- The problem
- AI agents act in many steps, and harm can come from steps that each look harmless — reading a private file, then sending a message outside. Catching this means looking back over what the agent has done, but reviewing its whole history every time is costly and buries the signal.
- Why it matters
- Small language-model agents increasingly run on their own. Stopping too late lets harm through; stopping too early throws away useful work.
- What this work does
- We give the agent a risk budget: a rule for when to stop it, with a statistical guarantee on how much harm gets through first. The safety check then looks only at the private information an outgoing action could have drawn on, rather than the entire history, so it reads far less while letting more legitimate work finish. One honest caveat: an equally sized random slice of history helps about as much on average — following the connections pays off in specific cases, where it keeps harmless work from being stopped.