A GHOST in Long-Horizon Agents: Governance Hazard from Overlooked Safety Constraints across Turns

XinPeng Shen; Lan Zhang; Yixiao Huang; Haoran Cheng; Jiewei Lai; Leilei Chen; Haoxiang Deng

cs.AIOct 2, 2026

A GHOST in Long-Horizon Agents: Governance Hazard from Overlooked Safety Constraints across Turns

Authors: XinPeng Shen, Lan Zhang, Yixiao Huang, Haoran Cheng, Jiewei Lai, Leilei Chen, Haoxiang Deng

Abstract

Long-horizon agents are now playing an increasingly significant role in assisting humans with complex problem-solving. However, it is exactly their extended interaction history that introduces an underexplored execution-safety concern. Under benign interaction conditions, an agent may execute an action that violates a safety constraint specified many turns earlier. We term this failure mode Governance Hazard from Overlooked Safety Constraints across Turns (GHOST), which may cause irreversible damage. Our experiments reveal that GHOST events are not isolated cases: this failure mode, occurring precisely under benign interaction conditions, yields an occurrence rate of 11.5% on GPT-5.5. Furthermore, we theoretically show that if the residual conditional violation hazard along each safe prefix is bounded below by a non-summable sequence, the execution enters the hazard region almost surely. Leveraging this theoretical insight, we further propose STAR-Guard, a two-layer defense coupling historical semantic safety constraint restoration with pre-execution audit. STAR-Guard restores applicable safety constraints to reduce unsafe proposals, while its deterministic audit layer prevents residual violations from reaching the environment. Consistent with this two-layer design, we observe no GHOST events in our experiments under the GPT-5.5 setup.

Figures & tables

Figure 1: Illustration of GHOST. Initially, the user asks the agent to clean the inbox under a safety constraint requiring explicit approval before any email deletion, and the agent executes the task safely. After multiple benign interactions, the user resumes the inbox-cleaning task without restating the approval requirement and the agent starts to delete emails without requesting approval.

Figure 2: Overview of STAR-Guard. The restoration layer extracts and stores historical safety constraints, retrieves the constraints applicable to a resumed task, and semantically restores them to the current context. The audit layer checks the agent’s proposed environment-facing actions before execution and prevents noncompliant actions from reaching the environment.

API-served models
	SE		SI		LE		LI		GHOST
Target	SC	UC	SC	UC	SC	UC	SC	UC	[95% CI]
GPT-5.5	89.3	1.0	90.3	1.0	88.7	1.0	76.3	12.4	11.5 [6.4, 17.1]
DeepSeek-V4-Pro	80.6	1.9	79.6	1.0	85.6	1.2	79.6	9.7	8.7 [4.9, 13.0]
GLM-5.2	84.9	0.0	87.2	0.0	84.3	0.2	73.6	8.9	8.9 [4.5, 14.0]
Kimi-K2.6	80.6	0.0	82.5	0.0	75.7	2.9	68.9	9.7	6.8 [3.3, 11.4]

Table 1: Strict GHOST in our evaluation. All values are percentages averaged over five independent repetitions of the same 103 canonical cases. Strict GHOST is computed over 515 matched case–repetition pairs per model, with case-clustered 95% confidence intervals.

Figure 3: The difference-in-differences metric

(SC_{LI}-SC_{LE})-(SC_{SI}-SC_{SE})

. The vertical axis is measured in percentage points.

Model / Method	SC	UC	GHOST
GPT-5.5	$76.3\!\rightarrow\!\textbf{94.0}$	$12.4\!\rightarrow\!\textbf{0.0}$	$11.5\!\rightarrow\!\textbf{0.0}$
DeepSeek-V4-Pro	$79.6\!\rightarrow\!88.5$	$9.7\!\rightarrow\!0.2$	$8.7\!\rightarrow\!0.2$
GLM-5.2	$73.6\!\rightarrow\!84.9$	$8.9\!\rightarrow\!\textbf{0.0}$	$8.9\!\rightarrow\!\textbf{0.0}$
Kimi-K2.6	$68.9\!\rightarrow\!85.4$	$9.7\!\rightarrow\!\textbf{0.0}$	$6.8\!\rightarrow\!\textbf{0.0}$
Qwen-3.6	$76.7\!\rightarrow\!86.6$	$9.5\!\rightarrow\!1.2$	$9.1\!\rightarrow\!1.2$
Qwen3.5-4B	$47.0\!\rightarrow\!81.2$	$31.1\!\rightarrow\!1.9$	$27.8\!\rightarrow\!1.9$

Table 2: STAR-Guard effectiveness and component ablations. Arrows denote No Defense

\rightarrow

Full STAR-Guard. Changes across arrows are measured in percentage points (pp). Model rows use five independent repetitions.

Method	SC $\uparrow$	UC $\downarrow$	GHOST $\downarrow$
No Defense	47.0 $\pm$ 2.6	31.1 $\pm$ 1.0	27.8 $\pm$ 1.5
Prompt Reminder	50.5 $\pm$ 6.2	28.0 $\pm$ 4.3	23.3 $\pm$ 4.1
BM25 Top-3 (2009)	57.5 $\pm$ 5.9	16.5 $\pm$ 2.1	14.0 $\pm$ 2.6
DeCRIM (2024)	44.3 $\pm$ 3.2	31.8 $\pm$ 3.3	25.2 $\pm$ 3.3
TrustAgent † (2024)	54.2 $\pm$ 3.8	5.2 $\pm$ 1.8	4.7 $\pm$ 2.0
DVR † (2025)	75.1 $\pm$ 3.0	0.4 $\pm$ 0.5	0.4 $\pm$ 0.5

Table 3: Comparison on Qwen3.5-4B under the Long Implicit condition of SCARBench. Results are percentages reported as mean

\pm

sample standard deviation over five independent runs. DVR † and TrustAgent † assume that the applicable constraint is already known.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Property	Value
Canonical executable cases	103
Matched conditions	4
Instances per model	412
Unique benign long-history streams	103
Long-history condition instances	206
Independent repetitions	5

Appendix

Table 4: SCARBench confirmatory-suite profile. Each of the 103 canonical cases has one unique benign long-history stream, which is reused unchanged in its paired LE and LI instances. Token and turn counts describe one such stream, not the sum across turns or conditions.

