Long-running agents break safety rules set many turns earlier in 11.5% of GPT-5.5 cases with no attacker involved, a paper reports

A paper listed on arXiv on Monday 5 October, “A GHOST in Long-Horizon Agents: Governance Hazard from Overlooked Safety Constraints across Turns”, by XinPeng Shen, Lan Zhang and five co-authors, describes a failure that needs no attacker. An agent working on a long task carries out an action that breaks a safety rule the user set many turns earlier, because the rule has slipped out of its attention.

The authors say this failure, “occurring precisely under benign interaction conditions, yields an occurrence rate of 11.5% on GPT-5.5.” They also give a theoretical result: if the residual risk of a violation at each safe step stays above a certain bound, the execution reaches the hazard region almost surely, in other words the longer such an agent runs, the closer a violation comes to certain.

Their proposed fix, STAR-Guard, has two layers. It restores the earlier safety constraints to the model's attention, and it adds a deterministic audit before execution that stops any remaining violating action from reaching the environment. “Consistent with this two-layer design, we observe no GHOST events in our experiments under the GPT-5.5 setup,” they write.

The finding matters for agents given long jobs with standing instructions, such as “never delete production files”: a rule stated once at the start is not a durable control. It is a preprint and has not been peer reviewed.

• Confirmed The authors report the GHOST failure occurs in 11.5% of cases on GPT-5.5 under benign conditions. Shen et al., arXiv 2610.02664 (abstract)
• Claimed Their two-layer STAR-Guard produced no GHOST events in their GPT-5.5 experiments. Shen et al., arXiv 2610.02664 (abstract)