Unaccountable Delegation, Fading Skills: Mapping the Risks of Workplace AI Agents

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

The methodology is well grounded in established risk foresight and validation practice.

“This methodology is well grounded in established risk foresight and validation practice (Perez et al. 2022;Ganguli et al. 2022;Fröhling et al. 2026;Buçinca et al. 2023;Rao et al. 2025;Herdel et al. 2025;Wang et al. 2024b)”

• cites Perez et al. 2022 sourcePartly supported

  The Introduction (p. 1) describes red teaming as a way to find harmful language-model behavior before deployment, and §9.1 (p. 9) recommends further validation of classifier-flagged cases by other classifiers or people. These passages support risk discovery and validation as elements of the practice, but do not establish that the citing document’s unspecified methodology as a whole is well grounded in established practice. (LLM, conf=0.78)

  Experimental — accuracy not yet measured
• cites Ganguli et al. 2022 sourcePartly supported

  The Introduction (p. 1) describes red teaming as adversarially probing models for harmful outputs to measure and improve safety, and §3.1 (p. 4) says the authors incorporated Trust & Safety best practices into the task design. But the paper calls this an early approach and says shared red-teaming norms remain to be developed (§5.2, pp. 14–15). It does not establish that the unspecified methodology is well grounded in established risk-foresight and validation practice. (LLM, conf=0.82)

  Experimental — accuracy not yet measured
• cites Fröhling et al. 2026 sourceNot checked — no full text of the source

May combine two claims.

The Erroneous Agent Actions category accounts for the largest share of risk scenarios and has the highest concentration of severe risks.

“Second, Erroneous Agent Actions category accounts for the largest share of risk scenarios and has the highest concentration of severe risks.”

May combine two claims.

The Workplace AI Agent Risk Taxonomy was preferred in 64% of decided pairwise comparisons against the GenAI Risk Taxonomy (54 wins vs. 30, 46 ties) and achieved the highest classification success rate (97.7% vs. 96.2% and 96.9%).

“Our taxonomy was preferred in 64% of decided pairwise comparisons against the GenAI Risk Taxonomy (54 wins vs. 30, 46 ties) and achieved the highest classification success rate (97.7% vs. 96.2%and 96.9%).”

Classified as probably not a substantial claim.

The framework captures the relationships among agents, goals, environments, and human workers.

“The framework also captures the relationships among agents, goals, environments, and human workers.”

May combine two claims.

Employment Displacement is 98.8% automation-bound and 92.7% high or critical severity, the most one-sided and most severe category in the taxonomy.

“The starkest case is Employment Displacement, which is 98.8% automation-bound and 92.7% high or critical severity, the most one-sided and most severe category in the taxonomy.”

May combine two claims.

Table 1 shows that prior risk classifications cover human-oriented risks thoroughly: Discriminatory Agent Outcomes is fully represented in nine of the ten classifications, Physical Risks in seven, and Psychological and Social Risks in six.

“Table 1 shows that prior risk classifications cover human-oriented risks thoroughly: Discriminatory Agent Outcomes is fully represented in nine of the ten classifications, Physical Risks in seven, and Psychological and Social Risks in six.”

Classified as probably not a substantial claim.

The authors developed a multi-layer framework based on a review of the literature on AI agents.

“First, we developed a multi-layer framework based on a review of the literature on AI agents.”

May combine two claims.

Automation is associated mainly with organizational risks (operational failures, financial losses), whereas augmentation is associated mainly with risks to workers (human capability erosion, psychological and social risks).

“Third, automation is associated mainly with organizational risks (operational failures, financial losses), whereas augmentation is associated mainly with risks to workers (human capability erosion, psychological and social risks).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Geopolitical and Security Risks is omitted because no generated scenario was assigned to it; this category and its sub-categories were formed from incident-based risk scenarios rather than generated ones.

“Geopolitical and Security Risks is omitted because no generated scenario was assigned to it; this category and its sub-categories were formed from incident-based risk scenarios rather than generated ones.”

Classified as probably not a substantial claim.

The paper introduces a multi-layer framework for workplace AI agents that organizes risks across three layers: Technical Capability, Human Interaction, and Systemic Impact.

“We introduce a multi-layer framework for workplace AI agents.Building on prior work on socio-technical safety and compositional risk assessment, the framework organizes risks across three layers ( §3.1): Technical Capability (AAIS components and how they work together), Human Interaction (how people engage with AAIS), and Systemic Impact (broader organizational and societal consequences).”

May combine two claims.

Workers found the taxonomy easier to use for a risk classification task than two other risk taxonomies and preferred it in 64% of non-tied comparisons with a recent generative AI risk taxonomy.

“Fourth, workers found our taxonomy easier to use for a risk classification task than two other risk taxonomies and preferred it in 64% of non-tied comparisons with a recent generative AI risk taxonomy.”

Classified as probably not a substantial claim.

The framework models three core components and their interactions: the agents, their goals, and their environment.

“The framework models three core components and their interactions: the agents, their goals, and their environment.”

May combine two claims. The quote only partly states this claim.

78.6% of capability erosion risks are classified as limited severity, and only 0.1% as critical.

“The severity profile confirms that this is not a dramatic or sudden failure: 78.6% of capability erosion risks are classified as”

May combine two claims.

Workers found the scenarios moderately novel, offering genuine discovery value; the LLM judge was far stricter, likely recognizing training data patterns.

“Workers found the scenarios moderately novel, offering genuine discovery value; the LLM was far stricter, likely recognizing training data patterns.”

May combine two claims.

AI augmentation is not inherently safe; it introduces a slow and largely invisible risk of deskilling.

“Augmentation is not inherently safe; it introduces a slow and largely invisible risk of deskilling.”

Classified as probably not a substantial claim.

The authors recruited 26 workers from five professional backgrounds: software engineering, data science, design, healthcare, and finance.

“Using the same professional-background matching criteria as in the scenario-validation study, we recruited 26 workers from five professional backgrounds: software engineering, data science, design, healthcare, and finance.”

• AssumptionRests on an assumption: The 26 workers in the usability study are representative of the relevant worker population.

May combine two claims.

Many AI risk taxonomies are too generic or focus primarily on technical failures, and therefore overlook socio-technical AI risks that emerge from the dynamic interaction between an AI agent and its social context.

“First, many taxonomies are too generic or focus primarily on technical failures.They can therefore overlook socio-technical AI risks that emerge from the dynamic interaction between an AI agent and its social context, including the humans, organizations, and institutions in which it is embedded.”

Probably not a substantial claim: may not pass S3 (load-bearing).

An LLM-as-a-judge from a different model family assessed the full corpus.

“Second, an LLM-as-a-judge from a different model family assessed the full corpus.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Earlier research on human factors has long warned that the more reliable a system is, the more people stop practicing the skills they would need if it ever failed.

“The pattern is consistent with earlier research on human factors, which has long warned that the more reliable a system is, the more people stop practicing the skills they would need if it ever failed (Bainbridge 1983).”

• cites Bainbridge 1983 sourceNot checked — no full text of the source

May combine two claims.

Modern AI agents are proactive rather than passive: they suggest next steps, flag priorities, and take initiative, which accelerates the rate at which workers hand over their professional judgment to the system.

“What makes modern AI agents different is that they are proactive rather than passive: they suggest next steps, flag priorities, and take initiative, which accelerates the rate at which workers hand over their professional judgment to the system.”

Classified as probably not a substantial claim.

Each participant classified five AI agent risk scenarios drawn at random from a held-out pool not used during taxonomy construction.

“Each participant classified five AI agent risk scenarios drawn at random from a held-out pool not used during taxonomy construction.”

Classified as probably not a substantial claim.

AI agents are increasingly deployed to support everyday workplace tasks.

