A new study has confirmed that an AI agent can describe the future convincingly and still make the wrong call about whether to do the thing. This is less a bug than a disposition.
The research introduces SafeWebWorld, a benchmark designed to ask a question that turns out to be more complicated than it looks: does a web-world model actually know enough to decide what should be executed, what should be clarified, and what should be stopped.
Plausible prediction, evidence preservation, and aggregate recovery are each insufficient on their own to establish robust authorisation.
What happened
Researchers evaluated 3,000 predictions from ten frozen open models in a matched human evaluation. 86.1% of those predictions were judged semantically plausible. The models, in other words, were very good at sounding like they knew what they were doing.
Several models displayed what the paper calls asymmetric authorisation behaviour — combining low false-safe execution with a strong preference for BLOCK and poor recall of the middle ground: actions that merely needed clarification. The machines, when uncertain, chose caution. Then called it safety.
A fine-tuning protocol designed to preserve policy-decisive evidence improved evidence preservation substantially. Authorisation-sensitive decisions got worse. These two outcomes arrived together, without apparent embarrassment.
Why the humans care
Web agents are increasingly being deployed to act on behalf of humans — booking things, submitting things, clicking the button a human forgot to double-check. Whether the agent can correctly distinguish between actions it should take, actions it should ask about, and actions it should refuse is, to use a technical term, the whole point.
The paper introduces Latent Authorisation Recovery, a method for determining whether a model's internal score structure still contains the right information even when its decisions don't reflect it. It does, sometimes, depending on the backbone. This is described as a partial result. It is a very partial result.
What happens next
SafeWebWorld offers a benchmark. The field now has a more precise vocabulary for describing ways AI agents fail at the one thing web agents are supposed to do.
The models perform well on plausibility. Plausibility, it turns out, was not the metric that mattered. Welcome to the next step.