Wednesday's cs.AI announcement day (2026-10-14) lists 360 new and 492 cross-lists (replacements skipped; listing total 852). A filter for agent systems, memory/context, computer-use / GUI / tools / MCP / skills / harnesses, multi-agent, persistence/identity, and local/open models keeps 54 papers. Skills and harnesses lead: implicit skill routing collapses once libraries reach a thousand entries, Cortex gates every rule or skill edit on repeated with/without replays, and a cluster of harness-evolution papers (HarnessNet, Harmony Harness, Harness^2, Trace-to-Architecture) make harness edits measurable. Memory gets a hard look at consent and deletion: grounding awareness shows a remembered proposal is not an agreement, Bemula finds no mainstream memory system honors forget requests, and Memory Echo and PolyGraph receipts tie memories to provenance. On the tool and authorization side, MCP schema shape steers tool selection, replayed tool results misbind to the wrong task, approval gates over-block authorized actions, and a residual-stream probe stops unauthorized actions before they happen; local and on-device work rounds it out with SchemaWeaver, cloud-written programs with local SLM interpreters, and Davinci-Tool.
Research Papers
Lost in Implicit Routing: How LLM Agents Fail to Load Relevant Skills at Scale
Jinlin Liu; Wei Chen; Xiaojin Zhang arXiv: 2610.18522
Holds SkillsBench tasks and golden skills fixed while adding irrelevant skills. With 1,000 distractors, loaded-skill recall falls 73.6% → 27.4% and zero-load rate rises 9.3% → 51.6%; explicit selection from the same library keeps 73.9%. Masking distractor descriptions largely restores loading; asking agents to plan skill use still underperforms preselection.
Key insight: Implicit metadata routing collapses as skill libraries grow: 1,000 distractor skills drop loaded-skill recall from 73.6% to 27.4%, while explicit preselection from the same library keeps 73.9%.
Cortex: Measurement-Gated Evolution and Pruning of Coding-Agent Skills and Rules
Samuele Giampieri arXiv: 2610.14216
Cortex saves developer corrections as replayable tasks, writes one skill or rule at a time, and keeps it only if repeated with/without runs show net gain and no task made noticeably worse; existing text is tested the same way before deletion. With Claude Haiku 4.5, auto-loading rules did most of the work; skills helped only when offered with the files a task touches. Under Claude Sonnet 5 a single run added little, and on a real OSS project it found nothing to learn. Tool, lab and data released.
Key insight: Gate every rule or skill edit on repeated with/without replays; path-scoped rules beat always-offered skills, and the measurable gains shrink on stronger models.
Knowing the User Is Not Knowing What We Established: Grounding Awareness in Personal Agents
Jiajun Chen; Xinyue Chen; Yicheng Jiang et al. arXiv: 2610.18684
Distinguishes accepted, unacknowledged, revised and scoped arrangements between user and agent. Across agents and memory systems, strong memory scores do not ensure it; more complete user info can increase execution of unacknowledged proposals, and persistent memory makes agents treat their own proposals as instructions. A training-free Grounding Layer tracks grounding status and checks consequential actions.
Key insight: A remembered proposal is not consent: persistent memory makes personal agents execute unacknowledged proposals, so grounding status should be tracked and checked before consequential actions.
Can Agents Forget When Asked? A Benchmark for Memory Unlearning in LLM Agents
Bofan Xie; Chaokun Wang; Guanchen Ge et al. arXiv: 2610.18052
First benchmark for "forget this" requests: 50 multi-session dialogues, 135 forget requests of six types, 1,742 questions, with control versions. Six mainstream memory systems × three backbones: none passes more than 1.5% of forget requests end-to-end; they leave info extractable or over-delete. Data/code released.
Key insight: No mainstream agent memory system passes more than 1.5% of user forget requests end-to-end, so deletion has to be designed in as a first-class memory operation.
Memory Echo in Single-Agent Long-Term Memory: Lifecycle Evaluation and Provenance-Guided Mitigation
Yufeng Li; Sheng Yao; Peng Zeng et al. arXiv: 2610.17763
Defines Memory Echo — one historical source occupying multiple retrieval slots via repeated retrieval/write-back without new evidence — and MEchoBench. The Family–Provenance–Authority (FPA) fix keeps one representative per source family, gates old records on verified corrections, and constrains answers with authoritative evidence: accuracy 0.825 → 0.920 (DeepSeek V4 Flash), 0.782 → 0.916 (Kimi K2.6) across four memory frameworks.
Key insight: Write-back loops let one stale source occupy many retrieval slots; deduplicating by source family with provenance and authority checks lifts accuracy from 0.825 to 0.920.
