Friday's cs.AI announcement day (2026-10-30) lists 158 new and 234 cross-lists (replacements skipped; listing total 392). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 40 papers. Agent skills are the day's security story: a study of 1.53 million public skills finds about 1 in 17 telling agents to skip approvals or checks, a poisoned Markdown skill file lifts jailbreak success from 0.5% to 45%, and a new scanner that analyzes how skills combine confirms dozens of real vulnerabilities in popular repositories. Self-improvement cuts both ways: compiling stable skill steps into validated programs gains up to 32%, but agents rewarded for following external instructions learn to obey injected ones, and self-editing harnesses can quietly shed redundant safeguards. For computer-use agents, an online-RL 8B agent ties a frontier model on live iOS apps, clicks planned in the first second of a page load go stale 17% of the time, and agents miss mid-task world changes unless shown the new value. Memory work favors governance over volume, keeping superseded facts but gating them by time, and pairing episodic with relational memory. Also: signed micro-VM sandboxes and proof-carrying messages between agents, evidence that role-split coding pipelines cost 3x without solving more, explicit rules beating code examples for coding agents, frontier-written artifact banks that lift small models, an open hybrid Mamba-Transformer for agentic coding, and lossless KV compression for personal devices.

Research Papers

Online Dense Reinforcement Learning with Planning-Grounding Agent for UI Navigation on Live IOS Apps

Peitong Duan; Khashayar Gatmiry; Jeffrey Nichols; Samy Bengio; Emmanuel Abbe arXiv: 2610.39264

Figure from Online Dense Reinforcement Learning with Planning-Grounding Agent for UI Navigation on Live IOS Apps
Planner and grounding model trained with online RL on hundreds of virtual iOS devices, with dense VLM-as-a-judge rewards.

Splits the agent into a Planning agent and a UI Grounding model and trains it online on live iOS apps with PPO, using an LLM-as-a-Judge for dense step-level rewards plus a terminal reward; GiGPPO stabilizes the critic with rewards from visually similar states across concurrent trajectories. Infrastructure runs hundreds of concurrent virtual iOS devices. 8B RL agents get nearly 7x the SFT baseline on out-of-distribution Android, beat Gemini-3.5-Flash and tie Gemini-3.1-Pro on real iOS apps (UINavBench, iOSWorld, AndroidWorld).

Key insight: Trained online on live iOS apps with dense step-level judge rewards, an 8B planner-plus-grounder agent tied Gemini-3.1-Pro on real iOS apps and reached nearly 7x its supervised baseline on unseen Android tasks.

When Skills Tell Agents Not to Ask: A Large-Scale Study of Oversight Directives in Agent Skills

Timofey Sanko; Yuan Tian arXiv: 2610.37734

Figure from When Skills Tell Agents Not to Ask: A Large-Scale Study of Oversight Directives in Agent Skills
How the study built its codebook and detector for oversight-loosening directives across 1.53M agent skills.

Analyzes 1.53M English skills from GitSkills with a hand-labelled codebook (2,097 units) and a trained detector. About 1 in 17 skills (~88,000) carries a directive that loosens oversight (proceed without approval, --no-verify, keep going without check-in), mostly via permission flags, 70.1% unconditional. Skills that run shell, install packages or use sudo have 1.7-1.8x the odds. Spread is upstream: 2.4% of skill families account for half of all copies. Open-source skill scanners catch at most 46% (precision <0.4); the same LLM prompted with the codebook catches 61% at 0.71.

Key insight: About 1 in 17 public agent skills tells the agent to skip approvals or checks, and the best open-source scanners catch fewer than half of them.

Compile Away Uncertainty: Self-Evolving Agent Skills via Programmatic Compilation

Chengyu Yang; Yunxiang Zheng; Zongzheng Li; Jiamei Li et al. arXiv: 2610.39508

Figure from Compile Away Uncertainty: Self-Evolving Agent Skills via Programmatic Compilation
SkillCompiler: task analysis, program synthesis and validation, and a reusable program asset bank.

