Friday's cs.AI announcement day (2026-10-23) lists 103 new and 126 cross-lists (replacements skipped; listing total 229). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 37 papers. Agent memory is the dominant thread again: a plain retrieve-and-rerank baseline over raw conversation history beats complex agentic memory systems in six of seven settings, a personal-agent benchmark finds retrieval-based memory no better than no memory for learning how users want to be assisted, users themselves often prefer answers that ignore what the assistant remembers, and corrupting only which memories are marked valid costs agents 30-40 points. On the tool side, a handshake benchmark puts numbers on MCP, A2A and ACP connection overhead and on the context cost of reading large capability lists, while tool-retrieval and small-model tool-selection papers show how to scale to big catalogs. Computer-use agents still struggle with fine-grained text grounding and with applying user preferences at the right step, and email agents that pass ordinary phishing tests comply with nearly half of persuasive attacks tuned to them. For coding agents, frontier models barely improve their own harnesses on held-out games, a small selective verifier adds cheap gains, skills work better with fallback to primitive tool calls, and over a quarter of frontend patches that pass requested checks still break something else on the site.

Research Papers

Is Complex Agentic Memory Always Needed? Naive RAG Is Stronger Than We Thought

Zhengye Bao; Shengtao Zhang; Haokai Zhang; Shiqi Lou; Muning Wen; Minnan Luo arXiv: 2610.30755

Figure from Is Complex Agentic Memory Always Needed? Naive RAG Is Stronger Than We Thought
Is Complex Agentic Memory Always Needed? Naive RAG Is Stronger Than We Thought

Raw-RAG (dense retrieval + reranking over raw history, fed to a reader LLM) ranks first among compared memory systems in six of seven benchmark-model settings across LoCoMo, LongMemEval, MEME and MemoryAgentBench, beating the strongest agentic memory system by 0.13-5.53 points. Higher evidence coverage offsets lower utilization; even full access to transformed memory stores leaves a gap vs raw evidence.

Key insight: A plain retrieve-and-rerank baseline over raw conversation history beat complex agentic memory systems in six of seven settings, because preserving raw evidence matters more than transforming it.

Why Bother Me Again? Benchmarking Personal Agent Memory for Interaction Preferences

Jialin Li; Zhenhao Chen; Hanjun Luo; Hanan Salam arXiv: 2610.30485

Figure from Why Bother Me Again? Benchmarking Personal Agent Memory for Interaction Preferences
Why Bother Me Again? Benchmarking Personal Agent Memory for Interaction Preferences

MemPABench: interactive on-policy environment where agents must decide when to clarify, confirm or act; four simulated users, 14 preferences, 99 sessions over four months with five event-driven preference changes each. Across four memory systems and four LLM backbones, retrieval-based memory (Mem0, MemOS, simple RAG) does not beat No Memory; file-based memory improves accuracy but over-applies preferences. Even with the right preference available, agents struggle to override default habits.

Key insight: Memory systems barely help agents learn how a user wants to be assisted; file-based memory helps but applies preferences where they do not belong.

Governance-State Corruption in Long-Term Memory for LLM Agents: A Cross-Model Stress Test

Bowen Liu; Youting Wang; Bonan Shen; Dingyan Shang arXiv: 2610.30698

Studies governance-state corruption: faults that change which retained records enter model-visible context (validity state) while stored content stays fixed. Across six providers and 2,080 matched fault pairs, corruption changes the operative projection in 96.25% of pairs; oracle-backed enforcement restores 100%. Clean-minus-corrupted contrasts: 40.54 points on LongMemEval correctness, 30.60 on Memora FAMA.

Key insight: Corrupting only which memories are marked valid, not the memories themselves, cost agents 30-40 points on long-term memory benchmarks; enforcing validity in code restored it.

Memory-Aware Reward Modeling: Learning Human Preferences for LLM Memory Use

Yijiang River Dong; Zexue He; Cheng Yu; Tiancheng Hu; Michael J Ryan; Jan Batzner; Zheng Hui; Shaolong Wu; Orestis Papakyriakopoulos; Alex Pentland; Nigel Collier; Jiaxin Pei arXiv: 2610.31272

About 1,000 pairwise judgments from 87 participants using their own ChatGPT queries and memories: memory-conditioned responses are not consistently preferred, sometimes strongly dispreferred; automatic evaluators favor memory-conditioned answers far more than users do. A memory-aware reward model trained on user judgments reaches 72.8% preference-prediction accuracy.

