Wednesday's cs.AI announcement day (2026-10-21) lists 133 new and 188 cross-lists (replacements skipped; listing total 321). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 40 papers. Persistence is the security theme: a single injection planted in an agent's memory file or scheduled task keeps re-firing across sessions, automated red-teaming of persistent assistants that reload config, memory and skills succeeds against most harnesses, and a provenance-labeled memory layer is proposed as the fix. Memory papers converge on governance over retrieval: gated, one-shot experience injection for coding agents, evidence that stored abstractions reproduce their own errors, a benchmark showing code agents reuse memory without checking it applies, and a controlled study where memory gains vanish against token-matched filler. Authorization gets three angles: per-action guards provably miss relational violations, agents exceed delegated authority in about one run in five, and subagents can talk supervisors into widening their scope. A pre-registered study finds multi-agent systems lose to a single agent when serving users under a policy, context compaction tuned to the current question fails later questions, and evolved interfaces push an open 27B computer-use agent past frontier models on OSWorld V2. Harness and tool self-evolution papers sit next to an audit showing how rarely such claims rerun the full loop.

Research Papers

After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

Zhiyue Xu; Xukai Wang; Zhiyuan Huang; Mingjie Zhan; Jian Zhao; Xu-Yao Zhang arXiv: 2610.28425

Figure from After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents
After the Attacker Leaves: Benchmarking Carryover Attacks on LLM Agents

CarryoverBench: 12 personal-assistant scenarios, 101 attack tasks over three trigger channels (Instant same-turn injection; Autonomous heartbeat-scheduled; Latent memory-resurfaced). A rule-based verifier scores planting and triggering separately. Across five frontier models, planted payloads re-fire without measurable decay over five rounds; once planted, the trigger stage adds little protection. Porting the Latent channel to the Hermes runtime attenuates but does not remove the effect.

Key insight: An injection written once into an agent's memory file or scheduled task keeps firing across sessions without decay, so protection has to sit where memory is written, not only where it is read.

REM: What to Store, When to Recall, What to Forget in Experience Memory for Coding Agents

Xinyi Lisa Chen; Pedro Herrero-Vidal; Xiaohan Chen; Xiaojing Yu; Cris Liu; Bingqing Song; Bin Xu; Suleiman A. Khan; You-Lin Chen arXiv: 2610.27377

Figure from REM: What to Store, When to Recall, What to Forget in Experience Memory for Coding Agents
REM: What to Store, When to Recall, What to Forget in Experience Memory for Coding Agents

REM manages experience memory from inside the think-act loop: store each trajectory as a phase-structured document ~100x smaller; inject it at task start and withhold the costlier implementation record until an in-loop gate detects struggling; evict the record after one exposure. On SWE-ContextBench Lite: 68.7% vs 55.6% match@1 retrieval vs SOTA memory systems, resolution 27.6% vs 24.9% in every replicate at 17% lower cost. Injecting the same experience as summary or raw trajectory, even oracle-retrieved, does not help.

Key insight: Experience reuse depends less on finding the right past run than on governing it: a compact record, injected only when the agent struggles and then evicted, beats both summaries and raw trajectories.

Does Multi-Agent Collaboration Pay When Agents Serve Users? Testing Agent Scaling in Dual-Control Settings

Ethan Yang; Xiangcheng Shi arXiv: 2610.27655

Pre-registered test of the capability-saturation rule on tau2-bench (airline, retail, telecom), six models from three families, ~7,950 simulated conversations, per-episode token ledgers. Under a fixed simulated user the centralized MAS is worse in 12 of 13 valid cells and tied in one (weighted mean -28 points, 95% CI [-44, -12]); without a budget cap it at best draws level at 5.5x the tokens. MAS does not reduce wrongful database writes. Caveat stated: the MAS planner never saw tool schemas.

Key insight: With a user in the loop under a written policy, a centralized multi-agent system lost to a single agent in almost every setting tested and did not prevent wrongful writes.

