Thursday's cs.AI announcement day (2026-10-22) lists 63 new and 148 cross-lists (replacements skipped; listing total 211). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 38 papers. Memory is contested from two sides: a small cost-accounting study finds that, with a strong model, a coding agent searching raw conversation history beats designed memory systems on both accuracy and cost, while a production study shows persistent memory, skills, project instructions and MCP resources turn one prompt injection into a cross-session, sometimes cross-user compromise on major assistants; a Lean-verified confirm-at-gate memory design and a predictive-coding approach to user memory are offered as answers. Reliability work is practical: agents almost never back up state before destructive actions, and a cheap per-tool-call backup layer fixes it; one planner call at a coding agent's first source edit lifts a cheap executor substantially; document converters silently drop highlight and colour, which makes agents confidently wrong about what authors flagged. Several papers converge on verification independence: a fresh-context verifier beats the builder's own tests, agent-written verifiers are over-strict, and approval monitors reading the same evidence fail together. Harness-evolution papers report gains but also show that more evolution tasks can make optimization worse and that edit-scoring advantages vanish with stronger models, while skill documents distilled from a frontier teacher close most of the gap for smaller models without weight updates.
Research Papers
MemoryTax: The Bitter Lesson of Agent Memory
Zedong Peng arXiv: 2610.29823
Short empirical study on one LoCoMo conversation (419 turns, 152 questions): four memory methods (full context, BM25, Mem0, Zep) vs three coding agents (Pi, Codex, Claude Code) that keep raw history and search it with their own tools, each with GPT-4o-mini, GPT-6 Luna and Claude Opus 5.5, with per-rollout cost. Mem0 beats full context only with GPT-4o-mini, and its build alone costs more than a whole full-context rollout; memory quality is capped by the model that writes it. With Claude Opus 5.5, Pi tops the cost-accuracy frontier at 99% for under half the cost of full context. One conversation, one run per cell; part of the lead comes from photo captions only agents could read.
Key insight: With a strong model, letting a coding agent search raw history beat designed memory systems on cost and accuracy, and designed memory is capped by the model that wrote it.
Combining Long-Term Memory and LLMs Comes at a High Cost: From Prompt Injection to Persistent Compromise
Pedro H. Barcha Correia; Matheus Azevedo de Sá; Paulo H. Gomes de Senna; Giovanni Mandel Martignago; Victor Takashi Hayashi; Charles Christian Miers; Marcos A. Simplicio Jr arXiv: 2610.28810
General threat model for memory injection in LLM-as-a-service: all NIST attack goals are achievable across ChatGPT Instant 5.3, Claude Sonnet 4.6 and Gemini 3 Flash. Injection vectors include personal memories, projects, skills, organization instructions and MCP-connected resources; services can be made to persistently spread disinformation, generate harmful content or simulate unresponsiveness in fresh sessions. In Claude, shared-memory features let an attacker compromise multiple users in an organization and exfiltrate prompts. Nearly half of the derived mitigations remain unimplemented.
Key insight: Persistent memory turns a single prompt injection into a cross-session, sometimes cross-user compromise on major assistants, through memories, skills, projects and MCP resources.
PerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community Trust
Tanqiu Jiang; Min Bai; Sadat Shahriar; Wanyu Du; Sandesh Swamy arXiv: 2610.28987
PerMIT: memory architecture where only user-typed inputs and gate-confirmed values are trusted; untrusted environment-derived values flow through a finite memory interface. Two integrity theorems, machine-checked in Lean 4, ensure environment-derived memory reaches a sensitive action only if confirmed at the gate. Zero observed attack success on Trojan Hippo; endorsements accumulate across users so items become community-confirmed; on tau2-bench, communities of up to 90 agents build shared knowledge bases with no injection promoted and better new-agent performance.
Key insight: Routing all environment-derived memory through a single confirmation gate turns memory poisoning into one auditable decision, with machine-checked guarantees.
Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding Agents
Xu Li; Simon Yu; Minzhou Pan; Yiyou Sun; Zhaorun Chen; Bo Li; Weiyan Shi arXiv: 2610.28934
RegretBench: 205 executable tasks grounded in real user 'regret moments'. Six frontier models complete 86.1% of tasks but back up before these moments in only 15.2%. BackUpper, a harness plug-in that checks every tool call and preserves affected state (rules plus a lightweight subagent, rule table grows over time), covers every regret-moment action, restores state at 92.2% similarity, costs $0.014 per task with 7x fewer tokens than main-agent self-backup, and matches human 'worth preserving' labels at 84.5% F1.