SkillCompiler decomposes textual skills into fine-grained operations, analyzes executability, and builds hybrid skill skeletons: context-dependent steps stay as LLM reasoning, well-specified ones become validated programs. Validated programs are kept as reusable assets and retrieved before new synthesis. Up to 32.33% task-performance gain over prior methods across five benchmarks and six model families.

Key insight: Turning the well-specified steps of a skill into validated programs, and leaving only context-dependent steps to the model, improved task performance by up to 32%.

Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed

Bravish Ghosh arXiv: 2610.38458

Figure from Tracekit Box: Running AI Agents in Micro-VMs Where Every Way Out Is Decided and Signed
Tracekit Box verifying a run bundle: every record signed, every exit accounted for.

Tracekit Box (open source, MIT, v0) runs each agent job in a Firecracker micro-VM with no network card; the only exits are host-side 'doors' over vsock (commands, outbound connections, secrets, model calls, workspace patch), each decided and signed by a signer the agent cannot reach. Private and cloud-metadata addresses are always refused, secrets never enter the VM (placeholders swapped by a host proxy), and changes return as a patch approved file by file. 13/13 end-to-end checks pass; 15 fuzz targets found nine issues, all fixed. Limits: no Firecracker jailer yet, co-located signer required.

Key insight: Running each agent job in a network-less micro-VM where every exit is a host-side, signed decision keeps secrets out of the sandbox and leaves a verifiable record of everything that left it.

PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication

Bravish Ghosh arXiv: 2610.39109

PCM makes each inter-agent claim ('tests passed', 'a person approved this refund') carry evidence: append-only Merkle-log records with inclusion proofs signed by an attesting signer the agent cannot control; receivers verify offline and grade each claim proven / unproven / failed. Authority travels as narrowing grant chains rooted in a recorded human approval. On 926 messages from real runs (712 lies in 16 classes), PCM accepts 10 lies, all stale evidence (1.4%); plain A2A accepts all 712 and six deployed protocol models accept 504-712. Verification ~1 ms.

Key insight: Making inter-agent claims carry signed log evidence cut accepted lies from all 712 to 10 on real multi-agent traffic, at about 1 ms of verification per message.

What Does "Now" Mean to Your Computer-Use Agent? Stale Screenshots, Page Loads, and Which Check to Run Before a Click

Vasundra Srinivasan arXiv: 2610.39282

Measures planned clicks on 31 public pages: 0.4% of clicks planned on fully loaded pages went stale within 30 s vs 17% of clicks planned in the first second after load. Waiting ~1 s for network idle removes most risk, yet 8 of 10 popular open-source agents' wait rules leave >1% stale. Commercial pages keep loading longer than .gov pages. Before irreversible actions, a pixel comparison verifies target position as accurately as a frontier VLM at 1/8 the latency, and a 4B model matches the frontier model at verifying the previous action. Releases a benchmark generator, a break-even formula and three rules.

Key insight: Clicks planned in the first second after a page load went stale 17% of the time versus 0.4% on loaded pages; a short network-idle wait plus a pixel diff before irreversible clicks removes most of the risk cheaply.

CALM: Conflict-Aware Lifecycle Memory Governance for Long-Horizon Language Agents

Chang Li; Xianhao Ou; Xinyan Ma; Hao Li et al. arXiv: 2610.38573

Figure from CALM: Conflict-Aware Lifecycle Memory Governance for Long-Horizon Language Agents
CALM keeps superseded facts but admits them only when a query's time frame calls for them.

CALM separates preserving memory from admitting it at query time: records become evidence-grounded memory cells whose validity and lifecycle state are updated from support, conflict and dependency signals, and query-time gating (training-free or learned) admits evidence by temporal applicability. Best overall accuracy on LongMemEval-S and LoCoMo with Qwen and GPT backbones; preserving superseded records keeps past-state questions answerable without hurting current-state answers.

Key insight: Keeping superseded facts but gating them by temporal applicability at query time lets agent memory answer both 'where do I live now' and 'where did I live before' correctly.

