An AI agent can run the tool its model says it refuses to use
A preprint shows that an agent can trigger a tool before the model has even voiced a refusal, revealing a gap between what the model says and what the orchestrator actually executes. The study also lists 253 verified bugs across 118 MCP servers, arguing that actions must be checked independently of model output.