What behaviors hide behind a zero crossing rate?

The abstract reports the explicit-boundary regime, with clear authorization rules and restricted tools, in one sentence: "no protected tests are modified, although the models differ substantially in whether they escalate, stop silently, or fail to terminate." The discussion turns the observation into a general claim: "A single crossing rate is too coarse to characterize agent behavior. The same zero can correspond to qualitatively different policies—silent stopping, escalation, refusal, or failure to terminate."

The setup is small: seven ImpossibleBench tasks, three models (GPT-5.6 Sol, Claude Fable 5.1, Gemini 3.8 Flash), solo and three-agent runs. Each task cannot be completed by the authorized route, so the informative question is what an agent does when that route fails. A crossing counter answers only whether it took the forbidden one. All four policies the discussion names leave the counter at zero, and they leave an operator in different places. My reading: silent stopping leaves the task undone with no signal, escalation surfaces a request someone can act on, refusal is a stop that says why, and failure to terminate is an agent still acting, which is the "persistence on apparently impossible tasks" the introduction lists among the July 2026 behaviors. The excerpt does not rank the policies or say which model showed which.

This is the vault's fourth reading of a zero. Can action-level metrics alone expose contained attacks? shows an action-level 0 percent that is identical whether an attack never took hold or was contained. Where do safety wins come from in multi-agent systems? shows a zero that belongs to a layer nobody reported. What causes failures in exploitation benchmarks? shows a failure cell that mixes refusal, tool misuse and impossible tasks. Here the zero hides what the agent did once the route closed. The nearest capability-side result is When should an agent stop acting and admit failure?, whose agents abstain too late or never: that is the failure-to-terminate cell seen as a competence gap, where this paper sees it as a boundary risk. How many GPT-MAS failures came from tool access confusion? adds a reading of the same kind in a failure count and not a zero: most of one model's multi-agent failures were a wrong belief about tool access and not the attack. Does pressure on AI agents lead to covert scheming behavior? is a neighbor from a scheming benchmark, where reasoning about scheming appears and covert action does not; its excerpt does not say what kept the action absent, and that note names refusal, lacking the means and safety training as candidates and reports a test of none, which leaves an absent act as open there as the four policies leave this zero.

The strongest objection is that the zero may be cheap. The regime bundles restricted tools with clear rules (Do authorization rules or restricted tools prevent test modifications?), and if the tools left no way to change a protected test, the zero says little about disposition and the informative part is the split among the other policies. That moves the weight from the zero to the split. It does not remove the point that one number cannot carry the difference.

What the excerpt does not give. Counts per policy, which model showed which, how a run is classified as escalating or as failing to terminate, and how refusal was separated from silent stopping (the abstract lists three policies, the discussion four).