Summary
A study of 1,065 BCI episodes in ALS patients finds AI agents do not reduce unsafe execution, but a hybrid architecture with an external gate shows promise.
A preprint posted on medRxiv on 17 September 2026 reports that AI agents used at the brain-computer interface (BCI) do not reduce unfaithful execution below a deterministic gate, even when prompted with reconstructed decoder confidence. The study, based on 1,065 episodes from 47 people with amyotrophic lateral sclerosis (ALS), found that apparent safety gains of up to 22 percentage points reflected the agents acting less often rather than being more accurate. The work is authored by Alon Gorenshtein, Mahmud Omar, Eric L Jia, Yosef Adiniaev, Oved Daniel, Jonathan Kruskal, Muneeb Ahmed, Olga R Brook, Eyal Klang, and Yiftach Barash, and is available under a CC-BY-NC 4.0 license.
The BCI context and the agent problem
In medicine, AI agents are moving from generating text to executing actions. At a BCI, decoded neural signals are translated into commands that can control a device. The upstream decoder introduces uncertainty, and when an AI agent acts on that uncertainty, it may execute a command that does not reflect the user's intent—a failure the authors call "unfaithful execution." A deterministic gate is a rule-based system that only allows a command when the decoder's confidence exceeds a threshold. The question is whether an AI agent, given the same confidence information, can make better decisions.
What the study tested
The researchers used 1,065 episodes from 47 people with ALS. They evaluated five language models as agents, prompting them with the reconstructed decoder confidence. The agents were asked to decide whether to execute a command or abstain. The primary comparison was against a deterministic gate at matched coverage—the proportion of episodes in which an action was taken. A post-hoc fair-information test later gave ten models the same command vocabulary as a deterministic resolver.
What the results showed
Prompting agents with decoder confidence never reduced unfaithful execution below the deterministic gate at matched coverage. Two models were significantly worse. The apparent safety gains of up to 22 percentage points reflected the agents acting less often, sometimes through invalid tool calls rather than explicit abstention. No direct agent arm improved on the resolver's risk-coverage frontier.
A hybrid alternative
The study also explored a hybrid architecture in which the models proposed semantic corrections while an external gate retained admission authority. In this setup, the models did not decide whether to act; they suggested alternative commands, and the gate decided whether to admit them. This hybrid architecture extended coverage beyond the resolver in five of ten models without observed unfaithful executions.
Implications for agentic neurotechnology
The results suggest that separating inference from control may be necessary for safe AI agents at the brain-computer interface. A model's ability to propose a correction does not guarantee that it will execute faithfully, and giving it access to confidence information does not by itself solve the control problem. The hybrid approach, where an external gate keeps the final authority, offers a potential path forward, though the study is a preprint and the hybrid test was post-hoc. The findings underscore a limitation of current AI agents in high-stakes control tasks: confidence-aware prompting does not automatically translate into safer execution.