The paper identifies a fundamental flaw in current autonomous LLM : safeguards are scoped to single trajectories and reset between iterations, allowing adversaries to spread attack evidence across iterations. The authors prove that such trajectory-scoped monitors cannot distinguish attacks from false alarms. They propose LoopHarness, a defense that maintains non-decaying risk state across the entire loop.
LoopHarness bounds the expected number of unauthorized irreversible actions by a constant independent of the number of loop iterations. In evaluations on Agent-SafetyBench, it reduced outer-state attack success from 88.4-97.6% for baselines to 0.1% while retaining 96.9% clean task completion. It composes with any single-trajectory defense.
This work exposes a fundamental composition failure in agent safety and provides a provably sound fix. The results are independent of the underlying model and hold even against fully colluding verifiers, making it highly relevant for deploying autonomous agents in real-world settings.