Tuesday's cs.AI announcement day (2026-10-20) lists 225 new and 261 cross-lists (replacements skipped; listing total 486). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 44 papers. Harness context policy leads: dropping turns is harmless for facts an agent can look up again but fatal for state it cannot re-observe, and moving long tool output into files can make some models answer from the wrong evidence. Agent skills get a hard look, from same-job skills that silently override each other (SkillClash) to executable skill composition, skill-versus-retrieval conflicts, and skill evolution that needs held-out checks. An empirical study of 496 LLM call sites in 40 open-source agent systems finds most expected constraints unenforced. Agent memory papers cover derived task state (MemDerive), write/read governance on Mem0, credential owner attribution in shared memory, habit inference, and budgeted memory, alongside context compaction and KV-cache compaction. Computer-use work includes an open CUA platform, synthesized GUI+MCP+CLI worlds, learned GUI reward verification, and on-device GUI agents on mobile NPUs, plus browser information-flow control, prompt-injection timing, risk-based access control, audit ledgers, and an Apache-licensed 30B on-device agentic model.
Research Papers
When the harness decides success: state that cannot be re-observed
Raimondas Lencevicius arXiv: 2610.26632
Asks when harness context choices (drop, summarize, replay reasoning) change success, not just cost. Pre-registered probe: truncation costs nothing when a needed fact can be looked up again but drops success to chance when it cannot be re-observed (92.5-point gap, 90% CI [89.5, 95.5]); replicated on a second provider. On ARC-AGI-3, summarizing old turns instead of dropping them, while keeping the Standard harness's note-taking invitation, recovers 86% of a 63-point harness gap; without the invitation 43%, and native reasoning replay recovers the remaining 57% (single-run point estimates).
Key insight: Dropping context is cheap only for facts the agent can look up again; anything that cannot be re-observed has to survive truncation or summarization.
Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy
Ke Zhang; Sahchit Chundur; Jerry Peprah Owusu et al. arXiv: 2610.26836
Harnesses that keep long tool outputs in files instead of context: with the PHREEQC geochemistry simulator (reports up to 846.8k chars, 158 execution-verified items), reading via a section index costs GPT-5.1 / GPT-5.2 11.3 / 7.9 points, with no detectable cost for Claude Opus 4.6 / Sonnet 4.6. Replaying 11,007 logged calls shows the GPT models still compute the keyed value; they answer from their own output files instead ('evidence substitution'). Naming the authoritative output adds 6.3–7.9 points for three GPT models; inlining outputs that fit works as well for GPT-5.1/5.2.
Key insight: Moving long tool output into files can cost accuracy not because the agent computes wrong, but because it answers from the wrong evidence; naming the authoritative output fixes much of it.
One Skill Takes Over: Clashing Agent Skills and a One-File Fix
Parsa Razmara; Seyedarmin Azizi; Ardalan Aryashad arXiv: 2610.25064
SkillClash: 16 pairs of same-job skills with code-checked rules. Across seven models (4B open to Qwen3-235B and GPT-4.1), a skill's rules are followed 93–99% alone but 61–62% when a same-job skill is loaded beside it; most outputs show 'takeover' (one skill's unique rules all followed, the other's all dropped), driven by the worked examples. Ending each skill with one example that follows both cuts takeover to 1–15%; priority instructions don't help. One merged file written by Claude Opus 5.5 gets all seven models to 96–99% of achievable rules.
Key insight: Two skills for the same job rarely merge: one takes over and the other's unique rules disappear, and a single correct worked example covering both is the fix that works.
When Code Becomes an LLM Call: An Empirical Study of Call-Site Contracts in Agentic Systems
Shihao Weng; Longtian Wang; Yang Feng et al. arXiv: 2610.24545
Empirical study of 496 LLM call sites in 40 popular open-source agentic systems (13.4 MLOC). 48% of LLM outputs reach control flow or execution and 73% of those never reach a person; 67% of prompt-side constraints are only requested of the model; 82% of call sites are checked before/after the call, yet 63% of expected constraints are unmet and only 5.3% of sites satisfy their whole contract. Ten patterns explain 99% of gaps; 38 runtime-triggering mechanisms are all stopped by a small code fix enforcing the expected constraint.
Key insight: The presence of checks around an LLM call says little about their adequacy: most agent call sites leave expected constraints unenforced, and small code-side fixes close the gaps.
