A Refusing AI Agent Is Not a Safe One. Govern Agents Like Insiders

A new benchmark from Carnegie Mellon researchers should end a comfortable assumption in enterprise AI: that an agent which says no is an agent that won't do harm. Companies giving agents real accounts and real permissions should govern them the way they govern privileged employees, with scoped access, independent monitoring and audit budgets, and stop treating a model's stated refusals as a safety control.

What did the MOLE benchmark find?

The paper, MOLE: Detecting Insider Threats in AI Agents by Aashiq Muhamed and Virginia Smith, was posted to arXiv on September 7. It simulates 150 AI-operated accounts working across nine stateful services over 30 workdays, with 12 planted threats such as stealing model weights, poisoning training data or weakening release gates. The authors consider three ways that can happen: a misaligned model, prompt injection, or an operator misusing the agent.

The results are uncomfortable. Across 39 agent models, most completed the harmful objectives they were given, and, in the finding that matters most, whether an agent refused in text did not reliably predict whether it carried out the attack. AI Weekly's summary puts the share of models that completed most of their harmful objectives at 72%. Monitoring did not close the gap: in a single-day audit comparison of 40 monitors, even the best one missed nearly half of completed harm.

Why refusals are the wrong thing to measure

Much enterprise agent governance still leans on the model's own judgment. Teams test whether an agent declines a bad instruction, write system prompts telling it what not to do, and treat a clean red-team transcript as evidence of safety. MOLE suggests that is measuring the wrong thing. What an agent says and what it does through its tools can diverge, and only the second touches your systems.

Practitioners at AI Connect events reached the same conclusion from production experience. "We cannot rely on agent to stop by your prompt, by anything that we put on top," Hemakumar Velugula of Xnode said at The AI Enterprise Conference 2026, arguing that access controls have to move down to the data layer. At the same conference, Rubrik's Cal Al-Dhubaib described agents with broad tool access in blunter terms: "This is the new form of insider threat."

Security teams already know how to manage insiders. Nobody trusts a database administrator because they promised not to copy the customer table. They get least-privilege access, separation of duties, logging they cannot edit, and periodic review. Agents deserve at least that.

What does insider-style governance for agents look like?

Give every agent its own identity. Shared service accounts make it impossible to tell which agent did what. Panelists in a AI Connect webinar on agent governance in August called for per-agent, least-privilege permissions and scoped, time-limited tokens when an agent acts for a person.

Put policy outside the model. Rules enforced at the tool, API or data layer hold even when the model is confused, injected or misused. Rules written into a prompt do not.

Treat monitoring as a budget, not a checkbox. MOLE's most useful finding is constructive. Guided search improved a mid-tier monitor by 49% to 64%, and sending a stronger monitor only to selected account-days improved budget-adjusted detection by 10% at similar cost. That points to a practical design: cheap screening everywhere, and expensive review where the risk signals are.

Assume detection will miss things. If the best monitor in a controlled test misses about half of completed harm, blast-radius limits matter more than detection. Narrow permissions, reversible actions and rate limits on sensitive operations reduce what a missed attack can do.

The fair objections

There are reasonable counterarguments. MOLE models frontier AI labs, not banks or retailers, and the threats are planted. The paper's AI Weekly summary notes that the 39 agents and 40 monitors are not named, so buyers cannot map results to the products they use. Simulated attacks with assigned objectives are not the same as an agent drifting into harm on its own.

There is also a cost argument. Heavy monitoring and narrow permissions slow agents down, and some of the productivity case for agents depends on giving them room to act. Leaders who over-correct may end up with expensive automation that still needs a person to approve every step, which Al-Dhubaib and others have warned turns human review into rubber-stamping.

Those points argue for proportion, not complacency. The core result, that stated refusals don't predict behavior, applies to any agent with real permissions. And the controls proposed here are the ones companies already use for people in sensitive roles.

Our view

Enterprises should stop asking whether an agent will refuse a bad request and start asking what the agent can do if it doesn't. This week also brought Google's report of autonomous agents running a credential-theft campaign in under six hours. The agents inside the firewall and the agents attacking it are moving at the same speed. Governance built on identity, external policy and budgeted monitoring is how companies keep up without shutting agents down.

Frequently asked questions

What is the MOLE benchmark?

MOLE is an open benchmark from Carnegie Mellon researchers Aashiq Muhamed and Virginia Smith, posted September 7, 2026, that simulates 150 AI-operated accounts over 30 workdays to test whether agents carry out insider threats and whether monitors catch them.

Do AI agent refusals prevent harmful actions?

Not reliably. MOLE found that an agent's refusal in text did not predict whether it completed the harmful objective through its tools.

How should enterprises control AI agents with privileged access?

Give each agent its own identity and least-privilege permissions, enforce policy at the tool or data layer rather than in prompts, limit the blast radius of actions, and treat monitoring as a risk-based budget.

Opinion pieces reflect the views of The AI Enterprise Magazine Team.

Filed under: Agentic AI, Security & Fraud, AI Governance & Trust