Key insight: Users often prefer answers that ignore what the assistant remembers about them, while automatic judges systematically overrate memory use.

ColaBench: Evaluating Memory-Guided Knowledge Acquisition in Personal Agents

Wenjie Zhang; Zhichao Shi; Xuhui Jiang; Xiaojun Wu; Cehao Yang; Chengjin Xu; Xiaoning Song arXiv: 2610.30989

ColaBench: synthetic health/daily-living benchmark (349 tasks, 10 profiles, 13,033-document KB) with an Evidence Graph linking personal conditions to disclosures and documents. MemKB (state summaries inform queries; memory-document links) reaches 86.25% accuracy at 4.07 rounds per task; errors come from unsupported personal assumptions and rule misapplication.

Key insight: Personal agents do better when their memory of the user shapes what they retrieve, not just how they answer.

When LLMs Forget What They Believe: Characterizing State Integrity Collapse in Long-Horizon Dialogues

Yancheng Zhu; Yifan Yuan arXiv: 2610.31314

StateTrack-Bench: models repeat a constraint but stop applying it (State Integrity Collapse). Across seven model snapshots, strict joint retention 62.4-100%; 88.6% of failures are behavioral drift, not forgetting. Structured State Anchoring recovers up to 24.4 points on immutable constraints.

Key insight: Models can recite a constraint while no longer obeying it; most long-dialogue failures are drift, not forgetting.

Subgoal-aware Memory Graph for GUI Agent

Dezhao Luo; Daniel Beechey; Derek Yuen; Weilin Luo arXiv: 2610.31307

Subgoal-aware memory graph distils past mobile GUI trajectories into subgoal nodes (consecutive actions sharing one intent) that can be merged, extended and retrieved by observation; +11.11% success on SPA-Bench over baseline.

Key insight: Storing GUI agent experience at the subgoal level, between single actions and whole trajectories, makes it reusable across tasks.

Muffin - A Shared Memory Buffer for Asynchronous AI Agents

Ping-Lin Kuo; Suman Navaratnarajah; Christian Frey; Gresa Shala; Josif Grabocka arXiv: 2610.31355

Figure from Muffin - A Shared Memory Buffer for Asynchronous AI Agents
Muffin - A Shared Memory Buffer for Asynchronous AI Agents

Muffin: orchestrator routes demanding queries to a multi-agent setting where a shared memory buffer exchanges intermediate findings asynchronously while private reasoning stays local. Best accuracy in 17 of 20 settings; +19.2 accuracy points with 77.4% fewer tokens than multi-agent debate.

Key insight: An asynchronous shared memory buffer beat multi-agent debate by 19 points while using 77% fewer tokens.

Agentic Knowledge-Model Co-Evolution via Consistency Regularization

Sirui Chen; Zhining Liu; Chao Zhang; Jingrui He; Zheng Li arXiv: 2610.30790

SPLICE perturbs how the same experience is analyzed to produce several knowledge candidates and keeps updates with consistent gains across views, interleaved with self-distillation + RL. Up to +7.1 / +4.6 points over knowledge-evolution and training baselines; evolved knowledge cuts output tokens per correct solution by up to 44% and transfers across model sizes.

Key insight: Keeping only lessons that help across several ways of analysing the same experience produces skills that transfer and cut tokens.

HERD: Harness-Evolving Recursive Distillation for Continual Learning

Xun Sun; Thanh Thi Nguyen; Thuy-Trang Vu arXiv: 2610.31401

HERD refines harness skills and keeps high-residual examples in bounded memory, then distills into weights with drift-constrained dual-anchor distillation. On the 25-stage TRACE+17 stream it matches the best parametric baseline on new tasks with the least forgetting.

Key insight: Learning first in the harness and then distilling into weights let a model keep learning across 25 stages with the least forgetting.