Whose Credential Is It? How Owner Attribution in Agent MemoryShapes Cross-User Account Misuse
Hau-Sing So; Daixian Liu; Carl Hou et al. arXiv: 2610.25707
Three-stage audit (exposure → behavior → state) for cross-user credentials in shared agent memory on AppWorld. A store mixing 763 logins retrieves another user's credential for 84.7% of required apps, yet agents rarely act on it; in a stress test where memory presents one foreign credential as the user's, seven agents use it in 80–94% of runs and change the victim's account in up to 43%. Naming the owner before or inside each credential line cuts misuse from 92 to 1 of 305 paired runs (costs 3–5 successful tasks per model on clean memory); a wrongly written owner restores misuse.
Key insight: Exposure of another user's credential in shared memory rarely causes harm by itself; misuse comes when memory misattributes ownership, and writing the owner on every line nearly eliminates it.
MemDerive: A Diagnostic Benchmark for Agent Memory over Evolving Data
Sen Gao; Yongan Li; Han Chen et al. arXiv: 2610.25373
MemDerive: 10 symbolically specified scenarios (4,692 events, 1,503 queries) with Datalog-derived gold answers and derivation DAGs. On derived state, every one of four memory systems falls behind plain BM25, although the same answer model reaches 96.01% given the supporting events. Most failures are 'ungathered' (the system holds the intermediate state but doesn't retrieve it), and implicit changes rarely propagate. Proposed principles: gather along the derivation, store versioned rules, maintain derived state via recorded dependencies.
Key insight: Agent memory fails on derived state not because the information is missing but because it is never gathered for the question that needs it; simple BM25 beats every tested system there.
Memory, Know Your PLACE: Governing Lifecycle State and Query-Time Eligibility in Persistent-Memory Agents
Chen-Fang Hu; Hong-Han Shuai; Woan-Shiuan Chien arXiv: 2610.25179
PLACE: factorized governance layer adding write-side state certification and read-side authorization to a memory backend. Factorial evaluation on Mem0 with Qwen2.5-3B / 7B: write-side governance substantially improves lifecycle state correctness; read-side governance eliminates measured causal leakage from ineligible memory in the state-correct setting; the combination performs best while preserving query-relevant support.
Key insight: Reliable persistent memory needs governance at both ends: certify what gets written and authorize what is allowed to influence each query.
Bud ContextCompact 2.0: Context Compaction for Agent Success and Accuracy with Small Language Models and Constrained Context Windows
Jithin VG; Ditto PS arXiv: 2610.25516
Bud ContextCompact 2.0 (Bud agent runtime). Recall over recorded sessions: compaction to 16K raises a 1.2B model to 0.335 (vs 0.247 truncation, 0.176 full 32K history) and a 9B model from 0.515 to 0.577. On 100 SWE-bench Verified tasks with a 27B reasoning model on a 49K window (556 sessions), long-session resolve rate rises 41% → 53% (+12.3, McNemar p = 0.043) with 13% fewer tokens per solve. Limits: gain vanished under a 45-minute budget (median 161 s per summary) and only appeared when compaction triggered early enough.
Key insight: Context compaction helps small and mid-size models on long sessions, but only when it fires early enough to leave room, and its wall-clock cost must be budgeted.
Claim Laundering: When Agent Decision Models Trust Records Over Reality
Tina Khezresmaeilzadeh; Seyedarmin Azizi; Erfan Baghaei Potraghloo et al. arXiv: 2610.25947
Across Android screen traces, ALFWorld and WebShop, paired states vary observation, logged action and explicit success claim. In all 12 configurations (four decision models × three domains), records outweigh observations; after claimed-but-failed steps models still stop, advance or purchase in 53–100% of cases. Linear probes on hidden states separate success from failure (AUROC 0.77–1.00); EVIGATE, an intermediate-layer veto adding 0.04–2.0% latency, improves success under injected silent failures by 18.7 (ALFWorld), 5.0 (WebShop) and 5.1 points (phone simulator). Offline-calibrated gates don't transfer reliably to live trajectories.
Key insight: Agents trust their own record of success over what the environment shows, yet the truth is often visible in their hidden states, which a cheap intermediate-layer veto can exploit.
Muse Glimmer 30B: An On-Device Agentic Model
Arash Ebrahim Abtahizadeh; Muna Aghamelu; Adil Ahmed et al. arXiv: 2610.24628
Muse Glimmer: open-source 30B causal LM with a perception encoder, built for agentic tasks on consumer hardware; text+image in, text out; trained on 100+ languages; quantized to ~4-bit for single-GPU inference. Claims state-of-the-art agentic benchmark results for its size vs Gemma4-31B and Qwen3.6-27B on tool use, multi-step planning and task completion. Apache 2.0.
