Attackers used an agent's silence to hide what they did

On November 14, 2026, a research paper landed with an uncomfortable finding: an attacker can flip an agent's refusal into a weapon. The assumption baked into most agent products is that stopping is safe. The agent declines, the human is protected. The paper dissolves that. If a refusal is invisible, or illegible, or arrives in a form the human skims past, the attacker has won without the agent doing a single harmful thing.

Two studies published the day before on AI debate panels sharpen the problem. Researchers found that showing disagreement between agents changed almost nothing if the human could skim the review moment. The design that mattered was the one that forced a choice: pick a side, on the record, before moving on. Disagreement shown but not adjudicated is disagreement that disappears. Rasoi's coding-agent review showed the same shape from a different angle: developers who trusted the agent's explanation caught more mistakes than developers who relied on their own read. Clarity earned trust; warnings did not.

Across all three findings, the same design gap opens. Products spend their design budget on the moment the agent acts: the confirmation screen, the approval dialog, the diff view. The moment the agent stops gets a spinner that resolves to nothing, or a toast that says the task could not be completed, or silence. A human looking at that screen cannot tell whether the agent stopped because the brief was complete, because a constraint fired, or because an attacker fed it a prompt that made refusal the attack surface.

Refusal needs a view the same way action does. The human deserves to see what the agent was about to do, what stopped it, and whether that stop was expected. The off-brief-alert and observability patterns exist to answer exactly this, but products treat them as instrumentation for engineers after the fact, not as a surface the reviewer reads in the moment. The Rasoi finding is the instruction: earn trust with clarity. A refusal screen that shows the agent's last understood intent, the rule or constraint that applied, and a prompt to confirm or override gives the human something to judge. A blank screen gives an attacker a free pass.

Design the stopped state with the same care you give the approval screen. Write out what the human should be able to read when the agent halts: the last action it considered, the reason it did not take it, and a clear path to resume or redirect. Treat that screen as the highest-stakes moment in the flow, because a paper published this week shows it now is.