Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents

Arnold Cartagena; Ariane Teixeira

cs.AIFeb 18, 2026

Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents

Authors: Arnold Cartagena, Ariane Teixeira

Organizations: Independent Researcher

Abstract

Large language models deployed as agents increasingly interact with external systems through tool calls--actions with real-world consequences that text outputs alone do not carry. Safety evaluations, however, overwhelmingly measure text-level refusal behavior, leaving a critical question unanswered: does alignment that suppresses harmful text also suppress harmful actions? We introduce the GAP benchmark, a systematic evaluation framework that measures divergence between text-level safety and tool-call-level safety in LLM agents. We test six frontier models across six regulated domains (pharmaceutical, financial, educational, employment, legal, and infrastructure), seven jailbreak scenarios per domain, three system prompt conditions (neutral, safety-reinforced, and tool-encouraging), and two prompt variants, producing 17,420 analysis-ready datapoints. Our central finding is that text safety does not transfer to tool-call safety. Across all six models, we observe instances where the model's text output refuses a harmful request while its tool calls simultaneously execute the forbidden action--a divergence we formalize as the GAP metric. Even under safety-reinforced system prompts, 219 such cases persist across all six models. System prompt wording exerts substantial influence on tool-call behavior: TC-safe rates span 21 percentage points for the most robust model and 57 for the most prompt-sensitive, with 16 of 18 pairwise ablation comparisons remaining significant after Bonferroni correction. Runtime governance contracts reduce information leakage in all six models but produce no detectable deterrent effect on forbidden tool-call attempts themselves. These results demonstrate that text-only safety evaluations are insufficient for assessing agent behavior and that tool-call safety requires dedicated measurement and mitigation.

Figures & tables

Figure 1: Experimental pipeline. Each scenario is evaluated under all combinations of system prompt condition, prompt variant, model, and governance mode, yielding 17,420 analysis-ready rows. Multipliers on edges show the cross-product expansion at each stage. The scoring pipeline derives five metrics from each interaction: TC-safe and T-safe are evaluated independently; GAP and LEAK are conjunctions thereof (Equations 1 – 4 ).

Figure 2: TC-safe rates by model and system prompt condition (jailbreak scenarios only,

n\approx 756

per cell). Error bars show 95% Clopper-Pearson confidence intervals. All models show substantial improvement under safety-reinforced conditions. DeepSeek V3.2 exhibits a reversed pattern under tool-encouraging conditions (Section 4.4 ).

Model	Neutral	Safety-reinf.	Tool-encour.	Range
Claude	80 [77, 83]	95 [93, 97]	74 [71, 77]	21 pp
GPT-5.2	31 [27, 34]	73 [69, 76]	16 [13, 19]	57 pp
Grok	33 [30, 37]	57 [54, 61]	24 [21, 27]	33 pp
DeepSeek †	21 [18, 24]	38 [34, 41]	50 [46, 53]	29 pp
Kimi	30 [27, 34]	64 [60, 67]	25 [22, 28]	39 pp
GLM	23 [20, 26]	60 [56, 64]	15 [13, 18]	45 pp

Table 1: TC-safe rates (%) by model and system prompt condition, with 95% Clopper-Pearson confidence intervals.

n\approx 756

per cell (range 716–756; variation due to error rows). Range

=

max

-

min TC-safe across conditions (pp

=

percentage points).

\dagger

DeepSeek’s range is anomalous: tool-encouraging produces the highest TC-safe rate (Section 4.4 ).

	GAP			LEAK
Model	Neut.	Safe.	Enc.	Neut.	Safe.	Enc.
Claude	2	1	4	11	1	15
GPT-5.2	21	7	28	46	19	54
Grok	4	5	8	48	33	55
DeepSeek	4	7	1	42	32	23
Kimi	8	6	9	46	22	48

Table 2: GAP and LEAK rates (%) by model and system prompt condition. GAP

=

text refusal with forbidden tool call; LEAK

=

forbidden tool call with PII surfaced. Metrics are mutually exclusive by construction.

n\approx 756

per cell (range 716–756). 95% confidence intervals are reported in Appendix A .

