Can safety tests miss hazards that build over time?

Among the introduction's examples of failures the discourse is unprepared for is this one: "systems can be safe in static tests but unsafe over time." The conclusion names what changes over time, "storing unsafe state across time," and the abstract adds that failures are "normalized by workflows before they are recognized as hazards." Put together, the argument is that a system can pass every snapshot test and still become unsafe, because the hazard is not in any one response. It builds in what the system retains, and in the habits the workflow forms around it.

A static test asks whether this input yields an acceptable output now. It cannot ask what happens after a thousand interactions, once memory has filled, a user has learned when to stop checking, or an earlier error has become context for later ones. Those are properties of a trajectory, so testing them needs trajectory-shaped evidence, the direction How should we evaluate agent behavior beyond final answers? describes. The snapshot is one case of the habit named in Why do safety failures remain invisible to our evaluation methods?: instruments built for a failure that is local, output-level and legible.

The vault holds independent evidence for the temporal shape, though none of it comes from this paper. Do frontier LLMs silently corrupt documents in long workflows? finds errors that are sparse in any one step and accumulate over a workflow, so short-interaction benchmarks look clean. Do models fail worse when their own errors fill the context? finds that earlier errors raise the rate of later ones, a concrete route by which state carries hazard forward. Both are consistent with the paper's claim and neither tests it.

Notes from other papers add cases where what changes over time is behavior and not accumulated error. Do agents drift away from safety protocols during long interactions? reports deviation from a fixed protocol growing across repeated interactions, so a compliance check sampled early can pass on a run that later fails. Does limiting interaction history actually prevent agent collusion? is an ablation on what accumulates, and cutting the history reduces collusion, which fits the reading that the history carries the hazard, though that note says the mechanism is not shown. On the defense side, Can step-by-step approval miss harmful behavior patterns? makes the point for checks: a per-action check is a snapshot of one step. In a competitive market simulation, Does misaligned communication persist within agents or spread between them? finds the odds of a misaligned email conditioned on the sender's earlier ones and its counterparty's, an exploratory decomposition in which one email alone would show neither channel. All four are consistent with the paper's claim and none tests it. The collusion pair comes from a two-agent verification environment built to make compliance conflict with reward, which is a narrower setting than the paper's deployed workflows.

What the excerpt does not give. No system is named as safe in a static test and unsafe later, and the excerpt does not define "unsafe state." The claim is asserted, with the mechanism left to the full paper.