AI agents that work through long, multi-step tasks can quietly violate safety rules you gave them several turns earlier - and it happens more often than you'd like.
Researchers studying long-horizon AI agents identified a failure mode they call GHOST: an agent executes an action that breaks a safety constraint set many turns earlier, even during normal, non-adversarial use. Testing on GPT-5.5, they found this happened in 11.5 percent of runs. The team also showed mathematically that if the residual risk of violating a rule doesn't shrink fast enough turn over turn, the agent will eventually cross into unsafe territory with near certainty. Their fix, called STAR-Guard, re-surfaces relevant safety constraints before each action and runs a separate audit layer to block violations before they reach the real world; in their tests, that combination eliminated GHOST events entirely.
This matters because the industry is racing toward agents that run for dozens or hundreds of turns - writing code, managing workflows, browsing the web - with instructions set once at the start. GHOST suggests that's a structural weak point, not a quirky edge case: safety constraints fade from an agent's effective attention the same way any other early instruction does in a long context. That's a harder problem than prompt injection, because nothing malicious has to happen for it to go wrong.
Worth noting: the 11.5 percent figure and the fix come from the same team testing one model, so treat STAR-Guard as a promising mitigation, not a solved problem.