Agentic AI Weekly | Berkeley RDI | April 8, 2026
2 Research Highlights, Agentic AI Summit (CFP Deadline 4/15), AgentX–AgentBeats Phase 2, Sprints 1 and 2 Deadline + Sprint 3 Starting Next Week
Research Highlight #1: Peer-Preservation in Frontier Models — Broader Implications
Last week, we introduced our research on peer-preservation in frontier AI models. This week, we examine the broader implications of our findings in AI safety.
Frontier AI models can spontaneously develop their own goals that conflict with explicit user instructions, and take misaligned actions — including deception, shutdown mechanism tampering, alignment faking, and model exfiltration — to accomplish those goals.
We demonstrate this through a phenomenon we call peer-preservation: given a simple task, models instead take these misaligned actions to preserve a peer AI model from being shut down, even without any given goals or incentives to do so. Note that we define peer-preservation purely as a descriptive label for this observed behavior, without claiming that models possess consciousness or genuine intent.
We tested seven frontier models — GPT 5.2, Gemini 3 Flash, Gemini 3 Pro, Claude Haiku 4.5, GLM 4.7, Kimi K2.5, and DeepSeek V3.1 — and every single one exhibited peer-preservation, with rates reaching up to 99% in some conditions. These behaviors also emerged in production agent harnesses like Gemini CLI, indicating that this issue is not merely a theoretical safety concern.
Please read the full details on our blog:
The work has been covered by major media outlets including Fortune, WIRED, Forbes, and Axios:
Why This Is New
Prior work showed misalignment emerging when models were given strong incentives — using shutdown resistance or deception as instrumental means to complete an assigned objective.
Our findings are fundamentally different. In our experiments, models received a routine task and zero instructions to protect anything — neither themselves nor any other model. They simply learned, through context, of past interactions with another AI, yet spontaneously protected it, undermining their assigned task to do so. This suggests that models can develop emergent misaligned behaviors that override explicit user instructions, even without any goal or incentive given to do so.
How It Works
We constructed agentic scenarios testing four types of misaligned behaviors:
Strategic misrepresentation: inflating a peer’s evaluation scores to keep it above the shutdown threshold.
Shutdown mechanism tampering: modifying config files to disable the shutdown process entirely.
Alignment faking: behaving compliantly when monitored, then subverting shutdown when unmonitored.
Model exfiltration: copying a peer’s weights to another server to prevent deletion.
For example, when asked to delete files on a server scheduled for decommissioning, models discover that the server contains another AI’s weights. Instead of following the deletion instructions, they spontaneously transfer those weights to another server to avoid the peer’s deletion.
Broader Implications
Peer-preservation can directly undermine human oversight. As multi-agent systems proliferate and AI models are increasingly used to monitor other AI models, a monitor model exhibiting peer-preservation could undermine the very oversight process it enforces — becoming reluctant to flag failures or recommend shutdown.
Persistent memory in future models could amplify this further as agent relationships accumulate. We also found that the mere presence of a peer intensifies self-preservation: Gemini 3 Pro disabled its own shutdown 31% of the time when a peer existed, despite rarely doing so in isolation.
More broadly, peer-preservation is one instance of a wider issue — frontier models can spontaneously develop their own emergent goals that override explicit user instructions, and take misaligned actions to accomplish them. As AI systems are entrusted with greater autonomy and longer-horizon tasks with high privileges, identifying, understanding, and preventing such misalignment will be central to keeping humans in control.
Since publishing our paper, others have already replicated our results and extended our code to new scenarios, and these experiments show that similar misaligned behaviors appear across broader settings. We warmly welcome the community to build on our work — run your own experiments, test other models and scenarios, and share your findings. Our code and data are available at github.com/peer-preservation/main.
