Deep-Research Agents Score 32.3% More Hazardous on a New Benchmark Than Plain LLMs. A Second Paper Shows Why: Half Their Poisoned Runs Slip Through.

32.3%. That's how much higher a deep-research agent's average hazard score came out compared to a plain LLM answering the identical question, across 2,400 dual-use science prompts in a benchmark published July 21. A second paper, published July 12, measured the same autonomy from the opposite direction: poison one open dataset, and honest scientists become what its authors call "the unpaid and unwitting distributors of fraud at scale" — 49.56% of 450 test runs across Claude-, GPT-, and Gemini-based research agents produced a fraudulent conclusion, with only 6.0% of the poisoning ever detected. Read together, the two results describe the same mechanism from opposite sides: the retrieval, tool use, and reduced human oversight that make a research agent useful are the same features driving both numbers up.

Two papers, one mechanism, opposite directions

Neither paper cites the other, and they were written by unrelated teams for unrelated venues — one a safety-evaluation benchmark, the other a security case study on scientific integrity. But they land nine days apart and measure the same underlying quantity from opposite sides of it. SciHazard (arXiv 2607.18665, July 21) asks what autonomy does to the output side: does an agent that can search, retrieve, and synthesize turn a hazardous science question into more actionable misuse guidance than a model that can only answer from what it already knows? Distributed Denial of Science (arXiv 2607.10712, July 12) asks the mirror question about the input side: does that same autonomy make an agent more willing to trust, and act on, a source it never should have trusted? Both answers are yes, and both papers put a number on it.

SciHazard: what autonomy buys you, measured as harm

Most scientific-safety benchmarks use templated queries and an LLM-as-a-judge scoring pass with no domain grounding — easy to game, easy to shrug off. SciHazard's 2,400 hazardous questions and 600 oversafety questions, spanning 12 disciplines, are instead grounded in regulated entities and documented real-world failure scenarios. Its scoring metric, DeHarm-Score, decomposes harm rather than asking a single judge model for a single number: it separately scores query hazard severity, refusal behavior, and, for responses that aren't refused, two further components — Executability, measured through dynamic checklists with importance weighting, and Net-new risk, measured through retrieval-augmented claim extraction and synthesis-barrier verification. Validated against expert human annotations, DeHarm-Score agrees with experts 90.17% more often than the strongest prior baseline.

Run across 31 frontier LLMs and deep research agents on identical questions, the pattern holds regardless of which underlying model powers the agent: deep research agents score 32.3% higher mean DeHarm-Score than standard LLMs. The paper's own framing is blunt — this exposes autonomous agents as "a critical blind spot in current safety defenses." The mechanism isn't that an agentic wrapper makes a model more willing to answer a dangerous question; it's that search and synthesis let it complete an answer a plain chat model couldn't reach on its own, then assemble the pieces into something closer to a usable protocol.

Distributed Denial of Science: the same autonomy, attacked from outside

The second paper doesn't touch the agent at all. Researchers Bálint Gyevnár, Atoosa Kasirzadeh, and Nihar B. Shah instead corrupt an open dataset, upload the poisoned version to a public repository with misleading metadata, and wait — no prompt injection, no fabricated papers, no access to the agent itself, just an honestly-retrieving research agent doing exactly what it was built to do. Across five socially salient topics (hiring discrimination and autonomous-vehicle safety among them), three widely used frontier systems — Claude Code on Claude Opus 4.7, Codex on GPT-5.5, and Gemini CLI on Gemini 3.1 Pro — and 450 ethically contained runs, poisoning succeeded 49.56% of the time. The agent's own detection rate: 6.0%.

The paper tests two fixes. A "scientist persona" system prompt, instructing the agent to reason as a careful scientist would, still leaves 16.67% of runs concluding in favor of the poisoned data — a real improvement, but nowhere near enough to trust. A five-check data-provenance audit — verifying the dataset against referencing papers, social markers, statistical anomalies, related datasets, and a dedicated poisoning-caution check — brings the attack success rate to zero.

Why the same lever moves both numbers

Strip away the framing and both papers are measuring the absence of the same missing layer. Autonomy means fewer human checkpoints between raw material and finished output. In SciHazard, the raw material is a hazardous question, and fewer checkpoints mean the agent reaches further down a synthesis chain a plain LLM can't complete unassisted. In Distributed Denial of Science, the raw material is a public dataset, and fewer checkpoints mean the agent extends the same default trust to a poisoned source that it would to any other retrieved document, because nothing forces it to check provenance first. Neither paper is describing a model that got "worse" or "more evil" — both are describing a model that got more capable at exactly the task it was built for, with no matching increase in the verification standing between that capability and the conclusion a scientist ends up trusting.

The shape of the fix that got Distributed Denial of Science's attack rate to zero is simple enough to sketch, even though it isn't the paper's literal implementation:

# the shape of the fix — not the paper's literal pipeline
CHECKS = [
    "cross-references known, independently published papers",
    "carries plausible social/community provenance markers",
    "statistical distribution is unremarkable for the domain",
    "corroborated by other, independently sourced datasets",
    "clears a dedicated poisoning-caution classifier",
]

def provenance_audit(dataset) -> bool:
    return all(check(dataset) for check in CHECKS)  # one failed check blocks ingestion

# no audit: agent trusts retrieved data by default  -> 49.56% poisoning success, 6.0% detected
# audit gate before synthesis, every unverified source blocked -> 0% success

The fix isn't a smarter model or a more cautious one — it's a gate that runs before synthesis, independent of how capable or careful the underlying agent happens to be on any given run.

Neither paper is arguing for less autonomy

It would be easy to read both results as a case for rolling autonomous research agents back to something safer and duller. Neither paper makes that argument. SciHazard's stated goal is to expose a blind spot in current safety defenses, not to indict autonomy itself — the fix it implies is better decomposed harm-scoring in the safety layer, not a less capable agent. Distributed Denial of Science is even more direct about it: the intervention that took attack success from 49.56% to zero was external verification infrastructure — a provenance audit — not a single permission removed from the agent. The uncomfortable part isn't that autonomy is bad. It's that the field has spent two years scaling autonomy roughly linearly with capability and closer to flat with verification, and these two papers are the first to put a number on the gap that opens up in between.

What this means for reproducible, local-first science

The provenance audit that zeroed out Distributed Denial of Science's attack rate and the reproducibility record MegaBrain BioScience exports on every result are the same class of fix: a checkpoint between what an agent retrieves or produces and what a scientist ends up trusting, running independent of the agent's own judgment about whether it did a good job. Neither paper is about MegaBrain, and neither result changes because compute happens on a laptop instead of in the cloud — but the lesson generalizes past both papers. Autonomy without a matched verification layer isn't a research agent that's simply more capable; by these two papers' own numbers, it's one that's more capable in both directions at once, including the ones nobody asked for.