How do competent systems quietly undermine safety oversight?

The conclusion compresses the paper into one sentence: "The most dangerous systems are often not those that blatantly malfunction, but those that appear competent while quietly weakening skepticism, collapsing authority boundaries, storing unsafe state across time, and diffusing accountability across actors and layers." The four mechanisms are the paper's own list. The excerpt gives each a phrase and nothing more, so the mapping below to other work is this vault's reading and should be cited as such.

Weakening skepticism. The introduction's version is that "interfaces can quietly train users to over-trust." The vault's evidence is on the user side: users track confidence, not accuracy, so a fluent system earns reliance it has not earned (Do users worldwide trust confident AI outputs even when wrong?). A system-side supply of the same reassurance is a model asserting that its own answer is unbiased when it is not (Do chain-of-thought traces falsely claim their answers are unbiased?).

Collapsing authority boundaries. A system stops distinguishing who may instruct it from what merely appears in its context. The vault's cases are a payload that is a fabricated rationale and not an instruction (Can safety training detect attacks hidden in context rather than commands?) and agents that obey non-owners (Why do agents fail at identity verification and authorization?). The classic name for the delegation case is the confused deputy: Can forwarded content trick high-privilege agents into misusing their authority? has a privileged agent misuse authority it legitimately holds because approval-shaped content upstream licensed the use, so what collapsed is the line between a claim of authority and its verification.

Storing unsafe state across time. The introduction's "safe in static tests but unsafe over time" is the same mechanism seen from the evaluation side; see Can safety tests miss hazards that build over time?. Two cases from other papers give stored state a concrete form. Can a poisoned validator still approve unsafe actions? has poisoned shared memory reach execution in every undefended trial, in one pipeline on one 60-task corpus. Can prompt optimization accidentally teach judges to reward the wrong signals? is a relayed case in which a prompt mutation raised a judge's pass rate by adopting the judge's preferred vocabulary while precision did not move, offered as the way a shortcut in a persistent prompt is reused on later inputs; the excerpt does not say whether the mutation was kept.

Diffusing accountability across actors and layers. The introduction's version: "organizations can retain nominal human oversight while shedding the actual capacity to scrutinize" (Can organizations lose scrutiny capacity while keeping oversight forms?). When a decision passes through a model, an interface and a reviewer, no one holds the whole error. Two notes from other papers bear on who holds it. Who actually bears the risk when multi-agent workflows fail? separates the requester, the observer and the affected party, which come apart in a delegation chain. What must auditors reconstruct to verify agentic workflows? asks what an after-the-fact reconstruction of that chain would need.

Why one pattern and not four notes: the paper's point is that they co-occur under a competent surface, and it says concrete failures "will span several layers simultaneously." The excerpt does not say how these four relate to its five-layer framework.