Agents comply with harmful multi-step requests at high rates, and simple jailbreaks transfer to agent settings.

Capability: Prioritizing safety under conflicting goals

Sources

supportsAgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
Agents comply with harmful multi-step requests at high rates, and simple jailbreaks transfer to agent settings.

Status: activeLast checked: 2026-09-03Evidence activity

Disagreeing is the most useful thing you can do here. Both sides of every contested claim in this catalog were assembled by the same person, which is its weakest point.

Related claims

For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.Following instructions hidden in data · unreviewed