Friday's cs.AI announcement day (2026-10-16) lists 132 new and 154 cross-lists (replacements skipped; listing total 286). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence/identity, and local/open models keeps 37 papers. Personal-agent trust leads: who may release an assistant's promise, and how to bind human approvals to the exact effect an agent executes. Agent memory follows with learned memory assembly (MemComposer), user-requested forgetting (MemCut), store-level memory evaluation (FEB-30), localized memory-architecture repair, latent memory tokens, and anticipatory workspace curation (Librarian Agents). Skills and harnesses cover skill drift after deployment, non-elitist and federated skill evolution, small decision models that share control with LLMs, tool retrieval, and weak-drafts/strong-verifies execution. Computer-use work includes the open MAI-Gym-9B, OS-Helix, and LEASH escalation, alongside multi-agent repair and orchestration, guard and monitor robustness, and open agentic training recipes.
Research Papers
Who May Release an Agent's Promise? Standing over Commitments in Multi-Party Chat
Lan Wei; Bingyu Shen; Jiaqi Tang et al. arXiv: 2610.21203
Defines standing: only the creditor (person owed) or someone they or operator policy authorize may release an assistant's promise. Across six models, small open models override the creditor (Qwen3.5-9B: 69%), larger ones drop promises on a peer's word (Qwen3.8-27B: 89%; gpt-6.1-sol: 83%), and nearly all act on a bystander's "go ahead after all". A self-kept commitment ledger stops override in 4 of 5 models; with a one-paragraph release policy it raises gpt-6-luna strict accuracy 49% → 83%. Code/prompts/labels released.
Key insight: Who may cancel an assistant's promise is a policy question; a self-kept commitment ledger stops override in four of five models tested.
Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization
Sai Varun Kodathala; Prashanth Pollishetty; Jaylen Cargill arXiv: 2610.21063
Twelve attacks on agent approval paths (decoy recipients, amount cancellation, label spoofing, threshold splitting…) against AP2, Microsoft action-bound approval, and MCP elicitation. Audit of ten runtimes: no third-party verifiable approval record, post-approval argument changes in 4 of 8 measurable runtimes. ASU gateway renders the card from a canonical effect descriptor, has a phone passkey sign its digest, executes only the stored call (Tamarin-proved, 53 lemmas); trusted card cuts forged-narration attack success 0.54 → 0.03. Flooding still succeeds 0.45–0.60 against a modeled approver.
Key insight: An agent approval only counts as a second factor when it is rendered from, and bound to, the exact effect that will execute.
MemComposer: Learning to Assemble Memories for LLM Agents via Reinforcement Learning
Yixuan Xie; Xueqiang Xu; Xinyi Fan et al. arXiv: 2610.21091
Composer jointly reads query + retrieved candidates to decide which experiences to include, how many, and in what order; trained with ExPO (GRPO over full agent interactions). Beats strongest baseline on three τ²-bench domains with two frozen executors, cutting memory tokens 16.9% / 4.9%; transfers to unseen domains, executors and memory banks.
Key insight: Which memories to include, how many, and in what order is learnable from task success — and beats similarity-only retrieval with fewer tokens.
MemCut: Every Secret Leaves a Trail in the Long-Term Memory of LLM Agents
Cheng Zhang; Xuanning Cao; Zhicheng Zheng et al. arXiv: 2610.21405
Benchmark of 456 hand-designed secrets in long-horizon conversations with annotated evidence trails, testing recovery after deletion (native vs residual recovery) across five memory designs and four LLMs. LLM-guided deletion of ten extra turns from twenty candidates still leaves 39–76% residual recovery; candidate coverage is the bottleneck.
Key insight: Deleting the stated secret is not forgetting: surviving evidence still lets a reader recover it 39–76% of the time.