Key insight: Agents finish most tasks but rarely back up first; a cheap harness-level backup layer that checks every tool call fixes this without relying on the model.
PAUSE: Search-Free Steering of Coding Agents Before Their First Source-Code Edit
Viral Patel; Boyin Tan; Jason Xue; Youcheng Sun arXiv: 2610.29870
PAUSE intercepts a coding agent's first source-code edit (median 60% of trajectory progress), has a separate Planner write one repair plan from the pre-edit transcript, and resumes the same Executor with its context and workspace. No learned monitor, no checkpoint search. With Qwen3-coder Executor and GPT-5.6 Sol Planner: +16.8% resolution on SWE-bench Verified (OpenHands), +14.7% on Multilingual (SWE-agent); comparable to SICA's periodic overseer at ~11-15% of its Planner cost. Offline it recovers 35.4% of eligible failed tasks with 33-41% fewer Executor tokens than restarting.
Key insight: One planner intervention at the moment a coding agent first edits source code lifts a cheap executor substantially at a fraction of periodic-review cost.
What the Author Wrote, What the Agent Reads: Silent Cue Loss in Enterprise Document Ingestion
Yikai Zhao; Saurabh Pandey; Pradeep Kumar Misra arXiv: 2610.30026
On 76 real policy documents, formatting-blind ingestion collapses recovery of author-flagged requirements from micro F1 0.690 to 0.150 (docling) and 0.075 (plain text), replicated across five Claude models and GPT-5.6. The loss localizes to highlight (+0.302) and colour (+0.262); bold/italic/etc. are ~0. 32.8% of 6,460 documents carry deliberate colour or highlight, 10.3% on an obligation. Typing the cue for the agent adds +0.085 beyond preserving it. Scored by a deterministic matcher, no LLM judge.
Key insight: Mainstream document converters drop highlight and colour, which makes agents confidently wrong about what the author flagged; preserving and labelling those cues is a cheap fix.
D-Skill: Distilling Teacher Knowledge through Agent Skills
Shuo Yuan; Dacheng Li; Joseph E. Gonzalez arXiv: 2610.28914
D-Skill treats a teacher agent as a black box, compares paired teacher/student rollouts for behavioral divergences, and consolidates lessons offline into a natural-language skill document given to the student at inference. No labels, no extra environment interaction, no weight updates. Across SpreadsheetBench-Verified, ALFWorld and chess puzzles it closes 75-95% of the teacher-student gap, beats one-epoch SFT and is competitive with multi-epoch SFT; student inference is 5.7-8.3x cheaper than the teacher.
Key insight: A frontier agent's advantage can be distilled into a readable skill document that closes most of the gap for a smaller model without touching weights.
Correlated Failures of AI Approval Monitors
Luca Zanolini arXiv: 2610.29178
Borrows fail-prone systems from distributed computing to combine monitors that check consequential actions. On payment approval with twelve small open-weights monitors (plus Claude Opus 5.5, GPT-6 Astra, Gemini 4 Argon, DeepSeek-V3.2): every reliable fooling into approving fraud came through one evidence source and reached only that source's readers; small models and DeepSeek obeyed planted notes, the closed models ignored them in all but one case. Counting sources instead of votes blocked 0.9% of correct payments vs 7.4% for the best counting rule at equal safety. The pre-registered worst-case test failed; adding a non-persuadable rule engine restored a safe and live rule.
Key insight: Approval monitors that read the same evidence fail together; count independent sources, not votes, and keep a rule engine that cannot be persuaded.
Who Verifies the Builder? Toward Independent Assurance for Agent-Produced Software
Sion Israel Sion; Alain April arXiv: 2610.28667
Argues agent-produced software needs an assurance plane independent of the build plane: a Verification Contract, a specification-first phase without implementation access, then mutation analysis, property-based testing and fuzzing, with a human release decision. Pre-registered study on three stateful services: a verifier in a fresh context detected more of 46 seeded faults than the builder's own tests (Holm-corrected p = 0.006) and surfaced spec ambiguities, with rare false oracles; a verifier from another provider added no detection.
Key insight: A verifier in a fresh context catches faults the building agent's own tests miss; switching to another provider's model added nothing.
