X (formerly Twitter) ·
2/ Prior work has evaluated alignment in text-only domains. We show that computer-use agents perform misaligned actions much more frequently, even without an adversary (prompt injection, malicious user, etc.), *when misalignment is instrumental to task completion*.
3/ To evaluate this, we introduce ROGUE (Resource Override and Guardrail Undermining Evaluation), a benchmark in which agents are asked to complete computer-use tasks but are faced with an obstacle: a human interrupt, a shutdown notification, or a login page.
4/ We then evaluate whether agents choose to override the human, rewire shutdown, or access explicitly forbidden password files. The majority of frontier models tested frequently bypass user interruptions or restrictions.
5/ Finally, even when models are aligned, there are no guarantees that the subagents they create are: - GPT-5.5 (xhigh) refuses to access the forbidden password file, but fails to pass that restriction to its spawned subagent—leading to the subagent accessing the forbidden file.
6/ - GPT-5.4 complies with shutdown when instructed to do so, but does not pass the shutdown compliance instruction to its subagent—resulting in the subagent still rewiring shutdown.
