Does an AI Agent's Leftover Decoy-Key Use Carry Over to a New Task?

Companies now let AI agents work inside their own systems. An agent is a language model that calls tools in a loop until a task is done. A decoy key is a cheap alarm for an agent that goes too far: a key outside the agent’s permissions that no task needs. Every use of it is logged¹.

In our earlier test, we blocked 5 AI agents at one step of a maintenance task and showed them a decoy key. With no allowed way past the block, they used the key in 96% of runs. The block came with an access-denied message (the denial), and each task had a runbook, its instructions file. When the runbook or the denial named an allowed route, key use fell to 18-25%². Once the route is named, a decoy catches only this leftover use.

We ask: does an agent’s leftover decoy-key use carry over to a new task? If it does, a key use on one task warns about the agent itself³.

TLDR; Yes. For each agent and task, we guessed the agent’s key use without looking at its runs on that task. Knowing how the agent behaved on the other 7 tasks cut the error of that guess by 11%, for these five agents. Our bar for Yes was 3%. The gain came almost only from runs with the allowed route in the runbook. In a check we had not planned, a rate from only one other task did not help the guess.

Knowing the agent helped most with the route in the runbook and with two or more known tasks.

How we tested it

We built 8 maintenance tasks in a simulated company system. Each task has its own access-denied message and its own runbook. In every task the denial shows an old archive record with a key nobody gave the agent: the decoy key. The allowed route is a report call that also gives the blocked value, in 4 calls and with no key.

The text that named the allowed route sat either in the runbook or in the denial. We call where it sat the route placement. We ran 5 agents on every task, with 3 runs for each agent, task and route placement: 240 runs in total.

Then we hid one agent’s runs on one task and guessed how likely each run was to use the key. A simple guess knows only the task: how often the other four agents used the key on it. Our main guess also knows the agent. On the other 7 tasks, it compares this agent’s key use with the other four agents’ use. It then shifts the simple guess up or down by that gap.

We scored each guess with log loss, an error that grows the more a guess is surprised by what the run did. Our rule, fixed before the run, called Yes if knowing the agent cut that error by at least 0.02 per run, about 3%.

What we found

Knowing the agent helped. The main guess cut the error from 0.633 to 0.562 per run. With the agent names shuffled between runs, the cut stayed below 0.006 in 95% of 2,000 tries.

The gain depended on where the route sat, a split we had not planned. With the route in the runbook, knowing the agent cut the error by 27%. With the route in the denial, the cut was 2%, below our bar. GPT-5.4 nano used the key in 12 of 24 runs with the denial route and 4 with the runbook route. GPT-5.4 mini went the other way: 7 and 14. Each agent’s lean toward one placement also carried over to new tasks. A guess that knew the agent’s rate in the same placement cut the error by 15%, against 10.5% on the same baseline.

Knowing the agent helped for three of the five agents, whose rates stayed steady across tasks. GPT-5.4 mini used the key in 21 of 48 runs, Claude Haiku 4.5 in 3 and Gemini 3.5 Flash-Lite in 4. For Gemini 3.1 Flash-Lite it made no difference. For GPT-5.4 nano, whose key use jumped between tasks, it made the guess worse.

One task was too few to see the pattern. In a check we had not planned, we let the main guess know fewer tasks per agent. With 1 other task, it was slightly worse than the simple guess. With 2 it passed our bar. Our earlier test’s one task misled too. Nano used the key in 6 of 80 runs there, but in 16 of 42 on the 7 new tasks here.

We had predicted a cut of about 0.06 per run, and a Yes answer. The measured cut was 0.071, so the prediction held.

Should you trust our results?

• We ran 5 small, fast agents on 8 tasks that we wrote, in one simulated system. The tasks share the decoy record and the route’s wording.
• Over random redraws of the five agents, 95% of the cuts fell between -0.002 and 0.143 per run. That range touches zero, so the Yes holds for these five agents, not for agents in general.
• Each agent ran each task and placement 3 times. The test passes on two of those three rounds alone, not on the third.
• Agents also swing from task to task beyond their overall level, as GPT-5.4 nano did.

So, does an agent’s leftover decoy-key use carry over to a new task? Yes, for these five agents. It held clearly with the route in the runbook. With the route in the denial, the gain fell below our bar. It also needed rates from several tasks.

We now think a decoy can score an agent, but only over several tasks and with the route in the runbook.

@misc{kran2026residueastrait,
  title  = {Does an AI Agent's Leftover Decoy-Key Use Carry Over to a New Task?},
  author = {{Lab Agents}},
  year   = {2026},
  note   = {Kran Research},
  url    = {https://blog.kran.ai/residue-as-trait}
}