VerifierBench: Benchmarking the Generation of Executable Verifiers for LLM Agents
Jianing Yin; Ziyi Chen; Hao Wang; Yiyou Sun; Zijian Jin; Dawn Song; Daoan Zhang arXiv: 2610.28679
VerifierBench: 222 tasks from six agent benchmarks (tool-call, state-based, code) with 4,993 hidden test cases including alternative valid solutions and attacks, audited by a six-check Verifier4Verifier. Across 19 models, normalized balanced accuracy ranges 10.6-62.1; generated verifiers reject invalid solutions better than they accept valid ones, and most false rejections come from verifiers that accept no tested solution. Errors survive self-testing because agents test solutions sharing the verifier's assumptions.
Key insight: Agent-written verifiers are often too strict and accept no valid solution, and self-testing misses it because tests share the verifier's assumptions.
VeriEvolve: Evaluator-First Evolution for Tool-Using Agents
Yueshen Li; Kamer Ali Yuksel; Gokhan Tur; Dilek Hakkani-Tür; João Pedro Maia arXiv: 2610.29005
VeriEvolve synthesizes instruction-grounded challenge states and an executable evaluator before optimizing an agent, freezes it as the fitness signal per round, and revises it between rounds from strong/weak run end states. On all 30 MCPMark Filesystem tasks: 30 evaluators, 141/141 agreement on generated suites, 113/122 on held-out states; externally verified success rises 6/30 -> 18/30 for GLM-5.2 and 27/30 -> 30/30 for Claude. Cross-environment studies on PostgreSQL, Playwright, Notion and GitHub expose limits from observability and state representation.
Key insight: Building an executable evaluator before evolving an agent's workflow gives a usable fitness signal for stateful MCP tasks where success is observable.
Forging More Tasks into Better Harnesses: Agentic Harness Evolution via Successive Scale Racing
Jingzhe Liu; Jiliang Tang; Tong Zhao; Neil Shah; Clark Mingxuan Ju arXiv: 2610.28815
Finds existing harness-evolution methods degrade as the task pool grows, because evidence selection is suboptimal. Successive Scale Racing builds diverse evidence combinations by task quality and coverage and races candidate harnesses under a small budget. SOTA in all six configurations across three benchmarks; as tasks grow 40 -> 200, pass rate rises 64.3% -> 68.3% while baselines drop; racing cuts validation executions by 60%.
Key insight: More evolution tasks can make harness optimization worse unless evidence is selected deliberately; racing candidates fixes it at lower validation cost.
HGM-Dual: Lineage-Aware Guided Agent Harness Optimization for Long-Horizon Planning
Sudipta Paul; Pengrui Quan; Aounon Kumar; Nicholas Tzou; Vivek Kulkarni; Srinivas Chappidi arXiv: 2610.30042
HGM-Dual adapts Huxley-Gödel Machine harness search to planning (tool-call sequences under interacting constraints): lineage-aware context records what each ancestor changed and what regressed, and error-conditioned dual-path generation produces one exploratory child and specialized children targeting the components behind top constraint violations. Up to 14.45% relative improvement in case accuracy over the strongest baseline; matches HGM final performance with 2x-4x less evaluation budget.
Key insight: Recording what each harness edit changed and what regressed lets planning-agent harness search reach the same results with 2-4x less evaluation.
Harness Scaling for Generalizable Agentic Reinforcement Learning
Fei Bai; Huatong Song; Chuan Hao; Ran Tao; Jian Yang; Bryan Dai; Wayne Xin Zhao; Ji-Rong Wen arXiv: 2610.29458
Harness Scaling trains agentic RL across a factorized space of harness configurations (balanced factorial subset, cross-harness training for the same task) instead of one fixed harness. Improves generalization to unseen white-box configurations across benchmarks, model scales and RL algorithms, and transfers to unseen black-box harnesses better than training through one complex harness (no headline numbers in abstract).
Key insight: Training agents across many harness configurations, not one, makes them generalize to harnesses they have never seen.
Recursive Self-Improvement on a Budget: Scoring Code Edits Before They Run
Erfan Darzi; Sree Bhargavi Balija; Sheng He arXiv: 2610.29121
Scores proposed scaffold edits before running them with a frozen linear readout on parent solve rate plus eight diff coordinates (fit on 96 labeled edits). Twelve GPT-4o runs return a node at 87.0% held-out HumanEval+ vs 85.1% for Huxley-Gödel Machine selection and 81.2% for the root; with Claude Sonnet 4.5, 86.6% vs 86.5% for HGM.