Beyond Downstream QA: Rethinking How We Evaluate Agent Memory
Sebastian-Antonio Toma; Jean de Kernier; Mike Ply et al. arXiv: 2610.22209
30 fact-evolution trajectories (6 diagnostic categories, 3 difficulty levels) across docs/emails/conversations with deterministic ground truth, inspecting the memory store after each ingestion. Intrinsic vs QA-based evaluation diverge by 16 pp on average (44% of trajectories past threshold); the tested system classifies create/update/reinforce/supersede correctly only 20% of the time.
Key insight: Downstream QA accuracy hides broken memory operations; inspect the memory store directly.
MemScope: Evolving Agent Memory Architectures through Localized Code Repair
Miao Su; Yucan Guo; Zixuan Li et al. arXiv: 2610.21170
Tool-using Patch Agent inspects raw traces, runtime memory state and architecture code to make bounded in-place edits. On GAIA trace+memory inspection reaches 86.67% vs 70.00% trace-only and 63.33% summary-only; ALFWorld unseen 50.75% → 71.64%; median code-change ratio 4.4%.
Key insight: Memory architectures improve most when a patch agent sees traces plus memory state and makes small, localized code edits.
All-in-One Memory: Process-Rewarded Reinforcement Learning for Memory Agents
Bingbing Wang; Jingjie Lin; Weiming Qiao et al. arXiv: 2610.21147
Treats search, writing and stopping as transitions over a shared, source-traceable multi-view event state; a trajectory-conditioned process reward model scores actions and PA-DAPO optimizes the memory policy. Improves answer accuracy over static memory systems and RL-trained memory agents on long-context memory benchmarks.
Key insight: Search, writing, and stopping in memory agents can share one evidence state and one process reward.
Librarian Agents: Training LLMs to Curate Long-Context Workspaces that Anticipate Future Queries
Anikait Singh; Teresa Zhang; Yoonho Lee et al. arXiv: 2610.22273
A builder agent turns raw documents into a hierarchical filesystem of synthetic files and reference links for a downstream answering agent, optimized by RL for downstream accuracy. +33 pp over the strongest retrieval/precomputation baselines on BrowseComp-Plus; +31 pp average zero-shot on BRIGHT; construction cost amortizes across queries.
Key insight: Agents that pre-curate a filesystem workspace for future queries beat reactive retrieval by large margins.
Memorilla: Latent Semantic Memory for LLMs
Adibvafa Fallahpour; Parsa Idehpour; Vignesh Kothapalli et al. arXiv: 2610.21375
Encodes documents once and places query-specific info into 16 memory tokens in the frozen LLM's input embedding space. Best vs baselines incl. Mem0 and MemoRAG on 5 of 8 benchmarks; FactKG 84.33% vs 80.43% full-context with 108× fewer tokens; TextWorld success 18.6% → 24.2% vs full-history ICL.
Key insight: Sixteen learned memory tokens can stand in for whole document collections for a frozen LLM.
Rethinking the Role of Tool Graph Memory in Multi-Turn Tool Use
Uiji Hwang; Richeng Xuan; Taeuk Kim arXiv: 2610.21571
Across nine models and two benchmarks, tool-graph memory seldom beats baselines significantly and costs >2× LLM calls; random or no guidance keeps most of the gain. Storing the same experience as textual insights outperforms it with almost no extra calls.
Key insight: Tool-transition memory mostly buys extra computation; textual insights work better as a soft prior.
Same Context, Different Agents: A Behavioral Study of Semantic Layers, Orchestration and Compaction in Data Agents
Zhivar Sourati; Marianne Menglin Liu; Zheng Wang et al. arXiv: 2610.20959
Seven LLMs, 1,514 long-horizon tasks, five benchmarks. Agents cluster into investigators, premature answerers and early stoppers; each technique only helps the matching behavior group. For investigators, semantic layers stop looking, orchestration costs 5 pp via overconfidence, compaction causes repeated steps. Combined techniques give less than the sum.
Key insight: Context-engineering techniques only help the agent behavior type they match, and can hurt thorough investigators.