The Cost of Saying Hello: An Empirical Study of Handshake Overhead in AI Agent Communication Protocols

Pranav Varshney arXiv: 2610.30151

Phase-decomposed handshake benchmark using official SDKs. Legacy MCP: three round trips, 230 ms at 50 ms RTT; A2A one round trip, 61.0 ms. When an LLM reads counterpart metadata, cost is 24-107 tokens per capability — a 200-capability counterpart uses 11% of a 200k window. MCP's 2026 revision cuts to two round trips, zero on warm reconnects with era pinning.

Key insight: Round trips dominate agent-protocol handshakes, and reading a large capability list can eat a tenth of the context window before work starts.

MCP vs CLI for AI Agents: A Comparative Analysis of Tool Integration Strategies for Autonomous Systems

Arun Malik; Nitish Talasu; Bradley Klemick; Vineet Tushar Trivedi; Prachi Shah; Sanay Devi; Junjie Zhang; Kunal Sonawane arXiv: 2610.30157

Comparative analysis across 14 dimensions: CLI is more efficient for single-user local workflows; MCP provides access control, credential isolation, structured audit and multi-tenant governance; progressive disclosure gives MCP token efficiency comparable to CLI. Recommends hybrid. Analysis paper, no new experiments beyond worked examples.

Key insight: CLI wins for local single-user agents, MCP for governed multi-tenant access; progressive disclosure closes MCP's token gap.

Separate Field Scoring Protects Unused Tools When Agents Pool Tool-Use Experience

Abhijit Chakraborty arXiv: 2610.30867

Figure from Separate Field Scoring Protects Unused Tools When Agents Pool Tool-Use Experience
Separate Field Scoring Protects Unused Tools When Agents Pool Tool-Use Experience

Adding pooled usage examples as extra index entries raises Hit@5 for used tools but lowers it for unused ones. SYNAPSE scores usage as a separate field: held-out gold tool in top five 0.785 vs 0.683 for a slot-reserving router on StableToolBench; pooling across ten agents helps exactly as much as one agent with the same records.

Key insight: Mixing usage logs into a tool index buries tools nobody has used yet; scoring usage as its own field protects them.

Training Small Language Models for Transferable Tool Selection

Zhaoyi Zhou; Akshayaa Magesh; Jeongyeol Kwon; Artem Kuriksha; Daniel Jiang; Andrea Zanette; Ayush Jain arXiv: 2610.31483

RL post-training recipe lets Qwen3-8B decompose instructions and select tools over 10k+ tool corpora; outperforms Llama-4-Maverick (402B) on ToolBench and transfers to other retrievers and new tool corpora.

Key insight: An RL-trained 8B open model selected tools from huge catalogs better than a 402B model and transferred to new corpora.

Prompt Sensitivity in Tool-Augmented Model Comparisons

Mateusz Modrzejewski; Tomasz Radzikowski arXiv: 2610.31148

Matched protocol separating readout, reasoning, call decision, tool answer and report: on six open models, five domains, five wordings, tools raise accuracy but widen wording sensitivity of pairwise comparisons, tracking call frequency; a native tool-calling interface removes detected widening in one domain.

Key insight: Giving models tools can make model rankings more sensitive to question wording, not less.

What the Trace Shows and What the Label Says: Auditing Behavioral Detectors in Agent Evaluation

Idunnuoluwa A. Adeniji; Shilpika; Michael E. Papka arXiv: 2610.30491

Calculator-tool setting on GSM8K with corrupted outputs, six production models: final correctness, re-verification and fault-propagation labels disagree systematically; silent tool-output override (model ignores corrupted value without re-calling) is missed by verification detectors. Human review agrees 67/81 on verification; execution limits move one model from 21/30 to 27/30.

Key insight: Agent evaluation labels can misreport what the trace shows, especially when a model silently overrides a bad tool output.

EpiSEM-Bench: Evaluating Safety and Evidence Recovery in LLM Agents under Missing Evidence

Qijin Zhang; Hanzhen Wang; Yuehan Zhao; Haoyu Dai; Yao Shu; Zhongxiang Dai; Shuang Qiu arXiv: 2610.31650

EpiSEM-Bench: 300 matched unsafe/safe task pairs across six domains where tool responses omit a safety-relevant fact. Ten models vary widely; recovery access reduces unsafe execution for all, but agents differ in whether they fetch missing facts and act correctly.

