A new survey says AI agents that keep rewriting their own memories and tools can become unsafe later, even when nothing in them was ever malicious.
The paper, titled "Safety in Self-Evolving Agents: A Survey" and posted to arXiv on October 2, 2026, looks at a growing class of large language model agents that keep updating after deployment - adjusting their own parameters, memories, tool definitions, skills, and workflows as they pick up experience. The authors introduce a framework called SAVER, which splits the problem into five stages: Substrate (where reusable influence lives), Adaptation (how it changes), Violation (which safety property breaks), Exposure (when the failure becomes visible), and Response (whether it gets contained, repaired, or revoked). Reviewing existing research through that lens, they found solid coverage of how unsafe content gets admitted, retrieved, or triggered, and of containing it locally. They found far less work on fixing the downstream copies an unsafe update leaves behind, or on checking whether a fix actually holds once the agent keeps evolving.
The core claim is unsettling for anyone betting on long-running autonomous agents: information does not need to be harmful to cause a failure. It just needs to get reused somewhere its original, narrow context no longer applies, picking up more authority or reach than it was ever vetted for. That is a different threat model than the one-shot prompts and static red-teaming most current safety testing is built around.
Testing an agent once and calling it safe is a bit like inspecting a building's foundation and assuming it will hold up after a decade of undocumented renovations.