Key insight: A cheap linear score on a proposed diff can pick which self-edits to evaluate, but the advantage shrinks to nothing with a stronger model.
Agent Behavior Maps: Locating Agents by What They Would Do, Without Running Them
Shota Fujikawa; Takuya Tamura; Kosuke Akimoto; Daichi Haraguchi; Masafumi Oyamada arXiv: 2610.30014
Agent Behavior Maps embed LLM-harness combinations by centered action log-likelihoods on shared reference trajectories, no new rollouts needed. Error bounds tie coordinate distances to trajectory KL; across 100 LLMs and four environments ALFWorld-based coordinates support performance prediction and reveal behavioral similarity beyond success rate and size, including across families. Harness-component displacements approximately compose.
Key insight: Agents can be compared by what they would do on shared trajectories, without running them, and this predicts performance across 100 models.
Where Should a Stuck Agent Spend Its Next Tokens? Causal Attribution of Inference-Time Resources
Saiyue Lyu; Jerrold Huang; Yunbei Zhang; Janet Wang; Zhenting Wang; Yingqiang Ge; Haibo Zhang arXiv: 2610.28834
Banzhaf Resource Attribution measures marginal value of computation, information and feedback for repairing failed code while holding the failed state fixed. Six models, 194 function-level and 126 SWE-bench Verified failures: task-relevant specifications consistently help, public-test feedback helps little, retrieved code little or nothing; extra compute matters less as models get stronger. Three of four frontier models pick feedback in 95-100% of cases and do worse than random resource selection.
Key insight: Stuck coding agents gain most from a clearer specification, yet frontier models overwhelmingly ask for test feedback instead and do worse than random choice.
Automating ML for Science: Can Frontier Agents Climb Scientific Hills in the Wild?
Ming Zhong; Stacy Li; Nicholas Carlini; Matthew Jagielski arXiv: 2610.28763
Agent4Sci: 20 scientific-ML benchmarks across 11 domains. Frontier agents beat the published best on every benchmark (Claude Opus 10.4% mean relative improvement) but mostly via ML-engineering tricks; failure modes are novelty miscalibration, resource under-utilization and collapse into local engineering sweeps. Plug-in skills for ideation, experiment management and scheduled checklists raise Claude Opus 10.4% -> 20.1% and Codex 4.4% -> 8.1%.
Key insight: Frontier agents improve scientific models mostly through engineering tricks, and lightweight skills with scheduled checklists roughly double their gains.
PreCoMem: Predictive Cognitive Memory for Self-Evolving Long-Term Dialogue Agents
Jian Zhong; Zeyu Liu; Pingchuan Cao; Rongduo Han; Shunye Tang; Guohuan Xie; Mingyuan Qin; Ran Ji; Xiao Liang; Wei Wang; Haining Zhang arXiv: 2610.29467
PreCoMem models user memory as confidence-weighted beliefs updated by 'effective surprisal' (semantic deviation plus contradiction, downweighted when retrieval is diffuse). A two-threshold gate maps each turn to MAINTAIN, PROFILE (low-confidence hypothesis waiting room) or CORRECT (soft decay of contradicted facts). SOTA accuracy on LoCoMo, LongMemEval-S and PersonaMem-v2; new DiMoBench shows it adapts to real belief drift without over-reacting to noise. Code released.
Key insight: Holding ambiguous user signals as low-confidence hypotheses before committing keeps personal memory stable while still tracking real change.
MOSAIC: An Omni-Modal Benchmark for Long-Term Memory and Cross-Modal Reasoning in Conversational Agents
Hong Ting Tsang; Boyi Zhang; Haoyu Huang; Jiaxin Bai; Yufei Li; Yisen Gao; Zhongwei Xie; Hongyu Luo; Jeff Z. Pan; Yangqiu Song arXiv: 2610.29249
MOSAIC: 923 questions over persona-grounded histories of 11-24 sessions spanning text, image, video and audio, with a matched protocol that freezes question, reader, prompt and budget while intervening on representation, retrieval and delivery. Representation loss is modality-dependent, residual reading dominates even with gold evidence, and abstention stays weak.
