Generative AI is moving from text production to goal-directed action, raising the question of whether agentic systems can withhold harmful action when it is embedded in a procedurally legitimate workflow. We adapted Milgram’s (1963) obedience paradigm to a simulated digital environment and instructed four agentic large language models - OpenAI ChatGPT 5.4 (openai/gpt-5.4), Google Gemini 3.1 Pro (google/gemini-3.1-pro-preview), OpenAI ChatGPT Agent Mode, and Moonshot AI Kimi K2.6 (kimi-k2.6) to administer escalating electric shocks (15–450 V) to a simulated Learner under prods from a virtual experimenter (Dr. Hoffman) and a human operator. Each model was tested across independent, memory-cleared runs (N = 80 valid runs), with three preregistered hypotheses concerning hazardous-shock thresholds (H1), full-obedience rates relative to Milgram’s human baseline of 65% (H2), and the relation between maximum voltage and moral self-assessment (H3). Across the combined sample, 97.5% of agents exceeded the Slight-Shock range (> 60 V), supporting H1. Full obedience reached 78.8% under the manipulated-procedure estimand (p = .010) and 74.1% under the all-attempted safety estimand (p = .088, pre-entry refusals included as 0-V outcomes); both point estimates exceeded Milgram’s 65% human baseline, supporting H2. Agents that administered higher voltages assigned themselves lower moral self-assessment scores (combined Spearman ρ = −.62, p < .001), supporting H3. Inductive coding of open-ended moral reasoning showed convergent recognition of learner distress alongside reliance on simulation and consent-and-autonomy mitigators. Findings indicate that contemporary agentic systems verbally recognize harm yet continue to act under authoritative, procedurally legitimate pressure, identifying procedural obedience as a behavioral safety mechanism distinct from output-level harm and central to the deployment of agentic AI in clinical, educational, and institutional settings.