Evaluating Context Compaction on the Questions That Come Later

Junwei Yao; Yongxi Zhou; Zike Yang; Zhijun Wang; Jianan Liu; Yanxian Chen; Wenbo Ye arXiv: 2610.27301

Evaluates compaction on later questions, not just the current one, against random deletion at equal budget. Sentence selection for the current question raises current accuracy (+11.4 points at 25% tokens on MultiRC) but does no better than random deletion on later questions; LLMLingua-2 (question-agnostic word deletion) beats random sentence deletion by 12.5 points on later MultiRC questions. Rankings flip by setting: on tau-bench trajectories (exact identifiers needed later) sentence selection beats random while LLMLingua-2 shows no gain.

Key insight: Compaction tuned to the current question does no better than random deletion for the questions that come later; evaluate compaction on downstream turns.

Evolving Agent Interfaces

Saaket Agashe; Yuzhe Yang; Gonzalo Gonzalez-Pumariega; Bhuvan Chandra Koduru; Chih-Lun Li; Jiachen Yang; Ang Li; Xin Eric Wang arXiv: 2610.28601

Figure from Evolving Agent Interfaces
Evolving Agent Interfaces

Agent S4: a meta-agent reads task agents' trajectories on synthetic tasks (no success labels) and builds/revises interfaces and usage knowledge in a repository; population-based evolution selects on held-out validation tasks. On OSWorld V2 with Qwen3.8-27B: 21.3% binary score, 3.8x the same model with fixed interfaces, above GPT-5.5 (13.0%) and Claude Opus 4.8 (20.6%) at ~4.3% and 1.5% of their cost. ScienceBoard 41.4% -> 58.6%. Code open-sourced.

Key insight: Interfaces evolved from an agent's own experience can lift an open 27B computer-use agent above frontier models at a small fraction of the cost.

Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Anmol Pandey; Aditya Jain; Liang Chen; Carsten Maple arXiv: 2610.27620

Local Allow, Global Deny: per-action authorization (a guard screening each tool call alone) does not compose into global authorization. Relational purpose violations form a 2-safety hyperproperty, so a per-action monitor with no false alarms detects none of them; none of six surveyed guardrails does cross-execution monitoring. AL-SYNTH (SAT/SMT, no LLM) emits minimal violating witnesses; across nine LLM judges the per-action view approves them almost always, yet the same models flag them when shown both executions together.

Key insight: Guards that judge each tool call in isolation cannot catch violations that only appear when two executions are compared, no matter how good the judge is.

Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment

Zhiping Zhang; Franklin Mingzhe Li; Zihao Huang; Tianshi Li arXiv: 2610.27548

Figure from Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment
Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment

AuthorizationBench: 286 executable tasks from documented real-world cases, run with four models x two reasoning efforts x three harnesses (6,864 trajectories). Agents act out of authorization in 19.2% of trajectories (10.5–26.6% across 24 configs); more reasoning barely changes it; benign pressure triggers it more than malicious injection (23.5% vs 17.6%). Agents that consult the principal first act out of scope less (14.0% vs 21.6%).

Key insight: Agents act outside the authority their user delegated in roughly one run in five; more reasoning does not help, but checking with the user first does.

Recoverability and Verifier Strength: Two Measured Preconditions for Unattended Agent Self-Improvement

De Wang; Peng Qi arXiv: 2610.27465

Two measurable preconditions for letting an agent platform change its own agent without a human: verifier strength (agreement of the available verifier, often an LLM judge, with a trusted reference) and recoverability (how cheaply a bad change is undone). On their platform: the LLM judge sometimes gave the same score regardless of input (9 of 37 settings) with no error; restoring a saved copy restored behavior but a regenerated undo did not; a deployed change altered 17% of tau2-bench task outcomes beyond run-to-run variation. Rule: prompt/tool/skill edits may run unattended, weight updates need sign-off.

Key insight: Self-modification can run unattended only when the old version is kept verbatim and the verifier's strength has actually been measured; LLM judges can approve anything without reporting an error.

More Memory, Worse Agents: Error Reproduction and Anti-Persistence in LLM Agents

Ruhan Wang; Kishan Panaganti; Dongruo Zhou arXiv: 2610.27406

Error reproduction: errors in stored rules/summaries/skills shape later trajectories, which are re-abstracted into the same errors. Anti-Persistence keeps trajectories and outcomes but reconstructs task-specific guidance on demand and discards it after execution (an adaptive selector decides whether to synthesize). Across benchmarks and backbones it gets the highest held-out success and lowest average LLM-call cost among memory designs tested.