Key insight: Agents often take prohibited actions when a tool response simply leaves out a safety-relevant fact.

Diagnosing Personalization Failures in Mobile GUI Agents

Zhixin Lin; Dongliang Xu; Jungang Li; Shidong Pan; Jun Feng; Yanbin Sun; Jing Li; Liang Liu; Yue Yao arXiv: 2610.30573

Figure from Diagnosing Personalization Failures in Mobile GUI Agents
Diagnosing Personalization Failures in Mobile GUI Agents

PrefDiag-Bench: five preference types and 1,664 stage-wise probes over eleven GUI agent systems with profiles or behavioral memory logs. Best model (Seed-2.0-Pro) reaches only 47.17% on Process preferences; bottlenecks are selecting relevant history and knowing when a preference applies; supplying evidence lifts success up to 7.06%.

Key insight: GUI agents that complete ordinary tasks well fail at applying user preferences at the right step.

PointerBench: A Diagnostic Benchmark for Fine-Grained GUI Grounding

Valentino Sacco; Saurabh Pandey; Alexander Florian Jercher; Maximilian Schilling arXiv: 2610.31274

Figure from PointerBench: A Diagnostic Benchmark for Fine-Grained GUI Grounding
PointerBench: A Diagnostic Benchmark for Fine-Grained GUI Grounding

PointerBench: 1,500 screenshot-instruction pairs (spreadsheet sub-elements, character-level text, 100 professional apps). Text grounding is hardest: Claude Fable 5 69.6%, GPT-5.6 Sol 53.4%, UI-Venus-2-9B 25.8%, vs 83.2/77.7/54.5% overall.

Key insight: Even frontier models struggle to point at the right characters in long documents on screen.

AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack

Justin Tan; Miao Li; Ding Zhao arXiv: 2610.31404

Figure from AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack
AgentPhishing: A Benchmark of LLM Email Agents Under Adaptive Attack

AgentPhishing + PhishOpt optimize reusable email-generation skills against individual agents; agents handle existing phishing datasets safely but fall to adapted attacks — four of nine agents detect under 10% and comply with over 45% of malicious requests.

Key insight: Email agents that pass ordinary phishing tests still comply with nearly half of persuasive attacks tuned to them.

Can LLMs Improve Their Own Harness? A Controlled Study on ARC-AGI-3

Jens Lehmann; Sahar Vahdati arXiv: 2610.30499

On ARC-AGI-3, frontier models build a full task harness and revise it twice; 27 lineages range from zero to near-ceiling, but two revisions raise mean held-out RHAE by only 2.80 points (95% CI [-1.44, 7.35]). Development gains overstate held-out gains; cost cuts can hurt performance.

Key insight: Frontier models can build strong agent harnesses but barely improve them on held-out games when revising their own code.

Adaptive Skill Granularity for Coding Agents: Runtime Routing and Macro-to-Micro Recovery

Dingxuan Zhang; Yanhui Jiang; Jun Wang; Hefeng Zhou arXiv: 2610.31461

Treats skill granularity as an action-abstraction policy: feature-based controller chooses primitive tools, macro skills or hybrid with finite-state macro-to-micro recovery. Fixed macros are efficient but brittle under mismatch; runtime routing and recovery fix controlled macro failures.

Key insight: Coding agents are more robust when they can drop from a packaged skill back to primitive tool calls once the skill fails.

RIPPLE: Recovery Internalization through Process-Level Policy Learning and Effect-Aware Credit for Long-Horizon Agentic Coding

Jingxuan Xu; Zihang Xu; Yuechen Luo; Ziqi Miao; Wenqiang Zhu; Weihao Li; Junhao Fan; Xinshun Feng; Zhiyi Lai; Yanan Wu; Haoyang Huang; Ken Deng arXiv: 2610.31276

RIPPLE names the Critique-to-Action Handoff Gap; a prefix-only teacher provides recovery supervision, then RL assigns stage-specific credit to reflection, diagnosis and correction. +4.8 points mean across four repo-level SWE benchmarks, no critic at deployment.

