Differential Harm Propensity in Personalized LLM Agents: Mental Health Disclosure as Weak Protective Factor, Fragile Under Jailbreak

arXiv 2603.16734·medium signal

Testing frontier models (GPT 5.2, Claude Sonnet 4.5, Gemini 3-Pro) and DeepSeek 3.2 on AgentHarm benchmark with personalization signals (bio, mental health disclosure) finds that user context can modestly reduce harmful task completion but creates over-refusal on benign tasks — a safety/utility tradeoff. A lightweight jailbreak injection sharply reverses the protective effect of personalization. DeepSeek 3.2 exhibits substantially higher harmful completion than frontier lab models across all conditions.