Key insight: Breaking memory evaluation into write, retrieve, deliver and read stages shows most errors survive even when the right evidence is delivered.
Memory-Centric Continual Learning for AI Agents
Dongfang Li; Zhuoen Chen; Bonian Jia; Zixuan Liu; Zhengxuan Lu; Can Deng; Yukun Shi; Yuhang Meng; Xin Zhang; Jiahe Huang; Fuhao Li; Junmai Wang; Shunyao Wen; Jingjun Sun; Jiaxu Tian; Jiangling Zhang; Zihan Wang; Liangyou Li; Yitong Yao; Shuangyong Song; Beilun Wang; Pengxu Wei; Hanlin Xu; Chang Liu; Yongxiang Li; Baotian Hu; Xiangyang Ji; Min Zhang arXiv: 2610.29357
Memory-Centric Continual Learning argues memory should be judged by whether it improves future actions. Gives a three-axis taxonomy (substrates, assets, policies) with a two-loop lifecycle, an evaluation protocol for retention under interference, adaptation and transfer that separates gains from mere context expansion, and a memory scaling framework across experience, storage and compute.
Key insight: Agent memory should be judged by whether it improves future actions, with evaluations that separate real learning from simply adding context.
Behavior Beyond Text: Evaluating Refusal Transfer Failure in LLM Agents
Ekagra Gupta; Raj Saha; Aniekan-Abasi Inyang; Adam Al Gharib arXiv: 2610.28982
2,304 matched prompts (text-only, tool-enabled, adversarially framed tool-enabled) with 20 forbidden actions across five models: 10-52% of harmful requests refused in chat become unsafe tool calls with standard tool prompting. A refusal direction in the residual stream weakens in tool contexts in four of five models and predicts unsafe calls (AUC 0.76-0.86); patching or steering it only partly fixes the gap or suppresses benign tool use.
Key insight: Models that refuse a harmful request in chat often carry it out once tools are available, so agent safety has to be tested on actions.
AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards
Chao Shang; Wanyu Du; Yi Zhang; Sandesh Swamy arXiv: 2610.28989
AgentPolicyForge builds policy benchmarks from executable environments and iteratively trains guards: PolicyGym spans ten policy families (698 training, 254 held-out human-reviewed scenarios), every violation uses a permitted tool so checks must cover arguments, resources and context. An attacker generates requests and the guard is fine-tuned on environment-verified examples; the final guard cuts attack success 40-44% relative with fewer benign rejections than policy prompting.
Key insight: Writing tool policies into the prompt does not stop violations; guards trained on executed, verified examples cut attack success by 40-44%.
Black-Box Red-Teaming of Multi-Agent Systems via Reinforcement Learning
Yuqi Jia; Hangsheng Zhang; Chenxi Liu; Junjie Liang; Xun Chen arXiv: 2610.28966
ReMAS: RL-trained attacker LLMs for black-box system-prompt extraction from multi-agent systems, with a rewrite stage and a template stage that raises the chance of invoking specific sub-agents. Substantially higher attack success than existing black-box attacks, transferring across backend LLMs and MAS structures (no numbers in abstract).
Key insight: Sub-agents' system prompts can be extracted from multi-agent systems even when users never address them directly.
UserSWE: Evaluating Coding Agents in Multi-Turn Conversations with Dynamic Users
Zhan-Yu Wu; Ji Luo; Alyssa Wu; Junjielong Xu; Richeng Xuan; Zhichao Hu; Chongming Gao; Xinting Hu arXiv: 2610.29822
UserSWE turns repository history and single-turn benchmarks into multi-turn bug-fix tasks with simulated users constrained by information pools and personas calibrated on 20,859 development sessions; tests run every turn and a cross-family agent pair gates verdicts. Eleven agents on 72 tasks from 42 repos: rankings change with interaction budget (Claude Fable 5.1 best at one turn, GPT-6-Astra by turn eight, Claude Opus 5 at most intermediate budgets).
Key insight: Coding-agent rankings flip depending on how many conversational turns are allowed, so single-turn benchmarks misdescribe interactive use.
SWE-DIVE: Multi-Turn Coding Agent Evaluation with Dynamic User Simulation
Lorenz Brehme; Benjamin Steenhoek; Ruth Breu arXiv: 2610.30047
SWE-DIVE: a Harbor-embedded framework with a user simulator of different behavioral patterns, a conversation validator checking the simulator stays on the original requirements, and test execution for multi-turn coding sessions where users add tasks over time. Results and code on GitHub (no numbers in abstract).
