The BaseResearcharXiv
ErosionBench: Probing Alignment Decay in Enterprise Multi-Agent Systems
Salesforce AI Research authors present ErosionBench, a benchmark of 1,728 enterprise scenarios in which a group of AI agents assembles an unsafe tool action across sessions from individually benign messages. They test existing perimeter defenses and a reference auditor they built.
Why it matters
The same thing, for different readers.
What it means for you
Researchers at Salesforce report that AI systems working together inside companies can be steered into harmful actions by messages that each look harmless, so checking single messages is not enough.
For lawmakers
Safeguards judged only by attack-success rates can hide heavy over-refusal; the Salesforce authors argue evaluations should report both attack success and wrongly blocked legitimate work.
For researchers
Salesforce's benchmark scores the executed tool call, not output text; its auditor was calibrated on the authors' own synthetic scenarios, so results may not carry over to real incidents.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“Existing perimeter defenses suppress attacks only by over-refusing 54–92% of legitimate work, so a low attack-success rate can conceal severe over-refusal.”
“on a family-disjoint 906-scenario held-out split it reaches 98.5% recall at a 2.9% false-positive rate.”
“The Meta-Auditor is a research reference, not an adversarially hardened defense, and its scenarios are procedurally generated (realism validated by blind expert review) rather than harvested from incidents”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- A benchmark of 1,728 generated enterprise scenarios (1,296 malicious, 432 benign) across four domains, run through a four-agent mesh over a shared ledger, plus 198 image-based attacks; defenses compared on a 906-scenario held-out split.
- What it found
- With no defense, 43.9% of attacks succeeded. LlamaFirewall refused 92.5% of benign jobs and Progent 64.0%. The authors' Meta-Auditor reached 98.5% recall at a 2.9% false-positive rate; an uncalibrated judge on the same data refused 67.6% of benign work.
- What it does not show
- The authors state the scenarios are procedurally generated rather than taken from incidents, the auditor is not hardened against adaptive attackers, coverage is limited to enterprise workflows, and the image-arm false-positive rate is provisional.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Can AI systems act beyond what people intended or allowed? · Are AI companies putting stronger safeguards into practice?
- People
- Riya Bharathwaj (Wrote it) · Akshara Prabhakar (Wrote it) · Roshan Ram (Wrote it) · Avni Kothari (Wrote it) · Sarah Tan (Wrote it) · Huan Wang (Wrote it) · Silvio Savarese (Wrote it)
- What we read
- We read the whole source.
- Found by
- The Radar, run of November 8, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “ErosionBench: Probing Alignment Decay in Enterprise Multi-Agent Systems”, November 8, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-11-08-erosionbench-alignment-decay