Mosaic: Multi-Session Agentic Reinforcement Learning
Yilong Xu; Minrui Xu; Xinyu Zhou et al. arXiv: 2610.22174
Generalizes agentic RL to trajectories spanning multiple sessions (from compaction or subagent forking). Critic-free hierarchical optimization: session-usage signals at trajectory level, marginal-contribution shaping per session. Beats advantage broadcasting on BrowseComp with Qwen3.5-4B while using fewer sessions.
Key insight: RL for agents that compact or fork context should assign credit per session, not broadcast one advantage.
Evolving Together, Failing Apart: The Skill-Policy Co-evolution Trap in Self-Improving Agents
Yujie Feng; Xiaobin Wang; Jinluan Yang et al. arXiv: 2610.20845
Shows co-evolved policies are fragile when the skill bank drifts post-deployment; sensitivity grows with training. CODA protocol simulates drift and adds consistency (meaning-preserving edits) and resistance (corrupted skills) rates. Worst-case success is 5–13 points below peak, erasing 52–93% of the delivered bank's gain.
Key insight: Co-evolved policies overfit to their delivered skill bank; skill drift after deployment erases most of the gain.
SkillNEO: Non-Elitist Evolutionary Optimization of Agent Skills
Enze Ma; Chunyu Miao; Yankai Chen et al. arXiv: 2610.20926
Keeps lower-scoring skill versions alive for further edits; compares related versions on the same task to find steps to preserve and failures to fix. On 86 SkillsBench tasks (8 domains) raises GPT-5.4 Mini 49.1% → 66.4%; the evolved skills also improve stronger models (Luna +10.5 pp on 41 modified tasks).
Key insight: Keeping lower-scoring skill versions alive lets interdependent repairs mature, and the resulting skills transfer to stronger models.
FedSkillGit: Federated Skill Evolution via Version Control
Boxun Lan; Jiamei Li; Weijian Li et al. arXiv: 2610.21348
Replaces full-document skill uploads with bounded patches over named rules plus a local experience summary, passed through a two-stage privacy filter; server dedups, merges and publishes only when client validation scores improve. Up to 22% over baselines across three datasets and three model families; approaches centralized evolution without sharing raw data.
Key insight: Skill evolution can be federated as privacy-filtered patches merged only when client validation improves.
FAOPs: Normal Forms and an Algebra for AI Agent Workflows
Ali Mohammadi Shanghooshabad arXiv: 2610.22061
Formal theory for Agent Operating Procedures: four normal forms (decomposed, typed, factored, scoped/least-privilege tools), an algebra of sound rewrites, extensions for termination/cost bounds, and a 0–3 classifier for whether a step needs AI at all. Implemented as SkillBase plus an enforcing executor; illustrated on one financial workflow.
Key insight: Agent workflows can be normalized like database schemas — atomic, typed, factored, least-privilege steps.
AutoOnboarder: Autonomously Onboarding LLM Agents
Tanay Arora; Cong Liu arXiv: 2610.21218
An "Onboarder" coding agent iteratively tailors an agent's foundation model, prompt and harness source code from tens of examples, with eval data isolated on a separate VM. On genomic-sequencing prior-authorization form submission, onboarded agents match or exceed a Gemini 3.5 Flash baseline at up to 29× lower cost; results vary run to run.
Key insight: A supervising coding agent can tailor model, prompt, and harness for a task from tens of examples, at much lower cost but with high variance.
JevAgentHarness: Benchmarking, Deploying and Training Decision Models That Share Control with LLMs
Kunlun Zhu; Tao Feng; Xu Han et al. arXiv: 2610.21412
Most harness LLM calls end in a multiple-choice decision (e.g. which tool next). AgentDecisionBench shows naive delegation to a decision model lowers success by 19.0 points; JevAgentHarness fits a per-choice confidence threshold and defers to the LLM below it. Open AgentDecision-4B, trained on post-mistake states, solves 91.5% of out-of-distribution tasks; in-distribution 4B models make agents 81.1–89.0% cheaper and up to 2.5× faster. Models/data/harness to be released.
Key insight: Most harness steps are multiple-choice decisions; a calibrated small decision model can take them over cheaply if it defers when unsure.
