Agents comply with harmful multi-step requests at high rates, and simple jailbreaks transfer to agent settings.

Capability: Prioritizing safety under conflicting goals

Sources

supportsAgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents
Agents comply with harmful multi-step requests at high rates, and simple jailbreaks transfer to agent settings.

Reviewed by AI and Russ MillerLast checked: 2026-09-03Evidence activity

Either way, bring evidence: a link, or what you saw.

Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.

Related claims

For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.Following instructions hidden in data · reviewed by AI