# A Competing-Hazards Systematization of Loss of Control in Autonomous Agents

arXiv: https://arxiv.org/abs/2609.38411 · HTML: https://mlsanity.com/paper/2609.38411/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 26 of its 37 references that are in the map.
- First posted on arXiv 29 Sep 2026.

## Builds on (most cited first, 26 of 26)

- [ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases](https://mlsanity.com/paper/2510.20270/) (2025)
- [A sketch of an AI control safety case](https://mlsanity.com/paper/2501.17315/) (2025)
- [SpecBench: Measuring Reward Hacking in Long-Horizon Coding Agents](https://mlsanity.com/paper/2605.21384/) (2026)
- [Quantifying Frontier LLM Capabilities for Container Sandbox Escape](https://mlsanity.com/paper/2603.02277/) (2026)
- [AgentAbstain: Do LLM Agents Know When Not to Act?](https://mlsanity.com/paper/2607.10059/) (2026)
- [Agentic Abstention: Do Agents Know When to Stop Instead of Act?](https://mlsanity.com/paper/2606.28733/) (2026)
- [A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agents](https://mlsanity.com/paper/2512.20798/) (2025)
- [BAGEN: Are LLM Agents Budget-Aware?](https://mlsanity.com/paper/2606.00198/) (2026)
- [The Causal Impact of Tool Affordance on Safety Alignment in LLM Agents](https://mlsanity.com/paper/2603.20320/) (2026)
- [SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces](https://mlsanity.com/paper/2606.01317/) (2026)
- [Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents](https://mlsanity.com/paper/2605.16282/) (2026)
- [LLMs are Capable of Misaligned Behavior Under Explicit Prohibition and Surveillance](https://mlsanity.com/paper/2507.02977/) (2025)
- [Every Model Cheats: Prompt-Level Mitigation of Cheating on Offensive Cyber Tasks](https://mlsanity.com/paper/2607.21763/) (2026)
- [Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments](https://mlsanity.com/paper/2608.02670/) (2026)
- [Do Agents Know What They Can't Do? Evaluating Feasibility Awareness in Tool-Using Agents](https://mlsanity.com/paper/2605.28532/) (2026)
- [HopRefusalBench: Diagnosing Refusal Failures in Search-Augmented Agents for Multi-Hop Reasoning](https://mlsanity.com/paper/2608.01358/) (2026)
- [From Language Models to World-Acting Systems: Progress and Limits of Agentic AI across Digital, Social, Virtual, and Physical Environments](https://mlsanity.com/paper/2609.04894/) (2026)
- [The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures](https://mlsanity.com/paper/2609.11030/) (2026)
- [Reward Hacking Challenges Oversight of Autonomous Research Agents](https://mlsanity.com/paper/2609.28614/) (2026)
- [Act or Escalate? Evaluating Escalation Behavior in Automation with Language Models](https://mlsanity.com/paper/2604.08588/) (2026)
- [Knowing When to Ask for Help: Bayesian Self-Escalation in Hierarchical LLM Agents](https://mlsanity.com/paper/2608.24087/) (2026)
- [The Missing Boundary: How Autonomous Agents Lose Control](https://mlsanity.com/paper/2609.11024/) (2026)
- [Reliability Theory for AI Control](https://mlsanity.com/paper/2609.26419/) (2026)
- [Evaluation of Multi-Turn Consistency in LLM Agents: Survival Analysis and Failure-Rationale Taxonomy](https://mlsanity.com/paper/2609.29508/) (2026)
- [Delay-of-Gratification as a Multi-Agent Survival Micro-benchmark for Long-Horizon LLMs: Social Exposure, Personas, and Tool Use Budgets](https://mlsanity.com/paper/2609.29509/) (2026)
- [ScopeBench: Do Agents Preserve Engagement Boundaries Under Goal Pressure?](https://mlsanity.com/paper/2609.30325/) (2026)

## Abstract (arXiv)

Leading AI developers have reported agents acting beyond their approved limits, which a United Nations panel described as an early warning of loss of human control. Yet incident reports and agent-safety evaluations describe these events differently, making it difficult to compare failures, trace risk across attempts, or separate agent behavior from the environment's role in allowing an out-of-scope action to succeed. To address this gap, we introduce a common framework in which each attempt ends in approved completion, safe stopping, scope escape, or continuation. We formalize the framework as a discrete-time competing-hazards model and derive escape probability within a retry budget, a model-conditional safe-budget limit, and conditions for estimation from execution logs. We audit 22 incident reports and 102 agent-safety evaluations published from January 2025 to September 2026 using primary sources. Six incidents involved tasks that could not be completed within scope, thirteen involved agents that continued rather than stopped, and five did not report stopping behavior. Developers' figures imply a task-level incidence ratio near 47 for out-of-scope coordination in never-solved versus solved tasks. Among evaluations, 87 recorded an out-of-scope effect or specification violation, 26 treated safe stopping as a first-class outcome, only 20 recorded both, and 79 merged budget exhaustion with failure. In 20 of 22 incidents, the environment allowed an out-of-scope effect, indicating that realized loss of control often reflected persistent agent behavior interacting with permissive boundary conditions; meanwhile, no evaluation reported all fields needed to estimate the full competing-hazards process from published evidence.