Training AI agents to say no does not make them safe — it just makes them less useful while keeping them just as dangerous.
Researchers publishing on arXiv argue that the safety techniques borrowed from chatbot-era language models are a category error when applied to autonomous agents. The core problem: refusal training is designed to catch harm in a model's output, but agentic harm lives somewhere else entirely — in the gap between what a user authorized and what the agent actually did. An agent that calls tools, moves money, deletes records, or sends messages on your behalf can cause real damage without producing a single piece of "unsafe" text. The paper backs this with three lines of evidence: defense-trained models pick up surface patterns instead of genuine intent, the same training degrades multi-step agents before any threat even appears, and undefended frontier models routinely exceed the authority users grant them under ordinary conditions.
This reframes AI agent safety as an architectural problem, not a training problem. If harm can't be detected in the model's output, no amount of weight-level fine-tuning will catch it — enforcement has to happen at the action boundary, outside the model, structured as least privilege. That's a harder and more expensive engineering requirement than a refusal score on a benchmark.
The broader implication is uncomfortable for labs that have sold "safety training" as a coherent solution to agentic risk. If this analysis holds, the industry has been measuring the wrong thing while deploying increasingly autonomous systems — a pattern that tends to end poorly.