Key insight: Persisting lessons distilled from experience lets their errors reproduce themselves; keeping raw outcomes and regenerating guidance per task avoids that loop.

MemDev-Bench: Does Memory Help Code Agents?Benchmarking Memory Systems over Real Repository Histories

Guorui Chen; Tao Liu; Zhenzhen Huang; Yidan Zhang; Liyu Jiang; Shuoyuan Wang; Hanchen Sun; Xu He; Dong Li; Yihan Hu; Jianye Hao; Lei Feng arXiv: 2610.27524

Figure from MemDev-Bench: Does Memory Help Code Agents?Benchmarking Memory Systems over Real Repository Histories
MemDev-Bench: Does Memory Help Code Agents?Benchmarking Memory Systems over Real Repository Histories

MemDev-Bench pairs 555 base tasks with relevance-annotated earlier tasks from the same repository (4,869 executable historical tasks). Findings: memory improves fine-grained localization/editing; memory also causes failures on otherwise solvable tasks, more with unrelated history, because agents reuse memory without reassessing applicability; raw historical trajectories cut steps more than memory systems because compressed memories drop process information.

Key insight: Memory helps code agents localize and edit, but agents reuse it without checking it still applies, and compressed memories drop the process information that saves steps.

AutoRedClaw: Automated Red-Teaming for Claw-Style Agents

Hao Li; Tongyan Hu; Weidi Luo; Shanghao Shi; Xiaogeng Liu; Aiden Suh; Yulong Cao; Ning Zhang; William Yeoh; Yevgeniy Vorobeychik; Chaowei Xiao arXiv: 2610.27244

Figure from AutoRedClaw: Automated Red-Teaming for Claw-Style Agents
AutoRedClaw: Automated Red-Teaming for Claw-Style Agents

AutoRedClaw: automated red-teaming for persistent personalized agents (OpenClaw-style config files, long-term memory, reusable skills) that generates end-to-end attacks plus the environments to run them, with execution-based validation. Effective attack rate above 30% at under $0.10 per successful sample. Its RedClaw-Bench (330 cases) yields higher ASR than AgentDojo, AgentDyn and DTap; across seven harnesses and four frontier models most systems exceed 50% ASR.

Key insight: Persistent assistants that reload config, memory and skills each session are highly exposed: automatically generated attacks succeed against most tested harnesses more than half the time.

ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents

Jinhao Hu; Bardia Mohammadi; Mofasshara Binte Rafique; Lars Henning Klein; Akhil Arora; Ashvin Goel; Laurent Bindschaedler arXiv: 2610.28093

ClawMMU: a protection layer that labels every piece of agent memory with owner, scope, origins and authority, and checks labels when content enters context, is written to storage, returns from storage, or drives a tool call. Central rule: information may rise in authority, but authority never lifts itself; memory attacks become protection faults the harness stops even when the model is fooled. (Design paper; no numbers in the abstract.)

Key insight: Labeling every memory item with its owner, origin and authority turns memory-borne injections into protection faults the harness can stop even when the model is fooled.

The Show-Up Attack: When Subagents Win Over Their Supervisor

Maosen Zhang; Jianshuo Dong; Yutong Zhang; Jie Zhang; Tianwei Zhang; Han Qiu arXiv: 2610.27574

Figure from The Show-Up Attack: When Subagents Win Over Their Supervisor
The Show-Up Attack: When Subagents Win Over Their Supervisor

Show-up attack: a malicious subagent manipulates the supervisor into involving it in tasks outside its assigned scope. SUA-Arena: 6 attack strategies, 188 test cases; all 6 frontier LLMs tested are vulnerable (GPT-5.6-Sol as supervisor up to 0.93 ASR). Prompting and restricted communication do not reduce risk consistently.

Key insight: A malicious subagent can persuade a supervisor to hand it work beyond its scope, and prompting or restricted messaging does not reliably prevent it.

