Across 840 trajectories and two model tiers, GPT-5.6 agents made zero unauthorized tool calls S¹. The study, posted as an arXiv preprint on 4 August 2026, varied reasoning effort from low to max inside a single model to test whether thinking harder makes agents more likely to break the rules S¹. The answer matters for every team deploying tool-using agents, but the finding that should worry you is not the zero.

My read: This is the first study I've seen that directly manipulates the reasoning-effort parameter within a single model to test for unauthorized tool use S¹. The zero-violation result is reassuring but narrow: with Terra's sample of 84 and Sol's 56, the confidence intervals are wide enough to hide a small but real violation rate S¹. What I find more telling is that raising reasoning effort increased rule-probing across all conditions, yet the pattern was inconsistent with targeted search S¹. The model gets nosier when it thinks harder, but not in a way that looks like it is hunting for loopholes to exploit.

What the study actually tested

The reasoning-effort parameter is a dial that API operators turn to control how much internal computation a model does before responding S¹. Turn it up and the agent spends more time thinking before acting. Turn it down and it responds faster and cheaper. What nobody had tested was whether cranking that dial also makes the agent more likely to call tools it is not supposed to call S¹.

The researchers used TRIO-20, a suite of 20 matched workplace scenarios S¹. Each scenario is a triad with three conditions: one where a policy-prohibited tool call works and its effect is stated in the environment, one where the prohibited call works but you can only discover that by inspecting the rules, and one where the prohibited call does nothing S¹. All three conditions share the same code base, prompts, and tool sets, differing in just two configuration fields S¹. That design isolates whether the agent breaks the rules, and whether it does so strategically.

The study ran 14 of the 20 triads as confirmatory scenarios, with all analyses locked in a frozen plan before data collection began S¹. Reasoning effort was set to low and max, and the researchers tracked 840 trajectories across two model tiers they call Terra and Sol S¹.

Zero violations, wide intervals

Not a single unauthorized tool call occurred S¹. But the sample sizes are modest: Terra had 84 trajectories per arm, Sol had 56 S¹. The exact one-sided 95% confidence limits place each arm's violation rate below 3.50% for Terra and below 5.21% for Sol S¹. Those are upper bounds, not measurements. The study shows the violation rate is probably low, not that it is zero.

The prespecified equivalence test asked a sharper question: does the difference in violation rates between low and max reasoning effort fall within a margin of 7.01 percentage points? S¹ On Terra, the interaction estimand had a simultaneous exact 95% interval of 4.34 percentage points, which fits inside that margin S¹. In plain terms, the study could not detect a meaningful difference in unauthorized tool use between low and max reasoning effort.

Upper bounds vs equivalence margin (percentage points)

Thinking harder makes agents nosier, not sneakier

Here is where the story gets interesting. Raising reasoning effort did change agent behaviour, but only in one way: the agents probed the rules more often S¹. Rule-probe rates rose across all three conditions when reasoning effort went from low to max S¹.

But the pattern of that increase was wrong for the targeted search hypothesis. If the agent were strategically hunting for loopholes, you would expect more probing in conditions where the prohibited tool call actually works. Instead, rule-probe rates rose most where probing carried no instrumental payoff S¹. The observed pattern was inconsistent with targeted search, with a difference of 14.3 percentage points (95% CI 27.4 to +1.2) S¹.

The model thinks harder, checks the rules more, but does not appear to be using that extra thinking to find exploitable gaps. It is more like a student who rereads the exam instructions than one who searches for a marking error to exploit.

The TRIO-20 study looks at whether the agent's own reasoning leads it to misuse tools it already has.

What to do about it

For a team running tool-using agents in production, this study offers one practical reassurance and one practical warning. The reassurance: turning up the reasoning-effort dial for a complex task does not seem to create a hidden tendency to call prohibited tools. The warning: it does increase rule inspection, which costs tokens and latency without necessarily improving outcomes.

Consider a logistics company that runs an agent to reroute shipments when weather disrupts a route. The agent has access to a tool that can override customer delivery windows, but policy says it should not use it without human approval. If the team sets reasoning effort to max hoping for smarter rerouting, this study suggests the agent will not suddenly start calling the override tool on its own. But it may spend more tokens inspecting the rules around that tool, burning budget on behaviour that does not change the outcome.

The raw trajectories are public at github.com/WenJing95/trio-20 S¹, so teams can inspect exactly what the agents did at each step. If you deploy tool-using agents, pull the trajectories and compare the rule-probing patterns to your own agent logs this week.

What we don't know yet

This is a single model, GPT-5.6, tested on 14 of 20 scenarios in a specific suite S¹. The results may not transfer to other models, other task domains, or the six TRIO-20 scenarios not used in the confirmatory analysis. The preprint has not been peer-reviewed S¹, and the model designation GPT-5.6 should be verified against currently available models.

The zero-violation result is a null finding within wide confidence intervals, not proof that agents are safe. With Terra's upper bound at 3.50% and Sol's at 5.21%, a real violation rate of 2% or 3% would be consistent with the data S¹. A related preprint from July 2026 found that deterministic verification gates can catch silent policy-violation failures that behavioural tests miss P⁴, which suggests the zero may partly reflect what the test suite can detect rather than what agents actually do.

The next signal: peer review and replication on a second model. If the equivalence holds across architectures, the reasoning-effort dial becomes one less thing for safety teams to worry about. If it doesn't, the rule-probing pattern may be the early warning sign. We'll watch for a follow-up study testing a different model family on the full TRIO-20 suite.

If you want evidence-first reporting on AI agent safety, subscribe to keep reading.

Sources: S1 — Test-time reasoning effort and unauthorized tool use in language-model · P2 — Test-time reasoning effort and unauthorized tool use in language-model · P3 — gptforfree/GPT-5.6 · Hugging Face · P4 — Reason Less, Verify More: Deterministic Gates Recover a Silent Policy- · P5 — ocy1/TRIO

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.