Most AI safety monitors get credit for catching rogue behavior. A new benchmark asks whether they catch it in time.
Researchers introduced StepShield, a benchmark built on 9,429 code-agent incident trajectories, to measure not just whether a monitor detects a rogue agent but when. The key metric is the Early Intervention Rate (EIR): the share of detected bad runs where an alert fires within a short window after the agent first goes off-script. The results are damaging for the dominant approach. A rule-based guardrail with 847 patterns hit 86% recall — solid on paper — yet its timing was statistically indistinguishable from random (EIR 0.23 vs. 0.24 for random; p = 0.66). The reason: more than three-quarters of its alerts fired on normal code before any violation had even occurred. The researchers call this the Forensics Trap.
The gap matters because an alert that lands after an agent has already done the damage is a log entry, not a safeguard. Semantic detectors showed a 4x EIR advantage over rule-based ones, but that gap is invisible to accuracy, recall, and F1 — the metrics almost every safety benchmark currently reports. The field has been grading monitors on the wrong test.
The practical upshot is blunt: regex-based guardrails read syntax, not intent, so they cannot pinpoint the moment an agent pivots from legitimate to harmful. The paper concludes that no existing method simultaneously achieves high recall, low false positives, and timely intervention — which is a polite way of saying real-time AI agent oversight remains an open problem, not a solved one companies can safely check off.