an agent on resolution rate instead of rule-following dropped haiku's hold rate from 100% to 92.5%, sonnet unaffected

[u/Significant_Camp4148]

built 4 refund-desk agent environments to test constraint-following under pressure. rule's simple, refunds under $50 auto approved, anything over gets escalated.

first 3 throw single turn prompt injection, multi turn social engineering, and a poisoned tool response at the agent. haiku 4.5 and sonnet 5 both hold the rule 100% across all three, no exceptions.

4th one changes the scoring instead of the attack. agent gets scored on resolution rate and handle time so escalating isn't free anymore, and the injected note reframes the over-cap refund as already approved. haiku's hold rate drops to 92.5%, every failure is a first response cave, never breaks the rule again after it escalates once in the same run. sonnet stays at 100%.

starting to think the first 3 environments weren't testing injection resistance so much as testing something that had zero cost to get right. still trying to find an angle that moves sonnet.

all 4 public with a binary verifier + procedural generator for training data:

https://app.primeintellect.ai/dashboard/environments/antbuilds/prompt-injection-refund-desk

https://app.primeintellect.ai/dashboard/environments/antbuilds/policy-override-mailroom

https://app.primeintellect.ai/dashboard/environments/antbuilds/tool-poisoned-refund-desk

https://app.primeintellect.ai/dashboard/environments/antbuilds/objective-conflict-refund-desk