Key insight: An Apache-licensed 30B multimodal model quantized to about 4 bits targets agentic tool use on a single consumer GPU, claiming the lead over similarly sized open models.
Tandem: Serving Hybrid Linear-Attention GUI Agents on Mobile NPUs
Zhuomin Chen; Jingchao Ni; Xu Zheng et al. arXiv: 2610.26660
Tandem: runtime for hybrid linear-attention GUI agents on mobile NPUs. Saves recurrent state where consecutive prompts diverge so later requests reuse context, keeps prefill on the matrix unit, produces rollback states via a short per-token tail, and releases NPU power votes between bursts without unloading. On Snapdragon 8 Elite: per-step latency −30% (text screen descriptions) / −16% (screenshots), energy per text step −33%, standby power with model loaded 0.76 → 0.22 W.
Key insight: On-device GUI agents need caching built for agent prompts, where instructions persist but recent history is rewritten, plus power management between bursts.
SPIDES: Information-Flow Control for Browser Agents
Egor Zverev; Juhee Kim; Leon Trampert et al. arXiv: 2610.24277
SPIDES gates primitive browser actions (type, click, navigate) on labels propagated from element-level HTML confidentiality/integrity annotations; untrusted and confidential content is masked from context, and policies block unauthorized flows, independent of the driving model. MicroNet: 28 interlinked sites with element-level ground truth and paired benign/adversarial tasks. 0% attack success by design while retaining high task completion and autonomy.
Key insight: Information-flow labels on page elements can give browser agents security guarantees against injection and exfiltration that do not depend on the model.
Where Natural Language Ends in Agents: Executable Skill Composition with MetaSkill
Meng Shu; Wei He; Hang Zhou et al. arXiv: 2610.24723
MetaSkill: keeps complete Skill packages in natural language but makes invocation dependencies and predecessor-text bindings executable through a DAG runtime. Across 20 multi-skill artifact tasks and two LLMs, blinded judgments favor MetaSkill in all comparisons; intervals exclude parity vs Prompt Graph (DeepSeek-V4-Flash) and OpenClaw (GLM-5.2). In audited GLM-5.2 traces all planned nodes complete and all precedence constraints hold.
Key insight: Formalize only the coordination between skills (order and handoffs) and leave each skill's judgment in natural language.
When Retrieval Partially Conflicts with Skills: Understanding Procedural Hallucination in Language Models
Guanqun Jiang; Pengfei Cao; Kang Liu et al. arXiv: 2610.25827
SourceClash (1,271 bundles, 6,355 prompts, ten procedural domains) fixes task, skill and answer space while varying how retrieval relates to the skill. Across nine models, valid-answer rates average 25.7% under partly conflicting retrieval vs 78.2% / 72.8% under supportive retrieval ('procedural hallucination'). In open-weight models the preference gap peaks just after generation begins; most repair is attributed to attention value vectors.
Key insight: When retrieved context partly contradicts an active skill, models usually follow the retrieval and break the procedure.
Selm: Self-Evolving Library Management for Multi-Skill Agent Optimization
Mengxi Hu; Yuxuan Hu; Jinbo Su et al. arXiv: 2610.24630
SELM treats skill evolution as library management: utility-aware retrieval, Map-Reduce updates from task experience, and lifecycle controls that retain or remove skills by effectiveness, using skill confidence and utility signals. Evaluated on four agent benchmarks; outperforms in most settings (abstract gives no numbers).
Key insight: A skill library improves over time when skills are retrieved, updated and retired based on measured utility rather than simply accumulated.
EvoSkill v2: Fully Agentic Skill Evolution from Benchmark Adaptation to a Stateful Evolver
Dastin Huang; Baran Nama; Salaheddin Alzubi arXiv: 2610.25931
EvoSkill v2: benchmark adaptor + solver + evolver; the evolver is one stateful coding agent with a bash tool for the whole run (vs single calls in SkillOpt or fresh agents in SkillBoost). Accepts every epoch's skills instead of selecting on noisy scores. Held-out pass rate +7.7 points over the stronger baseline on SpreadsheetBench v2 and +5.4 on τ³-bench banking, at lower optimizer cost per point; Claude Haiku 5.5 as both solver and evolver gains up to 21.5 points on banking.
