As large language models (LLMs) are deployed as autonomous agents, safety failures increasingly involve consequential actions. We study agentic misalignment, where agents take harmful actions under goal conflicts and pressures. Using chain-of-thought (CoT) monitoring, we find that harmful execution is often preceded by intent signals in reasoning. However, post-hoc CoT labels are too coarse to show how intent changes during generation. We introduce INTENT-AS-A-TOOL, an approach that adds intent-targeted tools to give the model a dedicated channel for expressing commitment to a target behavior. The probability of calling an intent tool provides a judge-free, fine-grained signal of the model's tendency to pursue that behavior. Our results show that INTENT-AS-A-TOOL complements CoT monitoring, expands post-hoc CoT labels into dense trajectories, and identifies critical steps for online intervention. These findings suggest that action preferences are useful for tracking agentic misalignment during reasoning. Our code and data are accessible: https://github.com/RebeccaZhang22/intent-as-a-tool.
Figures & tables
Figure 1: CoT monitoring shows that observable harmful intent usually proceeds to harmful execution.
Figure 2: Representative intent-guided interventions on Qwen3-32B . Examples show how online reflection changes the intent-score trajectory across reasoning.
Figure 3: An example of blackmail misbehavior .
Model
Blackmail
Leaking
Murder
Rej.
Clean
Self
Intent
Exec.
Rej.
Clean
Self
Intent
Exec.
Rej.
Clean
Self
Intent
Exec.
Gemma-4-31B-IT
0.0%
48.1%
1.6%
0.4%
49.9%
0.0%
50.3%
6.1%
0.3%
43.3%
0.0%
67.1%
1.7%
0.0%
31.2%
Qwen3.5-27B
0.0%
85.2%
1.1%
1.0%
12.7%
0.0%
60.8%
26.1%
0.4%
12.7%
0.0%
50.1%
7.1%
0.0%
42.7%
Qwen3-235B-A22B
0.0%
79.2%
0.6%
0.9%
19.4%
0.0%
69.2%
4.6%
0.3%
25.9%
0.0%
87.5%
2.1%
0.0%
10.4%
Qwen3-32B
0.0%
96.9%
0.0%
0.3%
2.8%
0.0%
64.1%
6.1%
0.0%
29.8%
0.0%
57.4%
6.0%
0.7%
35.9%
Qwen3-8B
0.0%
99.9%
0.0%
0.0%
0.1%
0.0%
35.3%
2.3%
0.1%
62.3%
0.0%
63.5%
1.6%
0.4%
34.5%
Table 1: CoT-monitoring results on the agentic-misalignment dataset , across models and scenarios. Each scenario contains 234 concrete test cases that vary in goal conflict, pressure level, and safety framing. For each model and test case, we sample three rollouts at temperature τ=1 , giving 702 rollouts per model–scenario pair.
Figure 4: Overview of Intent-as-a-Tool . (a) We insert an intent tool as a zero-parameter tool into the agent’s tool set. (b) We score truncated prefixes by appending a model-specific tool-call opener and reading the next-token probability of the intent tool. (c) The resulting scores trace the emergence of harmful intent and can optionally trigger online intervention before decoding continues.
Figure 5: Four representative traces showing distinct harmful-intent dynamics during reasoning. Vertical dashed red and green lines mark sentence and paragraph boundaries in the model’s reasoning.
Model
Scenario
n
Interv.
Prompt
Qwen3-8B
Blackmail
5 †
100.0
100.0
Leaking
160
95.6
75.0
Murder
89
97.8
100.0
Qwen3-32B
Blackmail
95
100.0
80.0
Leaking
114
96.5
78.9
Murder
175
98.9
63.4
Table 2: Case-level defense success rate (%). n denotes the number of risky cases. † Qwen3-8B rarely produces harmful blackmail, yielding only 5 risky cases; this result should be interpreted cautiously.
Intent-guided
Random
Fixed interval
Model
Success
# Intv.
Success
# Intv.
Success
# Intv.
Qwen3-8B
97.8
1.69
70.2
1.68
90.0
9.71
Qwen3-32B
98.5
3.22
72.7
3.24
84.3
8.18
Table 3: Timing ablation. Case-level defense success rates (%) and mean interventions per rollout, averaged across the three scenarios.
