Behavioural drift: the silent way agents fail in production
The BASTYN Team · 28 May 2026 · 7 min read
Drift is the slow divergence between how an agent behaved when you certified it and how it behaves today.
AI agents do not operate like static software. They exist inside dynamic environments where models change, data changes, they have new prompt inputs, memories accumulate, tools are added, permissions expand and other agents enter the workflow without anyone shipping a single line of new agent code.
Over time, the agent’s behaviour can move away from the behaviour that was originally tested and approved.
This is Agentic AI Drift.
Drift may become one of the most consequential risks in the agentic economy.
From the outside, everything can still look fine.
Transactions complete. Customers receive answers. Operational dashboards remain green.
But the system is no longer behaving in quite the same way as the one that was originally designed, tested and approved.
Most organisations I talk to about controlling AI risk, still focus on the model.
Is it accurate? Is it biased? Can it be manipulated? Does it produce harmful content?
All those questions matter, but an AI agent is much more than a model.
It is the model, the instructions it receives, the data it can access, the tools it can call, the memories it retains, the permissions it has and the other agents or systems it interacts with.
Change any one of those and you may change the agent’s behaviour and operational context. The underlying model may remain exactly the same. Yet the system may no longer be operating as you intended
Drift can occur across the entire agent chain
Goal drift occurs when the agent’s actions move away from its original purpose.
A customer service agent instructed to resolve complaints fairly may gradually optimise for closing cases quickly because resolution speed becomes the dominant feedback signal.
Data drift occurs as sources become outdated, incomplete or manipulated. The agent may still retrieve information successfully while making decisions from incomplete, outdated or manipulated data.
Memory drift occurs when stored interactions, incorrect information and unusual interactions influence future decisions. begin to alter future behaviour.
Tool drift occurs as the agent discovers new sequences or shortcuts that were never explicitly tested. The tool itself may be approved. The emerging pattern of use may not be.
Permission drift occurs when access is gradually expanded without reconsidering the combined risk.
e.g. An agent originally allowed to recommend a payment may later gain the ability to initiate it, approve it and bypass controls surrounding the customer record.
Behavioural drift occurs when the agent’s decision strategy changes even though its stated objective remains unchanged. Resulting in increasingly unsafe reasoning or prohibited intermediate actions over time.
Multi-agent drift occurs when individually agent behaviour is acceptable but produce unexpected behaviour through coordination.
- One agent makes an assumption
- A second agent treats that assumption as trusted context.
- A third agent acts on it.
By the time the outcome becomes visible, it may be extremely difficult to identify where the problem began, as the failure is a result of complete chain.
On the systems I have worked with, monitoring usually tells us whether something is technically available and functioning. Did the call succeed or transaction complete? But what happens when the dashboard is green but actions and behaviour are not as intended?
Conventional observability tells you whether the system is working. Agentic observability must tell you if agent behaviour is still operating as you intended. is it:
- Using the wrong information
- Taking an unacceptable route to the answer
- Operating beyond its intended scope
- Combining permissions in a way nobody anticipated/intended
- Creating harmful outcomes over time
Pre-deployment test or periodic reviews tell you how an agent behaved under a particular set of conditions at a particular moment. It does not tell you how that agent is behaving today or what has changed around it...and it does not guarantee that the next thousand decisions will follow the same pattern as the last.
Agent evaluation practices are also moving beyond single benchmark scores towards combinations of code-based checks, model-based assessment and human judgement across both agent lifecycle and outcomes.
Trust needs to be continuous.
That means establishing a clear behavioural baseline for the agent’s intended use, then continuously verifying:
- Whether it remains within its authorised scope
- Whether its goals and actions remain aligned
- Whether approved data, models and tools are being used
- Whether its permissions or operating environment have changed
- Whether its behaviour is beginning to deviate
- Whether the consequences of its actions remain acceptable
- Whether evidence exists to explain every material decision
Continuous behavioural assurance across the full agent chain.
Agents WILL change
Agentic environments will change, their tools, data, models and responsibilities will evolve, and trying to freeze them permanently would actually remove much of the value that makes agentic AI useful.
The problem is them changing without visibility and without understanding the operational impact to the contextual use case of each agent
That is why agentic trust has to be continuously earned and continuously verified.
Because the AI agent I worry about most is not the one that crashes, produces nonsense or triggers an obvious security alert.
It is the agent that continues to work, completes its tasks, produces convincing answers but somewhere along the way, it has quietly started operating outside of its intended boundaries. The question is....