Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents

TL;DR - This paper argues that trajectory-scoped safeguards cannot detect attacks whose evidence is distributed across multiple autonomous-agent iterations. It proposes LoopHarness, which maintains persistent, non-decaying loop-level safety state to limit irreversible unauthorized actions independently of the execution horizon.

• The authors prove that trajectory-only monitors cannot distinguish fragmented attacks from benign behavior better than their false-positive rate, regardless of monitor expressiveness.
• Geometrically decaying risk scores remain vulnerable because patient attackers need only wait a constant cooling-off period that does not grow with the loop horizon.
• LoopHarness combines persistent safety state, mediated commits, and an arbiter to bound expected unauthorized irreversible actions by (B+m-1+m/\delta_M), constant in horizon (N).
• The evaluation protocol covers paired clean and attacked Agent-SafetyBench episodes, cross-iteration attacks, module ablations, and adaptive white-box red teaming.