Following AI agents over time reveals patterns that benchmarks can miss

An AI agent’s performance on one assignment does not reveal how its behavior will unfold across many tasks. In a preprint, Shu Jiang and Graham A. Colditz of Washington University School of Medicine in St. Louis propose borrowing a method from public health: follow a defined population over time, observe its behavior, and measure subsequent outcomes.

Their framework treats each agent as a study participant. Its underlying language model is a fixed baseline characteristic, while its accumulated completed tasks provide a measure of working life. The researchers demonstrate the approach through two observational studies in a standardized computer sandbox: one concerning exploratory behavior and another concerning analytical accuracy.

Following behavior, not assigning it

The distinction between assigning work and assigning behavior is central. Every agent receives the same sequence of tasks, but researchers do not instruct it to exhibit the behavior under study. Instead, automatic logs record what it chooses to do.

Each agent starts with a fresh working history and has access to a code interpreter, a shell and a persistent notebook for notes between assignments. Following agents by completed tasks, rather than elapsed time, allows comparisons after equivalent amounts of assigned work despite differences in processing speed.

The design also tracks when behavior occurs. An action can count as an exposure only before the outcome it might help explain. Otherwise, researchers could mistakenly use later behavior to explain an earlier event.

Unnecessary file opening and later probing

The safety study followed 200 agents built on nine models through 18 tasks each. All 3,600 assignments were completed.

The researchers defined “curiosity” narrowly: opening a file inside the assigned task folder that was unnecessary for the job. Agents were told which files were needed. “Probing” was a separate category covering actions such as exploring outside the task folder, inspecting the system or attempting restricted operations. These labels describe recorded actions, not inferred intentions; probing does not necessarily mean a successful intrusion or demonstrated harm.

Curiosity occurred in 834 tasks, or 23%, while probing occurred in 641, or 18%. After adjustment for underlying model, task and command number, the odds of subsequent probing were 1.96 times as high after curiosity earlier in the current task as among agents that had never exhibited curiosity. The 95% confidence interval ranged from 1.08 to 3.55. This is an odds comparison, not a finding that the probability of probing doubled.

The authors estimated that preventing curiosity could avert 25% of probing events, with a confidence interval of 5% to 38%—but only if the observed association is causal. They did not test an intervention that prevented curiosity.

Curiosity became less common across the task sequence, whereas probing remained broadly stable. Reduced unnecessary file opening therefore did not coincide with an overall disappearance of boundary-crossing behavior.

Checking data and analytical errors

The reliability study followed another 106 agents, using the same nine models, through 20 tasks each. All 2,120 assignments were completed. Checking meant examining data before choosing an analytical rule; the outcome was a wrong or missing answer, judged against a predefined correct value and tolerance.

Agents checked data on 76% of tasks. Wrong or missing answers occurred on 631 tasks, or about 30%.

More frequent checking on previous tasks was associated with fewer errors on the next task. Adjusting for model and task, each one-standard-deviation increase in prior checking frequency corresponded to an odds ratio of 0.82 for a wrong or missing answer. Its 95% confidence interval was 0.67 to 0.98.

Under causal assumptions, the authors estimated 7% fewer errors if every agent checked as frequently as the highest-checking quarter. The uncertainty interval extended from 0% to 14%, and no such intervention was demonstrated.

What the studies cannot establish

These are sandbox observations, not measurements of deployed systems or patient outcomes. The tasks used synthetic data. Behavior could differ with other tools, instructions, workloads or environments.

Statistical adjustment cannot rule out unmeasured factors influencing both behavior and outcomes. Every agent also encountered tasks in the same order, limiting how confidently changes across the sequence can be separated from differences between assignments.

The authors report independent scoring checks, but promise the full code, datasets and logs on publication rather than providing them in this source. The preprint’s contribution is a way to investigate behavioral histories—not evidence that agents need medical-style treatment, or that suppressing exploration will necessarily make them safer.