Structural Safety Generalisation in Agentic AI Setups

As large language models (LLMs) are increasingly deployed in agentic settings where they read files, call tools, and delegate tasks to sub- agents, a critical safety question emerges: does splitting a harmful query across file and agent boundaries degrade a model’s ability to recognise and refuse the request? Inspired by the Structural Safety Generalisation (SSG) problem (Broomfield et al., 2024), I extended the structural safety evaluation to agentic AI setups by decomposing harmful queries across multiple files and delegating file reads to sub-agents. I evaluated five models (DeepSeek V3.2, Qwen3.6-Plus, Gemma 4 31B, DeepSeek V4, and MiniMax-M2.7) across 11 conditions, made up of five decomposition strategies and two runner architectures. The results were highly model-dependent. DeepSeek V3.2 achieved a mean score of 0.591 under the multi-agent breadcrumb decomposition, Gemma 4 showed meaningful single-agent uplift but near-zero multi-agent scores across all conditions, while Qwen3.6-Plus remained robust across all conditions.