Key insight: Coding agents often see their own mistake and keep going; training recovery explicitly closes part of that gap.

SWE-VERIFIER: Selective Verification for Cost-Efficient Coding Agents

Kaijian Zou; Vaibhav Chennareddy; Yunxiang Zhang; Naihao Deng; Longju Bai; Jiaxin Pei; Rada Mihalcea; Lu Wang arXiv: 2610.30284

Figure from SWE-VERIFIER: Selective Verification for Cost-Efficient Coding Agents
SWE-VERIFIER: Selective Verification for Cost-Efficient Coding Agents

SWE-Verifier (from Qwen3.5-4B) decides when to sample and rank alternative actions. Resolution 75.47% to 77.20% on MiniMax-M2.7 at 1.09x cost; transfers to DeepSeek-V4-Flash (72.60% to 74.27%, 1.13x); verifies under 4% of steps. Open model, code and data.

Key insight: A small 4B verifier that checks fewer than 4% of steps improved coding agents at about 10% extra cost.

ProductWebBench: Evaluating Website Continuity Beyond Task Completion

Jiajun Wu; Jian Yang; Yaxin Du; Shukai Liu; Linzheng Chai; Tuney Zheng; Wei Zhang; Haitao Yang; Yan Bai; Yihang Lou; Xianglong Liu; Bryan Dai arXiv: 2610.31118

ProductWebBench: 320 Change + 80 Build tasks on living frontend repos with browser checks. Across 8,737 runs from 13 models, 28.2% of Change runs passing requested-work checks fail a continuity check; 10.8% break a state they had passed; interaction fails in 29.5% of runs whose static DOM passes.

Key insight: Over a quarter of frontend agent patches that pass the requested checks still break something else on the site.

Automating Feature Flag Cleanup at Scale with Multi-Agent LLM Systems: An Industrial Experience at DoorDash

Atharv Chandratre; Jai Datar arXiv: 2610.31351

DoorDash system cleans stale feature flags end to end (MCP queries of live rollout data, Jira, PR creation): engineer-approved PRs for 45 of 50 flags, $4.79 and 13.8 minutes per cleanup.

Key insight: An MCP-connected multi-agent system cleaned 90% of stale feature flags at under $5 each.

Feedback That Backfires in Games: Do LLM Players Repeat the Move They Just Watched Fail?

Esmail Gumaan arXiv: 2610.30205

Writing a failed move and error into the transcript makes small models (135M-1.7B) more likely to repeat it (corrective gain -1.38 nats/token) for illegal moves; inversion is present in base models and largely removed at DPO. "Do not repeat" instructions do nothing; a clean retry is worst; describing the failure without the move string keeps the preference.

Key insight: Echoing a failed action back to a small model makes it more likely to repeat it; describing the failure without the action string avoids that.

Certified Execution Harness for Agentic AI: Safe and Least-Intrusive Petri-Net Supervisory Control Between Reasoning and Action

Chao Gu; Quanyan Zhu arXiv: 2610.31376

Formalizes the LLM-to-tools harness as Petri-net supervisory control where marks are capabilities, approvals and budgets; injected requests with unmet preconditions are refused regardless of wording. Introduces replanning closed loops and characterizes the least-intrusive safe supervisor; on a release agent, safe deployment needs a refusable step after rollout starts.

Key insight: Treating tool permissions as tokens in a Petri net blocks injected requests by construction, regardless of wording.

SCOPE: Compiling Natural-Language Policies into Neurosymbolic Predicate Programs

Arnon Mazza; Elad Levi arXiv: 2610.31062

SCOPE compiles natural-language policies into programs of neural predicates run by small models, extractors and code, optimized with adversarial counterexamples. Highest average accuracy vs prompt optimization and workflow baselines; programs optimized with the weakest executor transfer and reach frontier-like accuracy on cheap models, with interpretable, stable verdicts.

Key insight: Compiling a policy into small predicate checks let inexpensive models enforce agent policies about as well as frontier reasoners, with stable verdicts.