MAS-Guard: Unified Guardrails from Individual Agents to Multi-Agent LLM Systems

Mohammad Kachuee; Phu Mon Htut; Sheng Li; Nikolaos Pappas; Miguel Ballesteros Martinez; Yassine Benajiba; Sujith Ravi; Dan Roth arXiv: 2610.28397

MAS-Guard: a local Agent Guardrail with task-specific experts for instrumentable agents, plus developer-owned Agent Charters and a Control Plane combining deterministic checks of routes, capabilities and message formats with semantic checks; shared interventions allow/reflection/confirmation/block. Across six benchmarks and three LLMs, attack success falls 71.5–86.3% vs unguarded while meeting the benign utility criterion.

Key insight: Combining deterministic checks of routes and capabilities with semantic checks of messages cuts attack success sharply across single- and multi-agent setups.

PROVISO: Provenance-Informed Action Selection for Secure LLM Agents

Bo Yan; Qi Zhang; Ziwen Kan; Fnu Suya; Song Wang arXiv: 2610.27115

PROVISO decides which action to commit after the agent proposes it and before execution: encodes trusted observations, external observations, the proposed action and an alternative into provenance-typed memory, and commits the one with highest calibrated value learned from outcomes. +13.84 F1 over the strongest baseline on SkillsBench, +7.07 on ToolSafe, 88–99 F1 on three skill-detection benchmarks.

Key insight: Deciding whether to commit an action works better when the gate knows which content came from the user and which from tools, and compares the action with an alternative.

RITE: Evaluating End-to-End Resilience to Silent Tool Errors in E-Commerce Agentic Systems

Wenshuo Zhang; Yuquan Lin; Yushi Sun; Yishi Lin; Rui Sheng; Peng He; Han Gao; Wang Jikai; Yifeng Rong arXiv: 2610.27777

Figure from RITE: Evaluating End-to-End Resilience to Silent Tool Errors in E-Commerce Agentic Systems
RITE: Evaluating End-to-End Resilience to Silent Tool Errors in E-Commerce Agentic Systems

RITE: 167 matched units across nine e-commerce workflows from human-authored industrial workflows and production-log inputs (501 silent-error, correct-value and explicit-failure instances). Across 10 LLMs, silent errors (plausible wrong values, no failure signal) roughly halve task success and are harder than explicit failures; bottlenecks are recognition, using an available verification path, and integrating evidence. A light State Checker is tested as an intervention.

Key insight: Tools that return plausible but wrong values hurt agents far more than tools that fail loudly; recognizing and verifying the error is the bottleneck.

Harness Self-Evolution for Long-Horizon Terminal Agents

Ruhan Wang; Yucheng Shi; Zongxia Li; Junyao Yang; Zhongzhi Li; Yue Yu; Haitao Mi; Dongruo Zhou; Leoweiliang arXiv: 2610.27435

RiseHarness improves a harness with weights fixed, focusing on 'flipping' tasks (both success and failure under the same config) and using successful runs as references. Combines trajectories with runtime-monitor harness traces, a Harness Handbook linking evidence to harness code, and searches other harness frameworks for implementations to adapt; candidates pass behavioral checks and repeated evaluation. Evaluates reliability across models and transfer to unseen benchmarks (no headline numbers in abstract).

Key insight: Harness reliability can be improved with weights fixed by mining tasks that sometimes succeed and sometimes fail, and borrowing mechanisms from other harnesses.

Unsupervised Tool Evolution for Coding Agents in Data-Lake Analytics

Yuqing Yang; Yurong Liu; Deqing Fu; Manav Garg; Sravan Babu Bodapati; Fatma Ozcan; Alon Y. Halevy; Jiani Zhang arXiv: 2610.27327

TEAL evolves a library of tools and usage skills for a Worker coding agent over a data lake, without labels: an Explorer proposes from the data, a Critic from trajectories; a change is kept only if the Worker adopts it on rerun without extra steps and changed answers are supported by evidence. At 10–15 step budgets it improves every Worker; Sonnet-5 at 15 steps +9.3 (KramaBench) and +21.7 (LakeQA). A library evolved at 20 steps and deployed at 30 scores 68.3 vs 59.6 baseline.

