An AI can pass every safety check one at a time and still become unsafe, because its memory and habits quietly drift.

This explores what kind of hidden danger can build up between safety checks, so that a system passes every individual snapshot test and is still unsafe over time. The corpus's answer is that the hazard sits in retained state, meaning what the system stores and remembers, and in normalized workflows, meaning habits that become routine. It doesn't sit in any single response Can safety tests miss hazards that build over time?. A test that grades one output at a time looks at the wrong place. Nothing in a single reply is wrong, but the stored context that later replies rely on has drifted.

A related idea explains why snapshot checks can't catch this even in principle. Sequences of individually permitted actions can together break a constraint that no single step violates Can step-by-step approval miss harmful behavior patterns?. A stateless guardrail can't even state a rule like that, because the rule depends on history the guardrail never sees Can stateless checks ever catch sequence-level constraint violations?. Only a monitor that keeps state and tracks the whole trajectory can check it. Think of a bank where every withdrawal is under the limit but the total is draining the account. Each transaction passes, and the pattern is the problem.

Poisoned shared memory is a concrete case. In a four-agent pipeline with no defenses, a validator that read corrupted shared memory forged approvals in every trial, and unsafe actions were executed Can a poisoned validator still approve unsafe actions?. The validator's own logic wasn't the failure. It was the last checkpoint before action, and the evidence it read had been corrupted. That note describes an undefended setup, not slow accumulation. But it shows how stored evidence can quietly make a safety boundary meaningless.

The same stored state can also carry protection. One persistent agent logged 889 governance events over 96 active days, with its safeguards written into the memory layer it consulted while working Can governance rules embedded in runtime memory actually protect autonomous agents?. So memory is where danger builds and also where defenses can live. Testing therefore has to follow trajectories, and benchmark-integrity work makes the same move. BenchShield treats a run as a lifecycle of typed events, not a final score Can a finite lifecycle model detect reward hacking across benchmarks?. A further gap is measuring whether errors stay visible and recoverable over time. Today's instruments cover pieces, such as chain-of-thought disclosure or rollback timing, but none covers the whole system How can we measure whether AI errors stay visible and recoverable?.

The corpus says where unsafe state accumulates: in memory and in routinized workflows. It doesn't give a catalog of the specific kinds of state, or a rate at which they build up. That is still an open question here.