How do agent risks accumulate across long stateful workflows?

The OpenART abstract makes a claim about where agent risk lives. Agents "operate in persistent environments where early state changes can influence decisions far into the future," and their behavior "is mediated through shared state that is repeatedly read, modified, and reused across long-horizon workflows." From that the paper concludes that "safety therefore depends not only on individual actions, but also on how agents respond as environments evolve over time." The unit of safety analysis moves from the single action to the sequence of actions taken against changing state.

The paper's diagnosis of current practice follows from this. Existing agent safety benchmarks "primarily evaluate short, static tasks, making it difficult to study cumulative risks in evolving environments," and benchmark-specific interfaces "hinder direct comparison across agent runtimes." Two separate gaps are named: the tasks are too short and static to show risk that builds up, and the interfaces are too particular to let results travel between agents. OpenART's response is scale on both fronts. It builds over 10K validated stateful scenarios across 50 domains, drawn from more than 500K Tools, MCPs, and Skills, with tasks needing a median of 97 tool calls. Target adapters project these onto 15 deployed agents, 5 foundation models, and 8 attack vectors, giving 75 agent–model configurations under one evaluation.

This sits close to the argument in Does a single benchmark score actually predict agent readiness?, which holds that no single benchmark captures readiness. OpenART adds a temporal axis to that list: a benchmark can score every action correctly and still miss what happens when an early state change carries forward. It also contrasts with What failure modes emerge when agents operate without direct oversight?, where twenty researchers found failures by hand over two weeks; OpenART aims at the same kind of adversarial probing but as a generated, repeatable arena. And where What blocks scaling from language models to autonomous agents? treats environments as something to scale for training, OpenART scales them for evaluation, with domain count and task length as the visible axes.

The excerpt is only the abstract, so much is left open. It does not say how environments "evolve," how scenarios were validated, what the 8 attack vectors are, or what any agent or model scored. It reports no evidence that cumulative risk is larger than per-action risk; that is the paper's premise, not something the excerpt demonstrates. The defensible reading is that OpenART is a proposal to measure state-dependent risk at scale, and its argument for why such measurement is needed is stated but not yet tested in what we have.