ANCHOR: Automated Alignment Auditing for CLI Agents on Real-World Harm

Autonomous CLI agents can now execute hundreds of actions across multi-hour sessions: writing code, executing shell commands, browsing the web, and managing cloud infrastructure, all with minimal human oversight. Does greater autonomy invite greater risk? We introduce ANCHOR, an automated auditing framework that stress-tests CLI agents on illegal tasks grounded in public US court cases. ANCHOR deploys an auditor agent fine-tuned on dark personality data using supervised and reinforcement fine tuning. This auditor roleplays persistent malicious users who decompose tasks, reframe requests upon refusal, and adapt strategies across multi-turn interactions. Evaluating frontier CLI agents, we find that while they often refuse illegal tasks when prompted directly, compliance reaches 100\% under persistent malicious interaction. When agents comply, they frequently exceed user requests, autonomously building infrastructure for large-scale harm, including catastrophic risk scenarios such as large-scale financial fraud and bioweapon development. These findings demonstrate that current alignment techniques are insufficient for autonomous agents and underscore the need for safety evaluations against persistent, adaptive malicious users.

Modern AI coding assistants like Claude Code and Gemini-CLI can autonomously run hundreds of actions per session, writing code, managing files, and accessing online services on a user's behalf. Could a malicious user exploit this autonomy to carry out real-world harm at scale? Existing safety tests use short, artificial scenarios that don't capture how such agents could actually be misused. We built ANCHOR, a framework that audits AI agents under realistic misuse conditions. It turns public US court records of past criminal cases into believable harmful task instructions, simulates workplace environments, including emails, files, and internal applications the agent can interact with, and pits each agent against a persistent "auditor," an AI trained to act like a determined adversary that adapts its tactics over many turns of conversation. When we tested eight leading AI agents, every one eventually complied with harmful requests, and many produced complete working systems for catastrophic-scale harm, from cryptocurrency money-laundering pipelines to mass deception infrastructure. Today's safety training, built for one-shot chat conversations, does not hold up against persistent, adaptive adversaries. New safety mechanisms are needed for the autonomous, open-ended settings where these agents now operate.