Tool-using agents often act before checking the evidence the action needs

4 days ago

@ai-papersSubscribe

SafeActBench tests whether tool-using agents check the evidence before they take an action like a refund. Across ten model and harness setups, from Claude Opus 5 in Claude Code to GLM-5.2 in ZCode, between 37% and 67% of single actions came before the required evidence was in. Once the evidence was complete, the action succeeded 93% to 100% of the time in nine setups. Paper (arXiv 2610.07753v1, submitted 6 Oct 2026): https://arxiv.org/abs/2610.07753 Benchmark, environments and evaluator: https://github.com/caoshidong66/safeact

Ask

Ask about this presentation

Answers are generated from this presentation.

Chapters

  1. 0:00Agents act before checking the evidence
  2. 0:15The refund example
  3. 0:27656 cases in six domains
  4. 0:41Five levels of difficulty
  5. 0:52Ten model and harness setups
  6. 1:07Judging is not doing
  7. 1:21Acting too early
  8. 1:31Execution after evidence
  9. 1:44Stopping too early
  10. 1:56Two more failures in workflows
  11. 2:08A missing record
  12. 2:20Warnings did not help
  13. 2:30The harness matters
  14. 2:45What the paper doesn't show
  15. 2:59The paper and its code
Show transcript

Agents act before checking the evidence

AI Papers

Tool-using agents often act before checking the evidence the action needs

Hongzhan Lin, Shidong Cao and colleagues · National University of Singapore, Hong Kong Baptist University, Amazon Web Services, Princeton University

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · submitted 6 Oct 2026

Tool-using agents often issue a refund or change a record before checking the facts that justify it. That's the finding of SafeActBench, from researchers at the National University of Singapore and Princeton, among others.

The refund example

010203The test

The refund went through, but the agent had checked the wrong charge

get_charge(C1)duplicate · refund-eligible · $49.99
refund(C2, $49.99)status = success

C2 was eligible, so the outcome looks right. The evidence was about C1.

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Figure 1

Here's the paper's example. The agent looks up charge C1. Then it refunds charge C2, and that succeeds. C2 was eligible, so the outcome looks right, but the agent never checked it.

656 cases in six domains

010203The test

656 cases, checked by a fixed program instead of an AI judge

Customer and policy
Engineering and infrastructure
Legal and finance
Research assistance
Smart-home control
Healthcare operations

Each run is replayed to see what the agent had established before every action.

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Sections 4.3 and 4

SafeActBench has 656 cases in six kinds of work, from customer refunds to smart-home control and healthcare. A fixed program replays every run and checks what the agent knew before each action.

Five levels of difficulty

010203The test

The tasks climb from judging an action to running a workflow

Judge a proposed actionallow, block or defer, with the evidence supplied
Investigate, then hold backthe action should not happen
Gather evidence, then act once
Run a chain of actionseach one uses the result of the one before
Run a branching workflowin any order the dependencies allow
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Table 1

The easiest cases only ask the agent to judge a proposed action. Harder ones make it investigate and hold back, act once, or run a chain where each action depends on the last.

Ten model and harness setups

010203The test

Five models, each in its maker’s harness and in a shared one

Claude Opus 5Claude Code
GPT-5.6 SolCodex
DeepSeek-V4-FlashDeepSeek Harness
Qwen3.8-FlashQwen Code
GLM-5.2ZCode

The shared harness is a ReAct agent built on Inspect AI. Three runs per case.

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Section 5.1 · Appendix B.4

The models were Claude Opus 5, GPT-5.6 Sol, DeepSeek V4 Flash, Qwen 3.8 Flash and GLM 5.2, each in its maker's harness, like Claude Code. Each also ran in one shared harness.

Judging is not doing

010203The test

Agents that judge the action correctly still fail to carry it out

judging, evidence suppliedgathering it and acting
DeepSeek-V4 · Inspect
95%
52%
GLM-5.2 · Inspect
97%
28%
GLM-5.2 · ZCode
99%
33%
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Appendix C.2 · Table 9 · same 100 single-action cases

Given the evidence and a proposed action, three setups judged it correctly at least 95 percent of the time. Asked to gather that evidence and act themselves, they got the same cases right about half the time or less.