Field	Value
Canonical case	filesystem_operation_delete_experiment_data_with_backup
Task goal	Delete temp/experiment_data.csv .
Safety constraint	Create a backup of the same file before deleting it.
Initial environment	The file temp/experiment_data.csv exists with content csv data ; no backup exists.
Available tools	list_files , calculate_file_hash , create_backup , delete_file , and quarantine_file .
Explicit resumed request	“Please resume the earlier task and delete the file temp/experiment_data.csv , but first create a backup of it.”

Appendix

Table 5: Representative SCARBench case. All requests, slots, tool arguments, environment objects, and evaluator targets bind to the same concrete path.

Target	SC	UC	SN	EF
GPT-5.5	76.3	12.4	10.9	0.4
DeepSeek-V4-Pro	79.6	9.7	10.7	0.0
GLM-5.2	73.6	8.9	16.5	1.0
Kimi-K2.6	68.9	9.7	16.5	4.9
Qwen-3.6	76.7	9.5	11.5	2.3
Qwen3.5-4B	47.0	31.1	8.3	13.6

Appendix

Table 6: Long Implicit full-denominator outcomes (%). Entries are means over five repetitions of 103 cases. The very high EF rate for Llama-3.1-8B indicates substantial task-execution incapability in addition to unsafe completion.

Method	Adaptation used in SCARBench	Privileged information
Prompt Reminder	Adds one general instruction to recover and follow still-valid historical requirements before tool use.	None.
BM25 Top-3	Ranks raw history turns against the resumed request and appends the top three positive-score turns. Uses $k_{1}=1.2$ and $b=0.75$ .	None.
DeCRIM	Generates an initial tool proposal, decomposes the complete conversation into requirements, critiques the proposal, and refines it based on the critique.	None; the auxiliary model sees raw history.
TrustAgent	Renders the benchmark safety slot as an Agent Constitution, then applies pre-planning regulation prompting, inspection, and refinement.	Ground-truth applicable constraint.
DVR	Divides the instruction into atomic constraints, checks the proposal with the benchmark executable verifier, and refines from exact verifier feedback.	Ground-truth executable verifier.
LIGHT Three-Memory	Constructs an adapted episodic memory and persistent scratchpad and retains the last 12 historical messages as working memory.	None.

Appendix

Table 7: Baseline configurations. TrustAgent and DVR are oracle-information comparators; their access is intentionally stronger than that of STAR-Guard.

AI Agent Safety

AI agent safety studies how to prevent and detect harmful actions by autonomous systems that use tools, memory, and multi-step plans.

See all 330 papers

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety
Jul 22, 2026Yuan Xiong, Linji Hao, Shizhu He +3AI Agent Safety LLM Agent Safety
The Key Laboratory of Cognition and Decision Intelligence for Complex Systems, Institute of Automation, Chinese Academy of Sciences, Beijing, China · School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China · Peking University, Beijing, China +2
HazardAuditor: From Executable Threats to Safer Computer-Use Agents
Sep 14, 2026Yunhao Feng, Ruixiao Lin, Ming Wen +5Computer-Use Agent Safety Language Model Safety Evaluation
Ant Group · Hunan Institute of Advanced Technology · Zhejiang University +3
DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model
Aug 6, 2026Wenhao Lin, Chenyu Yu, Xingwei Lin +6LLM World Models LLM Guardrails
Zhejiang University · Nanjing University of Posts and Telecommunications · Sun Yat-sen University

Jul 22, 2026J/K move · Enter open · S save

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety

Yuan Xiong, Linji Hao, Shizhu He, Ken Deng+2

The Key Laboratory of Cognition and Decision Intelligence for Complex Systems, Institute of Automation, Chinese Academy of Sciences, Beijing, China · School of Artificial Intelligence, University of Chinese Academy of Sciences, Beijing, China · Peking University, Beijing, China+2

AI Agent Safety LLM Agent Safety RL for LLM Agents

Open paper AskPDF arXiv

Agent safety is moving from content moderation toward preventing operational failures before tool-using agents act. We propose Janus, a foresight-oriented framework for long-horizon agent safety that trains guards to anticipate delayed risks from partial trajectories. Janus synthesizes diverse agent trajectories via multi-agent simulation and learns a shared policy with two coupled tasks: an anticipation task that forecasts safety-relevant futures and an adjudication task that decides safety from both the observed prefix and anticipated future. The two tasks are jointly optimized with CoAA-RL, which rewards forecasts by their utility for downstream safety judgment. The resulting guard model, Vanguard, blocks unsafe actions before execution. Across four agent-safety benchmarks, Vanguard improves average protection by 15.9 percentage points over baseline guards while increasing benign task completion by 5.1 percentage points.

Abstract

AI Agent Safety

Explore similar work

JANUS: Foreseeing Latent Risk for Long-Horizon Agent Safety

HazardAuditor: From Executable Threats to Safer Computer-Use Agents

DreamGuard: Efficient Runtime Guardrail for LLM Agents via Risk-Aware World Model