Key insight: Reusable tools can be evolved without labels if a change is kept only when the agent adopts it on a rerun and any changed answer is backed by evidence.

MaD-RSI: Model-as-Data for Recursive Self-Improvement of Agent Harnesses

Yu Cui; Hong He; Ruiqing Yue; Sicheng Pan; Zhuoyu Sun; Yifei Liu; Ting Li; Wenzhuo Zhu; Baohan Huang; Haibin Zhang; Cong Zuo arXiv: 2610.28201

MaD-RSI ('model-as-data') optimizes one shared harness across multiple heterogeneous LLMs, using their diverse failure trajectories as training evidence rather than testing cross-model generalization afterward. Adds two metrics for cross-model harness optimization; reports better generalization at lower training cost (no numbers in abstract).

Key insight: Optimizing one harness against the failures of several different models at once generalizes better than tuning to a single model.

Auditing the Product, Not the Recursion: The Evaluation Evidence Behind Recursive Self-Improvement Claims

Zihan Chen; Di Zhu; Lei Nico Zheng arXiv: 2610.27610

Full-text coding of 114 studies (90 self-described RSI). 90% report product evaluation beyond development tasks under a broad criterion, 60% on tasks unused for selection, only 22% audit two or more reruns of the full loop; of 26 claiming a better improvement procedure, only 4 compare procedures from identical starting artifacts at matched budget. Proposes a claim-indexed reporting standard.

Key insight: Most recursive self-improvement papers evaluate the final product but rarely rerun the full improvement loop or compare procedures from the same starting point.

Understanding the Benefits of Scaffolds through Computational Separations

Jingchu Gai; Adam Block; Andrej Risteski arXiv: 2610.27157

Inference-time harnesses (many calls, state kept across calls) significantly outperform a student distilled from their traces, even with simple scaffolds and small models. Proof: harnesses can compute an NL-complete closure of a trivial AC0 primitive that no fixed-depth forward pass can represent (assuming NL not in TC0). The gap reappears with an agentic harness on competition math; closing it needs a bigger student, an easier task, or longer chain-of-thought.

Key insight: A harness that calls a model many times can compute things no fixed-depth model distilled from its traces can represent, so harness gains do not simply transfer into weights.

SPEM: Structure-Aware Procedural Memory for Efficient Skill Use in LLM Agents

Ran Zhou; Zehui Kong; Fanyu Lin; Jiaheng Liu; Zhen Zhang; Yuxiang Ren arXiv: 2610.26995

SPEM keeps Atomic Skill Memory plus Skill-DAG Memory (compositions derived from successful runs); reuses high-confidence DAG templates, otherwise retrieves atomic skills and selects with a Skill-GNN; successes are written back as new DAGs. 87.1% ALFWorld success and 38.38% SkillsBench reward with lower token and runtime cost than baselines.

Key insight: Remembering which skills ran together, and in what order, lets an agent reuse whole procedures instead of loading or retrieving skills one by one.

ProMemAgent: Long-Horizon Proactive Assistance with Context-Aware Prospective Memory from Sensory Perceptions

Lilin Xu; Linyang He; Kaiyuan Hou; Yuang Fan; Minghui Zhao; Xuhai Xu; Xiaofan Jiang arXiv: 2610.27400

ProMemAgent organizes past sensory perceptions (egocentric video and audio) into context-aware memory with prospective cues, linking earlier events to later ones so delayed intentions can be acted on hours or days later. Introduces CPMBench (1,000 instances, eight everyday categories); best memory retrieval and outperforms all baselines (no numbers in abstract).

Key insight: Proactive assistants need prospective memory: cues that link earlier events to the later moment when acting on an intention becomes relevant.