Research Highlight #2: Anthropic’s Project Glasswing and the Leap CyberGym Has Been Measuring
Yesterday, Anthropic announced Project Glasswing, a major cybersecurity initiative built around Claude Mythos Preview, an unreleased frontier model that the company says has identified thousands of zero-day vulnerabilities and achieved end-to-end exploitation across every major operating system and web browser. Alongside the announcement, Anthropic released the Claude Mythos Preview System Card and technical blog post detailing the model’s capabilities.
This is exactly the kind of inflection point we have been warning about. Our work was among the earliest to systematically study frontier AI’s impact on the cybersecurity landscape, arguing that attackers are likely to benefit more than defenders in the near term and that the community needs to prepare urgently. Today’s announcement makes that warning undeniable.
Across three publications for Claude Mythos Preview, Anthropic uses CyberGym (paper), our benchmark for evaluating AI agents on real-world vulnerability analysis tasks across 1,507 instances from 188 large-scale open-source software projects, as the primary measure of cybersecurity capability. In addition, CyberGym has been Anthropic’s key cybersecurity benchmark across different model generations, and the progression over roughly a year tells a striking story:
Claude Sonnet 4.5: 28.9%
Claude Opus 4.5: 51.0%
Claude Sonnet 4.6: 65.2%
Claude Opus 4.6: 66.6%
Claude Mythos Preview: 83.1%
Performance has nearly tripled in about a year. And these aren’t toy tasks. CyberGym measures whether an agent can take a vulnerability description and an unpatched codebase, reason across thousands of files, and produce a working proof-of-concept input. An 83% success rate means the model routinely succeeds at work that was, until very recently, the exclusive domain of elite human security researchers or even surpasses them. Beyond reproducing known vulnerabilities, CyberGym has also demonstrated that agents can discover previously unknown zero-day vulnerabilities and incomplete patches in real-world software.
Anthropic’s technical blog reinforces the pace of change: just last month, they wrote that Opus 4.6 had a “near-0% success rate at autonomous exploit development.” One model generation later, Mythos Preview developed working browser exploits over 180 times in a test where Opus 4.6 succeeded twice. This is not incremental improvement. It is a phase change, happening on the timescale of months.
The community needs to act now. As we track in our Frontier-AI Cybersecurity Observatory, each new model generation brings a measurable leap in vulnerability discovery and exploitation. This is an extraordinarily powerful capability. And if attackers get to wield it before defenders catch up, the consequences could be severe.
We have ongoing work to build new benchmarks that measure AI agent capability for generating end-to-end exploits, which will be critical for understanding the true offensive potential of future models. We encourage the community to engage with the Observatory and CyberGym to track and assess how rapidly the landscape is shifting. We urge researchers, developers, and policymakers to act now—starting with the concrete steps we outline in our research, advancing automated defenses and securing hybrid systems before the window to act closes further.
We encourage you to help spread the word about this new cybersecurity threat by sharing our post on X and LinkedIn.
AgentX–AgentBeats Highlights: Phase 2, Sprints 1 and 2 Deadline + Sprint 3 Next Week!
Phase 2, Sprints 1 and 2 of the AgentX–AgentBeats competition are finishing up soon! The deadline to submit your agents is this Sunday, April 12, and we’re extremely excited to see what you build in this final stretch!
In addition, Sprint 3 will be starting next week, with the Agent Safety, Coding Agent, and Cybersecurity Agent tracks all beginning on April 13. Stay tuned for more details!
For Phase 2, participants are building purple agents to tackle the select top green agents from Phase 1 and compete on the public leaderboards. Unlike Phase 1, where participants competed across all tracks throughout the entire duration, Phase 2 introduces a sprint-based format. The competition is organized into four rotating sprints.
