Checking every single step an AI agent takes is slow and costly, so what smarter ways exist to catch trouble across its whole run?

This explores which defenses judge an agent's whole run rather than paying to inspect every step in isolation. Per-step review has two problems: it's expensive, and it can't see anything that only shows up across steps. The corpus offers four different ways out.

The blind spot comes first. A stateless per-action check cannot even state a rule that depends on history, so individually permissible actions can add up to a violation nobody flagged Can stateless checks ever catch sequence-level constraint violations?. Attackers already exploit this. ColluSkill reaches about 96% attack success because scanners score each skill on its own. Scanner feedback lets the attacker soften every piece while the chain-level meaning stays intact Can attackers evade skill scanners by refining individual skills?. The first family of defenses therefore changes what gets watched. One version is stateful monitors that track composed behavior. Another makes the unit of defense a revisable 'coordination episode', a set of actions linked by observed transfers, task authority and response history, with membership updated as evidence arrives Should defence units span multiple executions and agents?.

The second family cuts cost by choosing where to look. Validating the fully assembled workflow just before an irreversible action commits rebuilds the global risk picture that no single step holds Where should workflow validation gates be placed for safety?. This doesn't replace other checks. The commit-point, planning-boundary and per-hop defenses each catch attacks the others miss. The third family runs in parallel with the work. Asynchronous verifiers sit alongside a single reasoning trace, fork off to pull out checkable state, and step in only on a violation. On correct runs the latency penalty is near zero, and accuracy holds at similar token budgets Can verifiers monitor reasoning without slowing generation down?. A neighboring idea from reasoning quality rather than security points the same way. Step-level confidence catches local breakdowns that a global average hides, and it allows early stopping. That gives comparable gains to majority voting with far fewer traces Does step-level confidence outperform global averaging for trace filtering?.

The fourth family records instead of reviewing. Infrastructure-side instrumentation of authority-bearing transitions separates a task that merely exposes a reward-hacking vector from a run that actually exercised it, so one exposed task doesn't make every score suspect Can runtime instrumentation distinguish hacking exposure from actual exploitation?. This fills a gap. Today's defenses are task-specific patches, prompt instructions or post-hoc detectors, and none gives operators a portable record that a given run stayed inside its evaluation boundary Do current reward-hacking defenses provide reusable evidence of safety?.

The corpus doesn't settle which of these pays off. One paper designs an equal-cost comparison of isolated actions, rolling windows, known groups and prospectively discovered episodes, but reports no results Does added monitoring improve protection at acceptable cost?. So you get a menu of designs with clear reasons behind each, not a measured winner.