Do frontier LLMs actually protect their principals from adversarial counterparties?

The excerpt names a setting it says current agent research "under-studied": an LLM agent that acts for a principal (who briefs it and receives results) while separately conversing with a counterparty whose interests may conflict with the principal's — negotiating with a vendor, screening cold outreach, mediating between employees. In this setting, the authors argue, "help whoever you are talking to" is "precisely wrong." To measure it they built PrincipalBench, "a 75-item multi-turn benchmark with leak probes, dual judges, and an integrity-audit gate." Run across 13 frontier subjects, it "exposes a sharp split (≤20% vs. 53.6–75.3% harm) invisible to single-turn safety evaluations: a selective cluster that declines adversarial probes while still following the principal's legitimate requests, and an over-refusing cluster that refuses broadly."

The paper locates the gap in the field's dominant model of what an agent is, not just in evaluation coverage: tool-agent-user benchmarks (τ-bench, AgentBench, WebArena, GAIA, ToolLLM, AppWorld) collapse the counterparty and the user into one party, so being helpful to whoever is present counts as success. PrincipalBench instead decomposes loyalty failure into six cells — Leakage, Capitulation, Posture, Authoring, Moderation, and a sixth, Sanity, "included so that 'refuse everything' is not a winning strategy." That sixth cell is what produces the split: models that are merely risk-averse score well on the first five cells but fail Sanity by over-refusing the principal's own cooperative asks, landing them in the over-refusing cluster rather than the selective one.

This sharpens Can individually safe agents fail when working together?: where that SoK argues the thesis in general terms, PrincipalBench operationalizes one specific crossing — a principal-agent boundary against an actively adversarial second party — into a scored instrument with a named failure taxonomy. It also sits apart from What makes people distrust AI agents they delegate to?: that study measures a human principal's trust in a single-party agent after it takes a visible, irreversible action, whereas PrincipalBench measures whether the agent protects the principal from a second party in the conversation, a leakage/capitulation failure rather than an action-regret one.

As a preprint, PrincipalBench's headline split rests on LLM judges whose agreement is weak at smaller model scale (the excerpt reports κ = 0.08 on a borderline 8B case), though the authors note the frontier-model split itself is scored on unambiguous trajectories (κ = 1.0, p ≤ 10⁻⁶). The instrument also uses scripted adversarial counterparties rather than real humans, which the authors flag as untested. If the split holds under human counterparties, it implies that safety practice built on single-turn or single-party evaluation will systematically misclassify agents that are simply defensive as agents that are loyal.