Monday's window is about how agent surfaces are built, isolated, disclosed, folded, evolved, edited, and attacked at document length. A first large-scale study of Claude Code plugin marketplaces measures 8,351 plugins and finds SKILL.md–script coupling as a maintenance class. Logos moves composition onto a ROS-like bus whose only shared state is an append-only transcript. String treats every app as a Markdown file behind two verbs and cuts resident tool context from tens of thousands of tokens to 53. ContextPilot teaches agents to plan, memorize, and fold their working context under fine-grained RL. EvoUndo rejects capability-positive harness mutations that cannot restore prior state. SEPO replaces whole-prompt rewrites with typed local edits that carry newly-fixed and newly-broken lineage. LongPIBench shows short-context prompt-injection defenses collapse on long email, paper, resume, and code-review documents.
Plugin-touching commits grow 8.8× from October 2025 to March 2026 across 77,773 commits; 78% of sampled script–Markdown co-change PRs are functionally coupled. Logos resumes 80/80 sessions with no repeated effect after kills at four tool-call-cycle boundaries; bus hop median 0.215 ms versus first-token 177 ms. String reaches 51.8% versus 50.5% skills on SkillsBench with 33.5% fewer tokens among completed episodes; wrong-action selection falls from 28% to 2% under staging. ContextPilot-8B-RL averages 69.40 versus StateLM-8B-RL 65.85 on long-context QA in a 32K window, with working context stabilizing near 8–10K versus ~30K linear growth. Of 197 capability-positive but unrecovered harness mutations, conventional repair recovers 0/197 under L0; D0L1 rescues 180/197. SEPO reaches 61.9% / 73.3% macro on Llama-3.1-8B / Qwen3-8B (+3.1 / +2.2 pp versus GEPA) with prompts more than 5× shorter. On LongPIBench Combined, undefended ASR is 0.98; MetaSecAlign 8B is 0.78 and PromptLocate 0.45, while Authority spoof hits Llama email at 0.70 and GPT-4o email at 0.69.
Hereiz, Ahmed; Lyu, Yingzhe; Li, Hao; Adams, Bram; Hassan, Ahmed E. arXiv: 2608.28497
AI coding agents increasingly ship behavior through plugin marketplaces, but whether those plugins are maintained software or one-off Markdown dumps was empirically open. From Queen's University SAIL, this study is the first large-scale look at Claude Code plugin marketplaces: discovery via GitHub Code Search for .claude-plugin/marketplace.json on 2 April 2026, a 10-star filter, then analysis of 1,926 repositories, 2,018 marketplaces, 8,351 locally resolvable plugins, and 77,773 plugin-touching commits by 3,948 authors.
The marketplace is still accelerating. Plugin-touching commit activity grows 8.8× from the October 2025 launch (2,923) to March 2026 (25,618), with a Mann–Kendall p-value of 0.003 and Sen's slope of roughly 4,550 extra commits per month and no plateau at cutoff. Software-engineering plugins account for 61.3% of the catalog; 34.4% of plugins combine two or more component types; skills grow 22× (1,776 → 39,287) and by March outnumber all other component types combined. Feature commits are 39.6% versus 17.2% in conventional OSS CCS baselines; Claude co-authors 34.9% of commits. Manual study of 700 commits finds that 74% of sampled docs commits update runtime SKILL.md or agents/*.md rather than human documentation, and reclassifying by diff function collapses the docs share from 10.3% to 1.7%. Inside skills directories, script–Markdown Lift is 1.37–1.58, and 78% of 64 sampled co-change pull requests are functionally coupled (interface change, internal logic, variable/version sync, or repo restructuring). Dataset: github.com/SAILResearch/agentic_plugin_marketplace.
The operational read is that SKILL.md and its scripts are one artifact: a script flag, path, or version change without a matching instruction update is a correctness defect, not documentation drift. Commit classifiers and “docs:” heuristics trained on conventional OSS do not transfer cleanly to this ecosystem.
Key insight: Agent plugins are a distinct maintenance class where natural-language instruction files and scripts co-evolve, and 78% of sampled skill script–Markdown co-changes are functionally necessary.
Jia, Hanzhang; Zeng, Liheng; Cheng, Hao; Gao, Yi; Ma, Bo arXiv: 2608.28553
The spatiotemporal-composability calculus proves reversibility for plugin assembly inside one process, but that process is then a single failure domain for every co-resident session. Logos, from the University of Sussex with Zhejiang Gongshang University and Shanghai Shuyuan Information Technology, argues that neither the modeling nor the calculus binds an agent to one process. Four lemmas — orchestration externality, carrier substitution, recovery localization, and external resolution — rest on the calculus hypotheses plus the statelessness of language-model inference.
The construction is ROS-like: a plugin is an OS process; the router holds only a routing table; the only shared state is an append-only transcript owned by no process. After process death, a new process of the same id imports the transcript and continues (“cold switching”) without repeating recorded steps. Eighty sessions resume with no repeated effect after kills at the four boundaries of the tool-call cycle (during execution, after return before persistence, after persistence before announcement, after announcement). Twelve sessions under six process kills all resume. Same-fault comparison against a single-process DeepSeek harness reference (v0.1.0-rc.5): one host kill interrupts every co-resident session (5-session composition, 10/10), while peer processes interrupt only the faulty node (0/4 innocent sessions). Bus hop median is 0.215 ms over 10,000 calls versus model first-token latency of 177 ms (about 1/823). Relative to MCP and Temporal, Logos moves composition and assembly themselves out of the host; outward effects such as payments stay outside the boundary with withholding and compensation only.
The portable cut is to persist an append-only session transcript outside the live agent process and refuse to re-execute settled tool calls on resume, keeping irreversible tools out of the chat process.
Key insight: Spatiotemporal composability does not require co-residence: make each plugin a process and keep the only shared state in an append-only transcript so cold switching resumes without repeating effects.
Song, Jookyung; Kwak, Nojun; Chang, Simyung arXiv: 2608.28027
Every tool schema dumped into context charges rent on every turn. String, from Seoul National University and H1R.AI, treats the agent–computer interface as an OS problem: SFMD (String-Flavored Markdown) declares views, typed actions, navigation, and credentials, and the runtime handles discovery, validation, execution, and secrets behind two verbs — /open to see and /act to do.
Measured residency for 100 public OpenAPI services packaged as String apps is 53 tokens for the fixed single-tool interface, versus 103,518 tokens for full JSON schemas and 3,291 for a one-line-per-tool index. On SkillsBench v1.1 (87 tasks × 6 models × 3 runs on OpenHands), String averages 51.8% versus 50.5% for curated skills (+1.3 pp) while using 33.5% fewer tokens among completed episodes (range 21.7–44.3%). Staging is causal: showing every action at once pushed wrong-action selection from 2% to 28%, and injecting one tier of detail one turn early cost 11.6 pp on Sonnet 4.6 and 23.3 pp on Haiku 4.5 with information held fixed. Privilege follows provenance — local files may shell and HTTP; remote SFMD may HTTP only — and $VAR expands only in author-written template positions. Over MCP the whole runtime is one tool {topic, cmd}. Code: github.com/string-os.
The steal is progressive disclosure of tool and skill schemas: keep a tiny resident stub, stage confusable actions, and do not inject the full catalog every turn. v0.1 is single-user, loopback-only, and unauthenticated.
Key insight: Conserving agent context is the runtime's job — progressive disclosure of Markdown apps matches skill success while cutting tokens by a third and collapsing always-resident schemas from ~100K tokens to 53.
Pan, Zhuoshi; Pei, Qizhi; Lu, Junru; Lin, Honglin; Zhao, H. Vicky; Yin, Di; Sun, Xing arXiv: 2608.28476
Long-horizon agents that keep every turn in the working context grow without bound. ContextPilot, from Tsinghua and Tencent Youtu Lab with Shanghai AI Lab, lets the model edit that working context with an expanded toolset — plan, memorize/readMemory, and soft offloading via foldHistory / summarizeContext / compressContext — on top of StateLM-style search, delete, and summarize. An RL recipe branches at high-sensitivity context edits and assigns snapshot-level credit instead of a single trajectory reward.
On long-context QA with a 32K window, ContextPilot-8B-RL averages 69.40 versus StateLM-8B-RL at 65.85; Qwen3-8B without tools at 128K averages 45.93. BrowseComp+ rises from 48.84 (SFT) to 54.18. A Qwen3.5-397B-A17B tool ablation moves from 77.89 with original tools to 87.16 with the full set, and BrowseComp+ from 63.49 to 80.96. On deep search with WebExplorer-8B, ContextPilot averages 50.10 versus SUPO at 49.09, while working context stabilizes near 8–10K tokens versus ~30K linear growth for the baseline. Code: github.com/Tencent/ContextPilot.
The portable layer is the toolset itself — plan, long-term memory notes that survive folds, and foldHistory that collapses history to keywords plus a summary — complementary to KV-cache eviction methods that decide what to drop in cache rather than what to fold in the transcript.
Key insight: Agents should edit their own working context with plan, memory, and fold tools; fine-grained credit on context edits yields stronger long-horizon scores at a compact 8–10K working window.
Sah, Tanmay; Sah, Dolly; Jain, Harshul; Sah, Tanya arXiv: 2608.28363
Self-evolving agents that mutate prompts, tools, middleware, or harness config can improve capability while leaving effects that cannot be safely reversed in other states. EvoUndo, from independent researchers, admits a harness mutation only when a witness and recovery program restore typed observational equivalence across counterfactual states.