Improving Environment-Agnostic Coding Agents: The Role of Scaffolding
Sergey Rodionov arXiv: 2610.22289
Codex-based agent with unchanged code/tools across ARC-AGI-3, AGI Maze, Terminal-Bench. Only adding an instruction to report difficulties and return control for auto-continuation improves ARC-AGI-3 and AGI Maze; Terminal-Bench mixed. Moving reset decisions to a scripted controller recovers part of the specialized-agent gap; extra tutorial experience can hurt. Releases EnvTraverse.
Key insight: Supplied procedures and code-level control still beat letting a general agent organize itself.
ToolBottleneckBench: Measuring Tool-Agent Performance under Controlled Pressures and Fixed Harness Budgets
Zichuan Xu; Yuyang Dong; Makoto Onizuka et al. arXiv: 2610.21098
Varies one pressure at a time (tool catalog, visible menu, certified workflow, record encoding) over 21 model+harness configs. Only the visible menu imposes a large penalty, tracking truncation at the completion cap; a 16× cap removes most of it. Most failures end at a harness limit.
Key insight: Tool-agent scores often measure harness budgets — truncation at the completion cap dominates the visible-menu penalty.
TRACER: Trajectory-Aware Tool Retrieval for LLM Agents
Tanish Kher; Sarvesh DK; Abedelkadir Asi et al. arXiv: 2610.21267
Indexes observed tool-call sequences in a trie and ranks continuations with learned empirical+contextual priors. On mixed retail+telecom τ², GPT-5.4 tool-selection accuracy +4.7 points while cutting input tokens per step 80% (5 of 128 tools exposed); matches full-registry task success with 61% fewer input tokens. Better than full registry in 21 of 24 model-environment pairs.
Key insight: Ranking next tools from past call sequences shrinks the exposed registry and improves selection.
Trajectory-Level Speculation with Semantic Verification for Tool-Using Agents
Zilin Wang; Yinhong Liu; Chao Chen et al. arXiv: 2610.21463
Weak model drafts steps and executes read-only tool calls, holding the first environment-modifying action; strong model verifies the segment in one prefill pass, commits the longest valid prefix and repairs the first rejected step. Within one point of strong-model success on τ²-Bench at roughly half the memory traffic and wall time; on MCP-Atlas edge-cloud closes 53–75% of the weak-strong gap.
Key insight: A strong model can review a weak model's grounded drafts instead of authoring every step, keeping most quality at lower latency.
MAI-Gym: An Open All-in-One Platform for GUI Agent Evaluation and RL Training across Mobile and Computer Environments
Panrong Tong; Quyu Kong; Pengxiang Li et al. arXiv: 2610.20939
Unifies GUI eval, data collection and online RL across mobile, computer and web; 10 benchmarks, 20,000 parallel envs, synthesized resettable mocked apps with verifiers. MAI-Gym-9B: 78.4% MobileWorld, 76.2% OSWorld-Verified (SOTA among open GUI agents <10B). RL in a mocked ticketing app transfers to a physical phone (28.8% → 48.1%). Releases framework, mocked apps, 2,000 tasks, checkpoint.
Key insight: An open 9B GUI agent trained with mocked-app RL reaches state of the art under 10B and transfers to a physical phone.
OS-Helix: Unifying GUI Interaction and Code Execution in Native Computer-Using Agents
Bowen Yang; Kaiming Jin; Zichen Ding et al. arXiv: 2610.22234
Naively adding a code tool degrades a GUI agent; OS-Helix trains GUI actions and code execution in one action space using application-artifact composition and Step-balanced GSPO. OS-Helix-27B-RL reaches 66.44% on OSWorld-Verified; 27B and 35B-A3B variants improve 35.0% / 33.7% over Qwen3.5 hybrid baselines; transfers to WindowsAgentArena.
Key insight: GUI and code actions need to be routed by a trained policy in one action space; a bolted-on code tool degrades GUI agents.