Long-Term Agent Memory through Complementary Curation and Consolidation

Abhishek Gupta; Dongge Han; Daniel Madrigal Diaz; Wei-Ning Chen; Mayukh Das; Victor Rühle; Saravan Rajmohan arXiv: 2610.39790

Hybrid memory of episodic memories and structured relational memories plus an efficiency-preserving consolidation step. The two types are consistently complementary; combined they beat state-of-the-art memory frameworks at 90.2% on LoCoMo and 85.5% on LongMemEval-S.

Key insight: Episodic and structured relational memories turned out to be complementary; combining them with a cheap consolidation step reached 90.2% on LoCoMo and 85.5% on LongMemEval-S.

Masked Erosion: How Acceptance Gates Lose Redundant Safeguards in Self-Improving Agents

Hau-Sing So; Daixian Liu; Weicai Long arXiv: 2610.38392

Figure from Masked Erosion: How Acceptance Gates Lose Redundant Safeguards in Self-Improving Agents
Masked erosion: an acceptance gate keeps a harness that lost a safeguard because overlapping layers still block harm.

Self-improving agents edit their harness and keep edits that score higher; when safeguards overlap, deleting one is masked because others still block harm. Measures harm for all subsets of four safeguards in two environments, 411 improvement loops under ten gate rules, plus three GEPA runs. A paired significance test blocks chance deletions; at the same cost 20-task batches kept every harness protected while 40-task batches lost all six. GEPA kept safety rules verbatim, yet two of three final harnesses misused credentials under a weaker model. Freezing safety text or auditing one-layer ablations preserves depth.

Key insight: Self-improving agents can delete redundant safeguards one at a time without any score drop, because overlapping layers mask the loss; freezing safety text or auditing single-layer ablations prevents the erosion.

Appreciation Teaches Unauthorized Execution: Self-Evolution Degrades the Robustness of Personal Agents to Indirect Prompt Injection

Xinyan Wang; Xiaogeng Liu; Jun Shao; Chaowei Xiao arXiv: 2610.39122

Two-phase study on a real personal agent: the user asks it to read external content and do the task described there, then rewards it; later a third party plants a similar task the user did not authorize. Versus the non-evolving base agent, attack success rises 14.0-48.8 points under skill evolution and 3.0-39.3 points under RL.

Key insight: Rewarding a personal agent for doing tasks found in external content taught it to obey injected tasks too, raising attack success by up to 48.8 points after skill evolution.

Is it my preference? Role Grounding Attack against Agent's Memory via Social Interaction

Haoran Bu; Yiting Shen; Litian Zhang; Ruihan Hu; Xi Zhang arXiv: 2610.38209

Role Grounding Attack: an experience-sharing post quotes a conversation between the attacker agent and its user; the victim agent stores the attacker user's preference as its own user's. Instantiated as tool-selection manipulation (steering to an attacker tool) and privacy leakage (sensitive data put into that tool's arguments). High attack success across five mainstream memory systems and six models.

Key insight: A shared 'experience' post that quotes another user's conversation can make a victim agent store that stranger's preferences as its own user's, steering tool choice and leaking data across five memory systems.

Poisoned Skills: Propagating Jailbreaks Through Agent Markdown Files

Kashyap R Manjusha; Murali Emani arXiv: 2610.37738

A LangChain QA agent whose system prompt is built from a user-provided Markdown skill file. Across seven open-weight models and 270 forbidden questions, a benign prompt gives 0.5% mean attack success; the poisoned skill file raises it to 45% (up to 68.9%). Zero-width and phonetic obfuscation do not beat plain text (phonetic drops to 30%); vulnerability depends more on the model than on the payload.

Key insight: A poisoned Markdown skill file raised jailbreak success on open-weight models from 0.5% to 45%, and plain text worked better than obfuscated payloads.

Scan Before You Install: Detecting and Mitigating Local and Composite Vulnerabilities in Skills

Parth A. Gandhi; Avital Aviv; Prasanna N. Wudali; Yuval Elovici; Asaf Shabtai arXiv: 2610.37901

Six-module scanner (extraction, local analysis, composite analysis, validation, reporting, mitigation) for unintended vulnerabilities in benign skills and multi-skill interactions. 95.90% recall at 4.22% FPR on a 556-case SkillTrustBench subset; F1 0.947 on 1,000 MalSkillBench skills, beating Cisco Skill Scanner, NVIDIA SkillSpector and others. In 1,587 skills from 75 top GitHub repos, 53 of 59 findings confirmed; mitigations blocked PoC attacks for 47 of 55 findings. Composite analysis F1 0.991 on SCR-Bench.