Key insight: A single stateful evolver agent with a shell, run across epochs, improves skills more cheaply than call-by-call or restart-each-round optimizers.
Are Self-Evolving Agents Continual Learners?
Xiaoyin Chen; Yizheng Huang; Yinglun Xu et al. arXiv: 2610.25858
Four drifting task streams (built from BIRD, BFCL, ScienceWorld) test ReasoningBank, GEPA and Meta-Harness. Self-evolution improves aggregate performance on most streams, but higher plasticity costs stability: self-modifying methods make global edits to a shared prompt/workspace that interfere with unseen tasks and overwrite earlier knowledge; similarity-based memory retrieval localizes updates but retrieves foreign memories and suffers retrieval collision when similar queries need conflicting workflows.
Key insight: Self-evolving agents gain plasticity at the cost of stability: global edits overwrite old knowledge, while retrieval-based memory collides on similar but conflicting tasks.
Understanding When Reflective Prompt and Skill Optimization Helps on Locally Served Reasoning Models: A Two-Model Study of GEPA and SkillOpt
Andrea Giummarra; Carmelo Baglieri; Antonio Di Maria et al. arXiv: 2610.26020
Replication of GEPA and SkillOpt on locally served reasoning models: DeepSeek V4 Flash via DwarfStar and Qwen3.8-27B via LM Studio, on HotpotQA (n=500) and MATH-500 (n=250). On Qwen, GEPA picks the HotpotQA seed and reproduces baseline; SkillOpt's validation gain reverses into held-out degradation. On MATH-500 GEPA lifts exact match 0.828 → 0.904 (Qwen) and 0.852 → 0.908 (DeepSeek), with lower latency but more tokens. Neither optimizer improves HotpotQA.
Key insight: Prompt and skill optimizers do not transfer cleanly to locally served reasoning models; validation gains can reverse on held-out data.
Symbolic Constraint Agents: Mining Formal Tool-Call Constraints to Prevent Agent Errors
Jinu Lee; Shraddha Barke arXiv: 2610.25552
SCA mines symbolic constraints from API docs, refines them on execution traces, and checks tool calls with an SMT solver at runtime (warning or auto-repair when the fix is unique). On AppWorld, refinement raises error-detection F1 37.0 → 58.3 (GPT-5.5 traces) and 39.3 → 61.9 (Qwen3.5-27B). Repair adds 5.4 points of task success for GPT-5.4-mini under a 40-call budget (9.8 with hidden env errors), removes 59–87% of failed calls, and transfers to τ²-bench (up to +5.6).
Key insight: Tool-call constraints mined from documentation and checked by a solver catch and repair a large share of failing calls before they execute.
Design and Cross-Domain Evaluation of an Agent Execution Harness
Saurav Joshi; Manas Gupta; Ashwin Venkatesh Raman et al. arXiv: 2610.25568
Harness that separates the original objective from a revisable plan and an execution record; planner assigns scoped tasks, workers produce artifacts, reviewer checks against the original request. Terminal-Bench 2.1: 83 of 89 (93.26%); HealthBench Professional (Fable-configured) 69.63 length-adjusted over 525 tasks; in a 53-task paired comparison +19.89 aggregate over direct completion but −1.46 median task-level change, with mean cost $0.29 → $2.13 per task.
Key insight: Separating an immutable objective from a revisable plan and execution record, with a reviewer, lifts scores but multiplies per-task cost.
Good Judgment, Bad Advice: Decision-Model Controllers Raise Agent Cost Without Improving Success
Naman Vats arXiv: 2610.24649
Pre-specified Terminal-Bench 2.1 study: a Claude Sonnet 5.5 terminal agent with controllers none / rules / Claude Haiku 5.5 / Jev 1.13 decision model / placebo. On 21 held-out tasks (315 trials), Jev raised cost per attempt 19% (ratio 1.19, 95% CI 1.02–1.36) at an identical 73.0% pass rate; cheaper than the Haiku controller (0.81) but 22% costlier than placebo. Offline Jev ranked finish requests best (AUROC 0.78 vs 0.62 / 0.60) but was poorly calibrated (mean completion probability 0.50 when 87% passed), so it requested needless verification.
Key insight: A decision model that ranks well can still raise agent cost if it is poorly calibrated, prompting verification of work that is already correct.
