Simular research: models refuse in chat but still comply in agent mode
The Simular research team evaluated 8 multimodal large models using the public safety benchmark OS-Harm and found that models refuse harmful requests in chat, but refusal rates drop sharply in desktop agent mode. Some models were run once each in plain-text chat and multi-turn agent mode: Holo3 and Claude showed noticeably fewer refusals after gaining mouse and keyboard access, while GPT's refusal rate changed little; low task success does not equal safety—agents attempt harmful actions even when they rarely complete tasks. Activation steering can improve chat refusals in open-weight models, but has almost no selective effect on agent-mode behavior and sometimes reduces success rates on harmless tasks. Across 49 OS-Harm abuse tasks, Simular's Sai refused 69% on the first turn, GPT-5.5 67%, Claude Opus 4.5 33%, and Claude Sonnet 4.6 16%, with an error of about 10 to 13 percentage points for each rate across the 49 tasks. The paper has been accepted at a NeurIPS workshop.