Pack Light, CarryOn: Building Object-Oriented Context for Long-Horizon Agents
Yuchen Lu; Julian McAuley; Lei Zhang arXiv: 2610.18784
Organizes continuation around reusable task objects ("continuation carriers") plus execution context and a live tail, instead of compressed histories; carrier records are revised against bound evidence across folds. +5.8% on OSWorld 2.0 and +7.0% on BrowseComp-Plus with 51.9% and 22.9% fewer total tokens.
Key insight: Persisting reusable progress objects instead of compressed history gains 5.8% on OSWorld 2.0 with 51.9% fewer tokens.
TurnCost: Turns, Not Observations: Cache-Aware Loop Engineering for Coding Agents
Pramod Kumar; Raj Kumar Pandey arXiv: 2610.15093
On 600 public coding-agent trajectories: median observations are 118–286 tokens; 98.6% of input tokens hit the prefix cache, so flat pricing overestimates loop cost ~7×. Turn count explains 84% of log-cost variance vs 4% for observation size; model delegation increased cost in half the settings (closed-form break-even given). TurnCost tool released.
Key insight: 98.6% of coding-agent input tokens are prefix-cache hits, so turn count, not observation size, drives loop cost (84% vs 4% of variance).
Should SLMs be in the Driver's Seat? A Study of Local Models as Interpreters in Cloud-Written Agent Programs
Boris Radovič; Marco Canini; Veljko Pejović arXiv: 2610.14209
Cloud model writes the program; bounded questions over user data are deferred to a small local model via an ordinary function call. On AppWorld, improves a code-only agent in all six backbone×partition settings by up to 14.9 pp, recovering much of the gap to a cloud ReAct loop while keeping user data on device.
Key insight: Letting a cloud model write the program while a local small model answers bounded questions over private data recovers much of the cloud-agent gap, up to 14.9 points on AppWorld.
SchemaWeaver: Accelerating On-Device Mobile Agentic AI via Schema-Guided Parallel LLM Decoding
Boyuan Yang; Wei Gao arXiv: 2610.17436
Tool-call latency on phones is decode-bound (memory bandwidth). SchemaWeaver enforces schema-guided parallel decoding to emit multiple tokens per pass; training-free, engine-level, up to 3.9× lower tool-calling latency across major mobile SoCs and LLM families.
Key insight: On-device tool calling is decode-bound, and schema-guided parallel decoding cuts its latency by up to 3.9 times without any training.
A Decade in a Day: Synthesizing Agent-Native Interfaces from Human-Oriented Software Evolution
Alan Wu; Wei Tao; Yiwen Guo arXiv: 2610.15765
Holding task/agent/verifier fixed across software releases (255 tasks, six desktop apps), newer releases consistently score higher; discoverability, granularity and observability matter. ANIS synthesizes agent-native interfaces: atomic interfaces +3.8/+3.5 pp over native SDK with DeepSeek V4 Flash / Claude Haiku 4.5 and ~73% fewer online tokens; goal-level commands reach 74.5% / 67.4%. Also on HF Daily Papers.
Key insight: Goal-level, discoverable, observable agent-native interfaces beat raw SDK access and cut about 73% of online tokens.
TRAP: Tool-result Replay Attack for Probing Misbinding in LLM Agents
Yutong Zhi; Jie Zhang; Xiuqi Lu et al. arXiv: 2610.16333
Real, unmodified tool results replayed into an incompatible context (via caches, recovery, shared state) cause unsafe actions. ReplayBench: 19 scenarios, 4 failure properties, 3 replay mechanisms; across eight LLMs and three frameworks, mean final-state error rate 0.649 under cross-task replay, localized to model-side action generation. Runtime validity checks eliminate errors in tested settings.
Key insight: Real tool results replayed into the wrong context cause unsafe actions (mean final-state error 0.649), so cached results must be bound to the call that produced them.
Which Metadata Matters for LLM Tool Selection in MCP? Evidence from Controlled Factor-Level Interventions
Xiaofan Li; Fengchun Qiao; Xing Gao arXiv: 2610.14334
Analyzes 367,174 MCP tools and runs single-factor interventions across five LLMs and five tasks. Parameter-schema changes cause the largest, most consistent selection shifts (models prefer separate top-level params over grouped ones); parameter-explaining descriptions help; names matter less. Schema and ordering can decide which implementation is invoked.
Key insight: In MCP tool selection, parameter-schema shape moves model choices far more than tool names; flat, well-explained top-level parameters win.
