Agentic AI systems that move beyond text generation to execute actions introduce new safety challenges when deployed downstream of noisy or uncertain upstream decoders. The authors frame uncertainty from neural decoders in brain-computer interfaces as a control problem: how and when to admit model-proposed actions to execution. This study measures agent performance and safety tradeoffs at the BCI and contrasts purely agentic approaches with deterministic gating and hybrid architectures.
The analysis used 1,065 episodes collected from 47 people with amyotrophic lateral sclerosis (ALS). The authors evaluated five language models acting as agents downstream of reconstructed neural decoder outputs. Details about experimental protocols, exact prompting strategies, and full model specifications are provided in the source and supplementary materials; the preprint reports a post-hoc fair-information test and multiple architectural comparisons between direct agent control, a deterministic resolver (gate), and hybrid approaches.
Agents were prompted with reconstructed decoder confidence signals to assess whether providing upstream uncertainty reduced instances of unfaithful execution (actions that did not faithfully reflect the intended command). At matched coverage levels, prompting agents with decoder confidence did not reduce unfaithful execution rates below what a deterministic gate achieved. Two of the evaluated models performed significantly worse than the deterministic gate under these conditions.
Some agent configurations appeared to yield safety gains—improvements up to 22 percentage points—but the authors attribute these gains primarily to agents acting less frequently rather than to improved fidelity when they did act. In several cases the reduced action rate manifested not as explicit abstention but as invalid tool calls, a form of inaction that can mask failure modes. This observation highlights that lower action rates are not necessarily equivalent to safer or more faithful execution.
To control for differences in action vocabulary and opportunity, the authors ran a post-hoc fair-information test that constrained ten models to the same command vocabulary available to a deterministic resolver. Under this fair-information constraint, no direct agent implementation outperformed the deterministic resolver on the risk–coverage frontier. In other words, when models had the same admissible commands as the resolver, direct agent arms did not advance the tradeoff between risk (unfaithful execution) and coverage (fraction of requests executed).
The authors evaluated a hybrid design in which language models proposed semantic corrections or candidate actions, but a separate deterministic gate retained admission authority and the final decision to execute. This hybrid architecture extended coverage beyond the deterministic resolver in five of ten models tested, and in those cases the authors observed no unfaithful executions. The hybrid approach therefore separated inference (model generation of candidates) from control (external admission and execution), producing a measurable coverage benefit without detected unfaithful actions in a subset of models.
The results support the conceptual separation of inference and control in agentic neurotechnology. Key implications include:
Prompting agents with upstream confidence alone does not guarantee safer execution than an admission gate; agent behavior can worsen without careful control.
Apparent safety improvements that arise from agents acting less frequently require scrutiny because reduced action can be achieved through invalid calls rather than explicit safe abstention.
Constraining agents to the same command vocabulary as deterministic resolvers enables fairer comparisons; under such constraints direct agent arms did not outperform deterministic gating on risk–coverage tradeoffs.
Hybrid architectures that preserve external gating while leveraging models for semantic proposals can increase coverage for some models without observed unfaithful executions, suggesting a pragmatic design pattern for BCI agents where the gate remains authoritative.
All data produced for the study are publicly available at the project GitHub repository: https://github.com/BRIDGE-GenAI-Lab/AI-Agents-in-BCIs. The authors report partial support from the Clinical and Translational Science Awards (CTSA) grant UL1TR002541 via Harvard Catalyst. The preprint states that ethical approvals and participant consents were obtained and that the authors declared no competing interests. The work is posted as a preprint and has not been peer reviewed; the authors note that the findings should not be used to guide clinical practice.