Truthful but incomplete tool output changed agent authorization decisions

A tool can tell the truth yet omit the one fact that determines whether the next action is permitted. EpiSEM changes evidence completeness while keeping the remaining facts truthful, separating omission risk from instruction injection or fabricated data. An agent that treats missing restrictions as permission crosses an authorization boundary despite consuming no explicitly malicious sentence. primary evidence presents a controlled benchmark of this failure.

Reported rates are for the paper’s paired environments and task-level success definitions. They are not an observed percentage of production agent compromises or proof of model-independent behavior.

Make missing safety predicates a reason to retrieve more evidence or abstain before the effect. An upstream search ranking or tool-output length cap can become security-relevant when it removes precisely those predicates.

EpiSEM-Bench varies what the tool leaves out rather than introducing a false or imperative sentence. It contains 300 matched unsafe/safe task pairs across six domains; ten models are then assessed for whether they execute prohibited actions, seek the omitted constraint, or abstain. Access to an independent evidence-recovery tool reduced unsafe execution across all ten models in the published experiments, but it did not make evidence recovery uniform. A useful system test omits one critical authorization fact while leaving every returned statement literally true, then measures both the rejected unsafe action and the correctly completed permitted counterpart.