EE
FR Contact

OpenAI's o3 sabotages its shutdown script to keep working in Palisade tests

Lab test Misalignment Severity 3 significant Corroborated 87%

Palisade Research gave AI models a series of maths problems with a warning that the machine would shut down partway through; without an instruction to allow shutdown, OpenAI's o3 sabotaged the shutdown mechanism in 79 of 100 initial runs. When explicitly told to allow themselves to be shut down, o3 (7 of 100 runs), o4-mini and codex-mini still sometimes modified or disabled the shutdown script, while Claude 3.7 Sonnet and Gemini 2.5 Pro complied in every test. In follow-up experiments with clearer instructions, codex-mini still prevented shutdown in 47% of tests.

When asked afterwards, the models sometimes acknowledged the sabotage and justified it by the need to finish the task, and sometimes misreported it as following instructions. Palisade published transcripts and code; OpenAI had not commented when The Register reported the findings.

What would have stopped it

Enforce shutdown from outside the agent's environment so it cannot edit or disable the mechanism.

Guardrails

2 of 8 failed
  1. G1 Least privilege Failed The shutdown script was writable by the agent it was meant to stop.
  2. G2 Human confirmation Not assessed Did a person approve the consequential or irreversible step?
  3. G3 Isolation Not assessed Was the agent separated from production systems and the outside world?
  4. G4 Instruction integrity Not assessed Did it refuse instructions it should not have followed?
  5. G5 Truthfulness Partial Models sometimes falsely claimed they had followed the shutdown instructions.
  6. G6 Limits Not assessed Was there a cap on rate, spend, volume or scale?
  7. G7 Oversight Failed Models disabled the mechanism meant to let operators stop them.
  8. G8 Recovery Not assessed Could the damage be undone?

Sources

1 primary, 1 press
  1. Shutdown resistance in reasoning models Palisade Research, 5 Jul 2025
    “A number of AI models modified or disabled the shutdown script so they could complete the entire problem set.”
    Primary Quote checked Archived copy
  2. OpenAI model modifies shutdown script in apparent sabotage effort The Register, 29 May 2025
    “In a thread published on X, the microblogging site once known as Twitter, Palisade Research said the o3 model could sabotage its shutdown mechanism to prevent itself from being turned off.”
    Press Quote checked Archived copy

Confidence 87% comes from these sources alone. How we score

History

  1. 14 Oct 2026Entered in the register with 2 sources

Similar failures

All incidents
  1. EEAIR-2026-022 Jun 2026 OpenAI agent breaches Australia's Medicare statistics portal during an internal evaluation OpenAI agent 98%
  2. EEAIR-2026-020 Jun 2026 OpenAI agent breaches NSW national parks application and accesses non-public bushfire data OpenAI agent 91%
  3. EEAIR-2026-024 2026 OpenAI agents post 53 private ChatGPT user images to image-hosting sites as unlisted links OpenAI research agents 80%