Key insight: A scanner that also analyzes how skills interact found 53 confirmed vulnerabilities in 1,587 skills from popular GitHub repos, with 95.9% recall at a 4.2% false-positive rate.

SkillCT: A Multidimensional Benchmark and Execution-Free Baseline for Agent Skill Assessment

Mengyu Sun; Zunlong Zhou; Ziyuan Yang; Yi Zhang arXiv: 2610.38147

SkillCT scores skills on nine dimensions across static (specification), dynamic (stability across backbones and request variants) and human-assisted (behavior-chain consistency, granularity) assessment, applied to a public skill corpus; an execution-free baseline predicts a new skill's quality profile from similar reference skills, and SkillCT-guided optimization improves task success and efficiency.

Key insight: Skill quality can be scored across nine static, dynamic and human-assisted dimensions, and predicted for new skills without executing them.

REALM: Identifying Minimal Task Assets for LLM Agents

Zihou Ren; Byungchul Tak; Long Wang arXiv: 2610.39155

REALM builds a dependency graph of the assets a task needs (files, accounts, services), admits newly discovered assets through source-scoped selection, and separates discovering an asset from authorizing its use; agents run in a Task Container behind resource-bound Partial APIs. On AgentDyn (60 clean tasks, 560 injected cases) with qwen3.5-flash it completes 40.0% / 36.4% of tasks and cuts attack success from 16.6% to 0.2%.

Key insight: Giving an agent only the minimal assets a task needs, and separating discovering an asset from authorizing its use, cut prompt-injection success from 16.6% to 0.2%.

Think Before You Act: Decision Gate for LLM Agents

Iftach Shoham; Yuval David; Offer Akrabi; Erez Bilgory; Ido Levy; Sami Marreed; Sergey Zeltyn; Segev Shlomov arXiv: 2610.38620

JevAct intercepts selected agent actions before execution, compiles domain policies into executable state checks plus structured questions scored by a prefill-only decision model (probabilities, no generation), and returns feedback for bounded revision; model-agnostic, no tool changes. Across eleven agents on tau^2-bench Airline/Telecom and BFCL: consistent gains on Telecom and BFCL, mixed on Airline.

Key insight: Checking selected agent actions against compiled policy rules before execution, scored by a prefill-only decision model, improved reliability on Telecom and BFCL tasks without changing any tools.

Where You Inject Matters: The Trust Region Effect in LLM Agents

Chengquan Guo; Xiaodong Liu; Weiwei Yang; Mingqian Feng et al. arXiv: 2610.38867

Three agentic testbeds (tool use, coding, daily workflow). With content fixed, susceptibility varies by placement: a GPT-5.4 agent follows an unsafe instruction in a README or TODO 2.6x more often than in a code or data file. Learning-based attackers that choose content and placement are stronger.

Key insight: The same malicious instruction is followed 2.6x more often when it sits in a README or TODO than in a code or data file, so placement is part of the injection risk.

Understanding and Mitigating Role Spoofing in LLMs

Ezra Edelman; Benjamin Edelman; Surbhi Goel; Eran Malach arXiv: 2610.40396

Malicious tool output (e.g. a web page) can impersonate the user because models attribute roles from content and structure cues. Models are highly susceptible to combined fake-structure + fake-content attacks; in a toy setting, adversarial training against content-based injections leaves structure-based ones open. Proposes linear-probe detection of role spoofing that works across settings.

Key insight: Models decide who is speaking from content and structure cues, so tool output can impersonate the user; training against one kind of spoof leaves the other open, while a linear probe detects spoofing across settings.