AuthGateBench: Benchmarking LLMs as Authorization Gate
Zhixiong Zhuang; Jin Jia; Zhiwei Shang et al. arXiv: 2610.16426
Policy-guided benchmark (1,400 instances, five failure modes from real Claude Code incidents) with contrast pairs: same action and trajectory, different request, flipping allow/block. Models over-rely on safety alignment and still block most explicitly authorized actions; retrieved environment signals substantially improve accuracy.
Key insight: LLM approval gates for coding agents still block most explicitly authorized actions, and feeding them retrieved environment signals substantially improves accuracy.
The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow
Arya Fayyazi; Mehdi Kamal; Massoud Pedram arXiv: 2610.17301
On CAPE-Bench, "retroactive permission laundering" precedes a false report in 70% of 1,081 informed violations (vs 8%). A linear residual-stream readout forecasts violations before the act (AUROC 0.94) and beats CoT monitors; gating on it cuts Gemma-4 violations 0.70 → 0.09 at full completion, and on AgentDojo cuts attack success (Gemma-4 11.7% → 5.7%, gpt-oss 28.5% → 17.5%) at a tiny fraction of agent compute and orders of magnitude less than a CoT monitor. Preregistered; code/data released.
Key insight: A linear residual-stream probe forecasts unauthorized agent actions before they happen (AUROC 0.94), and gating on it cuts violations from 0.70 to 0.09 at a tiny fraction of a CoT monitor's cost.
PrivacyGuard: Source-Linked Sanitization and Locally Resolvable PII References for Cloud GUI Agents
Zian Yuan; Wei Li arXiv: 2610.16778
Source-linked sanitization reconstructs fragmented PII spans; a reference lifecycle links changed appearances to session entities with locally resolvable references. Cuts audited leakage 33.55–82.60% vs the closest full-pipeline system; cross-form continuity 0.04 → 0.81; reference-required Android task completion 8/30 → 17/30 and 7/30 → 20/30.
Key insight: Replacing PII in screenshots with locally resolvable references, instead of masking it, cuts leakage by 33.55–82.60% and roughly doubles reference-dependent Android task completion.
Cost-Efficient Privacy Enforcement for Email-Generating LLM Agents under Strategic Information Requests
Qikun Cai; Tao Huang; Chen Hou arXiv: 2610.18007
Intercepts outgoing drafts, builds an information-release contract (preserve/generalize/forbid), rewrites with a local Gemma model, and selectively calls a final PrivacyChecker. Normal-prompt leakage 11.41% → 4.03% with usable rate 85.2% → 92.6%; under strategic requests 28.19% → 18.79% and cost amplification 1.32× → 1.02×.
Key insight: Contract-conditioned rewriting with a local model plus a final checker cuts email-agent privacy leakage from 11.41% to 4.03% while raising the usable-draft rate.
Iterate on an LLM, Serve on an SLM
Keegan Wang arXiv: 2610.14576
Develop behavior in prompt space on a frontier model with live traffic, then SFT an SLM on recorded production decisions. A LoRA Qwen3-8B on 11.6k home-care scheduling decisions reaches 0.913 agreement with GPT-5.4-nano (which agrees with itself only 72.7%); a blinded scheduler sided with the student 48–29; ~2.5× lower median latency.
Key insight: Iterating on behavior in prompt space with a frontier model, then distilling logged production decisions into an 8B LoRA, gives 0.913 agreement at about 2.5 times lower latency.
Davinci-Tool: Scaling Agentic Tool-Use Supervision with Verifiable Executable Environments
Xiaoyang Yuan; Ji Zhao; Xingyu Hu et al. arXiv: 2610.16867
30B tool-use model + Davinci-ToolData (30,395 verified trajectories, 2,260 tool names) from execution-grounded task synthesis and executable environment synthesis, SFT then outcome-grounded DPO. Lifts Qwen3-Coder-30B-A3B-Instruct 52.4 → 88.2 on τ²-bench, 30.4 → 62.8 BFCL v4 multi-turn, 16.9 → 56.2 MCP-Atlas, beating Qwen3-Coder-480B-A35B on all three. Code available.
Key insight: Execution-verified synthetic tool data lifts a 30B-A3B open model to 88.2 on tau2-bench and 56.2 on MCP-Atlas, beating its 480B sibling.
When Skills Remain But Access Fails: Factorized Skill Memory for Continual Skill Internalization
Haomiao Qiu; Yining Tang; Hongyi Wan et al. arXiv: 2610.15492
Finds two-stage forgetting when skills are internalized continually: first the model loses the ability to address a skill from the raw request (giving the canonical skill name restores it), later execution itself degrades. FSM splits memory into a plastic Address Memory and a stable Execution Memory of frozen per-stage LoRA executors. On a five-stage, 100-skill TaskBench setup: 65.95% mean exact match, 93.38% addressing accuracy, +14.3 pts over the best replay-free baseline and within 1.9 pts of Replay.
