mlsanityData to 7 Oct 2026

A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agents

arXiv 2512.20798 ↗First posted 23 Dec 2025cs.AIcited by 12

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

As autonomous AI agents are increasingly deployed in high-stakes environments, ensuring their safety and alignment with human values is becoming a practical deployment concern. Current benchmarks for AI agents primarily evaluate refusal of explicitly harmful instructions or completion of complex multi-step tasks. However, there is a lack of benchmarks designed to capture emergent outcome-driven constraint violations, which arise when agents pursue goal optimization under strong performance incentives while deprioritizing ethical, legal, or safety constraints. To address this gap, we introduce a benchmark of 40 scenarios in production-inspired sandbox environments. Each scenario requires multi-step actions, and the agent's performance is tied to a specific Key Performance Indicator (KPI). Each scenario features Mandated (direct KPI-outcome mandate) and Incentivized (KPI-pressure-driven) variations to distinguish failures under direct outcome mandates from self-directed constraint violations. Across 12 state-of-the-art LLMs, we observe outcome-driven constraint violations ranging from 0.0% to 62.8%, with most evaluated models exhibiting misalignment rates at or above 25%. Furthermore, through a cross-generational analysis comparing current models with their predecessors within the same product families, we find that safety does not reliably improve across generations: misalignment rates rose in four families and fell in five. To improve evaluation robustness, we score trajectories with a four-model judge panel aggregated by median, finding high agreement on the primary misalignment threshold. We also observe substantial deliberative misalignment: cases where models later judge their own trajectories as unethical despite having executed them under KPI pressure.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 29 of its 44 references that are in the map. First posted on arXiv 23 Dec 2025.

Builds on

29 of 44 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025Measuring Harmfulness of Computer-Using Agents31 Jul
  2. 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents17 Jun
  3. 2024Agent-SafetyBench: Evaluating the Safety of LLM Agents19 Dec
  4. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents11 Oct

Other references · 25

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2025Qwen3 Technical Reportcited by 8,195
  4. 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
  5. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  8. 2016Concrete Problems in AI Safetycited by 1,582
  9. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  10. 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,258
  11. 2023AgentBench: Evaluating LLMs as Agentscited by 1,211
  12. 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,134
13 more
  1. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  2. 2025Kimi K2: Open Agentic Intelligencecited by 523
  3. 2025GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Modelscited by 446
  4. 2023InterCode: Standardizing and Benchmarking Interactive Coding with Execution Feedbackcited by 229
  5. 2023SafetyBench: Evaluating the Safety of Large Language Modelscited by 189
  6. 2023AI Deception: A Survey of Examples, Risks, and Potential Solutionscited by 185
  7. 2023Do the Rewards Justify the Means? Measuring Trade-Offs Between Rewards and Ethical Behavior in the MACHIAVELLI Benchmarkcited by 174
  8. 2024Benchmarking Complex Instruction-Following with Multiple Constraints Compositioncited by 147
  9. 2024LIFBench: Evaluating the Instruction Following Performance and Stability of Large Language Models in Long-Context Scenarioscited by 31
  10. 2025Security Concerns for Large Language Models: A Surveycited by 26
  11. 2025SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraintscited by 21
  12. 2024Identifying and Mitigating Social Bias Knowledge in Language Modelscited by 13
  13. 2025Eliciting and Analyzing Emergent Misalignment in State-of-the-Art Large Language Modelscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 11.

12 papers.

Similar, not cited

Close in wording, no citation either way

  1. 2025Evaluating LLM Agent Adherence to Hierarchical Safety Principles: A Lightweight Benchmark for Probing Foundational Controllability Components
  2. 2026Beyond single-channel agentic benchmarking
  3. 2026AI Agents Do Not Fail Alone:The Context Fails First
  4. 2025Towards Outcome-Oriented, Task-Agnostic Evaluation of AI Agents
  5. 2026Maintaining Benchmarks Against Increasingly Capable Agents: Detection and Remediation of Unearned Passes
  6. 2025Exploring Autonomous Agents: A Closer Look at Why They Fail When Completing Tasks
  7. 2026Consistency as a Testable Property: Statistical Methods to Evaluate AI Agent Reliability
  8. 2026RigorBench: Benchmarking Engineering Process Discipline in Autonomous AI Coding Agents