A new paper from researcher Wenhao Wang, posted to arXiv on August 11, 2026, makes a provocative claim: the dominant approach to AI safety is fundamentally broken for autonomous agents. The current paradigm—instilling safe behavior through training techniques like RLHF (Reinforcement Learning from Human Feedback), DPO (Direct Preference Optimization), and Constitutional AI—is "structurally insufficient" for systems that execute code, mutate files, send messages, and modify databases.

The Problem With Training-Time Safety

Wang argues that safety baked into a model during training can't account for the infinite variety of real-world agentic tasks. An LLM might behave responsibly in most contexts, but once you let it loose on a codebase, an API, or a production database, static behavioral constraints hit their limits fast. The paper puts it bluntly: when agents operate autonomously in complex environments, you need enforcement mechanisms that exist outside the model itself.

Two Faces of Runtime Safety

The proposed solution is a runtime contract with two complementary components. The preventive face blocks dangerous actions before they happen through sandboxes, permission gates, output filters, and trajectory monitors. Think of it like capability-based security—you grant agents only the specific permissions they need for a given task, nothing more. The evidential face requires verifiable proof that good actions actually occurred, gating task submission on hard evidence such as test runs, log captures, file diffs, and citation grounding. This mirrors how experimental sciences document methodology—results don't count without an auditable paper trail.

The Evidence Base

Wang backs this position with four lines of public evidence: a survey of 52 documented AI-agent and LLM safety incidents, a false-completion audit covering 31 non-contested core cases plus one disputed illustrative case, a trajectory-schema audit examining 12 public agent systems and harnesses, and a title-level audit of all 28,560 papers accepted at NeurIPS, ICML, and ICLR from 2023 to 2025. That last dataset reveals a striking 8-12x imbalance between training-time and deployment-time publication—the research community is heavily focused on how models are built rather than how they're deployed and monitored in the wild.

Academic Incentives Favor Training-Time Solutions

The paper digs into why this imbalance persists: publishing novel training techniques earns citations, conference slots, and industry partnerships. Runtime safety work—monitoring, auditing, sandbox engineering—is unglamorous and hard to publish in top venues. The result is a research ecosystem that systematically undervalues the deployment half of the safety equation, even as agents become more capable and consequential.

Lessons From Security and Science

The paper draws explicit parallels to two communities that already faced this problem: computer security and experimental sciences. Both converged on runtime contracts with preventive and evidential elements out of necessity. Secure systems don't rely solely on trustworthy code; they use sandboxes, capability models, and audit logs. Scientific claims require peer review and reproduction—evidence that the methodology was sound, not just that the conclusion sounds reasonable. Wang argues agentic AI is under identical pressure.

Formalizing Agent Safety

The paper formalizes an Agent Trajectory Schema and Evidence Chain as a concrete framework for this approach, along with a compositional gating proposition based on standard monitor composition. This gives the argument technical teeth—you're not just making a philosophical point about where safety should live; you're providing architectural patterns that practitioners can actually implement.

Key Takeaways

  • Training-time safety (RLHF, DPO, Constitutional AI) can't secure autonomous agents operating in complex real-world environments
  • Runtime contracts need both preventive measures (sandboxes, permission gates) and evidential requirements (test runs, logs, diffs)
  • The research community has an 8-12x publication bias toward training-time solutions over deployment-time monitoring

The Bottom Line

Wang is right that we can't train our way to safe agents. When a system can touch production data, modify files, or send messages on your behalf, you need enforcement mechanisms with teeth—not vibes baked into weights during fine-tuning. The question isn't whether runtime safety contracts are coming; it's whether we'll build them properly before the next wave of incidents forces us to improvise.