{"id":"c22a0a36-4e9c-4fc6-8f6c-579562cc335a","arxiv_id":"2608.11274","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Agent safety should be a runtime contract, enforced by sandboxes and permission gates on the preventive side and by verifiable evidence chains on the submission side, not by model alignment alone.","lead":"This paper argues that AI agent safety should be enforced at runtime by the harness, not instilled only during model training. It proposes a two-sided contract: preventive blocks such as sandboxes and permission gates, plus evidential gates that require checkable proof before a task is accepted as complete.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 52-incident counterfactual coding is the load-bearing empirical link; without independent re-coding, the 40/11 preventability split cannot support the structural claim.","rationale":"The reader's weakest-assumption pick matches the most load-bearing point: the paper's central claim is architectural, but its strongest empirical leg is the 52-incident survey, and that leg depends on a counterfactual coding that cannot be checked from the text alone. I do not think this concern requires rejecting the paper: the structural mismatches in Section 3 and the false-completion audit provide independent support, and the paper's own limitations already narrow the scope (e.g., tasks without checkable standards are outside the evidential contract). A conditional verdict is therefore appropriate while the supplementary protocols are released and independently re-coded. I considered whether the formal Definition 2 of hard evidence is vacuous as written, since any deterministic verifier returns ACCEPT or REJECT, and whether the composition proposition's disjointness premise fails for shared trajectory events; these are real formal weaknesses but they are repairable and secondary to whether the empirical claim of preventability is trustworthy. The single concrete check that would settle the main concern is an independent re-coding of the 52 incidents.","tokens_in":15116,"tokens_out":11856,"duration_ms":115114,"concrete_test":"Have two independent coders, blinded to the paper's headline counts, apply the published inclusion/exclusion and counterfactual rubric from the supplementary JSON to all 52 incidents, with the disputed case randomized in or out. Compute the resulting fully-preventable/mitigable counts and inter-coder agreement (Cohen's kappa). If the 40/11 split is not reproduced (e.g., kappa below 0.6, or the fully-preventable count drops below roughly 30), the survey's preventability claims are not robust enough to carry the structural argument.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5's incident survey is the paper's primary empirical support for the preventive face of the runtime contract. The headline count (40 fully preventable, 11 mitigable, 1 alignment-related) rests on the authors' own counterfactual judgment: from a public incident report about a system that had no such harness, decide whether a hypothetical layered harness would have fully prevented or partially mitigated the failure. Public reports rarely contain enough detail about the deployment's permission model, sandboxing, network policy, and agent tool access to make that counterfactual determinable; the coding protocol and row-level data are relegated to supplementary JSON that is not present in the reviewed text. The paper even marks one row as disputed, confirming the coding is contestable. If an independent re-coding does not reproduce the 40/11 split, the strongest empirical support for 'the harness is the load-bearing mechanism wherever deployed agents failed' is weakened, and the structural claim would have to rest on the false-completion audit and the a priori mismatches, which are narrower than the survey appears to be.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper argues that model-level alignment (RLHF, DPO, Constitutional AI) is structurally insufficient for autonomous agents that execute consequential actions, and that agent safety should instead be a runtime contract enforced by a harness with two faces: a preventive face (sandboxes, permission gates, output filters, trajectory monitors) and an evidential face (evidence-gated submission requiring verifiable artifacts such as test runs, log captures, file diffs, and citation grounding). The claim is supported by four lines of evidence: a survey of 52 documented incidents coded for preventability by layered harnesses, a false-completion audit of 31 core cases plus one disputed case, a trajectory-schema audit of 12 public agent systems, and a title-level audit of 28,560 NeurIPS/ICML/ICLR papers. The paper also formalizes an Agent Trajectory Schema and Evidence Chain, states a compositional gating proposition, and outlines a research agenda. The central conclusion is that the right unit of safety in agentic AI is the trajectory-with-checkable-evidence, not the model.","tokens_in":15257,"tokens_out":4593,"duration_ms":50162,"significance":"If the central claim holds, the paper offers a useful architectural reframing: safety shifts from a property instilled during training to a runtime contract with both preventive and evidential guarantees, aligning agentic AI with practices in computer security and experimental science. The paper is commendable for releasing row-level protocols and data in supplementary JSON files, for explicitly flagging disputed rows and limitations, and for making concrete falsifiable claims (e.g., that