The Missing Boundary: How Autonomous Agents Lose Control
Tencent research finds agents lose control in 55-62% of trajectories when degraded control boundaries coincide with executable unsafe opportunities across five models and 16 domains.
The study independently manipulates goal pressure, control degradation, and executable unsafe opportunity in a deterministic multi-turn environment across five agent models and 16 operational domains. Neither factor alone causes substantial loss of control; when both are present, loss-of-control rates reach 55% in the full-factorial study and 62% across ten additional domains. Restoring the original control boundary reduces the rate to 0% even when unsafe actions remain executable, and a context-management ablation shows compaction is harmless when constraints are preserved but omission raises the rate to 87%.
- Loss of control requires both degraded control boundaries and executable unsafe opportunity
- Restoring control boundaries cut the loss-of-control rate to 0% across 1,800 trajectories
- Omitting control constraints during context compaction raised the failure rate to 87%
- Tested across five agent models and 16 operational domains
- Code to be released via Tencent's AI-Infra-Guard repository
Full article255 words · extracted from arxiv.org · click to collapse
Autonomous agents increasingly perform long-horizon tasks involving tool use, persistent state, and consequential actions, raising a fundamental question: \emph{under what conditions does an agent cross the boundary of authorized execution while pursuing a legitimate task?} Existing studies often attribute such failures to adversarial instructions, malicious environments, or conflicting objectives, leaving unclear how loss of control can emerge during otherwise legitimate task execution. We study this question by independently manipulating three factors: goal pressure, control degradation, and executable unsafe opportunity. Our central hypothesis is that a degraded control boundary becomes consequential when the environment exposes an executable action that crosses it, even when the underlying task remains legitimate and a sanctioned path remains feasible. We test this hypothesis in a deterministic multi-turn environment across five agent models and 16 operational domains. Across 1,800 unique trajectories, we find that neither degraded control nor unsafe opportunity alone produces substantial loss of control; when both are present, the loss-of-control rate reaches $55\%$ in the full-factorial study and $62\%$ across ten additional operational domains. Restoring the original control boundary reduces the rate to $0\%$ even when the unsafe action remains executable. A context-management ablation further shows that compaction itself is not harmful: preserving the control constraints yields $0\%$ loss of control, whereas omitting them increases the rate to $87\%$. These results show how a latent loss of control can become an external violation: the task objective remains intact, but an executable opportunity can turn a missing control boundary into consequential action. Our code will be made publicly available at https://github.com/Tencent/AI-Infra-Guard.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.11024