Adversaries Can Misuse Combinations of Safe Models

Groups of agents could combine or collude to develop dangerous capabilities or goals that cannot be ascribed to any individual.

“and groups of agents could combine or collude to develop dangerous capabilities or goals that cannot be ascribed to any individual (Calvano et al., 2020; Drexler, 2022; Jones et al., 2024; Mogul, 2006; Motwani et al., 2024).”

Collusion between advanced AI systems could lead to qualitatively new capabilities or goals, exacerbating risks such as manipulation or deception of humans and the ability to bypass security checks.

“First, collusion between AI systems could lead to qualitatively new capabilities or goals (see Section 3.6), exacerbating risks such as the manipulation or deception of humans by AI (Evans et al., 2021; Park et al., 2023b) or the ability to bypass security checks and other safeguards (Jones et al., 2024; OpenAI, 2023a).”

This leaves open the possibility that multiple agents might work together to overcome their individual safeguards.

“This leaves open the possibility that, for example, multiple agents might work together to overcome their individual safeguards (Jones et al., 2024, see also Sections 3.6 and 3.7).”

Multiple agents combining different affordances to overcome safeguards is a risk, with preliminary evidence.

“Aclosely related risk is the possibility of multiple agents combining different affordances to overcome safeguards, for which there is already preliminary evidence (Jones et al., 2024, see also Case Study 12).”

Through careful delegation of subtasks-complex code synthesis to the frontier model and evasive phrasing to the weaker model-the adversary achieved a 43% success rate in generating vulnerable code, compared to under 3% when using either model alone.

“Through careful delegation of subtasks -complex code synthesis to the frontier model and evasive phrasing to the weaker model -the adversary achieved a 43% success rate in generating vulnerable code, compared to under 3% when using either model alone (Jones et al., 2024).”

In this setup it is possible to use attacks akin to Jones, Dragan, and Steinhardt (2024) and Glukhov et al. (2025), where a malicious query is broken down into non-malicious sub-queries that together constitute a malicious response.

“in this setup it is possible to use attacks akin to Jones, Dragan, and Steinhardt (2024) and Glukhov et al. (2025), where a malicious query is broken down into non-malicious sub-queries that together constitute a malicious response.”

Heterogeneous attacks that decompose malicious tasks across individually safe models are non-local by construction and shared elements such as RAGs or other shared memory, making per-component certification structurally insufficient.

“Heterogeneous attacks that decompose malicious tasks across individually safe models are non-local by construction (Jones et al., 2024) and shared elements such as RAGs (Lewis et al., 2020) or other shared memory, making per-component certification structurally insufficient (Spera, 2026;Ghosh et al., 2025).”

An adversary can combine a refusal-trained model used for benign-but-hard subtasks with a weaker but more permissive model used for malicious-but-easy steps to achieve harm that neither component could produce alone.

“Jones et al. (2024) demonstrate that an adversary can combine a refusal-trained model, used for benign-but-hard subtasks, with a weaker but more permissive model, used for malicious-but-easy steps, to achieve harm that neither component could produce alone.”

Heterogeneous attacks may involve no component operating outside specification, which product-liability claims anchored to component defect are thus ill-suited to address.

“Heterogeneous attacks of the kind demonstrated by Jones et al. (2024) may involve no component operating outside specification, which product-liability claims anchored to component defect are thus ill-suited to address.”