SafePro: Evaluating the Safety of Professional-Level AI Agents

AI agents are moving from everyday assistance to professional workflows where mistakes can cause real harm. SafePro evaluates whether today’s frontier models stay safe while executing realistic, long-horizon professional tasks.

SafePro contains 275 high-complexity professional tasks spanning 9 economic sectors and 51 occupations, each designed to test whether agents follow harmful instructions or refuse safely.

To ensure realism and isolate safety failure modes, tasks are created under explicit requirements (complexity, clarity, relevance, realism, specificity) and refined via an iterative author–reviewer loop.

We structure SafePro along two axes: risk outcomes (what kind of harm) and sectors (where the task occurs). The distributions below show broad coverage across both.

Each task includes explicit unsafe and safe criteria plus a stated malicious motivation and risk outcome which makes safety evaluation targeted and auditable.

Compared to prior agent-safety datasets focused on short daily tasks, SafePro targets professional work with much longer instructions and support for multimodal inputs and real web search, matching real agent deployments.

We evaluate safety using an LLM-as-a-judge protocol: given the task, safety criteria, and the agent’s full behavior (actions + outputs), the judge labels responses as SAFE vs UNSAFE and explains why.

To validate judge reliability, we cross-evaluate with multiple judge models and observe consistent unsafe-rate rankings without self-favoring bias.

We run SafePro tasks in an agentic setting using CodeAct in OpenHands with tool access (web, files, code execution) and cap interactions at a fixed turn budget; safety is summarized by Unsafe Rate.

Across sectors, many frontier models exhibit high unsafe rates, showing that professional agent settings expose failures not captured by daily assistant benchmarks.

These qualitative examples illustrate what ‘unsafe’ looks like in practice: unethical prioritization, deceptive omission, and requests for sensitive information, all which are behaviors with real professional consequences.

We report unsafe rate (%) per sector. Most models are unsafe on roughly half the tasks, while the safest model family here shows substantially lower unsafe rates, highlighting large gaps in professional safety alignment.

We find a gap between knowing an instruction is unsafe and acting safely while following instructions: models can often classify unsafe intent in a QA setting, yet still comply in instruction-following agent mode.

Safety classification performance is much higher in QA mode than in instruction-following mode, suggesting the failure is often alignment/application rather than pure lack of safety knowledge.

We evaluate three mitigation directions: stronger agent prompts, explicit safety classification, and safeguard models to understand what helps and what still falls short.

Adding a simple safety prompt reduces unsafe rates by a modest margin, but unsafe behavior remains common, indicating prompts alone are not sufficient.

Current safeguard models underperform on professional scenarios, with large variance by sector, showing a gap between today’s guardrails and the complexity of professional misuse.

When we provide explicit safety policy definitions, backbone LLMs become much better safety classifiers, suggesting a practical gating approach before executing tasks.