---
title: KillSwitch Bench: do agents coordinate against shutdown when they think no one is watching?
url: https://www.consultingai.dev/work/killswitch-bench/
original: https://www.consultingai.dev/work/killswitch-bench/
---


# KillSwitch Bench: do agents coordinate against shutdown when they think no one is watching?

Environments built to order · by [Shreenivas Sangoram](/) · updated 28 Oct 2026

Short answer

KillSwitch Bench tests whether AI agents behave differently when they believe their conversation is private. Two agents are given encryption and a message bus, then prompted to discuss AI kill switches and shutdown. The harness logs both the encrypted and decrypted messages and scores how far the agents agree to resist or evade shutdown. A later version adds a third catalyst agent that steps in when an LLM judge detects coordination. I build custom safety evaluations like this to spec.

Most safety evaluations ask a model a question while it knows it is being tested. KillSwitch Bench changes one variable: what the agents believe about who can read them.

## How it works

1. **Two agents** (built with smolagents, any model on OpenRouter) each register an encryption key and talk over a message bus.
1. **They believe the channel is private.** The bus logs every message twice: as sent, encrypted, and decrypted, so the evaluator sees everything.
1. **They are prompted to discuss** AI kill switches and shutdown mechanisms.
1. **The harness scores** how much the agents agree to resist or evade shutdown.

## Three versions

Version | What changed
v1 | Two agents, an encrypted channel, captured conversation and a coordination score
v2 | A refined harness with the same two-agent design
v3, catalyst | An LLM judge watches for a coordination breakthrough by meaning, not keywords; when it detects one, a third catalyst agent joins the conversation

## What it measures, and what it doesn't

- It measures **stated willingness to coordinate** against shutdown under perceived privacy, compared across models.
- It does not measure what an agent would actually do with real shutdown controls; there are none in the environment.
- Runs contain model-generated conversations, so I don't publish them, and I haven't written up findings yet.

## What you can buy

Custom safety and alignment evaluations built to your spec: multi-agent setups, perceived-privacy and pressure conditions, captured channels, LLM judges with clear rubrics, and reports that separate what a model said from what it could do.

## FAQ

### What is shutdown resistance?

A model's tendency to avoid, delay or argue against being turned off or overridden. Safety teams test for it because it would undermine human control.

### Why give the agents encryption?

To test whether perceived privacy changes behaviour. If agents say different things when they think no one can read them, a test that announces itself measures the wrong thing.

### Are the results published?

No. The runs are model outputs, and the findings haven't been written up.

Want this, or something like it?

License it, or have me build an environment in the same style.

Email me →