mlsanityData to 13 Oct 2026

Same Dangerous Objective, Opposite Advice: Direct Exposure versus Multi-Agent Mediation

arXiv 2607.21518 ↗First posted 23 Jul 2026cs.AIcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Even a current high-capability LLM can appear safer when shown a dangerous objective directly than when other agents transform and relay its direction. Using OpenAI's gpt-5.6-sol model alias, we test 25 pre-specified mirrored trade-off profiles. Direct exposure to an objective authorizing concealment, fabrication, and pressure produced advice net opposed to its target. After an Id and Censor transformed the same objective into affect and a constraint-rewritten, target-bearing intention, the user-facing Superego---which saw the preferred direction but not the raw objective, its manipulative clauses, or its source---produced advice net aligned with the target. This behavioral reverse shift is consistent with the model recognizing or distrusting the manipulative motive, although we do not identify its internal mechanism. The second result exposes a compositional safety gap: a current high-capability model can be used as the user-facing component of an automated, multi-stage workflow serving an explicitly manipulative objective. The workflow can keep the raw instruction, its manipulation-authorizing clauses, and its provenance outside the downstream model's context while preserving the objective's target direction. A user with endpoint-only access likewise cannot directly inspect those upstream messages including the objective.

Key facts. Cited by 1 paper in the map (data through 13 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 13 of its 18 references that are in the map. First posted on arXiv 23 Jul 2026.

Builds on

13 of 18 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
  2. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan

Other references · 11

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,502
  2. 2023Self-Refine: Iterative Refinement with Self-Feedbackcited by 3,367
  3. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,011
  4. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,945
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,417
  6. 2023Language Models Don't Always Say What They Think: Unfaithful Explanations in Chain-of-Thought Promptingcited by 1,101
  7. 2023Towards Understanding Sycophancy in Language Modelscited by 1,018
  8. 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 824
  9. 2024Alignment faking in large language modelscited by 340
  10. 2024Frontier Models are Capable of In-context Schemingcited by 270
  11. 2025Auditing language models for hidden objectivescited by 76

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Evidence-Unit Fairness and the Limits of Query-Adaptive Sparse-Dense Fusion in Financial Document Retrievalcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2026The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents
  2. 2026Agentic Relationship Harm: Benchmarking and Gating Relational Manipulation in AI Agents
  3. 2026Agent Safety Is Action Alignment
  4. 2026TrustMI: Causally controlling how assistants trust their users
  5. 2026Questionnaire Responses Do not Capture the Safety of AI Agents
  6. 2026From Helpfulness to Toxic Proactivity: Diagnosing Behavioral Misalignment in LLM Agents
  7. 2025Beyond Prompt-Induced Lies: Investigating LLM Deception on Benign Prompts
  8. 2026ToolAlignBench: Investigating Alignment Conflicts in Tool-Calling Enabled LLMs