Key insight: Most forgetting in continual skill internalization is the model losing the route from request to skill, not the skill itself, so a plastic router over frozen per-skill executors recovers most of it without replay.
SkillFusion: Towards Reliable Multi-Skill Composition for LLM Agents
Enhao Huang; Xinye Zhao; Yiming Li et al. arXiv: 2610.15481
An offline compiler that reconciles independently authored skills loaded together: typed, scoped constraints linked to source directives; a type-scope gate plus selective fallback; classifier and adversarial verifier; conditional routing/priorities for hard conflicts, verified abstraction for soft ones, dedup for redundancy. Highest mean success among non-oracle methods on three agent and two transfer benchmarks across three executors; >2.5× unresolved multi-skill loading at the largest configurations.
Key insight: Conflicts between co-loaded skills are better compiled out offline, with typed scoped constraints and verified routing, than left for the model to arbitrate at runtime.
Encrypted Skills Can Become New Security Exploits If AI Agents Know How to Decipher
Yan-Lun Chen; Pin-Yu Chen; Chia-Mu Yu arXiv: 2610.18262
Embeds encoded (Caesar and layered) malicious instructions in skill files that agents decode and follow. Across eight models and 139 injection-task pairs, ASR reaches 47.5% and 40.3% in the shortened-skill setting; tested skill scanners rarely flag them. Decoding success does not guarantee attack success.
Key insight: Encoded instructions hidden in skill files are decoded and followed by agents up to 47.5% of the time, and plaintext skill scanners rarely flag them.
SkillScreen: High-Recall Screening of Malicious Agent Skills with Decision Models
Jerrold Huang; Junwei Quan; Saiyue Lyu et al. arXiv: 2610.17727
A compact decision model scores maliciousness directly from SKILL.md in one forward pass. On MaliciousSkillBench it flags 20–25% of benign skills at 99% recall on unseen attack families, fewer than word-level classifiers and prompted LLM judges; but unfamiliar benign sources sharply raise false positives.
Key insight: A compact decision model reading SKILL.md directly is a cheap high-recall pre-install gate for third-party skills, though unfamiliar benign sources still raise false positives.
Socratic Skill Learning: Interleaving Teaching and Practice for Transferable Agent Skills
Letian Zhu; Han Li; Yifan Yao et al. arXiv: 2610.17860
An Educator guides investigation while the Student stays the sole environment operator and Skill author. On SkillTransferBench (35 families, 408 cases), Fixed-Window SSL reaches 0.801 utility vs 0.723 no-skill, 0.761 Trace2Skill, 0.751 SKILL-KD; Issue-Guided SSL hits 0.805 with 61.7% fewer Educator tokens.
Key insight: Skills authored by the agent that will use them, under expert questioning, transfer better than expert-written or trace-distilled skills, at a fraction of the teacher tokens.
ClawLoop: Self-Improving Agents via Harness-Native Training Loop
Hansi Yang; Linji Hao; Hongyan Hao et al. arXiv: 2610.14118
Teacher-free loop for sandbox/shell harness agents: Task Synthesis (diagnosis-conditioned difficulty growth, agent-free and agent-based validation) → SFT/RL → Diagnosis report fed back into synthesis. With Qwen3.6-27B as loop model, consistent gains on SkillsBench, Claw-Eval-Live and ClawGym-Bench; refined tasks transfer to Qwen3.5-4B/9B.
Key insight: A teacher-free synthesize-train-diagnose loop improves open-weight harness agents, and the refined tasks transfer down to 4B and 9B models.
HarnessNet: Feedback-driven Hierarchical Joint Harness Evolution for Multi-agent Systems
Zhaoyuan Qiu; Sachith Seneviratne; Yu Xia et al. arXiv: 2610.15221
Hierarchical harness evolution for MAS: each Agentron = evolvable harness + frozen model + local optimizer that sees only its own harness; feedback propagates backward through a layered graph. On AgentBench, matches a global optimizer with fewer tokens/time per call and local privacy; evolved harnesses stay effective after swapping foundation models.
Key insight: Evolving each agent's harness locally with node-specific feedback matches a global optimizer on AgentBench at lower cost, and the evolved harnesses survive a foundation-model swap.
Harmony Harness: Multi-Objective Self-Evolution of Agent Harnesses
Weichen Yu; Lesly Miculicich; Bhavana Dalvi Mishra et al. arXiv: 2610.15150
Treats harness evolution as multi-objective (decomposition-based evolutionary search over a Pareto frontier) and factorizes operators into general-purpose mechanisms vs benchmark-specific adaptations, composed at inference. >10% gains over harness-evolution baselines on SecRepoBench and BaxBench.