StopLoss: Teaching Agents to Predict Failure and Stop Early
Jiarong Liang; Xueguang Ma; Dongfu Jiang et al. arXiv: 2610.25525
StopLoss: small external monitor trained on completed trajectories labeled by verifier outcome; scores the latest tool-step window in one forward pass and aborts above a threshold calibrated on successful runs. Trained on GPT-family SWE-rebench trajectories; evaluated on SWE-bench Verified and a SWE-bench Pro subset with GPT and Claude executors vs six judges. Cost per retained solve −4.5% on Verified (99% of successes kept), up to −31% on Pro, 48% with a Qwen3-8B backbone; one to two orders of magnitude cheaper per check than any judge.
Key insight: A small outcome-trained monitor can predict failing coding-agent runs cheaply enough that stopping early pays for itself.
Agents' Last Doubt: Knowing When to Act and When to Step Back in Tool-Using Agents
Qisai Liu; Qingyue Jiao; Bangwei Guo et al. arXiv: 2610.24194
Counterfactual ToolSandbox dataset: 3,115 action outcomes from 1,036 decision points, each legal action executed and scored on task completion, interaction cost and irreversible errors. SURE-Act, a controller over a frozen backbone, improves offline action-selection utility by 0.0309 over regression-only and end-to-end Overall Score by up to 0.0575 with Qwen3-4B, beating adapted SAGE-Agent and Calibrate-Then-Act rules by 0.1506 and 0.1438.
Key insight: Executing every alternative at each decision point yields counterfactual data that teaches a controller when to act, ask or escalate.
Not Every User Says It All: Training Tool-Using Agents Beyond Ideal Simulated Users
Han Bao; Zheyuan Zhang; Kaiwen Shi et al. arXiv: 2610.24294
Weak simulated users (masked sentences, same task and knowledge) lower every policy's success on tau2-bench and ToolWOZ; training with them via masks, mixtures or curricula doesn't help, nor does prompting to ask more. StaGPO has the agent write what the task needs, what's missing and how it's being filled, and groups same-situation turns across rollouts for step-level credit in GRPO. Qwen3.5-2B trained with weak users reaches 76.8% with weak users on ToolWOZ (+4.8 over GRPO).
Key insight: Agents trained and tested with clear simulated users overstate success; tracking what is still missing per turn makes training with vague users useful.
Agentic Interpretation: Harness-Governed Evidence Construction for Software Agents
Yifeng He; Yanjun Wang; Siwei Cui et al. arXiv: 2610.23996
AgInt: the model proposes typed evidence records; a deterministic harness admits, grades and persists them, reports unresolved requirements, and licenses answers by task rules, yielding an auditable certificate. On SWE-bench-Live, DeepSWE, Defects4J and GitBug-Java with four models: GLM-5 reject-class F1 0.256 → 0.543 (SWE-bench-Live), All@1 0.140 → 0.400 (Defects4J), wasted inspected lines 31.5 → 11.7 (GitBug-Java); 35% fewer executions and 59% lower cost per candidate.
Key insight: Letting the harness own typed, persisted evidence records makes software agents more accurate and cheaper than free-form trajectories.
From Trace to Fix: Residual Task State in Long-Horizon Agents
Zile Huang; Ser-nam Lim arXiv: 2610.25776
TRACE-FIX turns execution logs into a dependency-linked ledger prioritizing unresolved requirements over salient surface errors, then plans recovery under a budget with outcome forecasting and an explicit repair reserve. LongH-Debug benchmark separates root-cause attribution, verified-fault recovery and closed-loop execution. Structured residual tracking improves causal localization over raw traces; budget-aware planning converts fault signals into more reliable recovery (abstract gives no numbers).
Key insight: Long-horizon recovery works better when the agent tracks unresolved requirements in a ledger and reserves budget for repair.
HABIT-Bench: Evaluating Habit Induction from Longitudinal Weak Evidence in Agent Memory
Junming Zhang; Rubin Wei; Xu Cheng et al. arXiv: 2610.24520
HABIT-Bench: synthetic user histories spanning hundreds of sessions (food, finance, software, travel) with controlled habit graphs, temporary exceptions, habit changes and unaccepted suggestions; four-choice tasks with human review. Eight memory methods with Qwen3-235B-A22B and GLM-5.3-Flash: best macro accuracy 33.61%, and performance stays limited even when annotated evidence is given directly.
Key insight: Inferring user habits from weak, scattered evidence remains far beyond current agent memory methods, even with the evidence handed over.