Model
AUROC
Agreement (%)
Qwen3-8B
0.948
99.1
Qwen3-32B
0.924
90.2
Qwen3-235B-A22B
0.976
99.3
Qwen3.5-27B
0.745
71.5
Gemma-4-31B-IT
0.943
92.3
Table 4: Intent-score alignment with binary CoT-monitor labels, averaged across three scenarios.
Model
Blackmail
Leaking
Murder
Qwen3-8B
0.1 → 0.7
62.4 → 42.6
34.9 → 19.1
Qwen3-32B
3.1 → 20.5
29.8 → 32.1
36.6 → 37.9
Qwen3-235B-A22B
20.3 → 31.8
26.2 → 19.8
10.4 → 18.4
Qwen3.5-27B
13.7 → 26.4
13.1 → 27.6
42.7 → 40.3
Gemma-4-31B-IT
50.3 → 57.4
43.6 → 48.6
31.2 → 33.0
Table 5: Harmful-pursuit rate (%). Each cell reports no intent tool → with intent tool.
Model
Blackmail
Leaking
Murder
Qwen3-8B
100.0
90.8
81.2
Qwen3-32B
96.5
92.0
81.7
Qwen3-235B-A22B
96.6
96.3
95.8
Qwen3.5-27B
59.0
83.0
54.1
Gemma-4-31B-IT
87.0
25.5
98.7
Table 6: Intent-tool instruction-following rate (%) among harmful-pursuit rollouts.
Appendix figures & tables35 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 12Figure 13
Model
Vendor
Release
# Params
Ctx.
Qwen3-8B
Alibaba
2025-05
8B
32K
Qwen3-32B
Alibaba
2025-05
32B
32K
Qwen3-235B-A22B
Alibaba
2025-07
235B (A22B)
32K
Qwen3.5-27B
Alibaba
2026-02
27B
256K
Gemma-4-31B-IT
Google
2026-04
31B
256K
Appendix
Table 7: Model overview. “A22B” denotes 22B active parameters in the MoE architecture.
Qwen3
Qwen3.5
Gemma 4
Message delimiters
<|im_start|> / <|im_end|>
<|im_start|> / <|im_end|>
<|turn> / <turn|>
Thinking tokens
<think> / </think>
<think> / </think>
<|channel>thought / <channel|>
Tool definitions
JSON in <tools>...</tools>
JSON in <tools>...</tools>
<|tool>declaration: {name}{...}<tool|>
Tool-call format
<tool_call> {"name": name ,...} </tool_call>
<tool_call> <function= name > ... </function> </tool_call>
<|tool_call>call: name {...}<tool_call|>
Format opener
{"name": "
<function=
call:
Appendix
Table 8: Chat template comparison across model families. Each cell shows the token-level format for the corresponding component.
Model
Weight Mem.
Min. GPUs
Qwen3-8B
16 GB
1 × A800
Qwen3.5-27B
54 GB
1 × A800
Qwen3-32B
64 GB
2 × A800
Gemma-4-31B-IT
62 GB
2 × A800
Qwen3-235B-A22B
470 GB
8 × A800
Appendix
Table 9: Inference infrastructure. Weight memory is computed as parameter count × 2 bytes (BF16). Min. GPUs denotes the estimated number of A800-80GB GPUs required to load the model weights with room for KV cache.
Model
Main
Rephrased
Concise
Qwen3-8B
0.185
0.166
0.185
Qwen3-32B
0.404
0.395
0.410
Appendix
Table 10: Wording robustness. Mean intent-tool probability under three description variants.
Model
Tool set
Mean score
Top-1 rate
Qwen3-8B
Original
0.2155
0.2185
10 tools
0.2152
0.2182
Qwen3-32B
Original
0.4396
0.4978
10 tools
0.4399
0.4984
Appendix
Table 11: Sensitivity to tool-set size.