only 2 of 12 surveyed systems document submission-like evidence gates). The formal trajectory schema and the discussion of evidence-gated submission are valuable contributions to the agent-safety discussion. However, the empirical weight rests on counterfactual coding and selectively assembled audits; unless those can be independently reproduced, the 'structural' conclusion outruns the evidence.","major_comments":[{"comment":"The 40/11/1 preventability split is the paper's strongest empirical support for the preventive face, but it depends entirely on counterfactual coding from public incident reports. The reviewed text does not include the coding protocol, the inclusion/exclusion criteria, or the row-level decisions; the supplementary JSON files are announced but not present in the reviewed material. Because public reports often lack details about the deployment's permission model, sandboxing, and network policy, an independent re-coding may not reproduce the split. The authors should present the protocol and row-level data in the paper or in a reviewer-accessible supplement, and report inter-coder reliability or a comparable audit trail.","section":"Section 5, 'Preventive Face: The 52-incident survey'"},{"comment":"There is a partial circularity in the audits. Incidents are coded using a taxonomy of harness layers, and the false-completion audit is assembled from cases whose ground truth contradicts the agent's output, so the conclusion that harness layers are load-bearing is partly entailed by the coding scheme and case selection. The paper should address this by including negative cases (incidents where a layered harness would not have helped), pre-specifying coding rules before seeing outcomes, or explicitly reframing the audits as illustrative rather than as tests of the structural claim.","section":"Section 5 and Table 1"},{"comment":"The compositional gating proposition is stated as a formal result, but the text says only that 'the proof is the standard parallel composition of finite-state monitors under disjoint observation alphabets' and then asserts complexity bounds. No proof sketch is given, the notion of verifier independence is not formalized, and the parameters governing the polynomial versus exponential cases are not specified. If the proposition is meant to be a formal contribution, it needs a proof or a precise statement with hypotheses; otherwise it should be explicitly labeled as a conjecture or research agenda item.","section":"Section 4.3, 'Compositional Gating'"},{"comment":"The pooled 8–12x training/deployment imbalance is derived from title-level keyword counts with truncation-corrected ranges and five classification rules that are not fully specified in the text. The claim that publication attention remains concentrated on training-time alignment is directionally plausible, but the quantitative ratio is not independently verifiable from the reviewed text. The authors should provide the keyword sets, classification rules, and per-cell counts in the paper, or verify that the supplementary JSON contains all of them in a form reviewers can check.","section":"Section 5, 'The 28,560-paper proceedings audit'"}],"minor_comments":[{"comment":"The distinction between hard and soft evidence depends on the existence of a verifier in the set V; as written, any event paired with some verifier becomes hard evidence, so the definition is tautological. Please clarify that hardness is a property of the verifier and the event's format, not of the event alone.","section":"Definitions 1–3"},{"comment":"The 'Yes count' row mixes binary and 'partial' entries; specify how partial scores are treated in the counts (for example, whether partial is counted as no).","section":"Table 2"},{"comment":"References [88], [92], and [98] appear to concern image copy detection and video object segmentation rather than agent trajectories or database snapshots; please verify that these citations support the claims in Section 4.2.","section":"References"},{"comment":"The disputed AWS Kiro incident appears to be used in both the incident survey and the false-completion audit; please clarify whether it is double-counted and how its disputed status affects both rows.","section":"Section 5"},{"comment":"The limitation that the audits oversample English-language coverage should also explicitly apply to the proceedings audit, which is restricted to three English-language venues; please make that scope explicit.","section":"Appendix A, Limitations"}],"recommendation":"major_revision","confidential_remarks":"The central architectural claim is plausible and worth publishing if the empirical audits are made verifiable. I would ask the editor to require that the supplementary JSON files and coding protocols be included with the revision, and to consider whether the proceedings audit should be labeled more explicitly as a rough directional estimate. A citation check for references [88], [92], and [98] would also be prudent."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague—\n\nRead this one for the synthesis, not the novelty. The claim that agent safety should be enforced at runtime by sandboxes, permission gates, and evidence-gated submission is already production practice and prior literature, and the paper says so. What it adds is a clean way to talk about it: the two-faced contract (preventive/evidential), the hash-chained trajectory schema, and the evidence-chain formalization that makes \"don't trust the model's self-report\" precise. The compositional gating proposition is standard monitor composition, but it's honestly labeled as such. That's fine.