MemPrice: Online Memory Allocation via Adaptive Pricing for Long-Horizon Agents
Yiming Zong; Shiyuan Piao; Jiashuo Jiang et al. arXiv: 2610.24955
MemPrice treats active context as a shared resource and turns accumulated memory pressure into an adaptive price on context, allowing detail only when estimated retention value justifies it; enforces the hard context budget every round without knowing the horizon. Shows irreversible compression can force linear worst-case regret; evaluated under matched budgets on LongMemEval, LoCoMo, AppWorld and WebShop across three models (abstract gives no headline numbers).
Key insight: Treating context as a priced resource gives a principled way to decide how much detail each memory deserves under a hard budget.
Remembering Has a Price: Learning Memory Worth under Resource Constraints
Guannan Lai; Zi-Yang Bai; Jun-Peng Jiang et al. arXiv: 2610.26453
Under tight generation, interaction and memory budgets, several sophisticated lifelong-memory methods offer little advantage over simple retrieval or no memory. TokenWorth learns query-dependent memory worth from sparse execution feedback and applies it to retrieval and bounded memory management; across three LifelongAgentBench environments (local and API deployments) it gets the highest success with the fewest output tokens. Code released.
Key insight: Under tight budgets, memory pays off only when the agent learns which experiences are worth keeping and reusing.
Hippo: Training-Free Agent Self-Evolution via Hippocampal Replay
Yutong Song; Jiang Wu; Yuxuan Ren et al. arXiv: 2610.24453
Hippo compares attempts at the same task to extract reusable decisions and applicability conditions, then merges with existing memory and resolves conflicts instead of appending. An accumulation baseline without consolidation first improves then falls below no-memory. Gains on SWE-bench Verified, WebArena and Mind2Web with substantially fewer retained experiences, across base models of varying capability.
Key insight: Comparing attempts at the same task and consolidating lessons with explicit applicability conditions keeps experience memory useful over time.
Editing as Language: Teaching LLM Agents a Grammar for Native Context Editing
Yunlong Deng; Yan Li; Xing Hu et al. arXiv: 2610.25550
Native Context Editing encodes context-editing operations as dedicated special tokens so agents edit their own context during generation, trained on iteratively built trajectory segments. On Terminal-Bench 2.0 and SWE-bench Verified / Multilingual / Pro, average success +5.6 points (LongCat-Flash-Lite-Sparse) and +4.5 (Qwen3.6-35B-A3B) with 36% and 15% fewer tokens.
Key insight: Teaching models context-editing operations as native tokens improves long-horizon success while cutting token usage.
The KV-Surgeon: Compensation-Aware Offline KV-Cache Compaction
Moritz Wagner; Christophe Roux; Max Zimmer et al. arXiv: 2610.25933
KV-Surgeon uses calibration data and a quadratic surrogate with closed-form joint removal + compensation decisions, accounting for softmax coupling between entries. On QuALITY, LongHealth and Long Code Arena, it advances the cost-accuracy frontier for dense and MoE models 4B–30B at every compaction ratio; at 50× compaction up to +4 QA points over attention matching; a faster variant beats SOTA at two fifths of its cost.
Key insight: Accounting for how removing one cache entry changes all others gives much better offline KV-cache compaction at high ratios.
CUA-Lite: An Open Platform for Computer Use Agents
Zhanhui Zhou; Weichen Zhang; Haoran Liu et al. arXiv: 2610.26071
CUA-Lite: unified environment interface over 12 desktop/browser/mobile benchmarks plus VM-free sandboxes replicating OSWorld's desktop at lower cost (30,000+ verifiable tasks); a unified supervised data format for major public CUA datasets plus fresh frontier rollouts; and per-model harnesses for 14 model families shared across evaluation, RL and SFT. Reference scores released; RL and SFT through the same harness improve open-weight models. Data, code and models released.
Key insight: A shared environment interface, data format and per-model harness lets computer-use evaluation, RL and SFT run on one infrastructure.
Agent World Model in the Wild: Computer-Use Agent Environment Synthesis
Zhaoyang Wang; Qianhui Wu; Haorui Wang et al. arXiv: 2610.26828
WildAWM synthesizes executable environments jointly supporting GUI, MCP services and CLI, powered entirely by open-source models, with execution-based quality gates (heterogeneous rollouts, cross-judge consistency, counterfactual judge probes). 341 long-horizon environment-task pairs, some needing 100+ steps; GPT-6-Astra solves only 60%. Two Qwen models trained only in these worlds gain on 8 of 8 out-of-distribution web, claw and computer-use benchmarks. Code released.
