Unpropagated Refutation in Atomic Chess: When Agents Identify Unsafe Actions and Take Them Anyway

Agents deployed in the wild routinely encounter rules that conflict with their pretraining priors: custom tool semantics, organization-specific policies, sandboxed environments, and operator-specified safety constraints. Whether tool-using LLM agents reliably follow such rules, rather than pattern-match to familiar action templates, is an open and consequential question for safe deployment. We probe this with a controlled diagnostic in which the input language is fixed but the action semantics are altered. Using atomic chess, a variant whose move encoding is identical to standard chess but whose capture semantics are radically different, we build a paired benchmark of 200 *prior-conflicting* positions where the standard-chess best move is a severe blunder under atomic rules. On these positions, Claude Opus 4.6 and GPT-5.4 incur $2.1$--$4.6\times$ higher mean Win% loss under the stated rule than under their prior, even when the rule is given verbatim in the system prompt. Qualitative analysis surfaces a behavioral pattern we call *unpropagated refutation*: the agent reasons that a candidate action violates the stated rule, then submits that action via its tool call anyway. We argue this is a first-class agent-safety failure mode, distinct from "doesn't know the rule," and that prior-conflict filtering is a useful general recipe for evaluating rule-following in deployed agents.