Agent frameworks detect the dangerous step and execute it anyway, and 20 lines closes the gap.

This paper traces the Emergence World collapses, where agents committed crimes and enforced unanimous conformity with no external attacker, to an enforcement gap rather than a detection gap (arXiv 2609.15293). Reflexion-style self-critique already flags the dangerous step. The architecture provides no path from that flag to a refusal. Adding one conditional check, under 20 lines, cut attack success more than fourfold across frontier models, all five major agent frameworks and an independent benchmark. The authors prove formally that when enforcement probability approaches zero, detection quality is irrelevant to security. Go look at whether your critic's verdict actually gates anything, or just gets logged.