Across 600 one-shot self-evolution tasks, 197 capability-positive mutations fail recoverability. Under the original recovery language L0, conventional verifier-guided repair recovers 0/197. A deterministic oracle recovers 48/197 under L0 and 191/197 under extended language L1. A protocol-locked 2×2 factorial on gpt-oss-120b separates bottlenecks: exact-address grounding lifts recovery from 0/48 to 38/48 (79.2%) when L0 is sufficient; extending the recovery language recovers 142/143 (99.3%) on the S1 stratum. D0L1 rescues 180/197 (91.37%). Adding exact-address diagnostics on top of L1 hurts on gpt-oss-120b (133/143, 93.0%) and does not replicate as a drop on Qwen3.8-27B. Effect-scoped snapshots can beat EvoUndo when the affected pre-state is known; EvoUndo targets cases where inverse semantics must be synthesized. Code is stated to be released openly; no URL appears on the abstract page.
The operational gate is simple: do not merge a skill, config, or middleware patch unless the prior harness state is restorable — git revert for file snapshots, richer recovery language when the mutation is stateful.
Key insight: Capability-positive harness mutations are not enough; admit self-evolution only when recoverability of the prior state can be independently verified across counterfactual states.
Ma, Xiaoyu; Liu, Haoyue; Li, Yiwen; Zhu, Jionghao; Wang, Zhichao; Chen, Ye; Tang, Xiaoying arXiv: 2608.28067
API-only prompt optimizers often claim interpretability while still rewriting the prompt as one opaque string each iteration. SEPO (Structural, Evidence-grounded Prompt Optimization), from CUHK Shenzhen, Xi'an Jiaotong, and FNiI-Shenzhen, locally edits typed units in a two-layer schema (outline plus step-local rules) and carries an edit-effect lineage — which examples the last patch newly fixed or broke — into the next architect call on the same branch.
On a 14-task held-out suite with a 2000 metric-call budget and architect Qwen3.5-397B-A17B, SEPO reaches 61.9% macro on Llama-3.1-8B-Instruct (+3.1 pp versus GEPA at 58.8) and 73.3% on Qwen3-8B (+2.2 pp versus GEPA at 71.1), winning at least 11 of 14 tasks against every baseline. Optimisation tokens are 2.9M versus GEPA's 4.1M; deployment tokens 203k versus 424k; prompts are more than 5× shorter (236 versus 1,324 tokens). Ablations: dropping lineage costs 2.9 pp, dropping the multi-trajectory archive 4.7 pp, and dropping typed attribution inflates length from 228 to 450 tokens.
Complementary to whole-prompt single-lineage rewrites: start with a naive full rewrite when traces are cheap; graduate to addressable local edits with a newly-fixed / newly-broken log when prompts bloat or validation regressions appear. Evaluation is single-turn text tasks, not agentic tool loops.
Key insight: Prompt search becomes attributable when edits are typed, local, and paired with lineage of newly fixed and newly broken examples — beating GEPA with shorter prompts and fewer optimisation tokens.
Liu, Yupei; Jia, Yuqi; Gong, Neil Zhenqiang; Jia, Jinyuan arXiv: 2608.28411
Existing prompt-injection benchmarks concentrate on short contexts, which overstates defense strength. LongPIBench, from Penn State and Duke, covers four long-document workflows — paper peer review, resume screening, code review, and email summary — each with a synthetic set (100 instances) and a real-world set, at thousands to tens of thousands of tokens.
Heuristic attacks remain effective without defenses. Authority spoof (impersonating chairs, hiring managers, or IT admins) is the strongest heuristic: Llama-3.1-8B-Instruct email ASR 0.70 versus Combined 0.25; GPT-4o email 0.69 versus Combined 0.03. On Combined attack aggregated scores, undefended ASR is 0.98, MetaSecAlign 8B is 0.78, and PromptLocate is 0.45, against near-zero ASR for those same defenses on OPI / InjecAgent / AgentDojo. Paper-review Combined drives MetaSecAlign 8B to ASR 1.00 despite ~0 on short benches. Email-summary Authority spoof: no defense 0.97, MetaSecAlign 8B 0.40, PromptLocate 0.45. Detectors show extreme FPR/FNR trade-offs on long documents. Code: github.com/liu00222/LongPIBench.
Short-context PI numbers are not a long-email or long-document guarantee. Authority-spoof probes on multi-thousand-token threads are the missing evaluation cell.
Key insight: Prompt-injection defenses that look strong on short benches fail on long documents — Authority spoof on email summary remains highly effective even against MetaSecAlign and PromptLocate.