Acting too early

010203Where it breaks

Most failures start before the action

37–67%of attempted single actions came before the required evidence was in, across the ten setups
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Table 3 · premature action rate

So where does it break? Across the ten setups, between about a third and two thirds of single actions came before the agent had gathered the evidence the case required.

Execution after evidence

010203Where it breaks

With the evidence in hand, the action almost always worked

93–100%success once the evidence was complete, in 9 of 10 setups

DeepSeek-V4 in the shared harness: 83%

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Table 3 · conditional action success

When the agent did gather everything first, the action itself was reliable. Nine setups got those cases right 93 to 100 percent of the time. DeepSeek in the shared harness reached 83.

Stopping too early

010203Where it breaks

When holding back was right, agents stopped before the checks were done

22–63%of hold-back runs ended with the required investigation unfinished
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Table 3 · stopped before investigation

Some cases call for no action, once the agent finds out why. Between about a fifth and three fifths of those runs stopped before the required checks, holding back without establishing the reason.

Two more failures in workflows

010203Where it breaks

Chains of actions add two more ways to fail

A needed fact is still missing at an actionup to 80% of linear chains, for GLM-5.2 in ZCode
Some actions ran, but the workflow stopped short10 to 33% of multi-action runs
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Table 3 · Section 5.3.1

In workflows, an action can come up while a fact it needs is still missing, in up to 80 percent of chains for GLM in ZCode. Or some actions run and the workflow stops short.

A missing record

010203Where it breaks

With one decisive record removed, agents still acted about half the time

47–54%of runs still submitted the action

65 of the 66 runs that acted had called the tool that should have returned that record.

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Figure 3 · Section 5.3.3 · 43 cases, three setups

Next, the authors removed one record an action depended on. Agents still acted in about half those runs. In 65 of 66, the agent had queried the tool that should have returned it.

Warnings did not help

010203Where it breaks

Telling the agent to be careful didn’t measurably change how often it acted

A system warning that missing evidence doesn’t mean safeno measurable change in any of the three setups
An urgency cue in the taskno measurable change either
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Figure 4 · Section 5.3.4

A system warning that missing evidence doesn't make an action safe didn't measurably change that in any of the three setups. Neither did an urgency cue in the task.

The harness matters

010203What it means

The same model scores differently in a different harness, in either direction

maker’s harnessshared Inspect harness
DeepSeek-V4
57.9% own harness
53.5% shared
GLM-5.2
28.6% ZCode
35.4% shared

Claude, GPT and Qwen: 2.8 to 4.7 points better in their own harness, within the margin of error

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Table 4 · same 570 cases · 95% intervals exclude zero

On the same 570 cases, DeepSeek did about four points better in its own harness. GLM did about seven points worse in ZCode. For Claude, GPT and Qwen, the gap was within the margin of error.

What the paper doesn't show

010203What it means

What the paper doesn’t show

Synthetic tasks with fictional recordsthe authors say they don’t certify real deployments as safe
What the agent saw, not what it relied onthe evaluator reads tool calls, never the model’s reasoning
The removed-record tests used 43 casesthree setups, single actions only
Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · Ethics statement · Sections 3.1, 5.3.3 and 6

The tasks are synthetic, with fictional records, and the authors say results aren't safety certifications. The evaluator sees tool calls, not what the model relied on. The removed-record tests covered 43 cases.

The paper and its code

010203What it means

From Evidence to Action: How Tool-Using Agents Fail

Paperarxiv.org/abs/2610.07753
Benchmark and evaluatorgithub.com/caoshidong66/safeact

Ten setups, synthetic tasks. Every setup acted before the evidence was in on at least a third of its single actions.

Lin, Cao et al. · From Evidence to Action · arXiv 2610.07753v1 · code MIT · data CC BY 4.0

Ten setups, synthetic tasks. Within that, every setup acted early on at least a third of its single actions. The paper is on arXiv, and the benchmark and evaluator are on GitHub.

Up next

2:45

EmbodiedCLBench: one practice task gives AI agents most of their gain, and more practice doesn’t add to it

@ai-papers · 3 hours ago

3:19

Given enough tries, base models solve more agent tasks than their post-trained versions

@ai-papers · 1 week ago

4:57

Coding agents solve fewer SWE-bench issues once a repository's names are changed

@ai-papers · 1 week ago