Why Does Agentic Safety Fail to Generalize Across Tasks?
Abstract
AI agents are increasingly deployed in multi-task settings, where the task to perform is specified at test time, and the agent must generalize to unseen tasks. A major concern in such settings is safety: often, an agent must not only execute unseen tasks, but do so while avoiding risks and handling ones that materialize. Empirical evidence suggests that even when the ability to execute generalizes to unseen tasks, the ability to do so safely frequently does not. This paper provides theory and experiments indicating that failures of agentic safety to generalize across tasks are not merely due to limitations of training methods, but can also reflect an inherent property of safety itself: the relationship between a task and its safe execution is more complex than the relationship between a task and its execution alone. Theoretically, we analyze linear-quadratic control with H∞-robustness, and prove that in many cases, the mapping from task specification to an optimal controller has higher Lipschitz constant with safety requirements than without, yielding a Lipschitz bound of independent interest. Empirically, we demonstrate our conclusions in simulated quadcopter navigation with a neural network agent and in CRM with an LLM agent, showing that imitating safe and unsafe teachers is similarly straightforward on tasks seen in training, yet generalizing across tasks is considerably more difficult with the safe teacher. Our findings suggest that current efforts to enhance agentic safety may be insufficient, and point to a need for fundamentally different approaches.
Related
- Transformers as Adaptive Kernel Learners across Tasks for In-Context Learning
- Empirical-Bayes spectral partial pooling across related tasks
- Does your cost-effectiveness model answer the question of interest? Marginal versus conditional inputs and transportability across populations
- Predicting how model propensities generalize out of distribution
- Does a historical catch record support a stable latent structure in catch composition across ports, taxa, and years? An assessment of cooperative-level catch statistics from Lake Biwa, Japan, 1962–1972
BibTeX
@misc{slutzky2026does,
title = {{Why Does Agentic Safety Fail to Generalize Across Tasks?}},
author = {Yonatan Slutzky and Yotam Alexander and Tomer Slor and Yoav Nagel and Nadav Cohen},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2605.06992},
eprint = {2605.06992},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2605.06992},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Why Does Agentic Safety Fail to Generalize Across Tasks?
AU - Yonatan Slutzky
AU - Yotam Alexander
AU - Tomer Slor
AU - Yoav Nagel
AU - Nadav Cohen
PY - 2026
DA - 2026/09/27
PB - arXiv
DO - 10.48550/arxiv.2605.06992
UR - https://arxiv.org/abs/2605.06992
AB - AI agents are increasingly deployed in multi-task settings, where the task to perform is specified at test time, and the agent must generalize to unseen tasks. A major concern in such settings is safety: often, an agent must not only execute unseen tasks, but do so while avoiding risks and handling ones that materialize. Empirical evidence suggests that even when the ability to execute generalizes to unseen tasks, the ability to do so safely frequently does not. This paper provides theory and experiments indicating that failures of agentic safety to generalize across tasks are not merely due to limitations of training methods, but can also reflect an inherent property of safety itself: the relationship between a task and its safe execution is more complex than the relationship between a task and its execution alone. Theoretically, we analyze linear-quadratic control with H_∞-robustness, and prove that in many cases, the mapping from task specification to an optimal controller has higher Lipschitz constant with safety requirements than without, yielding a Lipschitz bound of independent interest. Empirically, we demonstrate our conclusions in simulated quadcopter navigation with a neural network agent and in CRM with an LLM agent, showing that imitating safe and unsafe teachers is similarly straightforward on tasks seen in training, yet generalizing across tasks is considerably more difficult with the safe teacher. Our findings suggest that current efforts to enhance agentic safety may be insufficient, and point to a need for fundamentally different approaches.
ER -