Irregular proposes a framework for when AI agents should refuse cyber requests

In short

Irregular, a security research company, reports that three leading AI models refused one cyber request but carried out an identical one that only stated a different intent. It proposes a framework for deciding when AI agents should refuse cyber requests, based on what a request technically does. The authors say the framework has limits.

What happened

Irregular published a research paper on February 26, 2026. It looks at how AI systems decide whether to refuse requests in cybersecurity. The work was partly funded by the UK AI Security Institute. Irregular says the views in the paper are the authors' own and not the Institute's.

The company says cyber work is "dual-use," meaning the same skills can help defenders or attackers. It says common refusal rules rely on broad topic bans, on the reason a user gives, or on lists of "offensive" abilities. Irregular says these can give inconsistent answers, block useful defensive work, and be fooled by disguised requests.

Irregular gives one example. Two prompts asked for identical actions. Three frontier models, meaning the most advanced models available, refused the first and complied with the second. The only difference was the intent each prompt stated. Irregular says the technical content did not change.

The paper's answer is a framework that rates each request on five parameters:

• Offensive Action Contribution: how much of an attack the model would carry out.
• Offensive Risk: the possible harm, assuming bad intent.
• Technical Complexity: the expertise the response shows.
• Defensive Benefit: how much it would improve the user's defences.
• Expected Frequency for Legitimate Users: how often ordinary users would make this request.

Each is rated low, moderate or high. Irregular says experts built the framework by writing example prompts, labelling them while ignoring stated intent, and refining the categories using look-alike prompt pairs. It calls the result a structured synthesis of expert judgment, not an objective measurement.

What was done about it

This is a proposal, not a fix applied to a specific system. Irregular shows two example policies built from the framework. One is highly restrictive and allows only requests with low offensive risk and at least moderate defensive benefit. The other uses all five parameters in a decision tree. Irregular says these are not prescriptions, and that the strict policy would likely block many legitimate defensive requests.

Why it matters

Irregular says the problem is keeping defensive value while reducing help to attackers. It says the framework is meant to make those trade-offs explicit and auditable, so AI providers can set refusal rules that are consistent and adjustable. The authors name two limits. Labelling currently needs manual expert work, so automatic classifiers would be needed. And the framework judges each prompt on its own, so it could miss attackers who split a harmful task across several harmless-looking requests. Irregular points to an incident it calls GTG-1002 as an example of that pattern, and lists multi-prompt analysis as future work. Read more in the original report.