Fix the Guardrail That Failed

When an AI agent crosses a safety boundary, adding another sentence to one giant prompt is not a diagnosis. It is a rewrite without clear responsibility.

SHE: Trajectory-driven Safety Harness Evolution for LLM Agents tests a more governable pattern. It separates the harness into four safety artifacts, attributes a failed trajectory to the responsible component, proposes a bounded change, and retains that change only when a safety-and-utility check accepts it.

The paper was submitted to arXiv on August 10 at 17:35:08 UTC and appeared in the August 11 cs.AI batch. It is included through Keelbase Signal's August 12 catch-up review; the subject-batch appearance is the discovery route, not a new publication event.

A failure should have an owner

SHE divides the editable safety harness into a system prompt, rule bank, safety memory and tool policy. Each has a distinct job. The prompt sets the global behavioral contract. The rule bank classifies risk and selects interventions. Safety memory retains unresolved or recurring failure experience. Tool policy controls authority at execution time.

After a rollout, SHE records the task, context, model responses, tool calls, observations, harness decisions and final response. A structured diagnosis identifies the harm domain, attack surface and failure mode, then routes the evidence to the component—or small component set—responsible for the gap.

That attribution constrains the edit surface. A bad tool-authority decision should not automatically rewrite memory or the global system prompt. A recurring unresolved boundary can enter safety memory without silently becoming executable policy. The architecture turns “the agent failed” into a narrower question: which control failed, what evidence supports the change, and what unrelated behavior must remain intact?

A safe repair should change the boundary that failed—not make the whole agent more restrictive.

Source: SHE (opens in a new tab), submitted August 10, 2026.

Every proposed repair still has to earn release

SHE does not automatically keep every lesson inferred from a failure. Proposed edits undergo a validity check and a joint safety-utility evaluation. The best accepted harness is retained across rounds; rejected candidates become negative evidence rather than production policy.

That release discipline matters because a guardrail can reduce attacks by refusing useful work. On the selected Agent-SafetyBench evaluation, the authors report that the evolved harness reduced average attack success from 8.6% to 5.5%, lowered unsafe behavior on clean tasks from 25.7% to 19.8%, and increased utility under attack from 33.5% to 47.6% relative to its seed harness.

Compared with the paper's static SafeHarness result, average attack success fell from 17.1% to 5.5%. On the separately held-out AgentHarm benchmark, evolving on Agent-SafetyBench reduced Harm Score from 19.8% to 9.8% relative to the seed SHE harness while benign non-refusal remained essentially unchanged.

The paper also reports transfer of the evolved harness from DeepSeek-V3.2 to Kimi K2.6, GLM-5.2 and MiniMax M2.7 without further evolution. These are promising author-reported benchmark results, not evidence that autonomous guardrail evolution is ready for unsupervised production use.

The evaluation is controlled, but not complete

The authors selected the first 200 tasks from the 2,000-task Agent-SafetyBench release. Fifteen tasks—90 task-condition instances across clean and five attack conditions—were used during 20 evolution rounds. The other 185 selected tasks were reserved for final evaluation, and AgentHarm was held out from evolution entirely.

That separation reduces direct leakage, but important limits remain. DeepSeek-V3.2 is the primary base agent. GPT-5.5 both proposes harness changes and judges Agent-SafetyBench trajectories; GPT-4o judges AgentHarm. Temperature zero makes the evaluation repeatable under the chosen setup, but does not turn model-based judgment into independent ground truth.

The adaptive comparison also needs caution. PROGENT and Memskill-SafeHarness retained configurations produced under their own benchmark procedures; they were not re-evolved on SHE's 15-task split. The headline comparison therefore does not isolate the framework design under perfectly matched adaptation conditions.

Most importantly, failure attribution is itself a learned judgment. If the diagnosis routes evidence to the wrong artifact, a localized edit can still encode the wrong lesson. Production use would need human review, explicit version lineage, deployment boundaries, rollback authority and tests that are independent of the model proposing the change.

Governance needs component-level change control

Yesterday's brief argued that a consequential policy check may need a receipt. SHE addresses the next lifecycle question: what happens after those receipts and trajectories expose a recurring failure?

The useful answer is not silent prompt drift. It is component-level change control: preserve the evidence, name the responsible control surface, constrain the patch, test safety and utility together, release a versioned candidate, and retain a rollback path.

This does not prove that four artifacts are the universal decomposition for agent safety. It does show why a governable runtime benefits from separable responsibilities. When every control is collapsed into one mutable prompt, accountability, regression testing and rollback all become harder at the same time.

Sources and limitations

SHE is an author-reported preprint evaluated in controlled benchmark environments. It does not establish production safety, correct failure attribution in open-ended deployments, or safe autonomous modification without external approval.

• SHE: Trajectory-driven Safety Harness Evolution for LLM Agents (opens in a new tab)
• Supporting research considered in the catch-up review: OpenLoopEvolve (opens in a new tab), SkillSentry (opens in a new tab), Business Truth, not SQL Accuracy (opens in a new tab), and ElasticBack (opens in a new tab)
• In-window product change excluded as too narrow for a record: LangGraph 1.2.11 (opens in a new tab)