mlsanityData to 7 Oct 2026

No More, No Less: Task Alignment in Terminal Agents

arXiv 2605.12233 ↗First posted 12 May 2026cs.LG cs.AI cs.CRcited by 1

Not on the map. Why?

Abstract (arXiv)

Terminal agents are increasingly capable of executing complex, long-horizon tasks autonomously from a single user prompt. To do so, they must interpret instructions encountered in the environment (e.g., README files, code comments, stack traces) and determine their relevance to the task. This creates a fundamental challenge: relevant cues must be followed to complete a task, whereas irrelevant or misleading ones must be ignored. Existing benchmarks do not capture this ability. An agent may appear capable by blindly following all instructions, or appear robust by ignoring them altogether. We introduce TAB (Task Alignment Benchmark), a suite of 89 terminal tasks derived from Terminal-Bench 2.1. Each task is intentionally underspecified, with missing information provided as a necessary cue embedded in a natural environmental artifact, alongside a plausible but irrelevant distractor. Solving these tasks requires selectively using the cue while ignoring the distractor. Applying TAB to ten frontier agents reveals a systematic gap between task capability and task alignment. The strongest Terminal-Bench agent achieves high task completion but low task alignment on TAB. Evaluating six prompt-injection defenses further shows that suppressing distractor execution also suppresses the cues required for task completion. These results demonstrate that task-aligned agents require selective use of environmental instructions rather than blanket acceptance or rejection.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 28 of its 45 references that are in the map. First posted on arXiv 12 May 2026.

Builds on

28 of 45 references.

References · 28

  1. 2022Training language models to follow instructions with human feedbackcited by 15,712
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  3. 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
  4. 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
  5. 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,134
  6. 2024Tulu 3: Pushing Frontiers in Open Language Model Post-Trainingcited by 988
  7. 2026Terminal-Bench: Benchmarking Agents on Hard, Realistic Tasks in Command Line Interfacescited by 515
  8. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 476
  9. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  10. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 341
  11. 2025Defeating Prompt Injections by Designcited by 256
  12. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
16 more
  1. 2025Measuring AI Ability to Complete Long Software Taskscited by 142
  2. 2024ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agentscited by 126
  3. 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agentscited by 104
  4. 2025PromptArmor: Simple yet Effective Prompt Injection Defensescited by 98
  5. 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agentscited by 89
  6. 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attackscited by 82
  7. 2025CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scalecited by 71
  8. 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 70
  9. 2024Get my drift? Catching LLM Task Drift with Activation Deltascited by 61
  10. 2025Ambig-SWE: Interactive Agents to Overcome Underspecificity in Software Engineeringcited by 28
  11. 2025Defending Against Prompt Injection With a Few DefensiveTokenscited by 26
  12. 2025ASIDE: Architectural Separation of Instructions and Data in Language Modelscited by 21
  13. 2024Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competitioncited by 20
  14. 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?cited by 16
  15. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 15
  16. 2025Soft Instruction De-escalation Defensecited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.