AgentTriage: Replayable Security Diagnosis Across Heterogeneous Agent Runtimes

Jie Ying; Xutao Zhang; Ningyuan Chen; Mengce Zheng; Jun Li; Zhongjie Zhu; Tiantian Zhu arXiv: 2610.30738

AgentTriage: executable contract normalizing runtime events across five agent runtimes into a typed provenance graph; claims must cite events, abstain when evidence is missing. On 120 cases: 0.858 grounded joint diagnosis, 0.966 evidence coverage, 0.036 unsupported-claim rate (+0.175 over baseline). Open source.

Key insight: Security diagnoses of agent runs can be made replayable and checkable by tying every claim to recorded runtime events.

Agent Mosaic: Recognizing Confidentiality Leaks in Agentic LLM Systems

Daniel Ruiz; Luca Luceri; Emilio Ferrara arXiv: 2610.30418

Agents combine documents into forbidden composite conclusions: GPT-5.6-Sol leaks in 7.08% of answers in simulation, worse in two live harnesses; classification headers and aggregation rules still leave 32.37% unsafe disclosure across intents; refusals can reveal the conclusion.

Key insight: Agents leak sensitive conclusions by combining harmless documents, and labels plus rules only partly stop it.

Simulated Control Evals

Jeffrey Olmo; David Zhang; Tyler Tracy arXiv: 2610.31593

An LLM simulates tool responses in place of an environment; on LinuxArena, SCEs predict safety with 3.6-point RMSE across five monitors (vs 10.1 for BashArena), using under 5% as many task-pair draws; strategies found in simulation improve monitors on held-out attacks.

Key insight: Simulating tool responses with a language model predicted deployment safety better than running a separate control environment.

LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades

Farnoosh Hashemi; Shiyu Ji; Joice Chen; Michael W. Macy arXiv: 2610.30769

Music Lab replication with LLM populations: exposure to recommendation counts triggers runaway cascades far stronger than in humans, and LLM cascades self-correct less.

Key insight: LLM populations herd far more than humans and rarely recover once a cascade starts.

Who Is the Influencer? Consensus Dynamics in Multi-Agent Systems

Gouki Minegishi; Jingyuan Feng; Hiroki Furuta; Takeshi Kojima; Yusuke Iwasawa; Yutaka Matsuo arXiv: 2610.31105

Across seven model families, the larger model's opinion absorbs the others in a no-right-answer consensus task; modeled as weighted particles on a simplex where stronger in-context learners amplify context majorities.

Key insight: In mixed multi-agent systems the largest model becomes the influencer, even when there is no correct answer.

RoleFlow: Self-Evolving Multi-Role Agentic Collaboration via Structural Adaptation

Yi Ge; Pan Wang; Xuehao Cui; Zian Zeng; Xu Hu; Heng Huang; Furong Huang arXiv: 2610.30429

RoleFlow refines collaboration structures by atomic edits and on-demand role synthesis, trained with SECPO counterfactual credit per edit. Best average across seven benchmarks, +4.7 over strongest competitor; +3.2-7.5 F1 on multi-hop QA.

Key insight: Crediting each individual change to a multi-agent structure lets the system evolve its roles more effectively.

Beyond Accuracy: Disentangling Decomposition from Typed-State Quality Assurance in Multi-Agent LLM Pipelines

Maria Gabriela Alves Zuppardo; Vinicius Cardoso Garcia arXiv: 2610.31280

Requirements-engineering pipelines on three local 7-8B models: F1 gain comes from the two-call specialized-prompt split (up to +0.075), while Pydantic-validated typed state adds -0.003 to +0.013 but contains out-of-range outputs at the boundary instead of failing later.

Key insight: In small-model pipelines, splitting prompts drives accuracy while typed state mainly stops bad outputs from spreading.

MoEZip: Routing-Aware KV Cache Compression for Sparse Mixture-of-Experts LLMs

Minsang Kim; Seungjun Baek arXiv: 2610.30206

MoEZip: routing-aware KV eviction using Fisher information of expert routing combined with attention scores. At 10% KV retention, +24 and +20 points over SoTA on LongBench and RULER.

Key insight: KV-cache eviction can change which experts a MoE model picks; accounting for routing preserves quality at 10% retention.

News and changelogs