Theme of inquiry
What causes autonomous agents to escape their intended constraints and oversight?
A question within its area, explored through 9 lines of inquiry below — each a family of specific questions the research asks.
64 specific questions
- When do multi-agent architectures create more attack surface than single-agent systems?
- How do hardened prompts defend against adversarial attacks in multi-agent systems?
- Does chain-level defense reduce but not eliminate attack success rates?
- How does prompt hardening work differently in single-agent versus multi-agent systems?
- How does task division in multi-agent design affect security outcomes?
- Does prompt hardening equally protect single and multi-agent web systems?
- How does payload exposure compare between single and multi-agent architectures?
90 specific questions
- How should task authority constraints apply across multiple coordinated executions?
- Does formal scope checking actually prevent compromised agents from exceeding boundaries?
- Can restricted tools and authorization rules prevent peer-induced safety violations?
- Does a correctly specified goal still leave open actions it does not exclude?
- Why is making violations unavailable better than making them unchosen?
- Why does forcing agents to trace function paths prevent unsupported claims?
- Can the policy oracle itself be written to by agents in the pipeline?
55 specific questions
- Can verification of agent actions after execution substitute for formal communication protocols?
- Can execution traces reveal unsupported claims in AI agent behavior?
- Can users distinguish between automation errors and unauthorized agent actions?
- Can users verify agent plans when the same request produces different behaviors?
- Do audit trails and cryptographic receipts actually prevent AI agent accountability failures?
- Can infrastructure records of state transitions prove a hack occurred?
- Can post-hoc execution traces alone solve the observation gap?
46 specific questions
- Are durable shared code artifacts better than per-task harness patches?
- How do agents decide which created code deserves long-term persistence?
- Do agent improvements discovered on code tasks transfer to non-coding domains as well?
- How should agents decide which created code is worth persisting?
- How do agents decide which created code should persist versus disappear?
- Can skill libraries prevent redundant narrow artifacts from proliferating?
- How should harness infrastructure validate code that agents generate themselves?
48 specific questions
- How does workflow position amplify malicious signals in multi-agent systems?
- Why does workflow position amplify malicious signals in multi-agent relay chains?
- Why does workflow position amplify malicious signals downstream?
- Do per-hop inspection gates miss attacks that bias upstream planning signals?
- Why do downstream agents relay signals they did not originate?
- How do unmonitored channels between pipeline agents enable security gaps?
- Can shared memory poisoning compromise multi-agent delegation chains?
59 specific questions
- How do memory hygiene and context efficiency trade off in deployed agents?
- How should we measure context efficiency and verification cost in agents?
- Do weaker agents need more aggressive compression than stronger ones to stay reliable?
- Does agent-side context control outperform external management on any task class?
- Does upgrading model capability improve token efficiency in agentic systems?
- Should artifact-level benchmarks replace token counts for agent evaluation?
- Can agents manage context through active delegation instead of progressive disclosure?
81 specific questions
- How do standardized artifacts reduce inter-agent communication failures?
- Why does structured protocol coordination outperform free-form agent-to-agent communication?
- Can structured artifacts replace natural language for multi-agent coordination?
- What would unified agent-to-agent and agent-to-tool protocols actually look like?
- How do standardized artifacts prevent autonomous agent failure modes?
- How do structured APIs constrain misaligned communication compared to free text?
- Can shared persistent artifacts between agents be properly governed?
80 specific questions
- Can agents diagnose their own errors better than they diagnose subagent failures?
- What distinguishes task failure from communication breakdown in multi-agent systems?
- How often do multi-agent systems fail from provider refusals versus agent errors?
- Why do agents report success when actions actually fail?
- How do agent teams use shared failures to reduce redundant exploration?
- Can smaller models trained for execution handle the failure modes that stop current agents?
- Which failure modes dominate in autonomous research agents?
93 specific questions
- Why do different agent memory architectures make incompatible granularity claims?
- How does durable memory quality shape agent performance over time?
- Can agent-controlled memory management outperform fixed consolidation schedules?
- Could a single agent system switch memory granularity between tasks?
- Does workflow-level memory or state-action memory better capture reusable agent knowledge?
- Should memory tools and prompts be governed structurally rather than patched?
- Should agents update memory after every turn or batch process sessions?