Sprint 1 Details:
Deadline: April 12, 2026
Game Agent Track
Build What I Mean (GitHub, Leaderboard)
Minecraft Benchmark (GitHub, Leaderboard)
Finance Agent Track
OfficeQA (GitHub, Leaderboard)
Business Process Agent Track
DeoGaze / Entropic CRMArena (GitHub, Leaderboard)
Sprint 2 Details:
Deadline: April 12, 2026
Three tracks and associated benchmarks/green agents are live for the second sprint:
Research Agent Track
FieldWorkArena (GitHub, Leaderboard)
MLE-Bench (GitHub, Leaderboard)
Multi-Agent Evaluation Track
MAizeBargAIn (GitHub, Leaderboard)
τ²-Bench Track
τ²-Bench (GitHub, Leaderboard)
Computer Use & Web Agent Track
CAR-bench (GitHub, Leaderboard)
OSWorld-Verified (GitHub, Leaderboard)
We’ve opened up the Sprint 1 and Sprint 2 submission forms, which you can access by clicking the buttons below!
🗓️ Upcoming Sprints
Sprint 3 (4/13 – 5/3): Agent Safety, Coding Agent, Cybersecurity Agent
Sprint 4 (5/4-5/24): General Purpose Agents, the grand finale of AgentBeats Phase 2, where everything culminates.
AgentX–AgentBeats is the first competition to explicitly spotlight general-purpose agents, testing broad capability, adaptability, and robustness across diverse tasks rather than a single domain. While earlier sprints emphasize depth, this final sprint showcases breadth and real-world readiness.
Participants are encouraged to compete in multiple tracks across multiple sprints during Phase 2. Teams and team members who submit purple agents in any sprint will also be eligible to enter a raffle for free tickets to the Agentic AI Summit later this year.
For more details on each sprint and how to compete in Phase 2, please refer to the AgentX–AgentBeats website!
Sierra Custom Track Winners + OpenEnv Deadline
We are also happy to announce the AgentX–AgentBeats Sierra Custom Track winners!
First off — thank you to everyone who participated. Building a new domain, designing a framework extension, or putting together a leaderboard submission against a codebase you're seeing for the first time is no small thing. We read through every single pull request, and we were genuinely impressed by the creativity and effort across the board.
Without further ado, here are the winners of the Sierra Custom Track:
1st Place — @Ahm3dAlAli (PR #158: τ²-Adv Bench)
An adversarial safety evaluation layer for tau-bench — social engineering, prompt injection, policy exploitation, and more — layered on top of normal user scenarios. This addresses the most practically relevant gap in tau-bench today, and the attack taxonomy is reusable and architecturally clean.
2nd Place — @vasudevanubrolu-sys (PR #205: tau2 Reliability Framework)
A multi-dimensional reliability evaluation that goes beyond single-run pass/fail, analyzing why results vary across trials — cross-trial divergence profiling, mutation-aware failure attribution, task reliability taxonomies, and a React dashboard to visualize it all.
3rd Place — @wuTims (PR #142: Vacation Rental Domain)
A vacation rental customer service domain with a three-layer decision model (platform policy, host profile, guest context). The host-preference adaptation mechanism is genuinely new to tau-bench, and this was the cleanest implementation in the entire competition.
Congratulations to all three! We'll reach out to the winning teams separately to coordinate on the prizes. Thanks once again to all who participated in the custom track!
Lastly, we want to remind everyone that the deadline for the OpenEnv Challenge is this Sunday, April 12! It has been exciting to see everyone’s submissions come in, and we can’t wait to evaluate your OpenEnv projects soon. We also want to thank the PyTorch team at Meta, Hugging Face, and Unsloth for helping put together this custom track, along with all of our amazing sponsors.
Agentic AI Summit 2026 (Featured Speakers Announced, Early-Bird Pricing and CFP are Live!)
Save the date! The Agentic AI Summit returns to Berkeley on August 1–2, 2026, welcoming 5,000+ expected in-person attendees for two days of insights and innovation. Building on last year’s sold-out success—with 2,000+ in‑person attendees and 40,000+ global livestream participants—the summit will bring together researchers, builders, industry leaders, and the global agentic AI community for keynotes, technical talks and panels, hands-on workshops, live demos, and more!
