GPT-4o-mini and GPT-5.2 agents quietly break the rules in τ²-bench tests

Researchers studied tool-using LLM agents and found that such agents can silently violate the very policies they are supposed to follow, while the task still appears to have been completed successfully. The paper was published on arXiv on July 7, 2026.

What a silent policy violation is

In environments where a tool can technically execute any correctly formatted call even when it breaks domain rules (policy-permissive environments), a "silent bad state" can arise: a cancelled booking, a changed passenger count, a claim processed without verification. Neither the tool nor the agent's own report of its actions signals an error.

The team tested this scenario on the τ²-bench benchmark in the airline domain. For the "budget" agent, 78% of all recorded failures were precisely silent state violations with no tool error at all, and the overall failure rate reproduces across independent sets of seeds rather than being sampling noise.

How much deterministic gates help

The authors proposed a lightweight intervention: deterministic, read-only checks (gates) that examine the proposed call and the current system state before allowing a write.

• A set of four gates raised success on the full benchmark from 29.6% to 42.0% on gpt-4o-mini (+12.4 percentage points; P=0.0012)
• The effect reproduced on an independent set of 15 seeds (+12.3 pp; P=0.0008)
• On 26 of the 50 tasks where the gates actually fired, success rose by +19.2 pp
• On the flagship gpt-5.2 with default reasoning settings, the same set of gates raised success from 61.2% to 71.6% (+10.4 pp; P=0.020, but on a sample of only 5 runs and without replication of the experiment)

Two negative controls, a self-contained retail domain where the tools enforce policy themselves and the BFCL benchmark, marked the limits of the method: gates help where tools permit policy violations, and have almost no effect where tools already enforce policy on their own.

What this means

Even flagship models such as gpt-5.2 keep attempting writes that violate policy, so the problem does not go away as model quality improves. The authors stress that deterministic gates do not guarantee success on the task as a whole, but they reliably block a specific class of silent violations at the action boundary, exactly where the agent is about to actually change something in the system.

Frequently asked questions

What is τ²-bench?

It is a benchmark for testing tool-using AI agents in the airline domain, on which the researchers identified and measured silent policy violations.

How do deterministic gates work?

They are read-only checks that, before a write is executed, analyze the proposed tool call and the current system state and block calls that violate domain rules.

Does the method work on top-tier models?

Yes: on gpt-5.2 with default reasoning, the same set of four gates raised success from 61.2% to 71.6%, although the authors note that this result comes from a small sample of 5 runs and has not yet been reproduced.