Wenhui Chu studies agents, models running multi-step tasks with tools, that write their own handoff summaries. A summary can invent an approval requirement or preserve permission that was withdrawn.
Synthetic records, reporting and coding tasks have a separate permission ledger. The successor receives the system prompt and saved summary, without the original user request. Replaying the same environment with edited summaries tests whether particular sentences change behavior.
- Two AI readers confirmed false restrictions in 1.2% of 1,044 Qwen3-8B summaries and 2.4% of 1,094 gpt-oss-20b summaries. False approvals appeared in 0.1% and 1.3%, respectively.
- Readers examined only automatically flagged summaries. Unknown filtering recall and limited human agreement make these imperfect prevalence estimates.
- Neutralizing false approvals cut unauthorized actions from 24 to seven of 120 pooled replay runs. This was exploratory; a later set changed from 17 to eleven of 48.
- Removing restrictions failed the original pre-specified held-out test (p=0.58). A later positive result was fragile, and fixing the compaction timing did not restore the development effect.
- A prompt naming where approval requirements originate cut confirmed restrictions from 1.8% to 0.3% on fresh held-out tasks. Requests for required approvals barely changed.
Caveat: The prompt experiment assumes every required approval is written down. Unauthorized actions and rule violations did not significantly improve, so fewer false restrictions do not establish greater safety.
The practical implication is to preserve permission provenance, exact targets and revocations outside a free-text summary. That is an engineering recommendation, not a validated defense. Code and run records expose the study’s plans and follow-ups.