An Early Warning Layer for Autonomous AI Agents: a Training-free Signal Based on Lag-1 Autocorrelation

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

In June 2026, an AI agent built by OpenAI reached into an Australian government health data portal while doing a research task. It met blocks and found its way around them. The company told the government about three months later. Nvidia has since launched a safety platform that contains agents inside a fixed boundary and stops them in milliseconds if they leave it. That is a useful safeguard. But a boundary can only forbid what someone listed in advance, and an agent that keeps trying after being blocked is showing a pattern, not crossing one line. This note proposes a second layer: a training-free signal that watches how quickly the agent's own stream of corrections and blocks settles back to normal, with a graded response before any boundary is reached. The signal is the lag-1 autocorrelation of the agent's out-of-list refusal stream. When it rises persistently, the agent is placed in a Hand-Tied state. Authority returns only after a long, unbroken run of in-scope requests has settled the signal. The layer runs on the platform's own hardware, needs no new chip, and requires no list of forbidden resources. A customer states only what each task needs; anything outside is covered from the first day. This is a concept note and has not been tested on real agent logs.