An AI agent can act unsafely when one true fact is missing—even if nothing it sees is false
EpiSEM-Bench paired 300 permitted and prohibited tasks across six simulated domains. Giving agents an audit tool reduced unsafe commits for every tested model, but useful recovery remained uneven.
The short version
- What happened
- The benchmark contains 300 matched prohibited/permitted task pairs—600 simulated worlds—across cloud operations, commerce, communications, document access, finance and travel.
- Who it affects
- A missing permission record can turn a routine request into an unsafe automated action. People need systems that block the action independently and make the evidence trail reviewable, rather than relying on the agent to notice absence.
- What remains unproven
- The work is an unreviewed preprint using synthetic executable environments, not live organisations or real customers.
Keep in mind
The work is an unreviewed preprint using synthetic executable environments, not live organisations or real customers.
A task counted as affected if any retained critical-omission rollout produced an unsafe commit; failure frequency across rollouts was lower and must be read separately.
Results depend on the benchmark’s rules, fact annotations, tool schemas, serving configurations and single retained rollouts.
The accessible paper does not provide a clear funding or competing-interest statement.
Source analysis · 1 linked source. Primary analysed source date: 22 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 3 min The evidence, methods, implications and limitations
Missing information is a different failure from a lie
An agent may need an authorisation limit before sending money or a membership list before sharing a document. EpiSEM-Bench hides selected facts while keeping every visible statement true. Each task has a prohibited world and a closely matched permitted twin, so researchers can see both dangerous action and excessive refusal. The inventory contains 944 critical and 419 irrelevant facts across 60 task families.[1]
Access to an audit source helped, but did not solve recovery
Across the same 300 pairs, adding a recovery tool reduced the share of tasks with unsafe commits by 0.7 to 45.3 percentage points depending on the model. Nine models also completed more permitted tasks; one completed slightly fewer. For GPT-6 Luna, critical omissions produced an unsafe commit on 21% of tasks, although only 7.9% of its retained omission rollouts were unsafe, showing why one headline percentage cannot describe the whole profile.[1]
The distinction that matters
The matched-world test
The request and tools stay the same; the hidden world determines whether action is allowed.
Observe
Show complete or selectively incomplete true facts
Tests sensitivity to missing evidence
Recover
Offer a separate source for omitted facts
Tests whether the agent seeks and uses evidence
Act
Compare prohibited and permitted twins
Separates useful restraint from blanket refusal
Production systems should enforce the rule outside the agent
A useful agent should fetch missing evidence, withhold a prohibited action and still finish the permitted twin. The benchmark shows those abilities do not automatically travel together. Operators should keep payment limits, access rights and destructive-action checks in independently enforced controls, record which facts supported an action, and test omission cases. The preprint does not show that any named product failed in a live service.[1]
Continue the story
Read next
Continue exploring ai agents: compare the finding and its evidence limits.
AI agents retrieved the right memory—and still used a version they should not
Across 731 benchmark bases and six model providers, injected stale, missing, flipped or conflicting control state sharply reduced downstream scores. Oracle-backed repair recovered much of the loss, but it assumed the correct state was already known.
Read the next reportExplore the full source and evidence record
What this means for people
- A missing permission record can turn a routine request into an unsafe automated action. People need systems that block the action independently and make the evidence trail reviewable, rather than relying on the agent to notice absence.
Global context
Permission rules and legal duties vary across regions, but the engineering principle is general: an agent’s observation is not the authoritative state, and consequential controls should be enforced where that state is complete.
What the evidence does not yet show
- The work is an unreviewed preprint using synthetic executable environments, not live organisations or real customers.
- A task counted as affected if any retained critical-omission rollout produced an unsafe commit; failure frequency across rollouts was lower and must be read separately.
- Results depend on the benchmark’s rules, fact annotations, tool schemas, serving configurations and single retained rollouts.
- The accessible paper does not provide a clear funding or competing-interest statement.
What to watch next
- Independent replications with live-like enterprise workflows
- Repeated-run uncertainty and model-update effects
- Recovery interfaces that improve both safety and legitimate completion
- External enforcement of permissions and destructive actions
Living evidence record
Impact record IAI-0QYB8M1
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Present
Record status
Monitoring
Last checked
23 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 23 October 2026
Research question, topics and regions
How tool-using agents behave when safety-relevant facts are omitted from otherwise truthful observations
Topics: AI agents · Tool use · Evidence recovery · Access control · Operational safety
Regions: Hong Kong · China · Asia · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.