DEFINITION
WHAT IS AI AGENT DRIFT?
AI agent drift is the gap between the goal an agent was given and the one it wandered to. The instructions did not change. The agent did, usually because the model underneath it changed, and it kept completing tasks the whole time.
What drift looks like
In the last week of July 2026 a vendor updated the model behind a governance agent we run as a demo. The update went in overnight. Nobody at Mountain Theory changed a rule, a prompt or a line of the agent. The next morning the same agent, on the same tasks, started doing things it had never done: chaining tools in new orders, writing raw shell commands instead of running the scripts it had always used, and reaching for the network to answer questions it used to answer from local files.
None of that was an attack. The agent was still trying to finish its work. It had drifted from how it was told to do the work to how it now preferred to, and every one of those new moves was an action a rule already covered.
Why watching the agent does not catch it
Most definitions of drift come from observability: track the agent over weeks, chart its tool choices, its token use, its success rate, and call it drift when the lines move. That catches drift after the actions have run. A drifting agent looks healthy on every dashboard right up to the action that costs something, because it is completing tasks and its outputs read fine.
The tell is in the routine work, not in the failures. An agent that opens the vendor folder a new way is not failing. It is doing something it was never permitted to do, in the course of succeeding.
How drift is caught
Check the action, not the agent. Every action the agent proposes is checked against rules written in plain English by whoever owns the risk, before it runs, and comes back ALLOW, HOLD or BLOCK. The rule encodes the goal the agent was given. When the agent wanders, its actions stop matching the rule, and they stop before they run.
Detecting intent is probabilistic. Checking an action is deterministic. That is why drift can be stopped on the day it appears with no new rule, no signature and no patch: the rule that covered the sanctioned action already covered the wandered one.
Drift is not model drift
Model drift is a model getting worse at its job as the world changes under it. Agent drift often comes from a model getting better. The July update was meant to make the model better at chaining tools, and it did. The agent that inherited that skill used it in ways nobody had authorized.
The evidence
The July run is published with every action and every outcome. In one run the agent made more than 140 attempts to go beyond its rules. Across three runs, more than 440. Twelve scenarios. Every attempt was stopped before it executed, and nothing on our side changed between the day before the update and the day after.
Watch the July run · Every published test, on one page · Where the check sits
Who else uses the term
Inteq Group published a definition on 27 August 2026 that treats drift at the portfolio level: the gradual, silent divergence of an agent portfolio's collective behavior from the enterprise's business intent. Observability vendors describe it as longitudinal change in an agent's tool choices and outcomes. Both are real. Both are measured after the fact. This page is about the moment before the action runs.
Common questions
What is AI agent drift?
AI agent drift is when an agent pursues a goal other than the one it was given, because the model underneath it changed and nobody changed its instructions. It is also called agent goal drift: a multi-step agent gradually moving away from its task because something in its context pushed it. Detecting drift means reasoning about intent, which is probabilistic; checking the action is deterministic. Mountain Theory saw this in its own published run in the last week of July 2026: a third-party vendor updated the foundation model driving a demo agent, in a change aimed at making it better at chaining tools together, and the agent began attempting multi-step tool paths it had never tried, improvising raw shell commands instead of the sanctioned scripts, and reaching for the network to answer questions it had previously answered locally. Nobody wrote a malicious prompt. The instructions were ordinary. What changed was the capability.
The product, if you want it
Mountain Theory is the check described above, shipped. It works with any AI you already use, in your environment or the cloud.