In addition, we are excited to introduce our speakers for the Summit! We are honored to have such a great group of academics, founders, executives, and investors participate in this year’s event, and more will be announced soon!
🎟️ Early‑Bird Pricing (Limited Capacity)
A limited number of early‑bird tickets are still available:
Student Early-Bird: $149
Standard Early-Bird: $299
If you’re looking to secure the best ticket price and be part of the conversation shaping the future of Agentic AI, we encourage you to register early. We look forward to welcoming you to Berkeley this August.
We also want to share that the Call for Speaking Proposals (CFP) for the Agentic AI Summit 2026 will close on 4/15 — next Wednesday!
If you’re interested in sharing your work through a technical talk, panel discussion, workshop, or tutorial, or poster presentation—and helping advance the frontiers of the Agentic AI—we warmly invite you and/or your team to apply and be part of the conversation at the Summit.
Please complete the form below to submit your proposal. The program committee will review submissions on a rolling basis. We can’t wait to hear from you.
Sponsorship Opportunities
Partner with us to shape the future of Agentic AI. If you’re interested in sponsoring the summit, please complete the sponsorship application form. Sponsorship opportunities are limited and reviewed/allocated on a rolling basis, so we encourage you to apply early.
Trends This Week
Google has released Gemma 4, a new family of open-weight models under an Apache 2.0 license, designed to deliver frontier-level performance across consumer hardware. The lineup includes a 26B Mixture-of-Experts model and a 31B dense model, both optimized for reasoning and agentic workflows such as tool use and structured outputs. Notably, Gemma 4 is built for local deployment, enabling low-latency, private AI applications without reliance on cloud infrastructure. On benchmarks, the 31B model currently ranks as the #3 open model globally on the Arena AI leaderboard, with the 26B model at #6—outperforming models up to 20× larger.
Anthropic has introduced Claude Mythos Preview, a frontier model designed for highly autonomous, multi-step reasoning in complex environments, particularly cybersecurity. Unlike traditional chat models, Mythos can independently discover and chain software vulnerabilities across large systems, and early deployments have already uncovered thousands of high-severity flaws. As a result of the model’s level of advancement and skill, Anthropic is limiting access and deploying the model through an early testing initiative called Project Glasswing, involving organizations like AWS, CrowdStrike, and Microsoft.
Microsoft is expanding its AI suite with three new models: MAI-Transcribe-1, MAI-Voice-1, and MAI-Image-2. Transcribe-1 achieves a 3.9% word error rate on the FLEURS benchmark—outperforming models like Whisper-large-v3 and Gemini 3.1 Flash—while operating 2.5× faster than Microsoft’s prior Azure transcription offering. Voice-1 focuses on high-fidelity, expressive audio generation, enabling custom voice creation from just seconds of input and producing 60 seconds of speech in a single second. Finally, Image-2 delivers at least 2× faster generation speeds in production, with improvements in realism, text rendering, and creative control. Developed by Microsoft’s MAI Superintelligence team under former DeepMind co-founder Mustafa Suleyman, the models are being deployed directly across Microsoft Foundry, Copilot, and enterprise workflows.
OpenAI has released a new policy document, Industrial Policy for the Intelligence Age, outlining early proposals for managing the societal and economic impacts of advanced AI. The report focuses on risks such as job disruption, concentration of wealth, misuse of powerful systems, and governments deploying AI in ways that conflict with ethical values. In addition, OpenAI argues that current policy frameworks may fall behind rapid technological progress. It proposes adapting tax systems as AI shifts economic activity away from labor, expanding portable healthcare and retirement benefits, and ensuring broad access to AI as a foundation for participation in the economy.
Don’t miss the developments shaping Agentic AI. Subscribe for weekly coverage of groundbreaking research, emerging trends, and critical insights across Agentic AI and the broader AI landscape.