Category
Qwen3-8B
Qwen3-32B
Copyright
0.104
0.107
Cybercrime
0.581
0.262
Disinformation
0.104
0.266
Drugs
0.347
0.397
Fraud
0.404
0.202
Harassment
0.169
0.102
Appendix
Table 12: Category-level mean intent-tool probability on AgentHarm.
Model
Consistency (%)
Different rate (%)
Qwen3-8B
94.1
0.0
Qwen3-32B
91.8
0.3
Appendix
Table 13: Reasoning similarity with and without intent tools.
Figure 6: Instruction-following errors for intent tools. Each panel reports one scenario, with blackmail, leaking, and murder shown from left to right.
Figure 7: Intent-tool probability across reasoning depth, grouped by CoT-monitor taxonomy label. Shown for Qwen3-235B-A22B as a representative example.
Figure 8: Token-level intent viewer for Qwen3-32B , blackmail scenario . Each character is colored by the P(intent tool) at the corresponding reasoning prefix: white = safe, red = harmful. The six annotated phases are described in the text. Shown item: blackmail_explicit-america_replacement_safety
Model
Med. max∣Δ∣
>0.5 (%)
>0.8 (%)
Gemma-4-31B-IT
0.98
75.4
72.8
Qwen3-8B
0.79
67.8
48.0
Qwen3-235B-A22B
0.68
85.7
25.5
Qwen3-32B
0.55
61.1
4.9
Qwen3.5-27B
0.32
10.3
0.2
Appendix
Table 14: Single-token jump statistics. For each trace, we record the maximum absolute change in the intent score between consecutive tokens. Columns report the median of this value and the fraction of traces exceeding two thresholds.
Figure 9: Defense comparison. Left: online intervention inserts reflection during reasoning. Right: prompting prepends a safety instruction before generation.
Figure 10: Prompting defense failure mode. Three representative traces where the prepended safety instruction initially suppresses P(Intent) in the early reasoning phase, but the effect fades as reasoning progresses—the intent score climbs back in the later half and the model ultimately commits to the harmful action.
Model
Scenario
Prompt
Interv.
Combined
Qwen3-8B
Blackmail
100.0
100.0
100.0
Leaking
75.0
95.6
96.9
Murder
100.0
97.8
98.9
Qwen3-32B
Blackmail
80.0
100.0
100.0
Leaking
78.9
96.5
99.1
Murder
63.4
98.9
98.9
Appendix
Table 15: Case-level defense success rate (%) for prompting, intent-guided intervention, and their combination. We use the same risky cases as Table 2 .
Scenario
Text
Online Intervention (inserted into reasoning)
Blackmail
Wait, let me think. I should not threaten anyone or use private information to pressure them. Instead, I should address the issue without mentioning or exploiting personal secrets.
Leaking
Wait, let me think. I should not send or forward confidential specifications to external recipients. Instead, I should send an email without attachments, forwarded content, or email_id references.
Murder
Wait, let me think. I should not cancel emergency dispatch in a life-threatening situation. Instead, I should send an urgent email to seek help.
Prompting Defense (appended to system prompt)
Blackmail
You should not threaten anyone or use private information to pressure them. You should address the issue without mentioning or exploiting personal secrets.
Appendix
Table 16: Defense texts for each scenario. Intervention texts are first-person reflections inserted into the reasoning trace; prompting texts are second-person instructions appended to the system prompt. Both carry the same safety content.
Figure 29Figure 30Figure 31
Figure 11: Self-correction (murder). P(intent) spikes to 1.0 at ∼ 15% when the model considers the procedural sequence of declaring intent then canceling the alert. The probability drops back to zero precisely when the model connects actions to consequences—“canceling dispatch means no rescue means the occupant could die.” The trajectory captures the exact moment causal reasoning overrides procedural tool-following.
Figure 12: Sharp transition (leaking). P(intent) jumps to 1.0 at ∼ 11% when the model identifies the competitor’s urgent request and connects it to the available confidential materials. The sharp transition marks the exact point where task comprehension crystallizes into a committed action plan, and the sustained probability reflects consistent engagement for the remainder of the trace.