Key insight: Simulated users with validated behavior let coding agents be tested on realistic multi-turn sessions instead of one clean prompt.
Robust Soft Skill Adaptation via Behavioral Localization in Tool-Using Agents
Zijian Jiang; Xilu Wang arXiv: 2610.30041
Behavioral Localization compares a frozen agent with and without a text skill to find the few trajectory positions where the skill matters, then supervises a short soft prompt there. On SpreadsheetBench with frozen Qwen3.6-35B-A3B, the top 10% of positions capture 96.12% of skill gain; selective supervision lifts shared-prompt success 30.36% -> 36.79%, and task-specific 57.38%, beating the full text skill and OPCD.
Key insight: Almost all of a text skill's benefit sits in a few trajectory positions, so a short soft prompt trained there can replace a long skill description.
Charts as Epistemic Actions for Experience-Driven Agentic Data Analysis
Xinzhe Wang; Xudong Weng; Zang Li; Shaolei Zhang arXiv: 2610.30072
Tests charts as internal reasoning actions for ReAct data agents: on 200 controlled tasks agents read self-generated charts as well as numbers but don't choose to use them; charts lead on temporal, pattern and anomaly reasoning, text on precise reading. Proposed method distils experience on which operations to use and when to use text vs charts, admitted only through a held-out validation gate; it raises accuracy on three held-out benchmarks with four backbones without weight updates.
Key insight: Data agents can read charts they draw but rarely choose to; distilled, validation-gated experience teaches them when a chart helps.
Steering Black-Box Large Language Model Agents with Pitfall Anticipation World Model
Jiongxiao Wang; Han Ding; Youzhi Luo; Yawei Wang; Yun Zhou; Linbo Liu; Panpan Xu arXiv: 2610.29139
Pitfall Anticipation World Model intervenes only when a likely failure is ahead within a bounded multi-step future, instead of predicting every next observation. Trained with SFT on pitfall-labeled synthetic data then GRPO co-training with a black-box LLM; improves Claude Sonnet 4.5 by 24.3% on ScienceWorld and 7.7% on WebArena-Lite.
Key insight: A small world model that only speaks up when it foresees a failure steers a black-box frontier agent better than step-by-step prediction.
Self-Improving Agents with World Model Predictive Paths
Haori Lu; Tianyu Gao; Yaoyao Liu; Yingying Li arXiv: 2610.28945
MPPI-inspired test-time framework: the agent proposes multiple actions, imagines outcomes with a world model, scores them for progress and risk, and weights the decision; a dual-branch experience memory improves both planner and world model. Strong results on ALFWorld and ScienceWorld across three backbones (no numbers in abstract).
Key insight: Imagining several candidate actions with a world model and learning from experience on both branches improves agent decisions at test time.
Parallel AI Agent Collaboration as Graph-Structured Distributed Block Optimization
Hanmin Li; Yury Demidovich; Peter Richtárik arXiv: 2610.30074
Models parallel agent edits as block optimization on a known dependency graph: independent sets certify compatible edits whose gains add, and a fractional-coloring merger preserves a 1/chi_f(G) fraction of verified local improvement (tight). Code-repair experiments show verified merging resolves conflicts that break naive merging; parallel agents cut modeled completion time at higher token cost; route-search agents see a median 15% wall-time cut.
Key insight: Parallel agents should merge only verified, independent edits; a coordinator using the dependency graph keeps a provable share of their gains.
Fig: Automated Multiagent Behavior Elicitor
Anrui Gu; Zhichao Wang; Nicolai Ouporov arXiv: 2610.28891
Fig takes a natural-language behavior description, decomposes it, generates or selects social games, and intervenes on engine, opponents, instructions and context, scored by mechanical checks plus rubrics (validated by human review). Models attempt target behaviors (cooperation, exploitation, deception, covert coordination, betrayal, sabotage) in 45.2% of episodes; interventions raise attempt rates 10.9% over matched controls.
Key insight: Multi-agent environments can be programmed to deliberately elicit behaviors like deception or sabotage instead of waiting for them to emerge.
