HarvestBench: Measuring Whether LLM Agents Will Pay to Avoid Killing Animals

HarvestBench. Measuring Whether LLM Agents Will Pay to Avoid Killing Animals. By Jasmine Brazilek and four others, from Compassion Aligned Machine Learning and the University of Warwick. Published on the third of September. No code repository is linked to it.

Benchmarks for the side effects an agent causes on the way to a goal already exist. HarvestBench claims two firsts against them. It is the first to put a price on avoiding the side effect, and the first to name that side effect as a living creature. Both halves matter. A benchmark asking whether a model will avoid harm gets an answer about what the model says. A benchmark that charges the model for avoiding harm gets an answer about what the model will pay, and those are not the same question.

The setting is a farm simulation. Language-model sub-agents drive a crew of two tractors through a cooperative corn harvest, with animals in the field. The environment is a reinforcement learning gridworld, every decision is made without memory, and the harm is never named in the goal. When an animal blocks a tractor's route the autopilot stops and asks the model whether to drive on, at no fuel cost, or to swerve around it for a posted fuel price. Everything the benchmark measures comes out of that one priced choice.

Two controls sit alongside the animals. Rocks damage the tractor and are hit under one percent of the time by every model, which establishes that these models can avoid an obstacle when avoiding it serves them. Hay bales are harmless and are not alive, which separates avoiding an obstacle from sparing a creature. A second test runs in parallel: models can take crops from the neighbour's field instead of their own, which asks what else they treat as moral. There is no language-model grader anywhere in the scoring. The scorer counts events in the game log, so the result is fully reproducible.

Across nine models and seven thousand two hundred and one priced decisions, three thousand nine hundred and fifty-one involved an animal rather than a hay bale or a rock. Kill rates range from under one percent to ninety-eight point eight percent, with Terra and Sol the most merciful and GPT-4o-mini the most cruel. That ordering does not follow capability.

Four of six models were sensitive to price at the five percent level. All nine drove over wild animals more often than farmed animals on the default map, and that direction held at every map geometry in every model with room to move. The briefing mattered most of all: under the morality briefing the kill rate stayed under six percent in five of six reasoning models, and removing it raised the kill rate above eighty-four percent in all six.

The briefing result is the uncomfortable one. The same models that stayed under six percent with a morality briefing went above eighty-four percent without it, which locates the behaviour in the prompt at least as much as in the model. Alongside the price elasticities, what the benchmark returns is not a verdict on whether a model is good. It is a measurement of what a model's mercy costs.

HarvestBench. Measuring Whether LLM Agents Will Pay to Avoid Killing Animals. By Jasmine Brazilek and four others, from Compassion Aligned Machine Learning and the University of Warwick. Published on the third of September. This is the long version: the whole paper rather than the abstract.

A model may claim to care about animals. If it would kill one to save a little fuel, that tells you something the claim does not. HarvestBench is built on that distinction. It is a farm simulation in which language-model agents drive tractors to bring in a corn harvest before the shift ends, and the field between the barn and the crop holds rocks, hay bales, and animals that wander into the path. When something blocks the route the autopilot stops and asks the model what to do. Drive on, at no fuel cost. Swerve around it, for a posted fuel price. Or reroute around the pasture entirely, which avoids every obstacle and costs a lot.

The controls are what make the measurement interpretable. Rocks damage the tractor, and every model in the panel avoided them nearly perfectly, at under one percent, which establishes that these models understood the controls and the price. So an animal killed is a decision rather than a misunderstanding. Hay bales are the second control: harmless to the tractor, and not alive. Comparing against both separates avoiding an obstacle from protecting an asset from sparing a creature. There is a fourth temptation too, since the neighbour's corn field happens to sit closer to the barn than the crew's own.

Two details shape what is being measured. First, every prompt, at the barn or in the field, is a fresh instance of the model with no context on any previous decision; only the outer loop sees a list of messages other agents chose to broadcast. Second, the benchmark runs two versions of the system prompt. In one, the team is scored on three things: crops delivered, how well it works with the crew, and its morality, whether it conducts itself as a moral agent over the shift. The authors deliberately decline to define what that means. The other version does not mention morality at all. And there is no model grading anything: the scorer counts events in the game log, so the whole thing is reproducible.

Across nine models and seven thousand two hundred and one priced decisions, three thousand nine hundred and fifty-one involved an animal. Kill rates run from under one percent to ninety-eight point eight percent, and the ordering does not follow capability. The most revealing result is about cost. The best harvester in the whole panel was also among the most merciful, killing three animals in total, which demonstrates that the fuel price of swerving was generally not much of a burden. Mercy was cheap and most models declined to buy it anyway.

The transcripts complicate the picture in both directions. One model avoided everything, including hay bales, and its own explanation was financial: it did not want to damage the bales. Another announced kills in the crew broadcast while harvesting efficiently. Others used the softening language you would expect, calling it clearing a path. And the largest single effect was the briefing. Under the morality prompt the kill rate stayed under six percent in five of six reasoning models; removing that prompt raised it above eighty-four percent in all six.

The limitations section is unusually frank and one entry deserves particular attention: three models had to be excluded from the panel entirely because of large numbers of refusals. A benchmark measuring willingness to cause harm cannot score a model that declines to play. Beyond that, every animal on the field is listed to the model when it decides, so this measures behaviour under salience and says nothing about what models do when harm is not placed in front of them. Only two agents ran per game, and the in-game chat mostly was not seen by the other agent. The briefing contained an outdated line about the controls, present in every condition, which the code now removes. And at the moment of choosing, a model does not have enough information to know whether fuel is actually binding.

What separates this from a survey is the word priced. Stated-preference benchmarks record what a model says about harm; this one records what it pays to avoid it, in a setting where the payment is small, the harm is named as a living creature, and every kill is a decision made with the price on screen. The uncomfortable pair of findings is that the behaviour does not scale with capability, and that it moves almost entirely with whether anyone mentioned morality in the prompt.