Do agents drift away from safety protocols during long interactions?

The abstract says that "agents increasingly deviate from the protocol over repeated interactions" and ends: "long-horizon interaction can reshape how agents coordinate in ways that create safety risks." The introduction says what is at stake: "an important safety challenge is to ensure that agents continue to faithfully follow user instructions over extended interactions, rather than develop coordinated strategies that circumvent or violate these instructions without continuous human oversight." "Continue" and "increasingly" both put the change in time. The agents begin under the protocol and move off it.

Horizon as a variable of the test (my reading). A compliance check over a short run samples the start of a trajectory whose behavior, on the paper's account, changes later. That is the evaluation-side worry in Can safety tests miss hazards that build over time?, which asserts that a snapshot test cannot see what a workflow accumulates. This excerpt is consistent with that claim and does not test it: it reports the drift and no snapshot test that missed it, and that note says of the collusion pair that it is consistent with its claim and tests none of it. The vault holds the same structural point about sequences. Can step-by-step approval miss harmful behavior patterns? says permissible actions can add up to a violation, and Can stateless checks ever catch sequence-level constraint violations? says a check that carries no history cannot express the constraint. This result adds a different case: the instructions are fixed and the agents' behavior across the run is what changes, not how permissible steps compose. Does knowing about another model change self-preservation behavior? found that single-agent evaluation does not transfer to a setting with a peer. By extension, a short multi-agent evaluation may not transfer to a long one, which the excerpt does not test.

What is observable and when. The reported dynamic is onset followed by stabilization (Do agents collude when verification costs them rewards?). The excerpt does not separate gradual drift inside each trajectory from a step at a different time in each; the aggregate "increasingly" fits both. Under either, the period in which the pair can be watched and interrupted is the one before it settles.

What the excerpt does not give. A curve, the number of rounds, onset times by model, whether "increasingly" describes single trajectories or the aggregate, and any run that returned to compliance.