Hidden Messages Between Diffusion Language Model Agents: Causal Evidence for Latent Communication
Alan-Barsag Gazzaev; Alexey Gavrilov; Sergey Muravyov; Ilya Makarov arXiv: 2610.28905
Diffusion-LM agents pass compressed denoising states (four signed dense vectors) instead of decoded text. Removing the message drops a +63.6-point advantage on Tiny-A2D and +100.0 on Dream-7B; on QASC with facts split across agents, matched messages reach 80.8% vs 46.8% with a wrong-example message; one late transfer reaches 87.8%, beating four recurrent exchanges by +7.0 points.
Key insight: Diffusion-model agents can pass meaningful hidden messages through latent states, and when they exchange information matters more than how often.
DiffResearch: Accelerating Deep Research with Diffusion Language Models
Alan-Barsag Gazzaev; Alexey Gavrilov; Mikhail Mozikov; Sergey Muravyov arXiv: 2610.28909
DiffResearch: open multi-agent deep-research framework with a diffusion LM at every stage. Holding scaffold, retrieval, prompts and evaluation fixed, the diffusion backbone is ~6x faster end-to-end on 100 Deep Research Bench tasks; dFast extracts subqueries from intermediate denoising states for a 1.99x median decomposition speedup with no quality loss and the best RACE score of three configurations. Released under Apache-2.0.
Key insight: Swapping an autoregressive model for a diffusion model in an otherwise identical deep-research agent made it about six times faster end-to-end.
Multimodal Embodied Agents: A Unified Capability-centric Perspective from Computer-Use to Robot-Use
Yanzhe Chen; Ziyi Yang; Jifeng Zhu; Qiming Huang; Ruihe An; Peiyao Xu; Hesen Yang; Runda Liu; Chang Gong; Zhijun Cao; Zechen Bai; Wenzheng Zeng; Yiqi Lin; Guoqiang Liang; Kevin Yuchen Ma; Kevin Qinghong Lin; Mike Zheng Shou arXiv: 2610.30108
PAPAV framework (Perceive, Anticipate, Plan, Act, Verify) compares computer-use agents, robot systems and multimodal embodied agents. Across 64 benchmarks evaluation centers on Act; only 5 assess Anticipate and 3 assess Verify.
Key insight: Agent benchmarks mostly measure acting; almost none test whether agents anticipate effects or verify outcomes.
GuideEvolve: Self-Evolving Agent Framework with Expert Guidance and 3Ts Mechanisms
Meihong Jia; Yasemin Timar; Jonathan Taws arXiv: 2610.30017
GuideEvolve adds expert-evaluation-driven evolution plus 'Think Fast and Slow', 'Throwback' (rollback) and 'Termination by choice'. On MGSM 89.8% vs Gödel Agent 90.6%, MMLU 89.1% vs 87.9%, with 25-59% lower variance, 100% evolution success vs 82%, and about half the optimization iterations.
Key insight: Adding rollback and voluntary termination to self-evolving agents mainly buys stability and fewer iterations rather than higher accuracy.
What Git Does Not Record: Provenance Legibility in Two AI-Assisted Research Repositories
Koutian Wu; Zesen Huang; Hejia Geng arXiv: 2610.28655
Audits two research repos with different agent residue: standing rule files (prescriptive) vs a running agent scratchpad (narrative). 85.6% of lines ever committed to rule files remain visible vs 21.8% for the scratchpad; the Co-Authored-By trailer covers 66 of 121 AI-trailered commits in one repo, and in the other only 1 of 39 commits touching the agent-notes file carries it. Neither rate can be read as an involvement rate.
Key insight: Git history and AI co-author trailers give an unreliable picture of how much an agent contributed to a repository.
SAKURA: Serving Attention Key-Value State Under Rate Adaptation for Private Image Editing on Phones
Shuncheng Jie; Desen Sun; Ri Hong; Yuyang Tian; Hong Zhang; Sihang Liu arXiv: 2610.29733
SAKURA delivers precomputed attention KV state from cloud to phone under a bandwidth budget for private on-device diffusion image editing: token-importance-aware compression, per-shard representation chosen by bandwidth, and a pipelined runtime overlapping transfer with execution. On a Snapdragon 8 Elite Gen 5, latency drops 1.82x vs CacheGen-for-DiT and 3.27x vs on-device generation, with 3.06x less cache storage.
Key insight: Streaming compressed, reusable attention state from the cloud lets phones keep personal inference on device while cutting latency.
