Long-horizon AI agents risk hidden safety breaches across turns
A GHOST in Long-Horizon Agents: Governance Hazard from Overlooked Safety Constraints across Turns
Artificial Intelligence
Summary
When AI agents work on complex tasks that take many steps, they might accidentally ignore important safety rules set long ago and cause serious problems. The authors call this issue GHOST and found it happens fairly often with advanced models like GPT-5.5. They also proved that this risk can grow over time and suggested a new two-step method called STAR-Guard to spot and stop these hidden safety risks before they happen. Using STAR-Guard, they prevented any GHOST problems in their tests.
What this means in practice
- •For ai safety engineers: Improve AI systems’ safety by detecting and preventing safety constraint violations over extended interactions.
- •For enterprise ai developers: Build more reliable long-horizon AI tools that maintain safety rules in complex multi-turn tasks.
Authors
XinPeng Shen, Lan Zhang, Yixiao Huang, Haoran Cheng, Jiewei Lai, Leilei Chen, Haoxiang Deng
Abstract
Long-horizon agents are now playing an increasingly significant role in assisting humans with complex problem-solving. However, it is exactly their extended interaction history that introduces an underexplored execution-safety concern. Under benign interaction conditions, an agent may execute an action that violates a safety constraint specified many turns earlier. We term this failure mode Governance Hazard from Overlooked Safety Constraints across Turns (GHOST), which may cause irreversible damage. Our experiments reveal that GHOST events are not isolated cases: this failure mode, occurring precisely under benign interaction conditions, yields an occurrence rate of 11.5% on GPT-5.5. Furthermore, we theoretically show that if the residual conditional violation hazard along each safe prefix is bounded below by a non-summable sequence, the execution enters the hazard region almost surely. Leveraging this theoretical insight, we further propose STAR-Guard, a two-layer defense coupling historical semantic safety constraint restoration with pre-execution audit. STAR-Guard restores applicable safety constraints to reduce unsafe proposals, while its deterministic audit layer prevents residual violations from reaching the environment. Consistent with this two-layer design, we observe no GHOST events in our experiments under the GPT-5.5 setup.