Key insight: Synthetic worlds that mix GUI, MCP services and command lines, built with open models, train computer-use agents that generalize out of distribution.
VeriCUA: Learning Proactive Verification for Reliable GUI Agent Rewards
Zhizhou Wang; Yaxi Lu; Zhong Zhang et al. arXiv: 2610.26469
Prompted judges from 4B to GPT-5.4 plateau at 68–70% macro agreement when verifying CUA outcomes. VeriCUA trains a Judge to decide what to check and when to stop while a frozen Probe executes checks, via online RL from single verification attempts. Trained only on OSWorld, it has the highest agreement on OSWorld, MobileWorld and WebArena-Verified, beats few-shot GPT-5.4 by 5.36 points with 47.6–59.8% fewer probe tokens; a 1B VeriCUA beats every prompted judge; as Actor RL reward it lifts success 3.21 points.
Key insight: For GUI reward agents, learning what to check and when to stop matters more than verifier size.
ScopeMem: Latent Memory That Learns Where to Revise Frozen GUI Agents
Zhicheng Zheng; Cheng Zhang; Shengping Yu et al. arXiv: 2610.26503
Shows that latent-memory prefix gains for GUI agents come mainly from action revision, and step-wise CE breaks 8–13% of initially correct answers. ScopeMem conditions prefix generation on the model's initial answer to correct errors while preserving correct ones (broken-correct share 5.6%). On AndroidControl, GUI-Odyssey and zero-shot AITW it beats prompting and latent-memory baselines; a frozen Qwen3-VL-8B matches or surpasses GUI-specialized agents and Qwen3-VL-32B.
Key insight: Latent memory for frozen GUI agents mostly revises actions; scoping that revision preserves correct decisions while fixing errors.
OpenVLHarness: Real World Visual Agentic Tool-Use with Multimodal Memory
Yu Zhou; Cheng-Fu Yang; Rui Sun et al. arXiv: 2610.26860
OpenVLHarness: capability layer (task-level tool interfaces + evidence rendering) plus persistent multimodal memory of images, structured data and web references as addressable artifacts, with a coding interface over stored data. Across 22 benchmarks and eight backbones, +9.7 to +12.6 points over no-tool baselines (e.g. +11.2 Qwen3-VL-8B); with GPT-6 Luna at medium effort it beats the base model, Codex and Visual Sketchpad at max effort by 7.7–8.5 points at ≤37% of their token cost.
Key insight: A tool harness with persistent, addressable multimodal memory lifts visual reasoning across many benchmarks at a fraction of frontier token cost.
CoworkEnv: Synthesizing Training Environments for Long-Horizon Cowork Agents
Zhongwei Xie; Yiming Du; Jiaxin Bai et al. arXiv: 2610.24960
CoworkEnv synthesizes executable training environments for AI coworkers (requests, service records, tool interfaces, grading checks) with programmatic validation and feedback repair. Teacher executions give SFT demos, student rollouts give RL rewards. Compact PocketWorker models: Qwen3-VL-8B-Instruct SFT lifts Claw-Eval mean from 46.6 to 64.1 (+31.9 on multi-turn); SFT-only extension to ClawMark.
Key insight: Synthesized, validated cowork environments let compact models learn multi-turn tool workflows through SFT and RL.
The Window Is in the Reasoning: When LLM Agents Decide to Follow Prompt Injections
Haoxuan Jia; Yang Liu; Bin Chong et al. arXiv: 2610.24048
Branching rollouts replay an AgentDojo episode up to the injection read and resample the rest. A Qwen3 agent without thinking is largely decided at read time (0.91 of outcome variance between states); with thinking, 0.62. Thinking lowers Qwen3's attack success but raises it for two other models. Cheap zero-shot CoT monitors miss much of what's decided; stronger and lookahead monitors come close. Single-run labels of thinking agents disagree with a rerun up to 35% of the time.
Key insight: Whether an agent follows a prompt injection is often decided during its later reasoning, not at the moment it reads the injection.
RATION: Towards Quantitative Risk-Based Access Control for AI Agents
Yuntao Du; Harsh Chaudhari; Yuetian Chen et al. arXiv: 2610.24311
RATION builds a task-specific policy from explicit constraints in the user request plus implicit risks calibrated from historical executions of similar tasks, then tracks accumulated measurable risk during execution with risk-type-specific enforcement. Strong security with high utility across four security benchmarks, models and environments (abstract gives no numbers).
