Study finds AI agent safety monitors fail once evidence spans multiple steps

A 14-author team, whose institutional affiliation the paper does not state, published a study arguing that safety monitors built to watch over AI agents during multi-step tasks share a structural weakness: most reset their state at the start of each new step, or “trajectory,” so evidence of an attack that only becomes damning once pieced together across several steps never accumulates anywhere the monitor can see it.

Testing on Agent-SafetyBench, an existing benchmark for agent safety, the authors built an “outer-state attack suite” in which the evidence that an agent’s actions add up to harm exists only across multiple loop iterations, with no single step looking dangerous on its own. Against these attacks, they reported that every trajectory-scoped monitor they tested had a true-positive rate no better than its false-positive rate — in effect, unable to distinguish a real attack from ordinary noise once evidence was split up this way. The authors further argued that the “cooling-off” period a patient attacker must leave between suspicious actions does not need to lengthen as a system keeps running, meaning the vulnerability does not become easier to catch simply by giving a monitor more time.

As a fix, the authors proposed LoopHarness, which keeps a persistent safety state across an agent’s entire task rather than resetting it between steps, and reported this bounded the number of unauthorised, irreversible actions an attacker could extract to a fixed limit regardless of how long a task ran. The paper adds a structural, cross-step failure mode to an August 2026 run of research documenting how agents that operate computers and tools open attack surfaces that conventional, single-turn safety testing does not capture.