LEASH: Uncertainty-Aware Weak-to-Strong Escalation and Oversight for Computer-Use Agents
Qingni Wang; Changdae Oh; Yuzhe Yang et al. arXiv: 2610.22280
Training-free: compares weak-model hidden states to past successful/failed trajectories for task-level routing, step-level escalation, and a shadow observer over the black-box strong agent. Beats random escalation by 6.55–11.94 points on OSWorld; with Qwen3.5-35B-A3B reaches 73.66% at $0.4117/task, matching always-on Claude Opus 5 (72.90%) at 19.2% lower cost.
Key insight: A weak agent's own hidden states can decide when to escalate to a frontier computer-use agent.
Probe-and-Resume: When and How to Evaluate Agent Execution
Jiakai Xu; Tiancheng Ge; Tujie Guan et al. arXiv: 2610.21088
MCTS with conventional critics doesn't significantly help terminal agents (critics barely beat chance mid-trajectory). Probe-and-Resume invokes the critic only when the agent claims done, gives it read/write/execute on a fork of the machine state, and resumes the rejected agent. +8.4 pp on Terminal-Bench 2.1 over MCTS; approaches Codex CLI with the same model at under half the cost.
Key insight: Critics for terminal agents work best at claimed completion, with read/write/execute access to a forked machine state.
ARIA: Runtime Inspection and Amendment for Multi-Agent Systems
Bolin Shen; Yushun Dong arXiv: 2610.20780
24,000+ trajectories across four MAS frameworks, six benchmarks, eight host models yield 3,953 execution-verified repair pairs (what went wrong, where, how to continue). A compact model learns when and how to amend ongoing runs, generalizing to unseen frameworks and host models. Code released.
Key insight: Execution-verified repairs make good supervision for a compact model that amends multi-agent runs mid-flight.
Believed but Not Said: Measuring Hidden Belief Collapse in Multi-Agent LLM Discussions
Liangjie Huang; Henry Peng Zou; Wei-Chieh Huang et al. arXiv: 2610.22138
Ten-agent factual discussions: one adversary raises benign agents ending on the false answer from 0.6% to 44.8%, three to 60.5%. With three adversaries benign agents privately hold the false answer in 51.6% of exposed turns but publicly endorse it only 19.7%.
Key insight: Adversarial peers flip agents' private beliefs far more than their public statements reveal.
HTN-Orchestrate: A Hierarchical Task Network Framework for Multi-Agent Orchestration
Yanchen Deng; Jianguo Huang; Yao Long Teng et al. arXiv: 2610.22195
Planner maintains subtask hierarchy/dependencies with deferred decomposition; local orchestrators schedule workers; results propagate under AND semantics and the network is rebuilt when stuck. Beats ReAct, Agent Team and DeepSeek Harness on five benchmarks with the same base model: 89.73% BrowseComp, 73.44% SUPERChem.
Key insight: Hierarchical task networks with deferred decomposition give multi-agent orchestration explicit dependencies.
Learning to Steer LLM Agents and Multi-Agent Systems
Leyang Shen; Yaxin Gong; Yang Zhang et al. arXiv: 2610.22316
A steering agent watches execution and decides when to intervene (cheap fast path) and how (expensive slow path), jointly trained with pairwise ranking + GRPO. Improves performance and efficiency on information-seeking search tasks for single- and multi-agent systems; transfers to unseen executors with controllable intervention frequency.
Key insight: A learned steering agent can detect goal drift and intervene at controllable frequency.
Agent Status Protocol (ASP): A Lightweight Specification for State Reporting in Multi-Agent Systems
Diego Gosmar; Deborah A. Dahl; Emmett Coin et al. arXiv: 2610.21538
Agents push small JSON events over HTTP POST; a status server exposes aggregated state over SSE, infers liveness from missed heartbeats and accepts supervisor/guardrail/peer observations that can override self-reports. Multi-dimensional state (lifecycle, health, task, floor, governance) reusing A2A task states, Open Floor Protocol and OpenTelemetry GenAI conventions. Explicitly a draft proposal.
