Layering more safety checks onto an AI agent does not automatically make it safer. A new paper finds the checks can actively interfere with each other.
The researchers looked at agentic AI systems that pass every action through multiple gates before it executes: one gate checks whether the agent has authority to act, another checks resource limits, a third checks the evidence behind the action. The problem is what happens when a gate does not just approve or reject an action, but fixes it. The paper shows that when one gate remediates a flawed action, its fix can change what a second gate sees, invalidating a judgment that gate already made. Testing two specific fixes, substituting in better evidence and downgrading an action to a smaller resource budget, the team found the two do not commute: running them in a different order produces a different outcome, confirmed with a model checker that surfaced concrete counterexamples.
This matters because companies are increasingly stacking guardrails on AI agents that take real actions, like spending money or sending messages, on the assumption that more checks mean more safety. The findings suggest that without careful design, those checks can quietly cancel each other out, and the order they run in becomes a design decision, not an afterthought. A related weak spot: a shared log of evidence that trusts its own most recent approved entry is vulnerable to being poisoned by exactly the defect classes the system was never built to catch.
The team tested this on a controlled setup built from three existing published tools and synthetic data, not live production traffic. Treat it as proof the failure mode exists, not a measurement of how often it shows up in the wild.