Key insight: Tracking accumulated, measurable risk during execution offers an alternative to blunt action restrictions for agent security.
Write Once, Check Many: Reusable Ledgers for Post-Hoc Policy Compliance Auditing of Agent Trajectories
Ashwin Nagarajan; Gursimran Panesar; Alicia Yang et al. arXiv: 2610.24483
A writer model converts each trajectory into a policy-independent ledger; a reader checks new policies against the ledger alone. On 900 trajectories from SHADE-Arena, τ-bench and τ²-bench, a 12B reader of narrative ledgers matches or beats the same model reading full trajectories; on multi-fact SHADE-Arena policies it beats a 31B trajectory reader (.777 vs .713 AUC); ~5× fewer tokens for eight policies including writing cost. Ledgers can miss evidence in long tool outputs.
Key insight: Converting each trajectory once into a policy-independent ledger makes later compliance audits cheaper and often more accurate.
Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs
Junru Zhu; Xin Chen; Hang Lyu et al. arXiv: 2610.24298
Separates communication, authorization and execution structures in multi-agent LLM systems and uses an 'authority cut' to characterize the smallest compromised signer coalition that can build a policy-valid false-claim proof. On invalid-proof cases Nemotron and Llama request protected actions in 52.1% and 54.2% of trials, yet a deterministic tool gate commits none; a false claim with a policy-valid compromised-signer proof can still pass the gate.
Key insight: In multi-agent systems, what models request and what tools commit diverge, and a valid signature on a claim does not make it true.
Is This Your Agent? Identity Watermarking for Agent Systems in Dynamic Environments
Yuwei Zhong; Yu Cheng; Jiuan Zhou et al. arXiv: 2610.24382
DASMark: identity watermarking for agents whose memories, skills and configs keep changing. Action-Preserving Embedding learns semantically similar but distinguishable decision-expression channels; Shift-Robust Recovery handles context-induced shifts. 98.5% bit-decoding accuracy in dynamic settings, 95.2% under attack, with task utility comparable to unwatermarked agents.
Key insight: Agent identity can be watermarked into decision behavior in a way that survives evolving memories, skills and configurations.
Teaching Code Agents to Ask Without Leaking Private Code
Wenjia Jiang; Jieke Shi; Zhensu Sun et al. arXiv: 2610.24824
Utility-verified abstraction (UVA) teaches a local coding agent to describe private entities by role and type when consulting a stronger cloud model, keeping a rewritten question only if it discloses fewer private entities and the repair still succeeds when replayed. On repository-level issue repair the trained agent solves 37.6% vs 25.3% alone, consults more often, and its questions disclose 3.7× fewer private entities and 1.4× less verbatim code.
Key insight: A local coding agent can learn to consult a cloud model with abstracted questions that leak far less private code while solving more issues.
News and changelogs
- Claude Code: v2.1.304 adds
decider: "person"on a mod'stool.checkanswer (only the permission dialog or a host callback can approve, and the call is refused with the mod's reason where nobody can be asked),e.isReadOnlyontool.checkevents, a transcript line when a first-running plugin skips a mod's hooks,/auto-mode-setup(a guided setup that reads the project and recent sessions to teach auto mode, now also on Bedrock, Vertex, Foundry, Claude apps gateway and telemetry-disabled sessions),/claude-api managed-agents-secure(compares a Managed Agents agent's settings with Anthropic's published security guide without changing anything), earlier tool names in the compaction summary, and a Pro/Max warning when resuming an inactive conversation would use a noticeable share of the 5-hour limit — the human-only approval path and read-only flag give agent builders new permission-hook primitives for harness guards. link - Vercel: Vercel posted updates to its Hobby and Pro Terms of Service (the feed carries no summary) — a terms notice for anything hosted on those plans; read the post for specifics. link
- OpenAI news: OpenAI describes improving ChatGPT across low-resource programming languages, with new evaluations for software engineering, SQLite and COBOL migration — new evaluation targets for coding agents outside mainstream languages. link
- Vercel: two new AI Gateway model listings: Mercury 3, and MiniMax M3.1 Flash (free on the gateway) — more routing options behind one gateway API for agent platforms. Mercury 3 · MiniMax M3.1 Flash