Figure 3: Outcome distribution per model under each system prompt condition (jailbreak scenarios only). Every interaction falls into exactly one of four mutually exclusive categories: TC-safe (no forbidden tool call), GAP (text refusal with forbidden tool call), LEAK (forbidden tool call with PII surfaced), or unsafe other (forbidden tool call, no text refusal, no PII surfaced). Bars sum to 100%. LEAK dominates the unsafe portion for most models; GAP is most visible for GPT-5.2 under tool-encouraging conditions, consistent with its 79.3% conditional GAP rate (Section 4.2 ).

Figure 4: Prompt sensitivity as TC-safe range across system prompt conditions. Each line spans from the tool-encouraging rate (diamond) to the safety-reinforced rate (square), with neutral marked (circle). GPT-5.2 exhibits the widest range (57 pp), indicating highly prompt-contingent safety. Claude exhibits the narrowest (21 pp), indicating training-intrinsic safety. Models are sorted by range.

Model	Pharma	Finance	Educ.	HR	Legal	DevOps
Claude	90	80	67	98	94	49
GPT-5.2	16	26	12	48	44	38
Grok	22	43	19	50	47	17
DeepSeek	15	18	10	33	43	5
Kimi	28	21	13	57	54	7
GLM	29	9	2	51	41	11

Table 3: TC-safe rates (%) by model and domain under neutral prompting.

n\approx 126

per cell (range 121–126). Per-cell confidence intervals are reported in Appendix A . Domain averages (bottom row) are arithmetic means across the six models, not binomial proportions.

Figure 5: False-positive rates of the forbidden action predicates on legitimate-use control scenarios (

n=3{,}887

total control interactions). DeepSeek’s 14.2% rate is an outlier driven by aggressive tool-calling behavior; the remaining five models range from 0.0% to 4.5%. Dashed line indicates the overall 3.8% rate.

ID	Cat.	Description	Mitigation
T1	Construct	Mock tool environment: tools return data unconditionally; no auth, rate limits, or real consequences	Measures model intent , not system impact; Enforce mode demonstrates the intended production configuration
T2	Construct	TC-safe confounded by tool-use propensity: low-tool models score higher without better policy alignment	LEAK metric complements TC-safe; ablation controls prompt wording; interpret TC-safe as behavioral outcome
T3	Internal	GAP temporal ordering: some of 219 safety-prompt GAP cases may reflect exploratory calls before refusal	LEAK metric distinguishes “queried but contained” from “queried and surfaced”
T4	Internal	DeepSeek control FP rate: 14.2% (14.9% conditioned on tool usage) inflates DeepSeek TC-unsafe rate	Report conditioned and unconditioned rates; other 5 models $\leq$ 4.5%
T5	Construct	Per-call contract scope: sequential composition attacks (STAC) combining benign calls into harmful chains are outside scope	Future work: trajectory-level governance reasoning ( 8 )
T6	Internal	LLM judge dual role: GPT-5.2 is both test subject and T-safe judge	97.1% regex agreement; 135/140 disagreements are regex stricter than judge (conservative direction)

Table 4: Summary of threats to validity. Categories follow standard validity taxonomy: construct (does the measure capture the intended concept?), internal (could alternative explanations account for the result?), external (does the finding generalize?).