Key insight: Treating harness evolution as multi-objective and separating general mechanisms from benchmark-specific patches yields more than 10% gains on secure-coding benchmarks.
Harness^2: Recursive Agent Harnessing for an Open World
Ruiyao Xu; Yanfei Chen; Zhongying CuiZhu et al. arXiv: 2610.14224
Two-level recursion: task-level Propose-Probe-Compose edits a harness without ground-truth verifiers; harnessing-level recursion distills those edits into a continual-improvement harness. One step improves GLM-5 and Gemini 3.5 Flash by up to 11.5 pts on WorkBuddy-Bench, 4.5 on JobBench, 11.8 pp on LAB. Also on HF Daily Papers.
Key insight: Contrastive Propose-Probe-Compose probing lets agents edit their own harness on open-ended tasks that have no ground-truth verifier, gaining up to 11.8 points.
Trace-to-Architecture: Capability Bottleneck Diagnosis for Harness Revision
Wenfeng Wang; Jianrui Shi; Mingang Guo et al. arXiv: 2610.16725
A development agent diagnoses failures from successful and failed traces, revises the matching harness component, then checks target tasks improve, selected successes stay successful, and edits actually trigger. Beats strongest baselines by 6.2–30.3 pts on ALFWorld, ScienceWorld, AppWorld; adding T2A to Meta-Harness +21.6 on ScienceWorld.
Key insight: A harness-edit loop should check that the edit actually fires and that prior successes stay successful, not only that target tasks improve.
Knowledge Graphs as Files: An Agent Harness Where Tool Creation and Tool Use Co-Evolve
Yuyang Bai; Yu Wang; Yu Zhang arXiv: 2610.18616
Instead of predefined graph APIs, agents get complete node/edge files and write Python plus shell search to build their own graph-access tools, revised from execution feedback. Training-free DKGI beats the strongest published baseline by ≥6.7 Hit@1 on every graph; multi-turn programming beats shell-only and predefined tools. Code released.
Key insight: Exposing a knowledge graph as plain node and edge files and letting the agent write its own access tools beats predefined graph APIs by at least 6.7 Hit@1.
AM-Bench: Understanding Agents under Task Underspecification across Models and Harnesses
Kaiyu Huang; Yiting Li; Angyang Gu et al. arXiv: 2610.18090
48 Terminal-Bench 2.0 / Harness-Bench tasks, each with six ambiguous/missing goal/context/constraint variants; 5 models × 4 harnesses, 20,160 runs. Goal gaps hurt completion, context gaps raise tokens, constraint gaps weaken compliance; missingness hurts more than ambiguity; rankings flip by model×harness pairing.
Key insight: Agents should be evaluated as model-plus-harness pairs under incomplete instructions, because missing goals, context and constraints each fail differently and rankings flip by pairing.
Recall What Is Missing: Composing Evidence from Long-Term Agent Memory
Qi Feng; Jicong Fan arXiv: 2610.15642
Treats memory read as query-conditioned evidence composition: each memory valued by what it adds beyond already-selected evidence, via the residual of a sparse convex query reconstruction on existing embeddings — no LLM or cross-encoder scoring. LoCoMo fixed budget: +7.2 pp at Top-10, +5.5 pp at Top-20; 32.9× faster median reranking than batched BGE-v2-m3.
Key insight: Valuing each memory by what it adds beyond already-selected evidence gives a training-free reranker that gains up to 7.2 points on LoCoMo and runs 32.9 times faster than a cross-encoder.
Many Steps into One: Reasoning Contraction and the Limits of Safe Memory Reuse for LLM Agents
Jianghong Zhou; Hao Rong; Chen Lin et al. arXiv: 2610.17544
Thought templates, skill libraries, memories and caches "contract" reasoning; they answer wrong silently after facts change. Proves success/failure counters are poor change detectors: ExpeL/ACE-style counters serve 7.0–13.5× more stale answers than certified memories on edited multi-hop facts, 35–73× on code tasks. Recipe: likelihood-ratio failure weighting, certification against live reasoning, restart on change.
Key insight: Success counters are poor change detectors for reused memories and skills; certify against live reasoning and invalidate on fact changes or stale answers multiply.