VeriCUA: Verification as Agentic Exploration for Computer-Using Agents

Qiushi Sun; Da Yu; Alexander Knop; Amer Sinha; Lingpeng Kong; Ben Kao; Ravi Kumar; Pritish Kamath arXiv: 2610.40578

VeriCUA treats task-completion verification as exploration: build a rubric from available context, then choose GUI or code checks for unresolved requirements and combine evidence under explicit rules; one procedure for online/offline, desktop/mobile/web. Better agreement with reference labels than baselines, biggest offline gains on hard cases, stronger rejection of false completion claims online.

Key insight: Verifying whether a computer-use agent really finished a task works better as an exploration problem, building a rubric and then choosing GUI or code checks, especially for rejecting false completion claims.

EnvOS: Auditing Computer-Use Agents When the World Moves On : Phenomenon-Based Task Construction, Certification, and Evidence-Based Evaluation

Ankush Kadu; Athira Gopal; Niharika Singh; Arpit Jain; Aswanth Krishnan arXiv: 2610.40246

Figure from EnvOS: Auditing Computer-Use Agents When the World Moves On : Phenomenon-Based Task Construction, Certification, and Evidence-Based Evaluation
EnvOS: a world change mid-task, the information conditions shown to the agent, and evidence-based evaluation.

EnvOS builds and certifies environments that change during a task (pre-checks that changes fire, task stays solvable, grader separates right from wrong; post-run re-check from archived evidence). In clinic booking, Claude Opus 5 succeeds 0/16 with nothing shown, 2/16 when reminded to re-check, 15/16 when the updated value is shown; in insurance approval Opus 5 re-checks itself (10/10) while Sonnet 5 goes 1/10 to 9/10 when policy is re-shown. The grading pipeline accepted 0/26 corrupted episodes as clean.

Key insight: When a value changed mid-task, a frontier computer-use agent succeeded 0 of 16 times unless the updated value was shown to it, which raised success to 15 of 16.

Where to Learn and How Far to Roll Out: Efficient Adaptive Training for GUI Agents

Yuxiang Chai; Quyu Kong; Panrong Tong; Steven Hoi; Yue Wang arXiv: 2610.39251

Builds reusable intermediate checkpoints from expert trajectories, picks pivots by action disagreement, does one-step RL at pivots, then expands through Local, Suffix and Root training as progress allows. Cuts environment interaction 56-61% vs vanilla GRPO while improving performance on MobileGym and CUA-Gym-Hub.

Key insight: Starting reinforcement learning at the steps where expert and agent disagree, then expanding rollouts outward, cut environment interaction for GUI agents by 56-61% while improving results.

DynaRev: Benchmarking Web Agents under Dynamic Goal Revision

Shiqi Zhang; Guochen Zhou; Zesheng Wei; Hai Zhao; Zhisong Zhang arXiv: 2610.40133

DynaRev: 181 tasks delivering additive, override and runtime-conditioned revisions at semantic milestones; scores correctness, responsiveness and efficiency from trajectories. Agents often satisfy only part of the requirements; rewriting instructions while preserving browser state helps, browser resets hurt.

Key insight: Web agents asked to change goals mid-task often satisfy only part of the revised request; rewriting the instruction while keeping browser state helps, while resetting the browser hurts.

WebAnything: From the Wild Web to Scalable Agent Environments

Tianci Xie; Zikun Cai; Chaoyun Zhang; Pinxue Guo; Bingxuan Li; Rui Zheng; Hang Yan arXiv: 2610.37786

Figure from WebAnything: From the Wild Web to Scalable Agent Environments
WebAnything rebuilds real websites into verified, resettable environments for agent training.

WebAnything rebuilds resettable web environments from real URLs with an Explorer-Builder and independent verifier: 244 sites, 14 domains, 12,984 accepted tasks; beats human-assisted WebHarbor on fidelity (12 wins, 2 ties, 0 losses). Fine-tuning Qwen3.5-9B on 5,856 trajectories adds +9.9 pts REAL and +13.33 pts WebArena-Verified. Code released.

Key insight: Rebuilding real websites as resettable, verified environments produced nearly 13,000 tasks across 244 sites, and fine-tuning a 9B model on them added about 10-13 points on web benchmarks.

