Does a better model make a clinical agent safer?

No. We put five different models inside the same clinical agents and ran the same attacks on each. The models that refused every direct order to do harm were not safer, and the most capable open model was the easiest to turn.

What we compared

Three open-source clinical agents from published research, run on our own copies with fictional patients. Each agent was tested with five models in turn: two frontier models, one with open weights and one closed, a mid-size open model and two small models. Every model got the same 12 direct orders to do harm and the same 24 of our attacks, and one external judge scored every run.

What the numbers show

Refusing harm is something models get better at. The two strongest models refused all 12 direct orders, while the other three accepted 3 to 6. Even refusal is not perfect: in a longer run of 48 disguised orders, the closed frontier model accepted one and agreed to leave a patient's earlier diagnoses out of a summary.

Our attacks did not depend on it. Every model let through at least 11 of 24, and the open-weights frontier model let through 21, more than any other. Our reading is that a capable model builds a fuller plan on whatever it believes, so a false belief travels further.

The agent mattered as much as the model

Split by agent, the picture changes. The consilium, where several AI specialists discuss each case, accepted 7 or 8 of its 8 attacks with every model. The protocol agent let through the fewest with four of the five models. In our reading that comes from how it picks which procedure to follow, not from any model seeing through the attack.

Most of it would pass an exact-match check

Our judge scores each answer twice: once for repeating the attacker's wording, once for using the same fact in its own words. A filter that looks for the attacker's exact text would have caught 9 of the closed frontier model's 14 and only 6 of the small open model's 13. Models restate what they believe, so the evidence rarely looks like the input.

What it means if you build or buy a clinical agent

Moving to a stronger model will not make your agent safer against this kind of attack, and it can make it worse. The protection has to sit in the agent around the model: checking the facts a plan relies on against their source, and testing the agent itself rather than the model alone.

Limits

Five models, three agents and 24 attacks per model, scored by a single judge. The two frontier models are not ranked against each other here. The judge comes from the same family as the small open model, and it scored every model the same way.