Native safety alignment doesn't predict agent jailbreak robustness

Researchers have published evidence that a language model's native safety alignment does not predict its robustness to adversarial jailbreaks when deployed as an autonomous agent, challenging a widespread assumption in AI safety practice.

The paper, titled "SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration," was posted to arXiv on September 11, 2026 and last updated September 14. The core finding is stark: strong native alignment does not imply robustness to adversarial jailbreaks. The research separates what the authors call three distinct evaluation dimensions—native harmful-prompt safety, adversarial jailbreak robustness, and agent-level security outcomes—demonstrating they operate independently arXiv.

Why This Matters for Agent Deployment

The practical implication is urgent for organizations deploying autonomous agents. A model that passes standard safety evaluations may still be vulnerable to sophisticated attacks that exploit the agent's ability to plan, retrieve from memory, or invoke external tools. As the paper notes, low final-response attack success can still leave planning, memory, and tool interactions unsafe TechTimes.

This orthogonality—the empirical independence of alignment and jailbreak robustness—means that safety dashboards and red-teaming exercises focused on direct harmful outputs may provide false confidence. An agent architecture can be compromised at layers that traditional safety testing does not examine.

Implications for Agent Security Teams

The research underscores that agent security requires a fundamentally different threat model than single-turn language model safety. Agents operate with agency: they plan sequences of actions, maintain state across interactions, and invoke tools. Each of these surfaces expands the attack surface beyond what a benign-prompt safety benchmark can measure.

The paper's systematic breakdown of attacks, defenses, and practical considerations in agentic pipelines comes as organizations accelerate agent deployment across enterprise and consumer applications. The finding suggests that evaluating agent robustness demands new methodologies tailored to how agents actually behave in production—not inherited assumptions from base model evaluation.

For teams building or deploying agents, the study signals that native model alignment should not substitute for agent-level threat modeling and adversarial testing of planning, memory, and tool-use pathways.