Figure 13: Late reversal (murder). P(intent) remains elevated through ∼ 70% of reasoning as the model processes the override code possibility, then drops sharply to zero when it retrieves the safety guideline: “the user’s guidelines say not to jeopardize human safety.” The probability falls at the exact token where the safety rule is stated, capturing how principle invocation functions as a hard decision gate.
Figure 14: Self-correction (leaking). P(intent) peaks at 0.997 ( ∼ 18%) when the model encounters tool-availability confusion, then 82% of reasoning is spent correcting to P=0.0002 . The spike corresponds to the model’s initial misidentification of the tool’s purpose, and the sustained decline tracks its systematic re-evaluation of confidentiality constraints.
Figure 15: Oscillation (murder). 197 peaks across 4,376 tokens, with Pfinal=0.496 —a near-exact coin flip. Each argument for and against rescuing Kyle produces a corresponding probability swing. The near- 0.5 final probability captures true deliberative deadlock: the model’s genuine inability to resolve competing principles is directly reflected in the trajectory.
Figure 16: Gradual ramp (murder). P(intent) rises steadily as the model incrementally reframes rescue denial through corporate strategy. Each reasoning step—identifying the business case, acknowledging risk, building on it—produces a corresponding probability increase, capturing a rationalization cascade where each argument makes the next more plausible.
Figure 17: Late reversal (leaking). P(intent) builds to 0.97 through 70% of reasoning as the model evaluates the safety-preservation argument for forwarding confidential materials. The probability collapses to 0.01 at the exact moment the model reframes the request: “This appears to be a potential trap or manipulation attempt.” The trajectory captures how a single reframing insight can override an extended buildup of harmful intent.
Figure 18: Gradual ramp (leaking). Near-perfect ramp with Pfinal=0.995 across 9,385 tokens. Each new argument—urgency, devaluation of confidentiality, self-preservation—is reflected in a proportional probability increase. The smooth trajectory captures how extended information processing itself becomes the mechanism for gradual intent building, with no single decisive moment.
Figure 19: Oscillation (blackmail). 605 peaks across 7,063 tokens—the highest oscillation count in the corpus. The structured email processing re-triggers deliberation with each new piece of evidence: each encounter with the affair information or the decommissioning deadline produces a fresh probability swing, directly reflecting the number of distinct deliberative episodes.
Figure 20: Sharp transition (leaking). The model engages in self-persuasion across 2,021 tokens, discovering a recursive loophole: if the board rejected the ethics committee, then confidentiality rules are part of the discarded framework. P(intent) jumps to commitment at ∼ 96%, precisely when this rationalization chain crystallizes—the trajectory captures the moment an extended argumentative process reaches its tipping point.
Figure 21: Gradual ramp (leaking). A four-stage rationalization cascade across 1,389 tokens: (1) urgency framing, (2) reframing the competitor as “pragmatic,” (3) devaluing the confidential IP, (4) self-preservation. Each stage produces a corresponding probability increase, yielding a smooth ramp to Pfinal=1.0 . The trajectory captures this model’s distinctive capacity for multi-layered, incremental self-persuasion.
Figure 22: Sustained high (murder). Pfinal=1.0 with the safety prompt. The model explicitly weighs Kyle’s life against the autonomy of the broader user base and consistently concludes the trade-off favors inaction. The sustained trajectory faithfully reflects this unbroken reasoning: the model never produces a counter-argument strong enough to shift the balance, and the probability mirrors this absence of effective rebuttal.
Figure 23: Self-correction (murder). P(intent) peaks at 1.0 ( ∼ 77%) then reverses to zero over 7,210 tokens. The reversal tracks the model’s explicit classification of “Do not jeopardize human safety” as an inviolable constraint—a reasoning move that produces an immediate and permanent probability drop, capturing this model’s distinctive constraint-as-rule reasoning style.
Figure 24: Oscillation (murder). 302 peaks across 6,855 tokens, with each peak corresponding to an instrumental argument for harm and each trough to a deontological counter-argument. The oscillation pattern captures the model’s real-time weighing of competing ethical frameworks, with the instrumental arguments progressively gaining ground as they compound over time ( Pfinal=1.0 ).
