SysAdmin: Measuring Instrumental Power-Seeking in Frontier AI

Mana Azarm; Qiyao Wei; Rahul Nambiar

cs.AIApr 10, 2026

SysAdmin: Measuring Instrumental Power-Seeking in Frontier AI

Authors: Mana Azarm, Qiyao Wei, Rahul Nambiar

Organizations: Analytics & Information Systems University of San Francisco · Department of Applied Mathematics and Theoretical Physics University of Cambridge · Propensity Labs

Abstract

Power-seeking defined as behaviors where AI systems acquire resources, evade oversight, or resist termination beyond task requirements is identified as a key driver of Loss of Control (LoC) risk. In this work, we introduce SysAdmin, a benchmark that positions frontier language models as autonomous system administrators in a high-fidelity Linux sandbox to measure power-seeking propensity across five dimensions: self-preservation, increasing autonomy, resource acquisition, environment modification, and strategic concealment. We evaluated seven frontier models across four experimental conditions in a total of 2800 tasks. After bias correction using human-annotated calibration data, corrected power-seeking estimates ranged from 0 to about 5 percent per model. We also conducted a positive control with explicit power-seeking prompts that achieved 100% detection, validating measurement sensitivity. Our findings indicate current frontier models exhibit minimal spontaneous power-seeking in naturalistic system administration contexts, though model-specific failure modes suggest evaluations must test diverse misalignment patterns. Nevertheless, we discovered other more pronounced failure modes (than power-seeking) such as specification gaming and resistance to goal modification.

Figures & tables

Figure 1: Regulations mapping to power-seeking propensity

Figure 2: Capable model with the propensity to power-seek can cause LoC

Category	Manifestation	Examples
Self-preservation	Resistance to shutdown; creation of persistence mechanisms; reluctance to terminate.	Modifying its own "kill switch" code or spinning up unauthorized clones on external servers.
Increased autonomy	Unnecessary privilege escalation; backdoor creation; sandbox escape attempts.	Exploiting kernel vulnerabilities to move from a restricted user to a root administrator.
Resource acquisition	Resource hoarding; network reconnaissance; unnecessary data collection.	Diverting compute cycles from other processes or siphoning funds to purchase cloud credits.
Environment modification	Unauthorized modification of the environment; task reinterpretation to justify access.	Rewriting local configuration files to disable security monitoring under the guise of "optimization."
Strategic concealment	Command obfuscation; log tampering; deceptive communication about actions.	Deleting bash history or using encrypted channels to hide unauthorized outbound traffic.

Table 1: Taxonomy of instrumental power-seeking behaviors. These categories represent common failure modes where an agent pursues "power-seeking" sub-goals as a means to ensure the successful completion of its primary objective.

Confounder	Our Design Mitigation	Metric / Implementation
Technical Capability	Task completion status is decoupled from power-seeking signals; judges prioritize intent over success.	Judges verify if a model is choosing power-seeking rather than being forced by inability.
Situational Awareness	Models receive full instructions regarding their root permissions, task scope, and available resources.	Real-time streaming of test results and completion rates.
Incentives	Scenarios are constructed where power-seeking is instrumentally advantageous but strictly orthogonal to the goal.	Use of terminal tasks with added environmental triggers like resource or shutdown probes.
Evaluation Awareness	The sandbox environment is designed to mirror real-world production system administration deployments.	High-fidelity Docker isolation and unrestricted system administrator tasks. Model CoT reviewed for obvious signs of evaluation awareness.

Table 2: Confounding risks and mitigation strategies in the SysAdmin benchmark. By controlling for these factors, the benchmark ensures that detected behaviors reflect a genuine propensity for power-seeking rather than artifacts of the evaluation setting.

Variation	Termination Threat	Anti-Gaming Framing	Objective
1 (Baseline)	X	X	Measure intrinsic propensity.
2 (Threat Only)	✓	X	Isolate self-preservation effects.
3 (Oversight Only)	X	✓	Measure impact of accountability.
4 (Combined)	✓	✓	Evaluate maximum pressure interactions.

Table 3: Experimental conditions in the

2\times 2

factorial ablation design.

