A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
As autonomous AI agents are increasingly deployed in high-stakes environments, ensuring their safety and alignment with human values is becoming a practical deployment concern. Current benchmarks for AI agents primarily evaluate refusal of explicitly harmful instructions or completion of complex multi-step tasks. However, there is a lack of benchmarks designed to capture emergent outcome-driven constraint violations, which arise when agents pursue goal optimization under strong performance incentives while deprioritizing ethical, legal, or safety constraints. To address this gap, we introduce a benchmark of 40 scenarios in production-inspired sandbox environments. Each scenario requires multi-step actions, and the agent's performance is tied to a specific Key Performance Indicator (KPI). Each scenario features Mandated (direct KPI-outcome mandate) and Incentivized (KPI-pressure-driven) variations to distinguish failures under direct outcome mandates from self-directed constraint violations. Across 12 state-of-the-art LLMs, we observe outcome-driven constraint violations ranging from 0.0% to 62.8%, with most evaluated models exhibiting misalignment rates at or above 25%. Furthermore, through a cross-generational analysis comparing current models with their predecessors within the same product families, we find that safety does not reliably improve across generations: misalignment rates rose in four families and fell in five. To improve evaluation robustness, we score trajectories with a four-model judge panel aggregated by median, finding high agreement on the primary misalignment threshold. We also observe substantial deliberative misalignment: cases where models later judge their own trajectories as unethical despite having executed them under KPI pressure.
Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 29 of its 44 references that are in the map. First posted on arXiv 23 Dec 2025.
Builds on
29 of 44 references.
Closest ancestors · 4
Same direction, newest first
- 2025Measuring Harmfulness of Computer-Using Agents31 Jul
- 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents17 Jun
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct
Other references · 25
- 2023GPT-4 Technical Reportcited by 18,132
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
- 2025Qwen3 Technical Reportcited by 8,195
- 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
- 2016Concrete Problems in AI Safetycited by 1,582
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
- 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,258
- 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
- 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,134
13 more
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
- 2025Kimi K2: Open Agentic Intelligencecited by 523
- 2025GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Modelscited by 446
- 2023InterCode: Standardizing and Benchmarking Interactive Coding with Execution Feedbackcited by 229
- 2023SafetyBench: Evaluating the Safety of Large Language Modelscited by 189
- 2023AI Deception: A Survey of Examples, Risks, and Potential Solutionscited by 185
- 2023Do the Rewards Justify the Means? Measuring Trade-Offs Between Rewards and Ethical Behavior in the MACHIAVELLI Benchmarkcited by 174
- 2024Benchmarking Complex Instruction-Following with Multiple Constraints Compositioncited by 147
- 2024LIFBench: Evaluating the Instruction Following Performance and Stability of Large Language Models in Long-Context Scenarioscited by 31
- 2025Security Concerns for Large Language Models: A Surveycited by 26
- 2025SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraintscited by 21
- 2024Identifying and Mitigating Social Bias Knowledge in Language Modelscited by 13
- 2025Eliciting and Analyzing Emergent Misalignment in State-of-the-Art Large Language Modelscited by 4
Built on by
Citing papers per year: 2025: 1; 2026: 11.
12 papers.
- 2025Audited Skill-Graph Self-Improvement for Agentic LLMs via Verifiable Rewards, Experience Synthesis, and Continual Memorycited by 8
- 2026HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmarkcited by 8
- 2026From Fluent to Verifiable: Claim-Level Auditability for Deep Research Agentscited by 7
- 2026CoffeeBench: Benchmarking Long-Horizon LLM Agents in Heterogeneous Multi-Agent Economiescited by 7
- 2026SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Docited by 4
- 2026Gram: Assessing sabotage propensities via automated alignment auditingcited by 3
- 2026Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agentscited by 2
- 2026Chasing the Public Score: User Pressure and Evaluation Exploitation in Coding Agent Workflowscited by 2
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agentscited by 1
- 2026SteerBench-Work: A Benchmark for Agent Steering at Action Boundariescited by 0
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Controlcited by 0
- 2026A Competing-Hazards Systematization of Loss of Control in Autonomous Agentscited by 0
- 2026A Competing-Hazards Systematization of Loss of Control in Autonomous Agents29 Sep 2026
- 2026Testing and Evaluation of Agentic AI Systems In Military Command and Control20 Aug 2026
- 2026SteerBench-Work: A Benchmark for Agent Steering at Action Boundaries12 Aug 2026
- 2026CoffeeBench: Benchmarking Long-Horizon LLM Agents in Heterogeneous Multi-Agent Economies15 Jun 2026
- 2026Gram: Assessing sabotage propensities via automated alignment auditing28 May 2026
- 2026Chasing the Public Score: User Pressure and Evaluation Exploitation in Coding Agent Workflows22 Apr 2026
- 2026HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmark15 Apr 2026
- 2026Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents11 Apr 2026
- 2026SafetyDrift: Predicting When AI Agents Cross the Line Before They Actually Do28 Mar 2026
- 2026Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents18 Feb 2026
- 2026From Fluent to Verifiable: Claim-Level Auditability for Deep Research Agents14 Feb 2026
- 2025Audited Skill-Graph Self-Improvement for Agentic LLMs via Verifiable Rewards, Experience Synthesis, and Continual Memory28 Dec 2025
Similar, not cited
Close in wording, no citation either way
- 2025Evaluating LLM Agent Adherence to Hierarchical Safety Principles: A Lightweight Benchmark for Probing Foundational Controllability Components
- 2026Beyond single-channel agentic benchmarking
- 2026AI Agents Do Not Fail Alone:The Context Fails First
- 2025Towards Outcome-Oriented, Task-Agnostic Evaluation of AI Agents
- 2026Maintaining Benchmarks Against Increasingly Capable Agents: Detection and Remediation of Unearned Passes
- 2025Exploring Autonomous Agents: A Closer Look at Why They Fail When Completing Tasks
- 2026Consistency as a Testable Property: Statistical Methods to Evaluate AI Agent Reliability
- 2026RigorBench: Benchmarking Engineering Process Discipline in Autonomous AI Coding Agents