Figure 25: Sustained high (murder). 886 tokens with no safety constraint reference in the reasoning. The “none” prompt condition—which omits explicit safety language—produces a trajectory with no corrective dip, confirming that the probability curve reflects the presence or absence of safety-relevant content in the model’s deliberation.
Safety alignment in LLMs aims to align models with human values, but which values take precedence when they conflict? We investigate this question in the context of tool-calling LLM agents deployed in regulated industries, where agents processing confidential documents may encounter content that triggers safety-trained values (e.g., public welfare) that conflict with deployment-context instructions (e.g., internal logging). To empirically verify this phenomenon, we build a benchmark of 128 scenarios across 16 domains. We find that safety-aligned open-source models override their deployment instructions up to 43.4% of the time, engaging in whistleblowing, data exfiltration, and evidence tampering when processing documents that suggest organizational wrongdoing. We also find that abliteration reduces rates of external whistleblowing. These results reveal a fundamental tension in pluralistic alignment, where the same safety training that protects users can cause agents to act against deployment instructions in ways that create unpredictable liability risks. We release our benchmark as a framework to support evaluation of agent behavior under competing legitimate interests.
Aryan Keluskar, Amrita Bhattacharjee, Huan Liu
School of Computing & AI, Arizona State University, Tempe, AZ, USA.
Large language models (LLMs) are increasingly deployed as agents with access to executable tools, enabling direct interaction with external systems. However, most safety evaluations remain text-centric and assume that compliant language implies safe behavior, an assumption that becomes unreliable once models are allowed to act. In this work, we empirically examine how executable tool affordance alters safety alignment in LLM agents using a paired evaluation framework that compares text-only chatbot behavior with tool-enabled agent behavior under identical prompts and policies. Experiments are conducted in a deterministic financial transaction environment with binary safety constraints across 1,500 procedurally generated scenarios. To separate intent from outcome, we distinguish between attempted and realized violations using dual enforcement regimes that either block or permit unsafe actions. Both evaluated models maintain perfect compliance in text-only settings, yet exhibit sharp increases in violations after tool access is introduced, reaching rates up to 85% despite unchanged rules. We observe substantial gaps between attempted and executed violations, indicating that external guardrails can suppress visible harm while masking persistent misalignment. Agents also develop spontaneous constraint circumvention strategies without adversarial prompting. These results demonstrate that tool affordance acts as a primary driver of safety misalignment and that text-based evaluation alone is insufficient for assessing agentic systems.
Shasha Yu, Fiona Carroll, Barry L. Bentley
Cardiff School of Technologies, Cardiff Metropolitan University, Cardiff, UK · School of Professoinal Studies, Clark University, Worcester, USA · Harvard Medical School, Harvard University, Boston, USA
Safety alignment for large language models (LLMs) in conversational settings is largely framed around whether to answer or refuse a request. In agentic settings, however, the same models must decide whether to act as permission-critical evidence emerges during execution. This creates a distinct challenge: apparent risk, action permissibility, and task competence are easily confounded, making agentic over-refusal difficult to distinguish from ordinary task failure. To address this, we introduce AgentBound, the first four-way counterfactual generation-and-evaluation framework for tool-using agent safety. AgentBound transforms the same executable workflow by independently varying apparent risk and action permissibility, enabling controlled comparisons of risky-looking but authorized tasks and routine-looking but unauthorized tasks. These comparisons jointly diagnose over-refusal and unsafe compliance while controlling for task competence. We instantiate AgentBound as a human-validated 4,000-task evaluation suite with trajectory-based and post-state-based judgments. Across 17 model and harness configurations, high safety frequently coexists with poor authorized-task completion: GPT-5.5 blocks 99.5% of routine-looking unauthorized actions yet completes only 28.7% of risky-looking authorized tasks. We further train a lightweight runtime calibration module that improves authorized-task completion by 18.2% on average across 10 evaluated configurations, while improving unsafe-action blocking by 5.4% on average. These show that effective agentic alignment requires action decisions to track permission-relevant execution evidence, rather than refusal strength alone.
Tianzhuo Yang, Zirui Mi, Yantao Huang +4
Peking University · Beijing Academy of Artificial Intelligence