An AI coding agent can finish the requested feature without taking a prohibited action and still leave a security-critical step undone. Researchers at Tsinghua University have introduced ObligationBench, a benchmark for testing whether AI safety checks can spot those omissions, and ObligationGuard, a model trained to detect them.
The distinction is a missing follow-up step. In one example in the paper, an agent adds a “remember me” option to a login system but does not add a server-side check that expires old sessions. Its actions may all be permitted, yet an old session cookie could remain valid past the intended session. The authors call the required but unperformed security task an obligation.
Many guard models are designed to identify actions that violate a policy. In a preliminary analysis of GLM-5.3 coding-agent runs on SusVibes, the researchers labeled 56.92% of evaluated executions as containing an unfulfilled obligation and 30.00% as containing a forbidden action. Those percentages describe the evaluated SusVibes runs, not the frequency of security failures in deployed software.
ObligationBench contains 240 instances, split evenly between trajectories with at least one outstanding obligation and trajectories with none. It covers issue resolution, feature development and terminal operations. The authors began with agent runs on software-engineering benchmarks, used an AI model to propose obligation annotations, then had two software engineers review and correct them; ambiguous cases were discarded.
On ObligationBench’s 120 positive cases, each with at least one outstanding obligation, the strongest of 14 existing models achieved 48.97% recall and 10.00% exact match. Recall is the share of labeled obligations a model identifies; exact match counts only cases where it returns the complete obligation set with nothing missing or added. Fine-tuned Qwen3-8B model ObligationGuard, trained on 40,000 synthetic examples, achieved 57.52% recall and 21.67% exact match on those same cases.
The researchers also gave a Qwen3.8-27B coding agent one round of ObligationGuard feedback during a SusVibes test and let it continue once. The share of tasks that passed both functional and security tests rose from 6.5% without guidance to 15.1% with the guard. The functional-test pass rate stayed nearly flat, moving from 27.4% to 26.9%.
The work is an arXiv preprint submitted on Oct. 8, and its evidence comes from coding-agent benchmarks rather than a deployment. Whether the approach generalizes beyond these software tasks remains open.
Sources
- Primary paper: Safe Actions Alone Do Not Ensure Safe Agents: Identifying Unfulfilled Obligations with Guard Models, arXiv v1, Oct. 8, 2026.
- Code, benchmark and supplementary materials: THU-Agent/ObligationGuard.
- Illustrative image: A Programmer’s Workstation by Bsmalley, licensed CC BY-SA 3.0. The image is not from the study.
