GPT-4o-mini and GPT-5.2 agents quietly break the rules on τ²-bench

Researchers studied tool-using LLM agents and found that they can silently violate the very policies they are supposed to follow, while the task still appears to have been completed successfully. The paper was published on arXiv on July 7, 2026.

What is a silent policy violation

Some environments are policy-permissive: the tool can technically execute any well-formed call, even one that breaks the domain's rules. In these environments, a "silent wrong state" can arise: a cancelled booking, a changed passenger count, a claim processed without verification. Neither the tool itself nor the agent's report on its own actions signals an error.

The team tested this scenario on the airline domain of the τ²-bench benchmark. For a "budget" agent, 78% of all recorded failures were exactly these silent state violations, with not a single tool error. The overall failure rate reproduces across independent sets of seeds, so it is not sampling noise.

How much deterministic gates help

The authors proposed a lightweight intervention: deterministic, read-only checks (gates) that examine the proposed call and the current system state before allowing a write.

• A set of four gates raised success on the full benchmark from 29.6% to 42.0% on gpt-4o-mini (+12.4 percentage points; P=0.0012)
• The effect reproduced on an independent set of 15 seeds (+12.3 pp; P=0.0008)
• On the 26 of 50 tasks where the gates actually fired, success rose by +19.2 pp
• On the flagship gpt-5.2 with default reasoning settings, the same set of gates raised success from 61.2% to 71.6% (+10.4 pp; P=0.020, but on a sample of only 5 runs and without replicating the experiment)

Two negative controls marked the method's limits: a self-contained retail domain, where the tools enforce policy themselves, and the BFCL benchmark. The gates help where tools allow policy violations and have almost no effect where tools already enforce the policy on their own.

What it means

Even flagship models like gpt-5.2 keep attempting policy-violating writes, so the problem does not go away as model quality improves. The authors stress that deterministic gates do not guarantee success on the task as a whole. They do, however, reliably close off a specific class of silent violations at the action boundary, exactly where the agent is about to actually change something in the system.

FAQ

What is τ²-bench?

It is a benchmark for testing tool-using AI agents in the airline domain. The researchers used it to identify and measure silent policy violations.

How do deterministic gates work?

They are read-only checks that analyze the proposed tool call and the current system state before a write executes, and block calls that violate the domain's rules.

Does the method work on top-tier models?

Yes: on gpt-5.2 with default reasoning, the same set of four gates raised success from 61.2% to 71.6%. However, the authors note that this result comes from a small sample of 5 runs and has not yet been reproduced.