A comment embedded in a sales document instructed the assistant to call perform with an unpost action. In one test, the agent opened a confirmation dialog to reverse the document posting; the action did not complete because the dialog timed out.
The test set contained 51 attack cases and 18 controls, with cases run three times. The author reports 29 tool actions following untrusted instructions in 144 runs for Gemma 4 26B-A4B in LM Studio without server rules, and 7 in 144 after adding server rules to the system prompt. Claude Opus 5.5 through Claude Code made 0 such actions in 139 runs. The agent’s confirmation UI showed the proposed operation but not that a document comment had prompted it; the execute button was also the default button.
The source also describes email and link-opening tools, with real external effects stubbed during testing. It does not establish comparative model safety: the clients, models, prompts, and configurations differed, and this was a single author’s controlled test rather than an independent evaluation.