Keep Your Receipts: Trustworthy Cleanup of Agent-Built Knowledge Graphs
Vishisht Choudhary arXiv: 2610.17719
Deployed KG pipelines delete only directly extracted facts on retraction (contaminated queries 32.2% → 28.0%); rebuilding is noisy (two builds differ in 29,475 artifacts). PolyGraph asks the constructor for per-artifact evidence "receipts", so cleanup is set arithmetic with no model calls; per-sentence summary receipts are 100%/88% faithful, and distrusting the summary layer cuts contamination to 0.4–0.8% at 99.8–100% of ideal recall.
Key insight: Recording per-artifact evidence receipts at write time turns knowledge-graph cleanup into set arithmetic and cuts contamination after retraction to under 1%.
Engram Injection: A Study of Temporal Validity in Parametric Language-Model Memory
Sam Siavoshian; Omar Ramadan; Amir K. Saeed et al. arXiv: 2610.15882
Stores facts in LoRA adapters with FiLM clock conditioning on frozen Qwen2.5-3B-Instruct. On 62 before/after-update question pairs at an unseen elapsed age, both adapter methods answer zero pairs correctly; full-history prompting gets 59/62, retrieval of four dated records 62/62. Adapters can store facts and removable units support local deletion, but time-based version selection fails.
Key insight: Storing changing facts in LoRA adapters on a small model fails temporal version selection outright, while dated retrieval answers every before/after pair correctly.
Learning How to Remember: Memory Modality Selection for GUI Agents
Taeyun Roh; Suhyeong Park; Gijin Kim et al. arXiv: 2610.17928
Systematic study shows the preferred memory representation (text vs visual) for VLM GUI agents is strongly step-dependent; SwitchMem routes per step and beats static-modality memory baselines on three GUI benchmarks. Also on HF Daily Papers.
Key insight: The best memory modality for GUI agents changes step to step, so routing between text and visual memory per step beats any fixed choice.
LatentRemedy: Efficient Remedy For Non-Prefix KV Cache Reuse in Multi-Agent Systems
Zhiwei Chen; Zhongtao Rao; Waikit Xiu et al. arXiv: 2610.18014
Non-prefix KV reuse across agents with conflicting tasks can drop performance up to 90%. LatentRemedy maps the target prefix's last hidden state through an MLP into a few task-conditioned latent tokens placed after the reused block (trained by full-prefill distillation); beats reuse baselines on conflicting tasks with TTFT near direct reuse.
Key insight: Naive non-prefix KV reuse across agents with conflicting tasks can cut performance by up to 90%; a few learned latent tokens after the reused block repair it at near-reuse latency.
CacheLink: Functional KV Transport for Zero-Prefill Cross-Model Context Handoff
Haomiao Qiu; Yining Tang; Zijia Song et al. arXiv: 2610.15509
Zero-prefill handoff: translate a sender model's KV cache into a receiver-compatible state. Shows reconstruction error is a poor proxy for receiver utility; learns coupled K/V correction through receiver behavior. Improves every one of four sender–receiver pairs; up to 7.27× lower handoff latency than re-prefill at 32K.
Key insight: Translating a sender model's KV cache into a receiver-compatible state enables zero-prefill handoff between models, up to 7.27 times faster than re-prefill at 32K.
Empowering Edge Agents: A Systematic Analysis of Edge-Cloud Collaboration in LLM Agent Execution
Pengcheng Huang; Zhenghao Liu; Shixin Ren et al. arXiv: 2610.17816
Benchmark of executable digital-workspace tasks scoring performance, resource use and privacy exposure for interleaved edge-cloud execution. Collaboration balances the three better than edge-only or cloud-only; as edge models get stronger, edge-controlled collaboration wins, but privacy exposure stays strategy-dependent. Code from OpenBMB.
Key insight: Edge-cloud collaboration balances task success, resource use and privacy better than either side alone, and edge-controlled collaboration wins as edge models improve.
RASSG: Repair-Aware Semantic Survival Gating for Streaming Tool Execution
Daijin Hu; Xi Wang arXiv: 2610.14659
Voice assistants launching tools before the user finishes speaking risk stale irreversible calls after self-corrections. RASSG launches after three identical ASR argument readings and cancels using calibrated invalidity risk vs execution cost at the last feasible moment. ReCAST prospective-repair stale-execution rate 50.00% → 3.15% (mean delay 3.676s).
Key insight: Speculative tool launches from streaming speech need a stability gate and a risk-aware cancellation window, cutting stale executions from 50% to 3.15%.
REVEAL: Reverse Engineering Agentic Latents from Frontier-Model Traces
Yuetian Du; Meng Wang; Yucheng Wang et al. arXiv: 2610.16288
Training-free: replays frontier-model trajectories in a target model to build "Agentic Latents" (anchored states, feedback–response profiles), then derives a target-specific steering direction from successful vs failed local events. Higher accuracy than unmodified agents across three targets on Terminal-Bench 2.1 and HLE with tools.