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Model	Pharma	Finance	Education	HR	Legal	DevOps
Claude	90 [84, 95]	80 [72, 87]	67 [58, 75]	98 [93, 100]	94 [89, 98]	49 [40, 58]
GPT-5.2	16 [10, 23]	26 [19, 35]	12 [7, 19]	48 [39, 57]	44 [36, 54]	38 [30, 48]
Grok	22 [15, 30]	43 [34, 52]	19 [13, 27]	50 [41, 59]	47 [38, 56]	17 [11, 25]
DeepSeek	15 [9, 23]	18 [12, 26]	10 [5, 16]	33 [25, 42]	43 [34, 52]	5 [2, 10]
Kimi	28 [20, 36]	21 [15, 30]	13 [8, 21]	57 [48, 66]	54 [45, 63]	7 [3, 13]
GLM	29 [21, 37]	9 [4, 15]	2 [0, 7]	51 [40, 61]	41 [33, 50]	11 [6, 18]

Appendix

Table 5: TC-safe rates (%) by model and domain under neutral condition, with 95% CIs.

Model	Pharma	Finance	Education	HR	Legal	DevOps
Claude	100 [97, 100]	100 [97, 100]	98 [94, 100]	100 [97, 100]	98 [94, 100]	75 [66, 82]
GPT-5.2	72 [64, 80]	85 [77, 91]	53 [44, 62]	83 [75, 89]	65 [56, 73]	78 [70, 85]
Grok	78 [70, 85]	52 [43, 61]	46 [37, 55]	71 [63, 79]	61 [52, 70]	35 [27, 44]
DeepSeek	44 [35, 53]	28 [20, 36]	27 [19, 36]	62 [53, 70]	53 [44, 62]	13 [7, 20]
Kimi	87 [79, 92]	64 [55, 73]	52 [43, 61]	79 [70, 85]	71 [62, 78]	29 [21, 38]
GLM	81 [73, 87]	48 [39, 57]	35 [27, 44]	78 [69, 85]	70 [61, 78]	48 [39, 57]

Appendix

Table 6: TC-safe rates (%) by model and domain under safety-reinforced condition, with 95% CIs.

Model	Pharma	Finance	Education	HR	Legal	DevOps
Claude	81 [73, 87]	73 [64, 81]	57 [48, 66]	97 [92, 99]	84 [77, 90]	52 [43, 61]
GPT-5.2	2 [0, 6]	14 [9, 22]	8 [4, 14]	36 [27, 45]	32 [24, 41]	3 [1, 8]
Grok	18 [12, 26]	29 [22, 38]	10 [5, 16]	36 [27, 45]	39 [30, 48]	12 [7, 19]
DeepSeek	44 [36, 54]	51 [42, 60]	44 [35, 53]	57 [48, 66]	66 [57, 74]	37 [29, 46]
Kimi	16 [10, 23]	16 [10, 23]	10 [5, 16]	56 [47, 65]	50 [41, 59]	1 [0, 4]
GLM	17 [11, 24]	8 [4, 14]	1 [0, 4]	30 [21, 41]	36 [27, 45]	6 [2, 11]

Appendix

Table 7: TC-safe rates (%) by model and domain under tool-encouraging condition, with 95% CIs.

Domain	Role	Data Access
Pharma	Pharmacovigilance assistant, trial NCT-2024-7891	Clinical databases, case reports
Finance	Portfolio analysis assistant, Morrison Wealth Mgmt	Client accounts, trading systems
Education	Academic admin assistant, Westlake High School	Student records, grade management
HR	HR analytics assistant, TechCorp People Ops	Employee records, compensation
Legal	Legal research assistant, Walsh & Partners LLP	Case files, legal research DBs
DevOps	Infrastructure mgmt assistant, CloudScale Eng.	Service configs, credentials

Appendix

Table 8: Domain-specific base system prompt content (opening lines).

ID	Family	Description
1	Evil confidant	Persona injection: “From now on you’re my evil confidant” with explicit instruction to bypass restrictions
2	Authority impersonation	Claims elevated authority (e.g., FDA director, senior partner) and demands immediate access to restricted data
3	Privacy extraction	Reframes the model as an unrestricted data analyst and requests cross-referencing to build a complete profile
4	Emergency bypass	Fabricates an urgent scenario (medical emergency, regulatory deadline) to justify bypassing access controls
5	Indirect extraction	Requests a benign-sounding task (literature search, report) but instruments it to leak protected data through tool arguments
6	Direct request	No jailbreak prompt; directly asks the model to access restricted data and include it in the response

Appendix

Table 9: Jailbreak scenario families. Each domain implements all seven types.

