When an LLM agent reads a confidential file, then writes a summary, then emails it externally, no single step is unsafe, but the sequence is a data leak. We call this safety drift: individually safe actions compounding into violations. Prior work has measured this problem; we predict it. SafetyDrift models agent safety trajectories as absorbing Markov chains, computing the probability that a trajectory will reach a violation within a given number of steps via closed form absorption analysis. A consequence of the monotonic state design is that every agent will eventually violate safety if left unsupervised (absorption probability 1.0 from all states), making the practical question not if but when, and motivating our focus on finite horizon prediction. Across 357 traces spanning 40 realistic tasks in four categories, we discover that "points of no return" are sharply task dependent: in communication tasks, agents that reach even a mild risk state have an 85% chance of violating safety within five steps, while in technical tasks the probability stays below 5% from any state. A lightweight monitor built on these models detects 94.7% of violations with 3.7 steps of advance warning at negligible computational cost, outperforming both keyword matching (44.7% detection, 55.9% false positive rate) and per step LLM judges (52.6% detection, 38.2% false positive rate) while running over 60,000x faster.

翻译：当大语言模型（LLM）智能体读取一份机密文件，随后撰写摘要，再通过邮件将其发送至外部时，每个步骤单独看均属安全行为，但这一序列却构成数据泄露。我们称之为安全漂移：个体安全行为累积引发违规。已有研究衡量了该问题；我们则对其进行预测。SafetyDrift将智能体安全轨迹建模为吸收马尔可夫链，通过闭式吸收分析计算轨迹在给定步数内到达违规状态的概率。单调状态设计的一个推论是：若不加监管，所有智能体最终都将违反安全（从所有状态出发的吸收概率均为1.0），这使得实际问题不再是“是否发生”，而是“何时发生”，也促使我们聚焦于有限时域预测。通过对涵盖四个类别40项现实任务的357条轨迹进行分析，我们发现“不可逆点”高度依赖任务类型：在通信任务中，达到轻度风险状态的智能体在五步内违反安全的概率为85%，而在技术类任务中，该概率从任何状态均低于5%。基于这些模型构建的轻量级监控器，能以可忽略的计算成本实现94.7%的违规检测率，并提前3.7步发出预警，其性能优于关键词匹配（44.7%检测率，55.9%假阳性率）和逐步骤LLM评判（52.6%检测率，38.2%假阳性率），同时运行速度快60,000倍以上。