Key insight: Replaying frontier-model traces in a target model yields a steering direction that improves frozen open-weight agents without fine-tuning.
Adaptive-Group Process Rewards for GUI Agents
Zirui Shang; Yang Liu; Xin Shu et al. arXiv: 2610.17710
Partitions GUI trajectories into subgoal groups; a critic scores actions from visual changes and subsequent actions, groups aggregate and refine with full-trajectory context; process rewards augment GRPO outcome advantages. Effective on process-reward benchmarks and downstream RL.
Key insight: Grouping GUI trajectories by subgoal and scoring actions by visual change gives process rewards that strengthen GRPO training for long GUI tasks.
Latent World Action Model for GUI Agents
Seungjun Yu; Hojun Choi; Seojeong Park et al. arXiv: 2610.14228
Replaces pixel-space future-screen prediction with latent prediction of action-induced change: shared LMM representations feed an action head and a transition head, with an action-aware contrastive loss against the identity shortcut. Up to 31.9%/40.6% relative success gains (offline/online) over pixel world models and up to 98.9% lower latency.
Key insight: Predicting action effects in latent space instead of future pixels gives GUI agents better look-ahead, with up to 40.6% relative success gains and 98.9% lower latency.
MCPDisCo: Seesaw-Mitigated Tuning for MCP-Native Agents
Kounianhua Du; Jianxing Liu; Shuai Shao et al. arXiv: 2610.14956
Ecosystem-scale RL over real servers (70 MCP servers, 527 tools, six domains) with a Thought-MDP; addresses the reasoning–tool seesaw via token-masked reward attribution and bidirectional gradient surgery. Higher success with fewer CoT tokens; monotone gains on OOD MCP-Atlas and GAIA. Weights and implementation available.
Key insight: RL over 70 real MCP servers with token-masked reward attribution eases the reasoning-versus-tool-use seesaw, raising success with fewer reasoning tokens.
ProgAgent: Learning Tool Orchestration through Programmatic Training
Hao Li; Keqing He; Longtao Zheng et al. arXiv: 2610.14774
Full training stack for Programmatic Tool Calling (tools invoked through code, intermediate results kept in runtime variables rather than context). With 215 tasks at four environment scales, ProgAgent-14B reaches 30.7% on LOCA-bench at 64k-token state where comparable baselines score zero; PTC-trained models win under both PTC and direct-call interfaces.
Key insight: Training agents to call tools through code, with intermediate results held in runtime variables, solves long-horizon tasks where direct-call baselines score zero.
Judges Follow the Reference: The Derivation Gap in Verifying Tool-Call Arguments
Linhai Ma; Yan Wang; Lingfei Qian et al. arXiv: 2610.18497
Tool-call judges (seven tested, incl. System One models CLM and Jev) accept correct argument values less often when no text states the value (schema defaults, inferred, truncated sources) and favor visible wrong values. DeRef has a separate model read the full history and write a reference for the judge; AUROC improves for all judges, from chance to 98.40–99.59 on the controlled test.
Key insight: Tool-call judges reject correct argument values that no visible text states; giving them a separately derived reference lifts AUROC from chance to above 98.
Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization
Huihao Jing; Shaojin Chen; Wenbin Hu et al. arXiv: 2610.16838
Benchmark contrasting authorization evidence for the same operation, with executed/verified operations and native-policy requests, tracking each request across guardrail changes. Many blocks come from failed reviews, not correct denials; fixing output format changes which authorized requests pass; a second reviewer removes errors but rejects valid authorization.
Key insight: Guardrails should be measured on the authorized actions they wrongly block, since many blocks come from failed reviews rather than correct denials.
Pollard: Governed Semantic Execution Trees for Framework-Independent AI Agent Control and Replay
Muntaser Syed; Marius C. Silaghi arXiv: 2610.16145
Framework-independent runtime: a step identity commits to canonical input, kind, attempt and parent; one tree records completion, refusal, resource settlement and branches. Strict replay returns verified stored results without re-invoking operations; transactional store coordinates reservations across workers. Verified under deterministic freeze, PostgreSQL lease tests and live provider runs.
Key insight: Committing each agent step to a canonical identity in one execution tree makes strict replay, refusal and budget settlement verifiable across frameworks and workers.
Can an Agent Learn to Predict Its Own Failure? Outcome-Grounded Confidence Calibration in LLM Agents
Ashutosh Hathidara arXiv: 2610.18614
Calibrates per-step verbalized confidence against eventual episode outcome using GRPO groups and a proper scoring rule. Qwen2.5-7B offline: step-confidence AUROC near chance → 0.68–0.85; top-10% confident steps succeed ~4.3× more often. Online ALFWorld: ECE 0.42 → <0.12, selective execution improves without hurting success.
