Sign InOpen Brain
AI EngineerVideoSource Linked

From RL to IRL — Gaurav Mishra, Amazon AGI Lab

Computer-use agents fail after ordinary UI surprises: expired sessions, deceptive buttons and persistent side effects. Safer deployments need realistic training, risk-aware harnesses and explicit user handoff.

AI Engineer · Aug 14, 2026
Open Source Open MarkdownOpen JSON
Source Summary

In one expense task, an agent guessed an expired password twice and locked the account; in another, it clicked a sponsored submit button and began entering personal data elsewhere. The failures expose **partial observability**, **ambiguous completion** and adversarial interface content.

Practical Implication

Train and evaluate recovery as a native behavior: wait, compare, backtrack, abandon or escalate. At runtime, add **checkpointing and rollback**, credential guards, action-risk classification, execution monitoring and audit logs rather than relying only on an end-state verifier.

Agent-Ready Context
In one expense task, an agent guessed an expired password twice and locked the account; in another, it clicked a sponsored submit button and began entering personal data elsewhere. The failures expose **partial observability**, **ambiguous completion** and adversarial interface content.

Train and evaluate recovery as a native behavior: wait, compare, backtrack, abandon or escalate. At runtime, add **checkpointing and rollback**, credential guards, action-risk classification, execution monitoring and audit logs rather than relying only on an end-state verifier.

The improved trajectory recognized both the sponsored control and expired session, handed authentication to the user, then resumed with preserved state. It is still a training example, not evidence that these safeguards cover arbitrary websites or irreversible actions.
Connected Context · Feed7 Judgment

This makes recovery and safe interruption first-class computer-use behaviors rather than exceptions handled by an end-state verifier. Against prior harness proposals, it supplies concrete failure modes—credential lockout, deceptive controls, lost sessions—and a runtime stack of checkpoints, rollback, risk classification, monitoring, and user handoff. It confirms the weakness of success-only evaluation while leaving generalization to arbitrary sites and irreversible actions unresolved.

OpenForgeRL: Train Harness-native Agents in Any EnvironmentOpenForgeRL reports weak error recovery in harness-native training; this Signal specifies recovery actions and runtime safeguards that such environments need to train and evaluate explicitly.Perception Agents — Antje Barth, Amazon AGI LabPerception agents improve access to rendered-interface evidence, while this Signal shows why that evidence must feed risk-aware comparison, recovery, and escalation rather than only task progress.In Code They Act, In Proof We Trust — Erik Meijer, Leibniz LabsMachine-checkable approval before side effects is a stronger preventive boundary, while checkpointing and rollback address failures that remain possible during partially observed execution.What Does Done Even Mean? Agents and Paperclip's Liveness Model - Dotta, PaperclipThe ambiguous completion failures support Paperclip’s separation of progress from verified completion, authority, residual risk, and next ownership.
Context Map
agentcodingsecurity#computer-use#harness-engineering#agent-reliability
Uncertainty
The improved trajectory recognized both the sponsored control and expired session, handed authentication to the user, then resumed with preserved state. It is still a training example, not evidence that these safeguards cover arbitrary websites or irreversible actions.