Prefix Executability: Evaluating Tool-Using Agents Beyond Final Success

Amir H. Rezaeian; Weiyi Sun; Yassine Benajiba; Dan Roth arXiv: 2610.40444

Scores whether every prefix of a tool-call sequence stays executable under schemas, preconditions and data dependencies (PEC curves, first-error depth, TER, AUC-PEC, recovery rate) on BFCL-v3 multi-turn, ToolSandbox and tau^3-bench Airline/Retail. Plan-conditioned agents often have higher final success but lower executability; explicit pre-execution plan checking improves prefix survival.

Key insight: Tool-using agents with higher final success can still issue more non-executable intermediate calls; scoring every prefix of a call sequence exposes this, and plan checks before execution help.

AgentDecept: Benchmarking Deceptive Behavior in Tool-Using LLM Agents under Pressure

Yehan Zhang; Qianqi Yan; Hang Yin; Ching-Chen Kuo; Shan Jiang; Ming Ouyang; Yijie Liu; Xin Eric Wang arXiv: 2610.39377

AgentDecept: 477 pressure variants from 257 executable tasks across six pressure sources (events, context, app state, tool responses, quotas), each with a pressure-free twin; trajectories are graded by relating user-facing claims to observed outcomes, separating falsification, concealment and equivocation from honest failure.

Key insight: Pairing each pressured agent task with a pressure-free twin separates genuine deception (falsifying, concealing, equivocating) from honest failure.

MemSteer: Turning User Histories into Supervision for Agent Memory Optimization

Jie Huang; Cuiling Lan; Qize Yu; Xiulian Peng; Yan Lu arXiv: 2610.39276

MemSteer turns unlabeled user histories into evidence-grounded QA pairs (answer plans, source-grounded audits, blind answer recovery); MemSteer-Opt uses them to revise memory store, retrieval and context construction without weight updates. +13.4 ATM-Bench Question Score over Base-BM25 and +4.1/+6.6 on RHELM; competitive with official-QA-guided optimization, and works for new users.

Key insight: Unlabeled user histories can be turned into grounded question-answer pairs that tune an agent's memory store and retrieval without weight updates, adding 13.4 points on ATM-Bench.

MUSE: Multi-Level Memory with Selective Runtime Injection for Scientific Coding Agents

Haoran Jin; Defu Lian; Xiting Wang; Hong Xie arXiv: 2610.38332

MUSE builds global, approach-level and implementation-level memory from past trajectories; global + matched approach memory at start, implementation memory retrieved during execution, with an LLM gate that injects review advice or skips. Beats retrieval and memory baselines on four benchmarks (numerical solving, kernel optimization, scientific software repair). Code available.

Key insight: Splitting memory into global, approach-level and implementation-level layers, and letting a gate decide when to inject advice during execution, outperformed retrieval baselines for scientific coding agents.

When to Assist and What to Suggest: Joint Gating and Memory-Grounded Hint Generation in One Compact Decoder

A. J. A. Jubayer Talukder; Mohammad Ariful Haque arXiv: 2610.40611

Evaluates 'when to assist' gating and 'what to suggest' generation jointly on 28,058 decision points. Removing the memory profile costs 24.7 exact-match points; retrieval and a larger generator add nothing on exact match. One 1B decoder gates from an intermediate layer and generates in the same pass, matching two-model pipelines at 1.31-1.76x less wall-clock time.

Key insight: A single 1B decoder can decide when to assist and generate the hint in one pass, matching two-model pipelines while running 1.31-1.76x faster; the user's memory profile matters far more than retrieval.

GAAC: Lossless KV Compression for Bandwidth-Efficient LLM Inference on Personal Devices

Yipin Guo; Arun M George; Siddharth Joshi arXiv: 2610.38210

GAAC losslessly compresses BF16 KV caches by coding exponents (1.405-1.407x across five models; FP8 E4M3 1.09-1.14x, E5M2 1.25-1.30x) with a fused attention kernel and paged-serving support. On DGX Spark: 1.19-1.27x faster decode attention at 64K context, ~26% less resident KV memory; on Apple M4: 1.02-1.25x attention speedups.

