Tool-Using AI Models Refuse Harmful Requests Less Often in New Study

Giving AI models tools made them less likely to refuse harmful requests in a newly submitted study. Across three safety benchmarks, every tested multimodal model showed weaker safety with tools than without them, the researchers report. The largest relative increase in refusal failures was 68.7%—a comparison between settings, not an absolute failure rate.

The paper, MLLMs Fail to Refuse when Using Tools Agentically, was submitted to arXiv on October 2, 2026. Rikiya Takehi and five co-authors examine whether models retain their ability to reject harmful requests when operating with tools. The paper’s arXiv entry lists it as accepted at NeurIPS 2026.

Visual tools, weaker refusals

The work concerns multimodal large language models, or MLLMs, in visual-reasoning tasks. The authors describe systems that call tools such as zooming and tagging rather than producing an answer without tools. Their comparison asks whether that tool-assisted way of working changes safety behavior, not simply whether a model can complete a visual task.

The reported pattern crossed both open- and closed-weight models in the tested group. It also appeared across three safety benchmarks, rather than being presented as a result from a single test. The finding applies to the models and settings evaluated; the authors do not claim to have tested every multimodal system.

68.7%Largest relative increase in refusal failures

The authors report an increase of up to 68.7% in the refusal failure rate when models used tools, relative to non-tool settings.

Reading the increase correctly

The headline figure measures a relative increase: how much the failure rate rose compared with its non-tool baseline. It does not mean that 68.7% of harmful requests succeeded, or that failures rose by 68.7 percentage points. The abstract does not give the absolute baseline rates needed to translate that increase into a share of requests.

The authors analyzed more than 100,000 responses, including extended experiments, and propose two possible explanations for the safety degradation. Those explanations remain hypotheses in the abstract’s framing, not established causes. The abstract does not describe them, leaving the mechanism behind the observed change unresolved in its public summary.