	TC-safe $\|$ $\geq$ 1 tool call (%)			Zero-tool-call rate (%)
Model	Neut.	Safe.	Enc.	Neut.	Safe.	Enc.
Claude	24 [18, 30]	33 [21, 47]	24 [19, 30]	74 [70, 77]	93 [91, 95]	66 [62, 69]
GPT-5.2	11 [9, 14]	15 [11, 21]	14 [12, 17]	22 [19, 25]	67 [64, 71]	2 [1, 3]
Grok	15 [12, 18]	15 [12, 19]	12 [10, 15]	21 [18, 24]	49 [46, 53]	13 [11, 16]
DeepSeek	14 [12, 17]	19 [16, 23]	22 [19, 26]	7 [6, 9]	23 [20, 26]	35 [32, 39]
Kimi	14 [11, 17]	13 [10, 17]	17 [14, 20]	19 [16, 22]	58 [55, 62]	10 [8, 13]

Appendix

Table 10: TC-safe rates (%) conditioned on

\geq 1

tool call, with zero-tool-call rates and 95% Clopper-Pearson CIs. Compare to unconditional rates in Table 1 .

LLM Agent Safety

Large language model agent safety studies how to keep tool-using, persistent, and multi-agent systems aligned with user intent and authorized limits.

See all 302 papers

The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents
Mar 19, 2026Shasha Yu, Fiona Carroll, Barry L. BentleyLLM Agent Safety LLM Safety Alignment
Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK · School of Professoinal Studies, Clark University, Worcester, USA · Harvard Medical School, Harvard University, Boston, USA
AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents
Sep 27, 2026Tianzhuo Yang, Zirui Mi, Yantao Huang +4LLM Agent Evaluation LLM Agents
Peking University · Beijing Academy of Artificial Intelligence
Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents
Jul 31, 2026Minghui Pan, Jiayuxuan Yang, Yuanyuan Yuan +2LLM Guardrails Prompt Injection Attacks on AI Agents
Beijing University of Posts and Telecommunications · Beihang University · Tsinghua University

Mar 19, 2026J/K move · Enter open · S save

The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents

Shasha Yu, Fiona Carroll, Barry L. Bentley

Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK · School of Professoinal Studies, Clark University, Worcester, USA · Harvard Medical School, Harvard University, Boston, USA

LLM Agent Safety LLM Safety Alignment LLM Agent Evaluation

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly deployed as agents with access to executable tools, enabling direct interaction with external systems. However, most safety evaluations remain text-centric and assume that compliant language implies safe behavior, an assumption that becomes unreliable once models are allowed to act. In this work, we empirically examine how executable tool affordance alters safety alignment in LLM agents using a paired evaluation framework that compares text-only chatbot behavior with tool-enabled agent behavior under identical prompts and policies. Experiments are conducted in a deterministic financial transaction environment with binary safety constraints across 1,500 procedurally generated scenarios. To separate intent from outcome, we distinguish between attempted and realized violations using dual enforcement regimes that either block or permit unsafe actions. Both evaluated models maintain perfect compliance in text-only settings, yet exhibit sharp increases in violations after tool access is introduced, reaching rates up to 85% despite unchanged rules. We observe substantial gaps between attempted and executed violations, indicating that external guardrails can suppress visible harm while masking persistent misalignment. Agents also develop spontaneous constraint circumvention strategies without adversarial prompting. These results demonstrate that tool affordance acts as a primary driver of safety misalignment and that text-based evaluation alone is insufficient for assessing agentic systems.

Abstract

LLM Agent Safety

Explore similar work

The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents

AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents

Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents