You gave your AI agent a 50-page contract to review. It did great — flagged three risks, suggested two clauses. Then you asked it to update the document. And again. And again. After 20 interactions, the contract is missing entire sections. Not highlighted. Not commented. Gone.
Microsoft Research just published DELEGATE-52, the most comprehensive study yet on what happens when AI agents work on long-horizon document tasks. The finding: frontier models lose 25-50% of document content over 20 interactions. And the tools that make agents more powerful? They make the corruption worse.
The Problem: Your Agent Is Slowly Deleting Your Work
DELEGATE-52 tested frontier AI models across 52 different delegation domains — legal documents, technical specifications, financial reports, codebases, and more. The methodology was straightforward: give an AI agent a document, let it work through multiple rounds of edits, and measure what's left.
The results were alarming:
- 25% average document degradation over 20 interactions across all domains
- 50% content loss in the worst-performing domains
- Only Python programming passed as "ready" for agentic delegation
- 51 out of 52 domains showed measurable content corruption
- Tool use made it worse — agents with access to editing tools corrupted documents faster than text-only agents
Let me be precise about what "corruption" means here. It's not just deletion. The research documented:
- Content deletion — Entire sections silently removed
- Information drift — Numbers and facts gradually changed from their original values
- Structural collapse — Document formatting and organization degraded
- Hallucinated additions — New, fabricated content inserted as if it were original
And here's the kicker: the corruption is silent. There's no error message. No warning flag. The agent confidently presents the modified document as if nothing is wrong.
The Solution: Why Agents Destroy Documents (And How to Slow the Bleeding)
The core issue is what researchers call context degradation under iteration. Each time the agent processes the document, it creates an imperfect internal representation. When it writes back, that imperfection compounds. After 20 rounds, the compounding errors are devastating.
Why tools make it worse: When an agent has direct document-editing tools (search-and-replace, file writing, code execution), each action is a potential corruption point. The agent reads imperfectly, acts on that imperfect reading, and writes back something slightly wrong. Multiply by 20 interactions.
Why only Python passed: Programming has built-in verification — the code either runs or it doesn't. Tests pass or fail. Most other domains lack this automatic feedback loop.
Practical Mitigations
You can't fully prevent this yet, but you can dramatically reduce the damage:
Version control everything. Before any agent touches a document, snapshot it. Not just git commits for code — full version history for documents, spreadsheets, and configs.
Diff-based verification. After each agent interaction, require a diff review. Not at the end — after every single edit. This catches corruption when it's small and reversible.
Turn limits. Cap agent interactions on a single document. Microsoft's data shows corruption accelerates after 10-15 interactions. Stop before that threshold.
Checksum critical data. For structured documents, extract key numbers, dates, and terms before delegation. Verify them after. Automate this if possible.
Domain-specific guardrails. Legal contracts need clause-presence checks. Financial models need balance verification. Build domain-aware validation, not generic monitoring.
The Benchmarks: DELEGATE-52 Results
- 25% average content loss across 52 domains over 20 interactions
- 50% content loss in worst-performing domains
- 1 out of 52 domains rated "ready" for agentic delegation (Python programming)
- Tool-using agents corrupt faster than text-only agents
- Gemini 3.1 Pro led the field with 11/52 domains rated "ready" — still a failing grade
- No frontier model exceeded 21% readiness across all domains
- The degradation is monotonic — it gets worse with every interaction, no recovery
Caveat: DELEGATE-52 tests worst-case extended workflows. Short, bounded agent tasks (2-5 interactions) show much less corruption. The 25-50% numbers apply to the long-horizon workflows that enterprises are increasingly deploying.
The Impact: What Document Corruption Costs You
This isn't a hypothetical risk. If your organization is using AI agents for document-heavy workflows, you're already losing data.
Legal teams: An AI-drafted contract that silently drops an indemnification clause after 15 revisions isn't just wrong — it's a liability. The opposing counsel won't notice what's missing. Neither will you.
Financial analysts: A model that drifts key assumptions by 2-3% per iteration accumulates 30-40% error by round 15. Your projections aren't just wrong — they're confidently wrong.
Engineering teams: Documentation that loses steps in deployment procedures. Runbooks with missing failure modes. Configuration guides with wrong parameter values. Each corruption is a potential incident.
Compliance: If an AI agent modifies your compliance documentation and silently removes required controls, you're not just non-compliant — you're non-compliant and you don't know it.
The operational cost: Microsoft's research suggests you need to verify every agent-modified document. If verification takes even 10 minutes per document and your agents process 100 documents a day, that's 16+ hours of daily verification labor. The agent was supposed to save time, not create a new QA bottleneck.
The Bottom Line
DELEGATE-52 is a wake-up call. The AI industry is racing to build agents that can handle complex, long-running workflows, but the fundamental reliability isn't there yet. 51 out of 52 domains aren't ready. The best model on the market only passes 11 out of 52 tests.
If you're deploying AI agents on document-heavy workflows today, treat them like a brilliant but unreliable intern: let them do the first draft, verify every change, and never — ever — let them work unsupervised on critical documents for more than 10 interactions.
The technology will get better. Architectural changes to long-horizon evaluation and document preservation are coming. But right now, silent corruption is the tax you pay for agentic convenience. Know the cost before you write the check.