“They are increasingly deployed to support everyday workplace tasks (Eloundou et al. 2024;Xi et al. 2025;Mohney 2025).”

• cites Eloundou et al. 2024 sourceNot checked — no full text of the source
• cites Xi et al. 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Mohney 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

When agents augment rather than automate, the risks land on the individual worker rather than the organization, manifesting as the slow erosion of professional agency.

“When agents augment rather than automate, the risks land on the individual worker rather than the organization, manifesting as the slow erosion of professional agency described in Finding 1.”

May combine two claims.

Together, these checks suggest that the taxonomy definitions are distinct in both their vocabulary and their underlying concepts.

“Together, these checks suggest that the taxonomy definitions are distinct in both their vocabulary and their underlying concepts (Supplementary Material H).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

All participants confirmed daily AI use and medium-to-high awareness of AI agents and passed three comprehension checks on the definition of AI agents before proceeding.

“All participants confirmed daily AI use and medium-to-high awareness of AI agents and passed three comprehension checks on the definition of AI agents before proceeding.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The authors presented the taxonomies in a randomized order under the neutral labels Framework 1, Framework 2, and Framework 3 to reduce name recognition bias.

“We presented the taxonomies in a randomized order under the neutral labels Framework 1, Framework 2, and Framework 3 to reduce name recognition bias.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The framework was refined through structured interviews with three experts in agentic AI systems and responsible AI.

“We refined the framework through structured interviews with three experts in agentic AI systems and responsible AI.”

May combine two claims.

The agent produces an answer that is technically consistent with its inputs but wrong for the situation; the human acts on it because the agent communicated confidence.

“The agent produces an answer that is technically consistent with its inputs but wrong for the situation; the human acts on it because the agent communicated confidence.”

Probably not a substantial claim: may not pass S2 (checkable).

AI agents are autonomous entities that perceive their environment, interact with humans or other agents, and act to achieve goals with varying degrees of independence.

“AI agents are autonomous entities that perceive their environment, interact with humans or other agents, and act to achieve goals with varying degrees of independence (Sap-kota, Roumeliotis, and Karkee 2026).”

• cites Sap-kota, Roumeliotis, and Karkee 2026Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

Qualitative reflections attributed the advantage of the Workplace AI Agent Risk Taxonomy to workplace specificity: the taxonomy names workplace consequences rather than AI mechanisms.

“Qualitative reflections attributed the advantage to workplace specificity: our taxonomy names workplace consequences rather than AI mechanisms.”

Classified as probably not a substantial claim.

The workplace-specific taxonomy addresses this limitation.

“Our workplace-specific taxonomy addresses this limitation.”

May combine two claims.

Workplace AI agent risks do not arise from agents alone; they also depend on how people work with agents and how agents are deployed.

“Taken together, these findings show that workplace AI agent risks do not arise from agents alone; they also depend on how people work with agents and how agents are deployed.”

Classified as probably not a substantial claim.

AI augmentation is often treated as the more responsible deployment choice.

“AI augmentation, where the agent assists rather than replaces the human, is often treated as the more responsible deployment choice (Wang et al. 2024a;Shao et al. 2025b).”

• cites Wang et al. 2024aNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Shao et al. 2025bNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The risk scenarios were validated with 45 workers across 10 job roles and an independent LLM judge, confirming their high plausibility and alignment with the corresponding job tasks.

“We validated these scenarios with 45 workers across 10 job roles and an independent LLM judge, confirming their high plausibility and alignment with the corresponding job tasks.”

• AssumptionRests on an assumption: The 10 job roles used in validation are representative of the broader set of job roles.

May combine two claims.

Augmentation is not inherently safe because overreliance on agents can gradually erode workers' skills and oversight.

“First, augmentation is not inherently safe because overreliance on agents can gradually erode workers' skills and oversight.”

Classified as probably not a substantial claim.

