Current agent safeguards defined over single trajectories have a fundamental composition failure: against attacks fragmented across iterations, every trajectory-scoped monitor has equal true-positive and false-positive rates regardless of expressiveness.

against an attack whose evidence is fragmented across several iterations, every trajectory-scoped monitor has a true-positive rate equal to its false-positive rate, however expressive it is, because the evidence it would need never appears in the window it sees

http://arxiv.org/abs/2608.27141v1