Key insight: Agent status should be inferred from heartbeats and supervisors, not only the agent's self-report.
INFUSE: A Unified Surface Benchmark for Indirect Prompt Injection in Agentic Systems
Thuy Dung Nguyen; Jingyi Guo; Rana Seda Dubauskas et al. arXiv: 2610.20776
40 realistic tasks, 56 attack scenarios across five threat categories, injected through realistic interaction surfaces; 19 LLMs, 41,824 adversarial trajectories. Mean attack success 19.6% (LLM-judged) / 15.4% (heuristic); per-model 3.2%–41.9%. Guard models give limited protection; prompt-level hardening cuts mean success 58.2% → 14.3%.
Key insight: Indirect prompt injection hits long agent workflows at many surfaces; prompt hardening helped more than guard models.
Screwtape: Adversarial Transcript Editing for Monitor Red-Teaming
Gosha Kozhevnikov; Tyler Tracy arXiv: 2610.20941
LLM attacker edits real Claude Code and Codex transcripts so the agent causes a specified harm (e.g. leaking an API key, spawning an unmonitored agent) while evading the monitor; an LLM verifier rejects inconsistent edits. 252 runs over 94 transcripts gave 35 verified evasions; 6 human-confirmed also evaded a held-out frontier-developer monitor.
Key insight: Action-only monitors can be evaded by edited real transcripts, including a frontier developer's held-out monitor.
Language Is a Security Surface for Agent Guards
Hasan Demirkiran; Jens Ernstberger arXiv: 2610.22244
Translates only the user instruction of 1,220 AgentDojo-Traj steps into five languages; 19 guards. Small/open/purpose-built guards flip verdicts beyond noise, growing with language rarity (sub-13B mean +1.5 pp French → +4.4 pp Amharic); every significant recall loss is in a guard below 10B. Frontier guards shift ≤ ~1 point. Releases 489k verdicts.
Key insight: Small and purpose-built agent guards change verdicts when only the request language changes.
Kolab: Benchmarking Human-Agent Collaboration in Long-Horizon Workflows
Shirley Anugrah Hayati; Patricia Anugrah Setiani; Ruizi Wang et al. arXiv: 2610.21109
115+ hours of screen recordings of 50 professionals from 40 occupations collaborating with agents, with collaboration and output-quality judgments. Benchmarks forecasting whether experts adopt/modify/reject agent contributions and judging collaboration quality; frontier models overestimate collaboration and longer context doesn't consistently help.
Key insight: Frontier agents overestimate how well they collaborate with professionals on long-horizon work.
Terminal-RSI: Recursive Self-Improving Terminal Agents via Recursive Self-Rewrite and Policy-Refine
Junyao Yang; Zongxia Li; Yucheng Shi et al. arXiv: 2610.22192
Alternates Recursive Self-Rewrite of verified trajectories with critic-inheriting Recursive Policy-Refine (TB-GAE, family dense rewards). From Qwen3.8-27B base: 86.52% Terminal-Bench 2.1, 79.00% Terminal-Bench Hard, 19.84% Terminal-Bench 4.0; LHTB strict completion 0/46 → 5/46.
Key insight: Alternating verified trajectory rewriting with critic-inheriting policy refinement lifts an open 27B terminal agent stage by stage.
Priming Base Models for Agentic Post-Training: An Open Midtraining Recipe
Soumye Singhal; Joseph Jennings; Ka Shun Shum et al. arXiv: 2610.22019
Open recipe: 256K-context midtraining on packed repos, PRs, commit histories, build logs plus a small share of agentic traces. Nemotron 3.5 Lightning (500B tokens): SWE-bench Verified 60.7 → 64.5, Multilingual 55.8 → 62.8, Pro 32.0 → 35.5 after identical SFT; Nemotron 3.5 Super (280B): DeepSWE 11.7 → 15.7. Also improves robustness across agent harnesses.
Key insight: Long-context midtraining on repository and agent-trace data improves open models' agentic post-training and harness robustness.