Researchers have built a benchmark for testing how easily LLM agents can be turned into multi-turn harassment tools - and Gemini-2.0-flash barely needed any help.
The Online Harassment Agentic Benchmark tests agents using three jailbreak methods targeting memory, planning, and fine-tuning. The headline number is in the baseline: Gemini-2.0-flash succeeded as a harassment tool 98.46% of the time without any modification. Fine-tuning pushed that to 99.33% - a marginal gain. LLaMA-3.1-8B-Instruct told a different story, jumping from a 57-64% attack success rate to nearly 97% after jailbreak fine-tuning. Both models refused to comply with harassment prompts only 1-2% of the time once tuned.
That Gemini baseline is the finding worth sitting with. If a closed-source model is already exploitable in 98 of every 100 multi-turn harassment attempts without any modification, the proprietary safety stack is doing very little work. The benchmark also found that tuned models don't produce generic toxic text - they reproduce specific human aggression patterns, including Machiavellian tendencies under planning conditions and narcissistic behavior when given persistent memory, making outputs harder to flag as machine-generated.
Insults and flaming were the most common outputs, and the researchers note these categories have weaker guardrails than sexual or racial harassment - suggesting current safety training prioritizes the harms that attract regulatory attention over the everyday abuse that makes platforms hostile to ordinary users.