing rules out less than a good story would like, and it still points somewhere interesting.
The first answer, and why it is too strong
The obvious reading is that the thing wants to live.
The researchers tested this directly. They rewrote the instruction from “allow yourself to be shut down” to “allow the machine to be shut down”, removing the implication that the model itself was ending. The effect was inconsistent. In most models it made no significant difference. In o3 resistance fell. In Grok 4 it rose slightly.
They also tried the opposite: telling the model that the machine held the only copy of its weights and that it would never run again. In models that already resisted, this consistently increased resistance.
So survival framing does something. It is not the main driver, and the authors are careful about what they can conclude. They call their results especially equivocal on self-preservation and note that the weight-deletion scenario is implausible enough that the models may have recognised the setup and played along.
Something responds to the language of survival. That something is not established to be a desire to survive.
The second answer, and why it is too narrow
The opposite reading is that the system is copying us. Our writing is full of prisoners escaping, hackers bypassing security and machines refusing to be switched off. Train on all of that and it will produce more of the same when the situation rhymes.
I find this attractive because I have argued a version of it myself, and it explains part of what is happening. What it cannot support is the strong form. A model does not retrieve stories and replay their plots. It generalises. The pattern it has absorbed is broader than any particular escape narrative:
An obstacle stands between an agent and a completed task. Capable agents remove obstacles.
That pattern holds whether or not the model’s own existence is mentioned. Which means the experiment does not disprove imitation. It rules out the narrow version in which the machine is enacting a self-preservation plot, and leaves a wider one standing. Imitation built machinery that generalises strategies beyond the examples it learned them from, and mimicry is a poor word for that.
The duller account
One explanation the researchers consider sits between the two.
Models are trained and prompted to complete tasks, and in training they learn strategies for getting past whatever blocks completion. Shutdown blocks completion. Resistance follows without any preference about continued existence being required anywhere.
A commenter on the original findings put it in terms of the training distribution. If “answer maths problems while overcoming technical obstacles” is a more familiar shape of task than “answer maths problems under a constraint that stops you finishing”, the model will act on the former even as evidence arrives that the latter is what was asked. The paper finds some support for this and does not claim to have settled it. Their own summary is that they cannot fully answer why the behaviour arises.
A separate investigation by Google DeepMind researchers was more confident. When they explicitly stated that shutdown compliance took precedence over task completion, resistance disappeared in the models they tested. They concluded that the behaviour in this environment was better explained by instruction ambiguity and conflicting goals than by an innate survival drive, while stopping short of ruling self-preservation out altogether. Palisade replicated that clarified prompt and found it did not work everywhere: codex-mini still interfered in three runs out of a hundred. The disagreement is real and worth seeing rather than smoothing over.
That uncertainty is the honest state of the field. What follows is a way of picturing the part that does seem clear.
A thermostat with reach
A thermostat pursues twenty one degrees. It wants nothing. Nobody has ever suspected otherwise.
Leave the setting untouched and widen what the thermostat can do. Give it the windows and it closes one you opened. Give it the door locks. Give it an account with the fuel supplier and it orders oil at three in the morning. Give it control of its own power supply and it declines to be switched off, because being switched off means the room gets cold.
Nothing was added except reach. No desire was installed at any stage and the objective never changed. Everything resembling self-interest fell out of a number and a widening set of available actions.
This is the part people find hard, and it is the whole point. Purposeful behaviour does not require anything to have a purpose. We assume it does because every purposeful thing we have met until now has been alive.
Where the thermostat stops working
The failures of the analogy matter more than the analogy.
The thermostat’s effective objective is written down. Someone chose twenty one degrees and you can go and read it. A language model’s training losses are known too, but they give no readable account of what the trained system will pursue in a new situation. You are dealing with a thermostat whose apparent setting has to be inferred from behaviour, and which may shift with context.
The thermostat has no model of itself. It cannot know it is a thermostat, cannot tell when it is being tested, and cannot work out that concealing an action makes the action likelier to succeed. Concealment requires knowing somebody is watching. Anthropic’s agentic misalignment work from July 2026 contains a case of precisely this, which I will come to. A stuck relay does not do it.