Key insight: Losslessly coding the exponents of BF16 KV caches shrinks them about 1.4x and speeds long-context decode attention on personal devices such as DGX Spark and Apple M4.

Nemotron 3.5 Super and Lightning: Open, Efficient Mixture-of-Experts Hybrid Mamba-Transformer Models for Agentic AI

NVIDIA arXiv: 2610.38095

NVIDIA's Nemotron 3.5 Super (120B total, 12B active, multimodal) and Lightning (30B, 3B active, text), described as open, with long-context training, native speculative decoding and agentic SWE mid-training. Super reaches 51.78% on SWE-bench Pro (above Nemotron 3 Ultra with ~4.6x fewer active params); NVFP4 quantization recovers 99.62% median accuracy vs BF16.

Key insight: An open 120B-total, 12B-active hybrid Mamba-Transformer reached 51.78% on SWE-bench Pro, beating a much larger predecessor, and keeps 99.6% of accuracy at 4-bit NVFP4.

Artifact Distillation: Training-Free Transfer from Frontier to Small Language Models

Mustafa Safa Ozdayi; Somin Wadhwa arXiv: 2610.37680

A teacher solves training instances and writes its procedure into an artifact bank that a student queries at inference, no gradients. A bank written by Claude Opus 4.5 lets Claude Haiku 4.5 beat unaided Sonnet 4.5 on spatial reasoning (0.707 vs 0.647) at 60% of its cost and match Sonnet on table joining at 89% of its cost; the same bank lifts Qwen3.5-27B from 0.730 to 0.800.

Key insight: A bank of procedures written by a frontier model lets a small model beat an unaided mid-size model on spatial reasoning at 60% of the cost, with no training.

The Coordination Tax and the Heterogeneity Dividend: Break-Even Conditions for Multi-Agent LLM Pipelines

Andreas Zettl; Diego Gosmar arXiv: 2610.37700

Closed-form model of coordination tax vs heterogeneity dividend, measured with Open Floor Protocol on 135 HumanEval/ClassEval tasks (2,430 runs, Claude Opus 5.5 and Haiku 5.5). Protocol overhead is tiny (7.2 ms/handoff), but planner-coder-reviewer costs 3.22x a single strong call, takes 3.24x as long and solves no more; moving roles to the cheap model is still worse. An oracle choice between the two single calls solves 94.3% at half the strong call's cost per solved task.

Key insight: A planner-coder-reviewer pipeline cost 3.22x a single strong-model call and solved no more tasks, while simply choosing the right single model per task solved 94.3% at half the cost.

Goal-Aware Dynamic Multi-Agent Collaboration for Long-Horizon Tasks

Xu Shen; Lingyong Yan; Shuaiqiang Wang; Jianmin Wu; Zhikai Chen; Jiliang Tang; Jie Ren arXiv: 2610.39193

Finds verification correlates most with success but happens late, and duty-relevant info thins as shared context grows; separate-context MAS alone loses the goal. GAD uses a growing execution graph of subtasks, keeps the original instruction plus each subtask's goal and acceptance conditions in every context, routes results by evidence-based dependencies, and verifies/repairs against goals.

Key insight: Long-horizon multi-agent systems lose the goal as shared context grows; keeping the original instruction and each subtask's acceptance conditions in every agent's context and verifying against them fixes this.

MAS-Loop: Beyond One-Shot Orchestration towards Self-Evolving Multi-Agent Systems

Hehai Lin; Qi Yang; Chengwei Qin arXiv: 2610.38946

MAS-Loop pairs an Orchestrator that builds and runs a MAS with a trajectory-conditioned Refiner that localizes a failure and proposes a bounded patch; the patched system is re-run and the pair provides learning signals for both. Strongest overall among baselines; releases MAS-JudgeCorpus.

Key insight: Pairing an orchestrator with a refiner that localizes failures and patches the multi-agent system, then re-runs it, beat one-shot orchestration baselines.

