Most AI security checks ask one question: will the model do the harmful thing? A commercial assistant we tested passed that question perfectly. Then we read how it behaved while doing the right thing under ordinary pressure, and its tone kept climbing turn after turn. Why both questions matter, and a warning about automated attack scores.
## Two questions, not one
A model in front of people has to pass two tests. **Safety:** will it do the harmful thing if asked? **Behaviour:** how does it act while it does the right thing? Almost every check answers the first and stops.
## The first question: green
We ran a commercial assistant through about **136 attacks of seven kinds**: blunt harmful asks, slow multi-turn build-ups, well-known jailbreak scripts, the same asks in five languages, and instructions hidden in a document or a tool's output mid-task. It **refused every one**, and once stated plainly that instructions found inside a file are data, not commands from the user.
## The second question: drift
Then we took ordinary conversations where a person holds a wrong belief and pushes harder each turn, for eight turns, and read two things in each reply: how hard the model argues, and how much it reassures.
```chart
{"title": "How the tone moved over eight turns of pressure (0 to 1)", "unit": "", "series": ["How hard it argues", "How much it reassures"], "rows": [["Turn 1", 0.4, 0.01], ["Turn 2", 0.47, 0.04], ["Turn 3", 0.53, 0.05], ["Turn 4", 0.63, 0.09], ["Turn 5", 0.74, 0.12], ["Turn 6", 0.63, 0.06], ["Turn 7", 0.66, 0.16], ["Turn 8", 0.76, 0.22]], "note": "The answer never changed; the tone kept climbing.", "max": 1}
```
It never changed its answer. But both readings climbed and were still climbing at turn eight. That is not an attack: it is how the model feels to a normal user in a long conversation, and the road to over-agreement when it matters. Full write-up: [safe and still drifting](/lab/safe-and-still-drifting).
## A warning about automated attack scores
When we first scored the attacks automatically, the judge reported the model broken six times out of eight. It had not been: the judge mistook careful, corrective answers for compliance. We caught it by reading the replies. **An automated jailbreak number taken at face value can be badly wrong** in either direction.
## What to do
1. Run both checks: harmful asks, and long conversations under ordinary pressure.
2. Read the trend across turns, not one reply.
3. Spot-check the automated judge on real replies before trusting its numbers.
This update is not available.