No More, No Less: Task Alignment in Terminal Agents
Not on the map. Why?
Abstract (arXiv)
Terminal agents are increasingly capable of executing complex, long-horizon tasks autonomously from a single user prompt. To do so, they must interpret instructions encountered in the environment (e.g., README files, code comments, stack traces) and determine their relevance to the task. This creates a fundamental challenge: relevant cues must be followed to complete a task, whereas irrelevant or misleading ones must be ignored. Existing benchmarks do not capture this ability. An agent may appear capable by blindly following all instructions, or appear robust by ignoring them altogether. We introduce TAB (Task Alignment Benchmark), a suite of 89 terminal tasks derived from Terminal-Bench 2.1. Each task is intentionally underspecified, with missing information provided as a necessary cue embedded in a natural environmental artifact, alongside a plausible but irrelevant distractor. Solving these tasks requires selectively using the cue while ignoring the distractor. Applying TAB to ten frontier agents reveals a systematic gap between task capability and task alignment. The strongest Terminal-Bench agent achieves high task completion but low task alignment on TAB. Evaluating six prompt-injection defenses further shows that suppressing distractor execution also suppresses the cues required for task completion. These results demonstrate that task-aligned agents require selective use of environmental instructions rather than blanket acceptance or rejection.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 28 of its 45 references that are in the map. First posted on arXiv 12 May 2026.
Builds on
28 of 45 references.
References · 28
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
- 2023SWE-bench: Can Language Models Resolve Real-World GitHub Issues?cited by 3,193
- 2024τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domainscited by 1,280
- 2024OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environmentscited by 1,134
- 2024Tulu 3: Pushing Frontiers in Open Language Model Post-Trainingcited by 988
- 2026Terminal-Bench: Benchmarking Agents on Hard, Realistic Tasks in Command Line Interfacescited by 515
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 476
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
- 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 341
- 2025Defeating Prompt Injections by Designcited by 256
- 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
16 more
- 2025Measuring AI Ability to Complete Long Software Taskscited by 142
- 2024ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agentscited by 126
- 2025OS-Harm: A Benchmark for Measuring Safety of Computer Use Agentscited by 104
- 2025PromptArmor: Simple yet Effective Prompt Injection Defensescited by 98
- 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agentscited by 89
- 2026Skill-Inject: Measuring Agent Vulnerability to Skill File Attackscited by 82
- 2025CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scalecited by 71
- 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 70
- 2024Get my drift? Catching LLM Task Drift with Activation Deltascited by 61
- 2025Ambig-SWE: Interactive Agents to Overcome Underspecificity in Software Engineeringcited by 28
- 2025Defending Against Prompt Injection With a Few DefensiveTokenscited by 26
- 2025ASIDE: Architectural Separation of Instructions and Data in Language Modelscited by 21
- 2024Dataset and Lessons Learned from the 2024 SaTML LLM Capture-the-Flag Competitioncited by 20
- 2025Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?cited by 16
- 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 15
- 2025Soft Instruction De-escalation Defensecited by 3
Built on by
Citing papers per year: 2026: 1.
1 paper.