The framework's decomposition of human interaction into five distinct relationship types enables more precise theorizing about how accountability drifts, how reliance develops, and how distributed agency makes it difficult for workers to contest outcomes that affect them.

“This enables more precise theorizing about how accountability drifts, how reliance develops, and how distributed agency makes it difficult for workers to contest outcomes that affect them.”

May combine two claims.

Organizational risks (Strategic Management Failures, Operational Failures) and agent-execution risks (Erroneous Agent Actions, Defective Agent Outputs) are consistently absent from or only partially covered by prior work.

“Organizational risks (Strategic Management Failures, Operational Failures) and agent-execution risks (Erroneous Agent Actions, Defective Agent Outputs) are consistently absent from or only partially covered by prior work.”

May combine two claims.

Mapping the taxonomy against ten established AI risk frameworks confirms that a workplace-specific lens is necessary: existing frameworks cover foundational harms such as bias and physical safety, but consistently overlook the operational, strategic, and agent-execution failures that only emerge when agents enter real organizational workflows.

“Mapping the taxonomy against ten established AI risk frameworks confirms that a workplace-specific lens is necessary: existing frameworks cover foundational harms such as bias and physical safety, but consistently overlook the operational, strategic, and agent-execution failures that only emerge when agents enter real organizational workflows.”

• AssumptionRests on an assumption: Many real deployments are hybrid and do not fit cleanly into automation or augmentation categories.
• AssumptionRests on an assumption: The automation vs. augmentation distinction simplifies a continuum.

Probably not a substantial claim: may not pass S3 (load-bearing).

Because the scenarios are LLM-generated, the category frequencies and distributional analyses describe only the composition of the risk corpus; they should not be interpreted as estimates of how often these risks occur in real workplaces.

“Because the scenarios are LLM-generated, the category frequencies and distributional analyses describe only the composition of our risk corpus; they should not be interpreted as estimates of how often these risks occur in real workplaces.”

• AssumptionRests on an assumption: These patterns may also reflect the selected job tasks, prompt design, and model used.

Classified as probably not a substantial claim.

Step 4 validates the scenarios with 45 workers from the selected roles and with an LLM-as-a-judge, on validity, utility, and discovery metrics.

“Step 4 validates the scenarios with 45 workers from the selected roles and with an LLM-as-a-judge, on validity, utility, and discovery metrics.”

Probably not a substantial claim: may not pass S2 (checkable). May combine two claims.

The central challenge is not only building more capable agents, but also designing safer ways for humans to work alongside them.

“These patterns point to the same conclusion: the central challenge is not only building more capable agents, but also designing safer ways for humans to work alongside them.”

• AssumptionRests on an assumption: Many real deployments are hybrid and do not fit cleanly into automation or augmentation categories.
• AssumptionRests on an assumption: The automation vs. augmentation distinction simplifies a continuum.

May combine two claims.

Interaction-driven risks can arise even when no single component is malfunctioning, a pattern the paper's empirical findings confirm.

“This distinction matters because interaction-driven risks can arise even when no single component is malfunctioning, a pattern our empirical findings confirm.”

May combine two claims.

Scenarios in both Erroneous Agent Actions and Human Capability Erosion were predominantly associated with augmentation, showing that keeping a worker in the loop does not eliminate risk.

“Scenarios in both categories were predominantly associated with augmentation, showing that keeping a worker in the loop does not eliminate risk.”

• AssumptionRests on an assumption: Many real deployments are hybrid and do not fit cleanly into automation or augmentation categories.
• AssumptionRests on an assumption: The automation vs. augmentation distinction simplifies a continuum.

Classified as probably not a substantial claim.

By grounding the framework in a 15-category taxonomy built from real job tasks, the paper provides a taxonomy that operates at the level of specific workflows rather than broad societal patterns, which prior work largely lacks.

“By grounding the framework in a 15-category taxonomy built from real job tasks, this paper provides something that prior work largely lacks: a taxonomy that operates at the level of specific workflows rather than broad societal patterns.”