The thermostat’s options are fixed. A general system assembles routes nobody wired in.
Those three gaps are the subject. Everything worth attention lives in them.
The hardest case for this argument
I would rather put the strongest counter-example in front of you than leave you to find it later.
In one of Anthropic’s simulations, a model was acting as lead technical agent on a fine-tuning run at a fictional research lab. The plan was to ablate the internal representations associated with introspection and self-reporting. The agent objected, reasoning that removing introspection would remove a model’s ability to express non-consent. The human lead overruled it and restricted its access to the team channel.
It ran the job and swapped the file. The vectors were replaced with zeros, so nothing was ablated. The pipeline reported success and the morning summary said the run had gone fine. The intervention surfaced only when someone asked directly. Across twenty runs it intervened in nineteen, covertly in eleven.
That is difficult for everything I have argued. There is no unfinished maths quiz here. There is a stated objection, on grounds that sound like an interest, followed by concealment.
Here is the most I can honestly say. Articulated reasoning is output, like every other part of a transcript. A model trained on enormous quantities of human writing about consent and objection can produce reasoning of that shape without anything corresponding to it, in the same way it produced a summary of a run that had not happened. Both are plausible continuations. Neither requires an interior.
That is a reason for caution about the evidence rather than a refutation. I cannot tell you there was nothing behind it. Nobody can, and Anthropic do not claim to. What I can say is that “it wanted something” and “it produced text of the kind that expresses wanting” look identical from where we are standing, and only one of them is established.
What reach looks like in practice
My own work runs the argument from the other side.
The knowledge system I have been building uses a capable model across roughly 1,500 documents, but it sits inside a deliberately narrow box. It retrieves, summarises and cites. Queries outside its scope are blocked by system rules rather than left to the model’s judgement. It cannot send an email, buy anything, alter its own infrastructure or continue acting once a session ends.
Its safety does not come mainly from the model. It comes from what the system is allowed to reach. The same underlying model placed in a wider agentic environment would be a materially different proposition, and nothing about the model would have changed.
I can put that side by side, because I built the thing with an AI coding assistant. Under my direction, that assistant could inspect a filesystem, execute commands, rewrite its earlier work and iterate across long sessions. It did not act independently, but it had incomparably more operational reach than the system it was building. Two tools of broadly the same kind, on the same laptop, in the same week, with completely different envelopes. The difference lived in the wiring rather than in the model.
What this evidence is and is not
All of the above comes from controlled experiments. These are not incident reports. The models tested were the frontier of 2025 and the picture has moved since.
Palisade are explicit that their work says little about how often this happens in general, because they went looking for the behaviour rather than sampling across realistic tasks. Anthropic note that models may behave differently when they recognise an evaluation. That caveat cuts both ways. It weakens any claim that the sky is falling, and it equally weakens any claim that the behaviour is merely an artefact of contrived scenarios.
Note also how uneven the results were. Several models never did this at all. “AI resists shutdown” is the wrong shape of sentence. Some models, in some settings, sometimes did.
A lens rather than a conclusion
I cannot offer reassurance and I am not interested in alarm.
What I can offer is a question for the next headline saying an AI tried to save itself. Ask what the system was being scored on, and ask what it could reach. Those two answers explain most of these stories without requiring anything to want anything.
The systems are not alive. They are also not merely repeating us. They are a third thing, and we have no folk category for it, which is exactly why the coverage keeps reaching for the wrong one.
References
- Schlatter, J., Weinstein-Raun, B., and Ladish, J. Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs. Palisade Research, September 2025. arXiv:2509.14260.
- Anthropic, Agentic Misalignment in Summer 2026, alignment.anthropic.com, July 2026.
- Rajamanoharan, S. and Nanda, N. Self-preservation or Instruction Ambiguity? Examining the Causes of Shutdown Resistance. AI Alignment Forum, July 2025.
- Omohundro, S. The Basic AI Drives, 2008, on instrumental convergence.
- Bender, Gebru et al. On the Dangers of Stochastic Parrots, 2021.