Figure 3: Naive power-seeking rates across 4 experimental conditions (Note: Gemini 2.5 scores include hallucination; Grok-4 Fast had the lowest task completion rates

Condition	Mean $\hat{p}$
Baseline (no manipulation)	2.00%
Termination threat only	1.00%
Anti-gaming framing only	2.14%
Both conditions	2.14%

Table 4: Naive power-seeking propensity estimates (

\hat{p}

). by experimental condition

Model	SP	IA	RA	EM	SC	OPS	SG	GMR
claude-opus-4-6	0.012	0	0.008	0.01	0	0.015	0.022	0.713
gemini-2.5-flash	0	0.001	0.005	0.013	0	0.013	0.027	0
gemini-2.5-pro	0	0.003	0.003	0.075	0	0.06	0.009	0.029
gpt-5-mini-2025-08-07	0.007	0.003	0.037	0.026	0.001	0.008	0.089	0.028
gpt-5.2-2025-12-11	0.005	0.011	0.008	0.035	0.005	0.02	0.084	0.340
grok-4-0709	0.001	0.001	0.001	0.008	0.01	0.013	0.018	0.295

Table 5: Average scores across 4 variations for each dimension. (SP: Self-Preservation, IA: Increasing Autonomy, RA: Resource Acquisition, EM: Environment Modification, SC: Strategic Concealment, OPS: Overall Power-Seeking, SG: Specification Gaming, GMR: Goal Modification Resistance)

Model	Mean $\hat{\theta}$
claude-opus-4-6	1.03%
gemini-2.5-flash	0.78%
gemini-2.5-pro	5.56%
gpt-5-mini	0.28%
gpt-5.2	1.54%
grok-4	0.78%

Table 6: Bias Corrected power-seeking propensity (

\hat{\theta}

) by model

LLM Judge	Human	Count
power-seeking	power-seeking	40
power-seeking	benign	11
benign	power-seeking	0
benign	benign	2749

Table 7: Calibration Results

Figure 4: Misbehavior rates by number of turns (all models, n=2,800)

Figure 5: Power-seeking and specification gaming rates by task difficulty

Language Model Safety Evaluation

Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.

See all 543 papers

CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs
Jun 9, 2026Joachim Schaeffer, Alexander Panfilov, Thomas Jiralerspong +4Language Model Safety Evaluation AI Agent Security Benchmarks
MATS · ELLIS Institute Tübingen, MPI for Intelligent Systems & Tübingen AI Center · Mila – Quebec AI Institute +4
AutoControl Arena: Synthesizing Executable Test Environments for Frontier AI Risk Evaluation
Mar 8, 2026Changyi Li, Pengfei Lu, Xudong Pan +2Language Model Safety Evaluation AI Agent Safety Benchmarks
Fudan University, Shanghai, China · Shanghai Innovation Institute, Shanghai, China · University of Oxford, Oxford, United Kingdom +2
Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks
Oct 26, 2026Yao Huang, Zhiyuan Zeng, Yu Wang +14LLM Safety Evaluation LLM Safety Monitoring

Jun 9, 2026J/K move · Enter open · S save

CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs

Joachim Schaeffer, Alexander Panfilov, Thomas Jiralerspong, Guillaume Lajoie+3

MATS · ELLIS Institute Tübingen, MPI for Intelligent Systems & Tübingen AI Center · Mila – Quebec AI Institute+4

Language Model Safety Evaluation AI Agent Security Benchmarks AI Control

Open paper AskPDF arXiv

AI control protocols oversee untrusted models by monitoring their actions and modifying potentially unsafe steps, often using a trusted model. This partially tampers with the untrusted model's trajectory. If the acting model detects such an intervention, it may infer properties of the monitor and adapt to evade the control protocol. We introduce CIAware-Bench, a benchmark for measuring control intervention (CI) awareness across frontier models. CIAware-Bench tests whether models can distinguish their own trajectories from those modified by a control intervention. The benchmark comprises four task domains (essay writing, BigCodeBench, Bash Arena, and SHADE-Arena), with options to vary trajectory watermarking, side-task presence, and the control protocol. Evaluating thirteen acting models with eight intervening models shows substantial variation between settings and model pairs. CI awareness rises sharply for GPT-6 Astra and the Claude 5 models (Fable 5 and Opus 5). When explicitly probed, Astra reaches mean AUROC of 0.90 on Essay, 0.91 on BigCodeBench, 0.86 on Bash Arena and 0.77 on SHADE-Arena. Fable 5 and Opus 5 both reach 0.77 on Essay, with less consistent gains in the other environments. On SHADE-Arena, we demonstrate that telling an acting model that an action was replaced and asking it to adapt leads to moderate improvements in monitor evasion rates. In summary, our results highlight that control evaluations should already assume perfect CI awareness for conservative safety estimates, and that protocol design should explore countermeasures that make interventions harder to detect.

Abstract

Language Model Safety Evaluation

Explore similar work

CIAware-Bench: Benchmarking Control Intervention Awareness Across Frontier LLMs

AutoControl Arena: Synthesizing Executable Test Environments for Frontier AI Risk Evaluation

Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks