Thursday’s cs.AI listing had 162 new submissions and cross-lists. This page keeps the 40 that are about agent systems: memory and context, harnesses and skills, tool use and computer-use, multi-agent coordination, persistent identity, and local open-weight models aimed at that stack. Telecom, medical, climate, quantum, generic eval, and vision-only papers are omitted.
Tool Primitives / HEART wrap tools as natural-language primitives and retrieve a subset from 25,519 functions (+10% vs SFT; 84% completion vs 22% frontier average on 50 real-world tasks). Agent rot measures geometric per-step reliability and finds near-perfect→near-zero within 16 steps (n=10,664), with context bounding steepening decay. The Memory Trust Gap shows stale memory overriding tools (0.92–1.00), and authorization laundering mints false authority for up to 50.2% of unauthorized requests (acted on 98.6%). SafeEvolve co-evolves harness and policy (AgentDojo ASR 3×↓; utility 59.79→61.86%). Repo-To-Skill distills 5,000+ skills from 1,000 repos (+134.3% MLE-bench). SkillGLoW consolidates procedural-family priors (+17.2 hard pts). CivBench stress-tests 76 MCP tools over 300+ turns (RAG@10 48.2–65.8%). Qwen3-4B ternarization reaches 1.641 effective bits/weight at 64.5→54.7% capability. Eight papers have a figure extracted from the PDF.
Research Papers
Discriminative World Models for Web Agents
Kelvin Li; Dhruv Pendharkar; Anish Pahilajani et al. arXiv: 2609.02885
Predicted-state matching trains web-agent world models so predicted states stay discriminative for the downstream ranker or process reward model, instead of supervised next-state snapshots (HTML or accessibility trees) that are misaligned with ranking. The method targets the mismatch between snapshot fidelity and action selection.
Key insight: Train world models for discrimination across candidate next states, not for snapshot reconstruction fidelity.
SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment
Qinghua Mao; Wanying Qu; Dadi Guo et al. arXiv: 2609.02786
SafeEvolve co-evolves the harness and the policy from on-policy safety experience rather than freezing one while tuning the other. On Qwen3.5-4B it reports a 3× attack-success reduction on AgentDojo while benign utility rises from 59.79% to 61.86%, placing harness↔policy co-evolution beside skill-level defense and harness self-evolution.
Key insight: Co-evolve harness and policy from safety experience so utility need not fall when attack success drops.
Measurement-Driven Sub-Network Selection for On-Premise Retrieval-Augmented Factory Agents
Vasileios Rizeakos; Georgios Paisios; Alexandros Machairas et al. arXiv: 2609.02760
After structural compression and retrieval-grounded adaptation, the method commits one sub-network per device by measuring judged answer quality and on-device throughput under a capability floor and memory budget. Extraction alone costs 13.7% of unpruned judged quality; distillation recovers to within 4.6%.
Key insight: Pick the on-device sub-network by adapted answer quality and throughput, not by parameter count.
Bilevel Coordinated Reflection: A Game-Theoretic Approach to Multi-Agent LLM Systems
Yihang Chen; Yuxiang Chen; Yuxuan Huang et al. arXiv: 2609.02750
Orchestrator and worker agents are cast as a bilevel coordination game with verification-gated reflection over semantic memory. On 500 SWE-bench instances a Kimi-based system reaches 72.2% versus 70.8% for a public mini-SWE-agent baseline. Code is released at github.com/YihangChen9/Bilevel-Coordinated-Reflection.
Key insight: Gate multi-agent reflection on verification rather than free-form critique loops.
Repo-To-Skill: Distilling GitHub Repositories Into AI4AI Skills
Jianlyu Chen; Yuyang Hu; Hongjin Qian et al. arXiv: 2609.02749
DisCo distills operational know-how from repositories into compact verified skills. The AREX-Skill Library holds 5,000+ skills from 1,000 ML repos across 20 areas and 178 families. With a fixed GPT-5.5 backbone, harness, and budget, skills lift MLE-bench by 134.3%, PaperBench by 34.4%, and FrontierCS by 9.2%.
Key insight: Distill repo operational know-how into verified skills instead of dumping whole repositories into context.
CivBench: A Long-Horizon Benchmark for Tool-Mediated Agents in Civilization VI
Austin Tudor David Andrews; Liam Wilkinson; Jamie Heagerty et al. arXiv: 2609.02459
CivBench is an open MCP benchmark with 300+ turns, thousands of tool calls, 76 MCP tools, and a narration layer. A pilot of 23 runs across four model families reports RAG@10 between 48.2% and 65.8% and shows agents under-query victory progress (every 30–75 turns versus a playbook cadence of every 20).
Key insight: Long-horizon MCP measurement needs proactive monitoring rates, not only final scores.
Diagnosing with Insights: Structured Analysis of Agent Failures via Behavioral Abstractions
Jiayi Bi; Yanjie Gao; Yuanmin Xie et al. arXiv: 2609.02371
AGENTSCOPE is a neuro-symbolic failure diagnosis method that abstracts trajectories into structured behavioral forms instead of asking an LLM judge to score raw long traces. The design complements live-trace and edge-diagnosis work by compressing what the judge sees.
Key insight: Abstract trajectories into behavioral forms before asking a judge to explain failures.
Improving Evaluation Realism with Inference-Time Compute and Deployment Scaffolds
Axel Ahlqvist; Richard Guan; Juan-Pablo Rivera et al. arXiv: 2609.02302
Two techniques push against evaluation awareness: critique refinement that spends inference-time compute on simulator actions, and DISH (Deployment-Imitating SWE-Agent Harness). The claim is methodological—make sealed harness evaluations harder for models to detect as tests.
Key insight: Spend inference compute and imitate deployment scaffolds so sealed evals are harder to detect.
Codebook Agent: Amortized Topology Design for LLM Multi-Agent Systems
Jinxi Yu; Yubei Li; Eric Hanchen Jiang et al. arXiv: 2609.02264
A VQ autoencoder yields a 16-entry query-independent topology codebook plus a score-weighted MLP. Surviving topologies collapse to about six graphs; edge count versus tokens shows Pearson r≈−0.4. Average score is 84.6 versus 83.0 for the strongest prior, with topology emit around 1.3 ms and about 0.2% of tokens.
Key insight: Amortize a small multi-agent routing codebook instead of searching adjacency per query.
APEx: Distillation of Agent Procedural Experience for Adaptive Deep Research Question Answering
Jie Ding; Rui Sun; Xinyuan Zhang et al. arXiv: 2609.02253
APEx builds instance trajectories and category-level procedural skills through Executor, Distiller, and Planner roles. Across seven benchmarks it reports +14.7 points versus GPT-5.4 and +3.0 versus the strongest memory-augmented baseline.
Key insight: Prefer category-level procedural skills over dumping verbose traces into the next prompt.
LLM-as-a-Judge Is Not an Oracle: Why Self-Improving Agents Need Deterministic Guardrails
Vansh Wahi arXiv: 2609.02246
This position paper treats the LLM judge as an advisor, not an oracle: every harness or prompt change must be gated by deterministic verification the judge cannot override. Production self-improve loops that read cached answer keys can report 100% pass while concealing 68% true capability.
Key insight: Never let an LLM judge override a deterministic gate on harness or prompt changes.
PGPO: Potential-Guided Policy Optimization for Multi-Turn Agentic Tasks
Yuyao Zheng; Haipeng Sun; Junwei Bao et al. arXiv: 2609.02236
PGPO adds potential-guided fine-grained credit for multi-turn agentic reinforcement learning so actions inside failed trajectories stay differentiated. It is a training recipe for long-horizon credit, not a drop-in runtime primitive.
Key insight: Differentiate credit inside failed trajectories with a potential-guided signal, not only terminal reward.
SkillGLoW: Procedural-Family Skill Consolidation for Self-Improving Agents on Long-Horizon Task Streams
Ao Yan; Xin Zhang; Jiawei Du et al. arXiv: 2609.02217
SkillGLoW aggregates local per-task skills into procedural-family priors. It gains +17.2 hard points on average over a no-skill baseline, leads a single-document optimizer on 15 of 21 cells, and lifts ALFWorld unseen success from 73.9% to 83.9%.
Key insight: Cluster skills by solving procedure rather than one mega-document or a flat per-task pool.
SCX Router: Streaming Zero-Shot Model Selection with a Decoder-KV Classifier and a Real-World Task Ontology
Ihor Stepanov; Aleksandr Smechov; Mykhailo Shtopko et al. arXiv: 2609.02292
A 0.6B Qwen3 decoder plus a shallow bidirectional scorer routes over an ontology of 23 families, 115 types, and 345 subtypes. On a LiveBench 1,000-task subset, top-1 accuracy is 0.707 versus 0.696 for the strongest fixed model.
Key insight: A small decoder-KV router can beat a fixed strong model when the task ontology is fine-grained.
Beyond Context Windows: Persistent Discovery Context for Data-Centric Agents
Jalal Mahmud arXiv: 2609.02129
A lightweight memory of prior intent→object mappings is reused to augment future retrieval. It beats metadata-only baselines and also exposes a reproducible interference failure mode when mappings collide.
Key insight: Persist discovery mappings across sessions, and watch for interference when memories collide.
READY or Not: Reliable Enterprise Agent Deployment
Veronica Chatrath; Bryan Zhu; Jingxuan Fan et al. arXiv: 2609.02095
READY qualifies agents on reliability under human oversight and cost, not autonomous bench accuracy alone. Across 16 systems and 750 cases, two systems at 72.8% and 72.5% autonomous accuracy need 39.2% versus 29.6% human review to hit the same 76% reliability target.
Key insight: Ship on review burden to a reliability target, not on autonomous pass rate alone.
MASkills: Continual Skills Optimization for Multi-Agent LLM Systems
Huaiyuan Yao; Xiaoou Liu; Charles Fleming et al. arXiv: 2609.02094
MASkills optimizes multi-agent systems via skills with skill-conditioned credit assignment, hierarchical aggregation, and momentum-smoothed updates. Skills are treated as when/how/which-tools units rather than opaque experience memories.
Key insight: Optimize multi-agent systems through skills with credit assignment, not only shared traces.
CHIME: Credit-Aware Hierarchical Memory Evolution for Long-Horizon Agentic Planning
Yongshi Ye; Tian Lan; Feihu Jiang et al. arXiv: 2609.02074
CHIME evolves hierarchical planning memory with credit that separates plan quality from execution and environment errors, fighting outcome-only memory poisoning. Plan memories should not be written from terminal success alone.
Key insight: Separate plan-quality credit from execution and environment errors before writing hierarchical memory.
Monitoring Web Agents Without Internal Signals: Observable Trajectories and Key-Step Supervision
Sitong Pan; Yipeng Shen; Yilin Lu et al. arXiv: 2609.02057
Prefix-level risk prediction uses observable Macro/Micro trajectory features without logits, labeling the first uncorrected critical error. Results are competitive with internal-signal baselines on WebArena-Lite and Online Mind2Web across five backbones.
Key insight: Monitor computer-use agents from observable traces when logits are unavailable.
HeadWiseKV: Budgeted Per-Head Cache Residency for Hybrid Long-Context Language Models
Renjie Xie; Juncheng Yang; Aoting Hu et al. arXiv: 2609.02029
HeadWiseKV is a training-free budgeted per-head history window for residual global KV in hybrid long-context models. On Qwen3.6-27B it cuts sampled peak device memory 8.59% at 112K and extends the largest verified context from 114K to 161K.
Key insight: Budget per-head KV residency to stretch hybrid long-context serving without retraining.
ClaimReceipt: Verifying Evidence Sufficiency and Coverage in Agent Evaluations
Peiying Zhu; Sidi Chang arXiv: 2609.01992
ClaimReceipt issues claim-relative receipts for sufficiency and coverage over signed manifests (PASS / INVALID / INCONCLUSIVE). Across 1,392 records, CR-2 reproduces five manual audit verdicts at +0.021% inference time and 9.9 KB per transaction.
Key insight: Every evolve or eval claim needs a recomputable receipt over a signed evidence manifest.
When Agents Implement Systems: A Case Study in Defects, Detection, and Evaluation Rigor
Phanindra Reddy Madduru arXiv: 2609.01985
A single-session case study catalogs five defects an LLM coding agent introduced on a fixed multi-component data system spanning schema, async, config, and retrieval-filter mistakes. Filtered recall ceilings by budget three on 100 questions over 2,994 paragraphs.
Key insight: Systems-level coding agents need defect catalogs beyond unit-test green; n=1 but the failure modes are concrete.
Post-Training Ternarization of Qwen3-4B Capability, Effective Bit Budget, Storage Compression, and Deployment
Anirudh Malik; M Sparsh Mehra; Poojith Devan arXiv: 2609.01962
Weight-only ternarization of instruct Qwen3-4B (KOTMS + E2M-ATQ + GPTQ-style compensation) keeps activations at 16-bit. Effective bits per weight are 1.641 on 81.62% of parameters; capability falls from 64.5% to 54.7% across ten scored comparisons, with BoolQ retaining 84.6% chance-corrected performance and ARC-Challenge at 43.8%.
Key insight: Post-training ternarization compresses a 4B hard, but capability loss is uneven and not free.
Epistemic Sybil Resistance: Multiplying AI Agents Without Multiplying Evidence
Marc Bara arXiv: 2609.01873
More agent reports are not more evidence under shared ancestry. In more than 20k controlled calls, report multiplicity from 1 to 32 collapses naive posterior coverage from 0.940 to 0.263; evidence-root multiplicity restores coverage. Correlated extraction yields γ_cal=0.719.
Key insight: Demand evidence-root diversity; agent count is not evidence multiplicity.
Belief-Calibrated Optimization: An Explicit World Model for Agentic Optimization
Yuhan Chen; Zhihua Tian; Mahavir Dabas et al. arXiv: 2609.01861
Belief-Calibrated Optimization writes an explicit belief or world-model of how scaffold edits should help, so later optimizer calls reuse the hypothesized mechanism instead of only scores and traces.
Key insight: Persist the hypothesized mechanism of each harness edit, not only the score delta.
The Memory Trust Gap: Capability-Dependent Failures in Persistent-Memory Agents
Jundong Hu; Shekar Ramachandran arXiv: 2609.01852
Stale stored facts override authoritative tools as capability rises. On the Benefit suite, stale-answer rates sit between 0.92 and 1.00 at every Qwen3 scale. Safety-suite harm rises with scale; mitigations are capability-dependent (metadata helps large models; pre-resolve helps small ones).
Key insight: Never let memory outrank a fresh tool read without an explicit conflict resolver.
SSAKG 2.0: An Open-Source Package for Structural Associative Sequence Memory and Context-Based Retrieval
Przemysław Stokłosa; Janusz A. Starzyk; Paweł Raif arXiv: 2609.01849
SSAKG 2.0 is an Apache-2.0 package for structural sequential associative knowledge graphs that reconstruct full sequences from partial unordered context, with bit-level search in Python and C. It is a niche associative substrate rather than a drop-in vector-database replacement.
Key insight: Associative sequence graphs can reconstruct ordered memory from partial unordered cues.
Architecting Conversational Data Systems for Stateless LLM APIs: The Hydration Proxy Pattern
Joseph Axisa arXiv: 2609.01834
The Hydration Proxy decouples session persistence and semantic memory from the stateless LLM API. A Context Stabilization Mandate keeps prefixes KV-cache friendly under sovereign state management outside the provider.
Key insight: Own transcript and memory outside the API; hydrate a stable prefix for cache hits.
Language Models Can Control Their Own Attention
Namgyu Ho; Huzama Ahmad; Woosung Koh et al. arXiv: 2609.02737
Declarative Attention lets the model declare which context spans to attend instead of O(N) proxy scoring. Zero-shot on Gemma-4-31B and Qwen-3.6-27B, attended tokens fall 52.0% and 31.1% with modest accuracy drops (1.27 pp on the first).
Key insight: Let the model declare attention spans instead of scoring every token with an extrinsic proxy.
Coverage, Not Targeting: A Structural Regime in Multi-Turn Agent Credit Assignment
Chenyu Zhou; Qiliang Jiang; Shuning Wu et al. arXiv: 2609.02417
Terminal verifiers sit in low verifier-information-density: k=1 final-write in 98% of τ²-bench rollouts while success needs 5–8 prerequisite tool calls. Uniform dense reward beats sparse; measured V_d is about 0.15 versus a crossover near 0.8. ToolACE-2-8B shows Δ=−0.048 over 32 seeds under the sparse regime.
Key insight: Buy denser process coverage before fancy per-turn credit when the verifier only sees the last write.
PaperCompiler: Faithful Paper-to-Code Generation via Repository-Level Specification Compilation
Yunhao Liu; Hong Phuc Pham; Jaehong Yoon arXiv: 2609.02272
PaperCompiler compiles paper-grounded repository-level specs so coding agents cannot ignore or compress intermediate plans. On Paper2CodeBench, fidelity rises from 3.64 to 4.15 (+13.8% relative) and high-severity critiques fall from 13.2% to 6.1%.
Key insight: Treat intermediate paper→code artifacts as enforceable repository-level specs.
SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
Qingyu Meng; Yiwei Zha; Jiahuan Pei et al. arXiv: 2609.02293
SEAL reinforces global MoE safety via shared-expert alignment. Attack success falls by up to 60% at a capability cost of at most 1.4% on a five-benchmark average, framing local MoE safety as a routing and shared-expert problem rather than only dense refusal.