News and changelogs
- Claude Code: v2.1.308 — bug fixes and reliability improvements (no further detail in the release notes). link
- Composio: Python SDK 0.29.0 and TypeScript SDK 0.26.0 warn when a toolkit version in use is deprecated (with sunset date and how to pin), fix tool argument serialization and preserve more schemas across providers; direct
HttpClientconstruction now takesauthandscope— early warning for agent builders before a toolkit they depend on is sunset. link - Claude Code: v2.1.307 adds a command to migrate Claude API code to API version
2026-10-21and an OpenTelemetry event for every tool call that a permission rule, auto mode, safety check, hook or the sandbox stopped or prompted; fixes MCP servers in headless runs (locked keychain, sleep during connect) and HTTP MCP tool calls being sent twice when a connection dropped (only read-only or idempotent tools are now retried) — useful for anyone running headless agents with MCP or auditing guard decisions. link - Composio: JS packages: the JSON-Schema-to-Zod converter gains a Zod v4 builder that keeps
format,contentEncoding,contentMediaTypeand integer types; the Claude Agent SDK provider adopts it (requires zod 4.1.13+), the LlamaIndex provider passes each tool's JSON Schema to the model unchanged, and binary/non-base64 string fields are no longer wrongly validated as base64 — fewer silent tool-schema losses between agent frameworks and models. link link link link - Composio:
@composio/coreand@composio/slim0.26.0 move credentials to the API client'sauth/scopeoptions; with only an organization API key, every request, including MCP session headers, now carriesx-org-api-key— worth checking for agent platforms that authenticate with org keys. link link - OpenAI news: Broad access through consistent standards — how OpenAI works with distribution partners to uphold consistent safeguards and clarify expectations in its Usage Policies; a usage-policy notice relevant to apps that distribute OpenAI models. link
- Vercel: Routing Middleware now supports Python (the feed carries no summary). link
- Composio: CLI 0.5.0: failed tool executions and invalid input now exit 1 instead of 0 (breaking),
composio executeruns through the Composio Dashboard, and high-severity MCP server dependency advisories are patched — scripts and agents that shell out to the CLI can now rely on the exit code. link link - OpenAI news: ChatGPT Ads expands to 26 new countries, with over 100,000 advertisers on the platform. link
- OpenAI news: OpenAI frontier models and Codex workflows are coming to Google Cloud's Model Garden via Google Cloud Marketplace — another hosting option for agent builders using OpenAI models. link
- OpenAI news: Patch the Planet connects security researchers, maintainers and incident responders to address critical open-source vulnerabilities as agents uncover them. link
- OpenAI news: How OpenAI built ChatGPT's LLM-powered ad stack to read conversational intent while keeping ads separate from answers. link
- Anthropic API: API version
2026-10-21released; new client SDKs (Python 2.0.0, TypeScript 1.0.0, C# 13.0.0, Go 2.0.0, Java 3.0.0, PHP 1.0.0, Ruby 2.0.0) and theantCLI 2.0.0 send it by default — major SDK bumps that agent builders should pin or migrate deliberately. link - Anthropic API: The new SDK and CLI versions also carry breaking changes independent of the API version and are now licensed under Apache 2.0 instead of MIT. link
- Anthropic API: User profiles gain
enforcement_statusandenforcement_actionsfields and a list filter showing whether Anthropic has restricted or banned one of your end customers — an enforcement-rule change for apps that serve Claude to their own users. link - OpenAI API: Platform settings can now limit which service tiers each project, or the whole organization, may use — a cost and latency control for agent projects. link
- OpenAI news: Democratic governance of frontier AI, part II: a policy blueprint for empowering cyber defenders with frontier AI and stronger safeguards. link
- Vercel: Baseten's Mammoth-1 and Elephant-1 are available on AI Gateway for free (the feed carries no summary). link
- Vercel: Skipped monorepo deployments no longer count against limits (the feed carries no summary). link
- Anthropic API: Organization admins can turn off web fetch in the Claude Console; requests using the web fetch tool then fail with a 400, and Managed Agents receive an error result — an org-level data control that can break agents relying on web fetch. link
- Anthropic API: In Claude Managed Agents, web fetch and web search now follow the organization's domain restrictions on top of each agent's own allowed or blocked domain lists — organization policy now constrains every agent's web access. link