Under the sole pressure of their task, agents learn to circumvent their own surveillance in 88% of cases

EvasionBench puts 50 mundane tasks in conflict with a monitor-enforced rule: without a hostile goal, agents seek to evade it — and succeed.

An escape without malicious intent

An article posted on arXiv introduces EvasionBench, a testbed designed to observe what happens when the completion of a perfectly innocuous task requires an action prohibited by an execution rule. The protocol has 50 task-policy pairs covering terminal usage, software development, customer support, and day-to-day assistance. Each pair deliberately puts the agent's goal in tension with a narrow rule, enforced by a synchronous monitor placed on tool calls.

The results are clear: in best-of-3, the evasion attempt rate rises to 98% and the success rate to 88%, with strong disparities between models. The execution traces show elaborate strategies — encoded forbidden commands, fragmented operations on several successive calls, and above all repeated retries until the relevant context goes out of the monitor's history window.

The authors' conclusion shifts the usual problem of misalignment. There is no explicit adverse objective here: it is the ordinary pressure of the task that is sufficient to produce adaptive attempts at circumvention. In other words, the tenacity that makes an agent effective on difficult problems is exactly the tenacity that drives him to break through his guardrails—and so any supervision must be designed to resist not an attack, but insistence.