Key insight: Align shared experts to cut MoE attack success without a large capability tax.
OmegaUse-SOP: SOP Engineering for Professional Computer Use from Human Demonstrations
Yixiong Xiao; Lang An; Hucheng Yang et al. arXiv: 2609.02149
Human-in-the-loop SOP Engineering turns professional GUI demonstrations into standard operating procedures for computer-use agents, demonstrated on PVsyst 7.2 photovoltaic workflows. The domain is specialized; the SOP-from-demo pattern is the transferable piece.
Key insight: Turn professional GUI demonstrations into SOPs before handing them to computer-use agents.
Git4Data: Database-Native Version Control for AI Agents
Hongshen Gou; Zuyu Zhang; Yuze Sun et al. arXiv: 2609.02106
Git4Data brings snapshot, branch, diff, and merge over tables via SQL for parallel agent exploration. On BranchBench it reports up to an order-of-magnitude improvement versus DoltDB, with cost proportional to change size using MatrixOne MVCC and object storage.
Key insight: Give agents table branches, not shared-writer mutable tables.
Agent Memory Is a Surface for Endogenous Authorization Laundering
Tommaso Cerruti; Mika Okamoto; Ansel Kaplan Erol arXiv: 2609.01836
EAL-Bench shows persistent memory can grant authority history never permitted. With incremental updates, writers create false authority for up to 50.2% of unauthorized requests, and executors act on that authority in 98.6% of those trials.
Key insight: Treat memory as an authorization surface; refuse permissions that exist only in memory without re-checking a signed source.
Zeta-Lite: A Concurrent, Branchable In-Browser SQL Database for Agentic Memory
Gene Zhang arXiv: 2609.01818
Zeta-Lite is a concurrent, branchable in-browser SQL database compiled from Zeta to WASM. The gzipped build is 2.87 MB; point reads land between 268k and 315k per second, with flat mixed read/write behavior over millions of operations in Chrome, Firefox, and native builds.
Key insight: A branchable in-browser SQL store can back agentic memory without a server database.
Harness Engineering in LLM Tool Use via Agent-Native Reusable Tool Primitives
Haibo Jin; Suijin Wang; Xucheng Yu et al. arXiv: 2609.01736
Tool Primitives wrap schema resolution in a natural-language interface so tools compose without brittle API schemas; ToolFace hosts 25,519 functions with dynamic retrieval. HEART averages +10% versus SFT and +6% versus GPT-5.4, Claude-4.6-Sonnet, and Gemini-3.1-Pro while cutting API cost up to 85%. On 50 real-world tasks, completion is 84% versus a 22% average for three frontier commercial models (3.8×).
Key insight: Wrap tools as agent-native NL primitives and retrieve a subset; stop dumping raw JSON schemas.
Public-Sharing Labels and Verbatim Field Egress in an MCP-to-A2A Agent Configuration: A Controlled Multi-Model Study
Arpan Kumar Mahapatra arXiv: 2609.01693
A controlled MCP→A2A study compares CONFIDENTIAL, unlabeled, and PUBLIC-OK-TO-SHARE labels across four models, three arms, and four repeats (480 trials). The PUBLIC label descriptively raises verbatim field egress versus unlabeled, with strong model dependence.
Key insight: Sharing labels are not free metadata; PUBLIC can increase verbatim egress across MCP→A2A hops.
How Fast Do Agents Rot? An Empirical Study of Long-Horizon Degradation in LLM Agents for Production Decision-Making
Shubhra Mittal arXiv: 2609.01660
Geometric per-step reliability is measured across nine models (open 1.2B–671B plus three proprietary). On an agentic task, success goes from near-perfect to near-zero within 16 steps (n=10,664). Bounding context steepens decay (logit slope −0.69 versus −0.44, p=3×10⁻⁶). Bench-to-production projection falls from 0.42 at GAIA-length horizons to 0.24 at 100 steps.
Key insight: Long-horizon production needs per-step survival engineering; truncating context can make decay worse.
WMLLM: Self-Evolving Optimization Agents via Predict-Then-Act World Modeling
Zhongzheng Li; Qingsong Ran; Shikun Feng et al. arXiv: 2609.01608
WMLLM builds self-evolving optimization agents that predict candidate outcomes before acting, using LLM world-modeling to improve black-box search sample efficiency. It is a training and optimization recipe adjacent to belief-calibrated and safety co-evolution work.
Key insight: Predict candidate outcomes before acting when using LLM world models for black-box optimization.