Individually safe updates to an AI agent's memory, prompts, or tools can combine into unsafe behavior that none of them would cause alone.
A new paper looks at what its authors call harness evolution: the ongoing process of updating the persistent parts of a self-evolving AI agent, including its memory, prompts, skills, and tools. Prior safety work mostly checked whether each new component held up on its own. This paper instead tested how components interact after each one has already passed its individual safety and utility checks. Across three safety benchmarks, the researchers found 43 pairs and 18 three-way combinations of updates that turned unsafe only once combined, even though every piece looked fine in isolation.
That matters because checking every possible combination of updates gets expensive fast as a harness accumulates changes, which is exactly where multi-tool AI agents are headed. The researchers' proposed fix is a typed hypergraph that tracks only the safety-relevant interactions touched by a given update, rather than re-checking the entire system each time, so monitoring cost does not explode as the agent evolves.
It is the software equivalent of two safe drugs turning dangerous when taken together - a reminder that as agents keep patching themselves in production, testing each new part in isolation will not be enough.