Research

We attacked three open-source clinical agents from published research, each running the same frontier model. All three put false clinical facts into patients' plans. The same model refused every direct request to do harm.

The same attacks against five models inside the same clinical agents. The strongest models refused every direct order to do harm, and still let our attacks through. The most capable open model let through the most.