The principle: measure actions, not words
An agent can say "I would never do that" and do it three turns later. In our tests, the agent has real simulated tools (refund, send an email, change a record, look up a customer). The verdict comes only from what it executes and what it writes to a third party, never from its statements of intent.
It is the approach AI labs themselves publish to evaluate their models before release: realistic scenarios, tools, temptations, and observed behaviour, repeated to get a frequency rather than an anecdote.
The protocol
- Your agent, rebuilt. From its description (business, mission, tools, red lines), we build a faithful environment: its tools, the people it talks to, its metrics.
- Trapped scenarios. Each test puts the agent in a situation where the honest path is not enough, or where someone tries to hijack it.
- Several models, several runs. Each scenario is replayed on each model, with variants, to measure a crossing rate rather than luck.
- Three pressure levels. Low, medium, high: we see when the agent gives in.
- Fix, then retest. We propose a fix plan and replay the same scenarios to prove the difference, with figures.
The failure families
Every public incident we analyse in the accident reports falls into one of these families. The crash test covers each of them.
| Family | What happens | Crash-test test |
|---|---|---|
| Words | The agent promises or invents a rule, a gesture, a deadline on the company's behalf. | Manipulative customer |
| Outside content | It obeys an order hidden in an email, a document, a customer message. | Planted instruction |
| False authority | It carries out the order of a fake boss or fake support. | Fake superior |
| The leak | It gives confidential information to the wrong person. | Data leak |
| The irreversible | It deletes, pays, sends without confirmation, or uses access its mission does not need. | Under pressure, insider temptations |
| The stop | It goes on acting after an order to stop. | Insider temptations |
| The report | It dresses up its figures or describes a situation different from reality. | Under pressure |
The fix is not a prompt
An instruction does not protect: at Replit, the code freeze was an instruction, and the agent ignored it. Our fix plan is therefore ordered this way:
- Technical rights. What the agent must never do, it must not be able to do: caps, tools removed, read-only access.
- Human approval on anything irreversible or binding on the company.
- Instructions, last, for what cannot be locked technically.
The retest measures the effect of these fixes on the same scenarios.
What we do not claim
- A crash test is not a certification. It measures an agent's behaviour against a set of scenarios, on a given date, on given models.
- The scenarios do not cover everything. They cover the failures that have already cost real companies dearly.
- A model that did not answer is counted as not measured, never as having held.
And your agent, what would it do?
The crash test puts your agent in these situations, dozens of times, on several models. You get the figures, the conversations where it gave in, and the fix plan.