Agents on GPT-4o-mini and GPT-5.2 Silently Break Rules in τ²-bench Tests

Researchers studied AI agents based on large language models that use tools (tool-using LLM agents) and discovered that such agents can silently violate the very policies they are supposed to follow—while the task appears to be completed successfully. The work was published on arXiv on July 7, 2026.

What is silent policy violation

In environments where a tool can technically execute any correctly formatted call despite domain rules (policy-permissive environments), a "quiet incorrect state" arises: a cancelled booking, a changed number of passengers, a processed claim without verification. Neither the tool itself nor the agent's report of its actions signals an error.

The team tested this scenario on the τ²-bench benchmark in the airline domain. For a "budget" agent, 78% of all recorded failures turned out to be exactly silent policy violations without a single tool error, and the cumulative failure frequency is reproduced on independent seed sets rather than being sample noise.

How much do deterministic gates help

The authors proposed a light intervention—deterministic, read-only checks (gates) that examine the proposed call and the current system state before allowing the write.

• A set of four gates raised success on the full benchmark from 29.6% to 42.0% on the gpt-4o-mini model (+12.4 percentage points; P=0.0012)
• The effect was reproduced on an independent set of 15 seeds (+12.3 p.p.; P=0.0008)
• On 26 out of 50 tasks where gates actually worked, success increased by +19.2 p.p.
• On the flagship gpt-5.2 model with default reasoning settings, the same set of gates raised success from 61.2% to 71.6% (+10.4 p.p.; P=0.020, but on a sample of only 5 runs and without experiment replication)

Two negative controls—a self-contained retail domain where tools themselves monitor policy, and the BFCL benchmark—outlined the boundaries of the method: gates help where tools permit policy violation, and provide almost no effect where tools independently comply with it.

What this means

Even flagship models like gpt-5.2 continue attempting to execute policy-violating writes—the problem does not disappear with increasing model quality. The authors emphasize that deterministic gates do not guarantee complete task success, but reliably block a specific class of silent violations at the action boundary—precisely where the agent is about to make a real change to the system.

Frequently asked questions

What is τ²-bench?

It is a benchmark for testing AI agents with tools in the airline domain, on which researchers identified and measured silent policy violations.

How do deterministic gates work?

These are read-only checks that, before executing a write, analyze the proposed tool call and the current system state and block calls that violate domain rules.

Does the method work on top models?

Yes: on gpt-5.2 with default reasoning, the same set of four gates raised success from 61.2% to 71.6%, although the authors note that this result was obtained on a small sample of 5 runs and has not yet been replicated.