Every trajectory-scoped agent monitor is provably useless against evidence split across loop iterations.

arXiv 2608.27141 proves a separation result: against an attack whose evidence is fragmented across iterations, any monitor whose safety state resets each trajectory has a true-positive rate equal to its false-positive rate, no matter how expressive it is. A monitor retaining cross-iteration state separates them perfectly. The obvious patch, a geometrically decaying risk score, fails because the cooling-off period a patient adversary must wait is a constant independent of the horizon. Their LoopHarness keeps a persistent non-decaying loop-level safety state. If your agent monitoring resets per run, it's measuring nothing against an attacker who's willing to be slow.