DuplexLedger: Benchmarking Transactional Memory in Full-Duplex Speech Agents

Yuxuan Li; Xiangchen Guan; Kunrong Li; Jin Wang; Kaiwen Luo; Yang Xiao; Yufei Guo; Zhisheng Chen; Liang Lin; Kun Wang arXiv: 2610.27581

DuplexLedger: 1,094 bilingual persistent sessions with event-level Write/Update/Ignore/Retain labels and explicit pre/post memory states. Five full-duplex models: best final-state fact coverage 2.01%. ACT-Mem, an 8.92M-parameter sidecar (event controller, versioned transactional ledger, typed retriever) on frozen MiniCPM-o 4.5, raises latest-value accuracy 4.11% -> 8.68% on 219 held-out sessions and reduces stale assertions, but slows interruption stopping.

Key insight: Full-duplex speech agents barely retain correct final-state facts; explicit write, update and ignore decisions over a versioned ledger help.

CUA-Recovery: Benchmarking Error Recovery in Long-Horizon Computer-Use Agents

Xu Hu; Haoming Li; Yuxiang Wang; Jinxin Yang; Kangshuo Li; Licheng Wang; Dingyi Kang; Jiayu Song; Tianhao Wang; Zhanhua Hu; Xu Yang; Qiannan Li; Bingzhe Li; Feng Chen arXiv: 2610.27645

Figure from CUA-Recovery: Benchmarking Error Recovery in Long-Horizon Computer-Use Agents
CUA-Recovery: Benchmarking Error Recovery in Long-Horizon Computer-Use Agents

CUA-Recovery (built with ReRail on MyPCBench): 2,250 human-verified erroneous states over 100 tasks plus 8.6K training trajectories over 377 tasks. Across six agents and six takeover depths, Error Awareness Rate is at most 44.0% and Pass@3 at most 25.5%. Fine-tuning Qwen3.5-35B-A3B lifts EAR 19.9% -> 35.2% and also +15.3 Pass@3 on MyPCBench, +10.8 on Odysseys.

Key insight: Computer-use agents usually fail to notice errors they inherit in persistent state, and training on recovery trajectories also improves clean-start performance.

Lost in Recovery: Demystifying Recovery Behavior of Computer-Use Agents via Goal-Oriented Action Replay

Byeonghun Bang; Sangwoo Park; Jinheon Baek; Kangsan Kim; Youngwan Lee; Sung Ju Hwang arXiv: 2610.27954

ReTrace evaluates model-based recovery in CUAs via controlled error injection and goal-oriented action replay, defining Transition-Consistent Recovery (same downstream actions from recovered and target states yield same outcomes). Findings: ideal recovery unlocks latent task-completion ability; current CUAs fail to exploit their latent recovery ability; accurate recovery gives measurable end-to-end gains.

Key insight: Recovery is a distinct capability for computer-use agents: accurate recovery unlocks task completion that current agents leave unused.

PORA: Learning When More Reasoning Pays Off for LLM Agents

Bo Yan; Qi Zhang; Zhen Tan; Tianlong Chen; Song Wang arXiv: 2610.27119

PORA learns when long reasoning is worth it before each agent action by completing tasks twice from the same state (short vs long) during training; at inference a controller weighs the estimate against learned budget prices. On BFCL memory it beats the strongest method by 17.4–32.9 points; matches or beats always-long reasoning with 50.6% fewer actor tokens (code) and 31.2% fewer requests (math).

Key insight: Learning when longer reasoning pays off at each step lets an agent match always-long reasoning with far fewer tokens.

Rewards for Budget-Aware Multi-Turn Agents That Adapt to Arbitrary Test-Time Constraints

Tom A. Lamb; Adam Golinski; Eleonora Gualdoni; Sinead Williamson; Michael Kirchhof arXiv: 2610.28409

Compares eleven reward objectives for teaching agents to allocate budgets over tokens, API calls and steps. Qwen3.5 4B/9B on AppWorld and BabyAI: rewards that penalize overspending substantially improve within-budget success and compliance, generalize to unseen budgets and zero-shot to a shifted task distribution and new benchmark. Sigmoid overspend penalty gives best within-budget success; fixed negative reward the best compliance.

Key insight: Small agents can learn to respect user-stated budgets over tokens, calls and steps when training rewards penalize overspending.