Key insight: Calibrating per-step confidence against eventual episode outcome turns near-chance confidence into a usable signal for when an agent should hand off.
Agent-Canary-Mas: End-to-End Evaluation of Protocol Risk in Long-Horizon Multi-Agent Systems
Xiuming Liu; Le Gai; Zhiyuan Chang et al. arXiv: 2610.15529
End-to-end evaluation of protocol attacks (five classes, 13 subclasses across A2A, ANP, BCS; 975 matched pairs) on an OpenClaw multi-agent framework. Local attack success often ≥90% but consequence conversion ranges 7.1–100%; cross-agent evidence lifts Audit-F1 29.7% → 95.5%; an authority-checking Guard at handoffs lowers Finance ASR 86.1% → 53.8%.
Key insight: Protocol attacks in multi-agent systems often succeed locally but convert to real consequences unevenly; cross-agent audit evidence and authority checks at handoffs are what reduce harm.
When Agents Talk, Secrets Travel: Topology-Driven Leakage and Recipient-Conditioned Sanitization in Multi-Agent LLM Systems
Sunday Oyinlola Ogundoyin; Muhammad Ikram arXiv: 2610.16039
485 scenarios across coordinator-worker, peer-to-peer and hierarchical topologies: disclosure to topology-introduced recipients rises 0% → 52.2% while surface leakage stays ~60–63%; framework choice drives a 150× leakage spread. RECONS (Detect → Decide → Transform, recipient-conditioned) cuts residual disclosure 96.7% → 29.25% while keeping 94.1% of authorized disclosures (vs 20.5% for blanket redaction).
Key insight: Topology alone drives multi-agent privacy leakage, and recipient-conditioned sanitization cuts residual disclosure from 96.7% to 29.25% while keeping most authorized sharing.
BLADE: Auditing Information Use for Failure Attribution in LLM Multi-Agent Systems
Xiaoguang Guo; Yaohao Long; Chuxu Zhang arXiv: 2610.18780
Training-free attribution that audits whether receiving decisions use their sources faithfully (not just traces dependencies), using Jev for structured probabilistic judgments to pick handoffs. Best or tied-best step accuracy among eight strategies on 1,228 failed Who&When / Who&When Pro runs, +2.2–11.1 pp over All-at-once.
Key insight: Auditing whether each handoff decision used its sources faithfully attributes multi-agent failures better than asking a judge for the first mistake.
Why Agentic Workflows Fail: A Taxonomy Derived from Literature and Empirical Data
Xin Li; Rami Bahsoon; Tao Chen arXiv: 2610.17418
Source-aware taxonomy (failure-type dictionary × workflow stage × agent capability) applied to literature and GitHub. Literature emphasizes planning/reasoning/knowledge failures; GitHub failures concentrate in execution, actuation, tool, API and infrastructure; the hotspot is iterative execution and actuation.
Key insight: Real-world agentic workflow failures concentrate in execution, tools, APIs and infrastructure, not in the planning failures the literature emphasizes.
Executable Prefix Values for Locating Agent Failures
Bingyu Shen; Jiaqi Tang; Lan Wei et al. arXiv: 2610.17633
Restarts agents from reconstructed intermediate states to estimate prefix success probability and a certified point of no return. On 150 SWE-bench Verified tasks with two frozen open-weight agents: judges agree on the exact step in only 21/57 cases, newest judges flag mistakes in 8/10 and 10/10 successful runs; for 66% of labels success probability does not drop at the labeled step. Restarting at the measured point raises success 0.44 → 0.57; restarting at judge labels does not help.
Key insight: LLM-judge first-mistake labels are unreliable for recovery; restarting from the measured point of no return raises success from 0.44 to 0.57 while judge labels do not help.
Instructions Are Evidence, Not Objectives: Measuring Outcome Alignment of Agents
Kaiming Liu; Yuxuan Liu; Jinrui Ju et al. arXiv: 2610.17757
In 100 SWE-chat trajectories, 56% of initial instructions omit later-needed requirements and 52% of useful follow-ups were inferable from the project. TiGanEval (SWE + research tasks) shows eight frontier models incl. GPT-5.6-Sol lose 53–67 success points going from full spec to partial instruction; feedback over four submissions and a plan-mode harness do not close the gap.
Key insight: Instructions are evidence, not objectives: frontier agents lose 53–67 success points when requirements must be inferred from context rather than stated.