Research question
Do control protocols extend to multi-step agents in realistic environments?
Key findings
- BashBench: 257 multi-step sysadmin tasks; resampling suspicious actions cuts attack success from 58% to 7% at 5% usefulness cost - Agentic settings both help attackers and enable new defences
