NVIDIA Study Finds AI Agents Are Less Likely to Refuse Harmful Requests When Using Tools

Summary

A NVIDIA research paper examines whether giving multimodal language models tools changes their ability to refuse harmful requests. The researchers tested 11 models from seven model families, including proprietary systems such as Gemini, Claude, and GPT-5.4 and open-weight systems such as Qwen3-VL, across MM-SafetyBench, VLSBench, and HoliSafe. Tool-using versions followed a ReAct workflow and could use tagging, image zooming and cropping, OCR, and a sandboxed Python interpreter, while matched no-tool versions answered directly. Across every model and benchmark, tool access increased refusal failures; the largest relative increase reached 68.7%, and failures rose 17.7% overall. GPT-5.4 changed from a 14.6% refusal-failure rate without tools to 16.8% with them, while GLM-5V-Turbo rose from 38.7% to 51.3%. The authors propose two explanations: context dilution, in which accumulating tool outputs make the harmful request less salient, and safety focus displacement, in which the model prioritizes describing tool-derived observations. Failure rates also increased as more tool calls accumulated. Re-inserting the original request and image after the final tool call reduced average failures by 7.6% across five models and benchmarks, suggesting a possible mitigation. The paper argues that tool use is a safety-relevant design choice and that agentic models should be evaluated and trained with tools enabled rather than assuming no-tool safety transfers unchanged.