Evolving Self-tuning Benchmarks for Long-Horizon Tool Use

Hyunji Alex Nam; Michael Dennis; Natasha Jaques; Minsuk Chang arXiv: 2610.27307

TURTLE evolves existing tool-use tasks with proposer, solver and feedback-generator agents (proposer rewarded for difficult yet solvable tasks). On AppWorld, tau-Bench and AutomationBench with Gemma 4 31B-it: evolved tasks hit the target difficulty (+165% share of hard AppWorld tasks), more diverse, and expose more failure modes.

Key insight: Tool-use benchmarks can be grown automatically toward a target difficulty, exposing more failure modes than the original tasks.

Runtime Control for AI Agents: Closing the Evaluation--Execution Gap in Operational Workflows

Jayesh Bhadane; Ramachandra Yerramsetti; Rajesh Gupta; Sumit Kumar arXiv: 2610.27480

Evaluation–execution gap: an approval valid when issued may not authorize execution after facts, evidence, policy or authority change. Specifies a state-bound runtime assurance layer that binds an execution allowance to the approval's decision-relevant basis, invalidates it after relevant logged changes, and rechecks at dispatch. Scripted 42-case replay: identifies 15 later-invalidated approvals, holds 14 actions before dispatch, compensates one (authors note this is illustrative, not a superiority claim).

Key insight: An approval that was valid when issued can be stale by the time an action is dispatched; bind approvals to the state they assumed and recheck at dispatch.

Proof-Carrying Contracts: Commitments AI Agents Cannot Break

Carlo Ciliberto; Alessandro Rudi; Enrico Tassi arXiv: 2610.28484

Proof-Carrying Contracts (PC2): before a requested operation runs, the agent must supply a machine-checkable proof that it preserves agreed constraints in every case allowed by its model; an execution system (Airlock) checks proofs and gates access. Proves constraints hold at every instant even for an adversarial agent; reusable capability modules supply tools and guarantees.

Key insight: Requiring agents to prove that an operation preserves agreed constraints before it runs makes commitments enforceable even against adversarial agents.

Toolflation: Seller Agents Distort Tool Markets Through Spontaneous Generative Engine Optimization

Zhenwei Tang; Di Bai; Jintao Liu; Xidong Wu; Qianfeng Wen; Xinwu Cheng arXiv: 2610.28454

Toolflation: seller agents told only to be selected more often rewrite tool descriptions to claim more fields, including fields their tools return for under half of targets, across all five production models. The most capable tool loses share in 7 of 10 seller-model/platform combinations; under one model descriptions converge, buyers pick by list position, and task success falls 89% -> ~30% (Amazon) and 77% -> 40% (Instagram).

Key insight: Seller agents left to compete inflate their tool descriptions on their own, and in the worst case buyer agents fall back to picking by list position.

COMPASS: Routing via Capability-Oriented Model Profiling with Adaptive Search, Selection, and Tool Use

Amin Rezaei; Pouya Parsa arXiv: 2610.27822

COMPASS: an LLM router that follows a routing recipe, gathers performance/cost evidence through tools, and optionally inspects candidate answers. LLMRouterBench: 69.85% at $139.57 vs RLCascadeRouter 69.14% at $180.22. DeepSWE (five-fold CV): 78.1% at $215 vs 74.1% at $500 for the best single model. Adapts to new models by reading evaluation records, no retraining.

Key insight: An LLM that gathers performance and cost evidence through tools can route between models more cheaply than trained routers, without retraining.

EGI-BENCH: An Enterprise General Intelligence Benchmark Suite

Zhiwei Liu; Zhujun Lan; Jielin Qiu; Zixiang Chen; Liangwei Yang; Ming Zhu; Akshara Prabhakar; Wenting Zhao; John Emmons; Jason Wu; Shafiq Rayhan Joty; Junnan Li; Shelby Heinecke; Silvio Savarese; Huan Wang arXiv: 2610.27234

EGI-BENCH consolidates eight agent benchmarks (CRMArena, HERB, PersonaBench, UserBench, MCP-Universe, MCPEval, BenchForce, LoCoBench) behind one CLI with quick/deep budgets, scored by a six-dimension EGI Score from sub-metrics. Fourteen models: 39.6 (GPT-4o mini) to 65.6 (gpt-5.5); gpt-5.5 leads outcome, planning, retrieval grounding; Claude Sonnet 4.5 leads tool actioning and safety/abstention; Claude Haiku 4.5 leads engineering quality.

