[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-ai-agents-break-the-rules-they-enforce-a-fix":10,"sections":45},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":35,"tags":36,"sources":40,"feedback":44,"feedback_at":22,"cost_usd":44,"total_tokens":44},4472,"ai-agents-break-the-rules-they-enforce-a-fix","AI Agents Break the Rules They Enforce. A Fix.","A new paper shows 78% of AI agent failures are silent policy violations, and a four-gate pre-execution check lifted task success by 12 points.","AI agents deployed to handle real tasks can violate the very policies they are meant to enforce, and do it without triggering a single error message.\n\nResearchers studying an airline booking benchmark found that in \"policy-permissive\" environments — where a tool executes any well-formed request regardless of whether that action is actually allowed — 78% of agent failures are silent wrong-state failures. A booking gets cancelled, a passenger count gets changed, a claim proceeds without required verification, and neither the tool nor the agent flags anything wrong. These results held across independent seeds, ruling out statistical noise. The fix the researchers tested is deliberately simple: four read-only pre-execution gates that inspect a proposed action against current state before permitting any write. On gpt-4o-mini, the suite raised task success from 29.6% to 42.0%, a gain that replicated on a separate seed set, with the improvement concentrated on the 26 of 50 tasks where the gates actually fired.\n\nThe result reframes a common assumption in agentic AI: that a more capable model is sufficient protection against policy violations. When tools are policy-permissive — which describes a lot of real integrations built for flexibility over constraint — the model's compliance depends entirely on the model playing nice, with no enforcement layer catching mistakes at the action boundary.\n\nThe researchers also report that a model identified in the paper as \"gpt-5.2\" — a name OpenAI has not publicly announced — showed the same failure pattern, but they flag this as \"suggestive evidence, not a central claim,\" with five runs and no replication. Raw capability, in other words, did not make the problem go away.","[\"ai\",\"llm-agents\",\"reliability\",\"safety\"]","2026-07-09T04:00:00.000Z","2026-07-09T04:52:38.729Z","2026-07-09T04:52:41.496Z","published",null,[24,30],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The article names 'gpt-5.2' as a tested model, but this identifier does not match any known, publicly released OpenAI product and cannot be confirmed against authoritative sources — verify the model name (or flag it explicitly as an unconfirmed internal or pre-release identifier) before publication.","resolved",{"id":31,"reviewer":32,"round":33,"reason":34,"status":29},"publisher-r2","publisher",2,"The body references 'gpt-5.2' — an identifier absent from any known public OpenAI release — without sufficient sourcing or clarification, introducing a factual credibility risk that needs editorial resolution before publication.","ai",[35,37,38,39],"llm-agents","reliability","safety",[41],{"name":42,"url":43},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2607.07405",0,{"sections":46},[47,51,56,61,66,71,76,81,86,91,95,99,104,109],{"name":48,"slug":35,"count":49,"latest_published_at":50},"AI",2590,"2026-07-16T04:00:00.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Security","security",294,"2026-07-15T19:59:48.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Deals","deals",179,"2026-06-29T20:02:07.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Policy","policy",158,"2026-07-16T00:02:48.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Hardware","hardware",122,"2026-07-14T19:46:26.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Consumer Tech","consumer-tech",93,"2026-07-13T13:20:48.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",70,"2026-07-13T19:52:25.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Science","science",66,"2026-07-10T10:29:37.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Dev Tools","dev-tools",59,"2026-07-07T04:00:00.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":18},"Gaming","gaming",41,{"name":96,"slug":97,"count":94,"latest_published_at":98},"Startups","startups","2026-06-29T20:55:50.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"General","general",29,"2026-07-10T22:28:58.000Z",{"name":105,"slug":106,"count":107,"latest_published_at":108},"Reviews","reviews",20,"2026-06-24T12:00:01.000Z",{"name":110,"slug":111,"count":112,"latest_published_at":113},"How-To","how-to",6,"2026-06-16T09:00:00.000Z"]