Paper Tests Whether AI Safety Governors Block Gemini Agents From Finishing Tasks

The paper, titled “When the Governor Becomes the Disturbance”, starts from a simple worry: a supervisory governor is added to a tool-using agent to catch risky actions, but the governor’s own interventions can become a new source of failure. The author builds a controlled file-recovery environment where turning up regulatory intensity triggers experimentally imposed tool failures, either by replacing a tool’s result or by executing corrupted tool arguments. A governor that is blind to the cost of intervening can turn those imposed failures into persistent blocking, meaning the agent never completes its task because the governor keeps stepping in.

Against that cost-blind governor, the paper tests a backoff rule that lowers the probability of intervention using a moving average of events the governor itself induced. On a hand-coded stochastic-policy agent, the blocking pattern shows up under both kinds of imposed failure, and the adaptive backoff rule improves task completion compared with a fixed, weak governor set to intervene about as often. The same comparison is then run on Gemini 2.5 Flash across 576 episodes spread over 6 tasks, and the pattern holds there too: backoff reduces blocking and raises completion, with an intermediate backoff strength producing the best observed aggregate success among the settings tried.

The numbers

Two figures anchor the Gemini experiment. The model was run for 576 episodes, spread across 6 tasks, giving the paper enough repetitions to compare a cost-blind governor against several backoff strengths on the same underlying agent. Neither figure is a benchmark score; both describe the scale of the test, which is what lets the author claim the backoff effect is not a one-off.

The author is careful to flag the limits of the result. The cost mechanisms that trigger governor interventions are imposed by the experiment design, and the events the backoff rule reacts to are directly observable to it, conditions that will not hold in every deployed system. Whether the same failure mode and the same fix generalise beyond this controlled environment is left as an open question. For teams running Gemini behind their own safety layers, the practical read is narrower than a headline result: a monitor that never relaxes its own grip can be the component that stalls a job, independent of anything the underlying model got wrong, and a monitor that tracks its own induced failures and eases off can recover most of that lost completion.