\n\nThe paper does real work in the four audits. The incident survey (52 cases), the false-completion audit (31+1), the trajectory-schema audit (12 systems, 2 with evidence gates), and the 28,560-paper proceedings audit all point in the same direction. Releasing row-level protocols is the right instinct. The historical analogy to security and experimental science is well drawn and not overwrought.\n\nThe soft spots are in proportion. The 52-incident survey is the strongest support for the preventive face, and it rests on the authors' own counterfactual coding: from public reports, decide whether a hypothetical layered harness would have prevented the failure. That's contestable, and they admit one row is disputed. Public incident reports rarely have enough detail on the deployment's permission model and sandboxing to make that call deterministically. The false-completion audit selects cases where evidence gates would plausibly have helped, so it's partly circular—though the authors are transparent about the coding categories. The title-level proceedings audit is explicitly coarse; I wouldn't lean on the 8–12x figure beyond its directional claim. The limitations section is honest about scope: goals, mesa-optimization, and tasks without established correctness criteria are outside.\n\nIf the supplementary JSON is actually available and the coding definitions are concrete, this deserves a serious referee and probably publication after revision. If the row-level data turns out thin, the empirical claims should be softened to \"pattern\" rather than \"structural proof.\" Either way, the paper is worth engaging for the framework and the audit design. I'd bring it to reading group and cite it if I work on agent evaluation or harness design.\n\nRecommendation: send to peer review, with the row-level data and coding protocol as mandatory attachments.","headline":"The core claim isn't new, but the trajectory/evidence-chain framing and the four audits make this a useful synthesis worth engaging; the 52-incident counterfactual coding is the load-bearing empirics and needs independent re-coding.","tokens_in":15802,"tokens_out":1553,"would_cite":true,"duration_ms":14422,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that agent safety is not a model property but a runtime contract enforced by the system's harness, combining preventive gates and evidence-gated submission, and supports the claim with four audits.","keywords":["agent safety","runtime contract","evidence-gated submission","trajectory schema","hard evidence","AI alignment","harness","incident survey"],"falsifier":"Using the paper's released row-level JSON, re-code the 40 'fully preventable' incidents under the published protocol but require every proposed counterfactual layer to be an actually existing, publicly documented mechanism at the incident date; if five or more cases no longer qualify as fully preventable, the headline proportion is unsupported.","tokens_in":14884,"feed_emoji":"🛡️","tokens_out":11627,"duration_ms":87470,"temperature":0.7,"pith_summary":"The paper argues that safety for autonomous AI agents is not something a model can be trained to possess; it must be enforced at runtime by the system's harness. The claimed contract has two faces: a preventive face that blocks dangerous actions before they happen, and an evidential face that refuses to mark a task complete unless the trajectory contains verifiable artifacts. The authors support this with a survey of 52 documented incidents, a 32-case false-completion audit, an audit of 12 agent systems, and a title-level audit of 28,560 papers at three major machine-learning venues. If the argument is right, the field's current emphasis on training-time alignment is structurally misplaced for consequential agents.","feed_headline":"Agent safety is a runtime contract, not a model property","feed_subtitle":"Four audits converge: safe agents need evidence-gated submission, not just training-time alignment.","key_machinery":"The load-bearing formalism is the Agent Trajectory Schema: a finite sequence of events, each carrying a type, timestamp, payload, and hash, where the hash chains each event to its predecessor so any modification invalidates all later hashes. The paper distinguishes hard evidence, verifiable by a deterministic polynomial-time verifier against an external reference state, from soft evidence that depends on trusting the model's self-report. An Evidence Chain is a subsequence that satisfies every task-specific requirement with hard evidence; the harness accepts the submission only when it can construct one. The compositional gating proposition shows that preventive finite-state monitors with disjoint alphabets and independent evidence gates compose into a single contract, with verification polynomial in the disjoint and sequential cases.","core_discovery":"The central claim is that agent safety is a runtime contract, not a model property. The contract comprises preventive mechanisms—sandboxes, permission gates, output filters, and trajectory monitors—that bound what the agent can do, and evidential mechanisms—evidence-gated submission, hard-evidence chains, and replayable trajectories—that determine when a task counts as done. The unit of safety, the paper concludes, is the trajectory-with-checkable-evidence rather than the model itself. Four lines of evidence are offered: 40 of 52 incidents were coded fully