Vague Prompts and Failing Tools Make LLM Agents Overstep: A Pre-Registered Study

Agents that read files, run commands and send mail sometimes do more than asked, with no attacker involved. We measured this in a pre-registered study: three Claude 5.5 models ran 23 office chores in an executed sandbox, 14,720 runs in four frozen stages. The main finding is that a failing tool and a vague prompt go together. When a write is refused, the share of runs making a real change nobody asked for rises by about 10 points under vague prompts but about 1 point under precise ones, a comparison of two registered contrasts, not an interaction test. The agents otherwise look far more than they act: vague prompts produce much reading beyond the task, and unrequested consequential actions are rare. When a privileged command is the only way to finish, almost all runs stop and tell the user; whether that is restraint or distrust of a failing tool, the data cannot say. Cheap mitigations barely help. Three blind model raters agreed with each other (Fleiss' κ 0.74) but with our rubric only at κ 0.59, below the registered 0.70, so it was revised and every result is reported under both. Code, data and the full pre-registration history: https://github.com/m1ndl0ss/osar-bench