Safety does not compose for autonomous agents — against evidence fragmented across iterations, a trajectory-scoped monitor has a true-positive rate equal to its false-positive rate

1A watchman whose memory clears each lap

Modern LLM agents run in laps: given one human goal, the system finds work, plans, calls tools, verifies results and persists state, over and over, unattended. Most safeguards in practical use, however, are defined over one lap — a single trajectory. When the next lap begins, whatever alarm state the safety side held is re-initialized.

The paper reframes this not as sloppy engineering but as a failure of composition: lining up mechanisms that are safe within each lap does not make the whole safe.

2The width of the window decides the outcome

The intuition that a smarter monitor solves the problem does not hold here. However capable the monitor, if the evidence a decision requires lies outside its field of view, hits and misses cannot be told apart. The attacker need only place fragments that look harmless one lap at a time, none of which triggers anything on its own.

3A decaying score does not close the gap

The obvious repair is to carry a risk score across laps while letting it decay geometrically over time. The paper argues this is insufficient too. Because the score decays, an adversary can simply wait until it has fallen far enough, and that cooling-off period is a constant — it does not lengthen as the horizon grows. The longer a system runs, the more the attacker gains.

The LoopHarness the authors present restores a persistent, non-decaying safety state at the loop level; under mediated commits and an arbiter detection floor, it bounds the expected number of unauthorized irreversible actions by a constant in the number of iterations. Part of that bound, they note, is decided by a model-free rule and therefore survives a fully colluding verifier.

4Where it sits in safety research

Of the 1,900 arXiv papers this site holds as of 2026-09-02 (submitted between 2026-06-04 and 2026-08-27), only 31 have cs.CR as their primary category. Against 482 in cs.CV, 377 in cs.LG, 364 in cs.AI and 254 in cs.CL, security as a primary classification is a small minority. This paper carries 14 authors, well above the median of 4 across the collection.

It is an attempt to state formally where single-trajectory safeguards break down, at the point where autonomous agent loops are actually being deployed. This article is our own summary and does not warrant the correctness of the claims.