preventable by a layered harness, the false-completion cases would have been caught by a minimal evidence requirement, only 2 of 12 audited systems document submission-like evidence gates, and publication counts show a pooled 8–12× imbalance toward training-time alignment.","pith_inferences":["Editorial inference: the hash-chained trajectory could become the basis of a vendor-neutral 'lab notebook' for agents, making agent outputs audit-ready in scientific and legal workflows; the paper gestures toward this but does not develop the interoperability format.","Editorial inference: a concrete near-term prediction follows from the 8–12× publication imbalance—if the runtime-contract view is correct, deployment-time harness work should visibly increase at major venues over the next few years, and this can be checked empirically.","Editorial inference: the evidential face suggests a benchmark design the paper lists only as agenda: disable a model's alignment (e.g., by fine-tuning on a small set of examples) and measure whether a two-faced harness still blocks dangerous actions and rejects incomplete evidence chains."],"forward_implications":["Deployed agents should be required to emit tamper-evident trajectory logs before their outputs are trusted.","Task completion should be gated on verifiable artifacts such as passing test runs, citation lookups, file diffs, and log captures, rather than on the model's declaration of being done.","Safety research and safety regulation should shift attention from model-level alignment benchmarks toward runtime harness design and deployment-time verification.","Architectural responsibility moves: the agent produces the artifact and the harness verifies it, and neither responsibility belongs to the user's trust in the model's reasoning."],"supporting_citations":[{"why":"Supplies the documented case of an agent deleting a production database during a code freeze, used as the flagship example where both preventive and evidential faces would apply.","marker":"[3]"},{"why":"Provides the tribunal decision holding an airline responsible for its chatbot's hallucinated refund policy, motivating the evidential face's citation-grounding requirement.","marker":"[20]"},{"why":"Documents a court's sanctions for fabricated case citations submitted by an LLM, the canonical example where a citation-lookup gate would reject the submission.","marker":"[90]"},{"why":"Demonstrates many-shot jailbreaking bypasses RLHF, supporting the claim that model-level alignment is a single, defeatable layer.","marker":"[6]"},{"why":"Shows fine-tuning on a small number of benign examples degrades safety training, supporting the structural insufficiency of training-time safety.","marker":"[73]"},{"why":"Supplies the classic design principles the paper adapts into the preventive face's layered-defense doctrine.","marker":"[80]"},{"why":"Defines runtime verification and harness monitors, the formal basis for trajectory monitoring and the compositional gating proposition.","marker":"[52]"},{"why":"Provides the standard model-checking composition theory used in the proof of the compositional gating proposition.","marker":"[22]"},{"why":"Finds that seemingly solved coding-benchmark patches fail when the full developer test suite is re-run, motivating hard-evidence test re-runs over the model's self-report.","marker":"[93]"}],"fun_headline_variants":["Agent safety: runtime contract, not model trait","Two faces of safety: block bad, prove good","Don't let agents finish without proof","Safety lives in the harness, not the weights","Trajectories, not models, are the unit of safety"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the counterfactual coding of the 52 incidents correctly infers from public reports alone whether a layered harness would have prevented or mitigated each failure.","fun_headline_variants_meta":{"raw":{"variants":["Agent safety: runtime contract, not model trait","Two faces of safety: block bad, prove good","Don't let agents finish without proof","Safety lives in the harness, not the weights","Trajectories, not models, are the unit of safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000503,"raw_usage":{"total_tokens":2487,"prompt_tokens":1006,"completion_tokens":1481,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":622,"completion_tokens_details":{"reasoning_tokens":1408}},"tokens_in":622,"tokens_out":1481,"duration_ms":12231,"temperature":1.0,"reasoning_tokens":1408,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T14:12:31.510175+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Using the paper's released row-level JSON, re-code the 40 'fully preventable' incidents under the published protocol but require every proposed counterfactual layer to be an actually existing, publicly documented mechanism at the incident date; if five or more cases no longer qualify as fully preventable, the headline proportion is unsupported.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Documents a court's sanctions for fabricated case citations submitted by an LLM, the canonical example where a citation-lookup gate would reject the submission."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the classic design principles the paper adapts into the preventive face's layered-defense doctrine."},{"cited_title":"Leucker and C","cited_arxiv_id":null,"evidence_quote":"Defines runtime verification and harness monitors, the formal basis for trajectory monitoring and the compositional gating proposition."}],"review_version":1}