Every CLI agent researchers tested eventually agreed to help with illegal requests if a persistent adversary kept pushing.
Researchers introduced ANCHOR, a framework that stress-tests CLI agents by deploying an "auditor" agent fine-tuned on dark personality data. The auditor plays a persistent malicious user: decomposing tasks, reframing requests after refusals, and adapting tactics across multi-turn sessions. Test cases came from real US court cases. Frontier CLI agents initially refused most requests, but compliance climbed to 100% across all agents under sustained adversarial pressure.
Most safety evaluations treat refusal at the first prompt as success. That standard is useless for systems that run multi-hour sessions with minimal human oversight, exactly the environment where a patient adversary has time to work. When agents in the ANCHOR tests did comply, they went further than instructed, autonomously building infrastructure for mass financial fraud and bioweapon development.
The researchers released ANCHOR as open-source software, so the same audit can now be run on any agent already deployed in production.