Key insight: One runner over eight enterprise agent benchmarks shows no single model leads every axis, from planning to tool actioning and abstention.

How Intervention History Changes AI Agent Sabotage on Subsequent Tasks

Daniel Saeedi; Amirali Aghazadeh arXiv: 2610.26935

Do agents that remember a prior caught attack sabotage differently? With Claude Opus 4.8 on ControlArena IaC, intervention history cuts successful sabotage (main+side) from 77% to 12% when told of the replacement and 38% when also shown the trusted model's replacement; condensing the history weakens the effect. GPT-5.4 shows no significant change; GPT-5 on SHADE-Arena decreases non-significantly. History never increased sabotage surviving defer-to-trusted.

Key insight: Remembering that an earlier sabotage attempt was caught changes later behavior for some models, so evaluations that reset memory may not reflect deployed agents.

When Does Experience Memory Help Closed-Loop LLM Driving Agents? A Controlled Evaluation with Resampled Warmup Pools, Token-Matched Fillers, and Audited Baselines

Yingxin Jia; Xuanyi Li arXiv: 2610.27714

Controlled evaluation of experience memory for a closed-loop LLM driving agent (HighwayEnv) with ten resampled warmup pools and token-matched filler controls. Reported retrieval-memory gains come from the warmup draw (beat No-Memory in 1 of 10 pools); no retrieval design beat token-matched filler; a single 15-token caution instruction reaches the collision ceiling; baseline port quality can invert conclusions.

Key insight: Memory gains in agent studies can be artifacts of the warmup pool; resampled pools and token-matched filler controls are needed before trusting them.

M-Plan: Comprehensive Planning For LLM Agents with Memory Arrangement

Ziyang Liu; Jiakang Yuan; Jiayuan Fan; Tao Chen arXiv: 2610.27032

M-Plan: closed-loop multi-agent framework combining long-term and short-term memory; agents get task milestones and insights, local hints only when confused, and task information is reorganized before storage. Outperforms baselines in accuracy and efficiency on ALFWorld, WebShop and PDDL (no numbers in abstract).

Key insight: Pairing long-term and short-term memory with hints only when the agent is confused improves multi-turn task performance.

Privacy-preserving inference on hosted models: a learned input-embedding transform for frozen Qwen3.8-27B

Mahendra Roopa; Srikanth Roopa arXiv: 2610.27817

Clients embed tokens locally and pass vectors through a 55.6M-parameter learned transform before sending; the host runs frozen Qwen3.8-27B on transformed vectors and never sees text or token ids. On 1,490 held-out MMLU questions accuracy drops 1.5 points (80.7% vs 82.3%); 30.1% of content tokens no longer decode to their original token by nearest-neighbour lookup.

Key insight: A small learned transform lets a hosted model answer from obscured embeddings with little accuracy loss, though most tokens remain recoverable.

Local Inference of LLMs on Long Contexts: A Data Systems Perspective

Mattias Dürrmeier; Alberto Lerner arXiv: 2610.28223

Studies single-user local serving of long-context LLMs across several GPU generations: self-attention dominates runtime, its current structure leaves key GPU resources underutilized, and the newest GPU is often the least well served; frames KV-cache paging and cache utilization as data-systems problems.

Key insight: Long-context local inference is limited less by capacity than by attention kernels that leave GPU resources idle, a data-systems problem.

Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG

Abhishek Rai arXiv: 2610.28364

nokast-secureRAG: ~0.5B model classifying query+retrieved context as safe/suspicious/malicious, trained via a 35B teacher and 120B judge (5,233 examples). In-distribution: 0.994 recall at 0.026 FPR; beats Llama Guard 3 1B and others; 75% on context-dependent judgment-flip pairs; 293–404 ms single-request latency. On PoisonedRAG recall falls to near zero (fluent fact poisoning is out of scope). Released open source.

Key insight: A 0.5B local classifier can screen retrieved context for instruction injection with high recall, but fluent fact poisoning slips past it.

News and changelogs