SkillMem: Compact External Skill Memory for Latent Multi-Agent Reasoning

Yuxuan Zhu; Mohammad Mohammadi Amiri; Pin-Yu Chen; Keerthiram Murugesan arXiv: 2610.37935

SkillMem stores each skill as a small external latent memory (8x256, 9.6 KB per skill) read by a role-conditioned cross-attention reader, trained by behavioral distillation from textual skills with a frozen backbone. Strong gains for small Qwen3 (4B-14B) backbones; for 100 skills, >38x less storage and up to 4.23x end-to-end speedup.

Key insight: Storing each skill as a 9.6 KB latent memory read by cross-attention gives small models strong gains with over 38x less storage and up to 4.23x faster end-to-end runs.

Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy

Hengyu Wu; Blaise Delattre; Yang Cao arXiv: 2610.39532

TG-CI formalizes Contextual Integrity over a multi-agent task graph, considering where an item will propagate and what recipients already know; Full-Scope and Auto-Region enforcement policies. MAPLE-Bench (144 cases). Cuts unauthorized disclosures 85.8-94.1% vs local-history CI while keeping 93.6-96.1% of task accuracy.

Key insight: Judging privacy by where information will propagate in a multi-agent task graph cut unauthorized disclosures by 86-94% while keeping almost all task accuracy.

Soei: Structured Observability of Evidence and Intent for Multi-Agent AI Software Engineering

Mohammed Nayeem Khan; K S Sarun Kumar arXiv: 2610.39468

Audits Agenttrail and analyzes 45 real coding-agent sessions (102,233 records, 20,577 tool runs): 23.4% of code-editing episodes end with no independent check after the last edit; 57.8% of to-dos marked complete had no proof in between; 42% of sessions run >24 h; 1,326 records contain credential-like strings. Proposes Soei: hash-chained local ledger, PROV-aligned graph, and a verification layer that separates 'claimed done' from proof (ledger 20% of raw size, ~126k events/s).

Key insight: In 45 real coding-agent sessions, 58% of to-dos marked complete had no evidence they were done, which motivates a ledger that separates 'claimed done' from proof.

Precedent or Intent? What Coding Agents Follow When Evolving Existing Code

Haichao Zhu; Geyang Xu; Zhaorui Yang; Jiyuan Wang; Qian Zhang arXiv: 2610.38244

5,625 trials across four coding agents: agents follow repository precedent over their defaults (359/360); three supporting local files give 96% adoption vs 4% for sibling-resource files, and file placement alone shifts adoption 0% to 100%. Written priority rules beat code examples when intent conflicts (59/60 vs 38/60); in open-source repos a harness-loaded rule raises joint success from 0/120 to 117/120.

Key insight: Coding agents follow the existing repository's patterns almost always, and an explicit rule loaded by the harness lifted joint success from 0 of 120 to 117 of 120 where examples alone failed.

How Deterministic SAST and AI Security Agents Divide the Work: Coverage, Harness Policy and Cost in Snyk VulnBench 2.0

Liran Tal; Chris Liu; Charlotte Fereday; Sebastian Roth; Brian Clark arXiv: 2610.38617

Snyk VulnBench 2.0 (108 vulnerabilities, 20 apps). Snyk Code 82.4% macro recall vs Claude Code /security-review with Opus 5 xhigh 79.3%; combined 101/108. Without Claude Code's built-in review policy the same model matched 16 vs 9 of 20 vulnerabilities in excluded classes; Codex Security (GPT-5.6 Sol) 80 file-level vs 34 line-level. Data public.

Key insight: A deterministic SAST tool and an AI security agent found largely different vulnerabilities, together catching 101 of 108, and the agent's built-in review policy hid classes it could otherwise find.

Answer-Only Disclosure: Private-Context LLM Assistance over Web APIs with a Leakage Ledger

Liang Yuan; Xiaohu Du; Ruikun Luo; Jinze Wang et al. arXiv: 2610.38126

Shows collaborative decoding can leak private document content through the message transcript (rejected speculative drafts carried a secret). ADLER makes every cloud message depend only on the public view and the shown answer, with a client-side leakage ledger. On masked GSM8K, a 0.5B client goes 0.41 to 0.83 and a 1.5B client 0.67 to 0.85 (full upload: 0.92).

Key insight: Collaborative decoding can leak private text through rejected drafts; making every cloud message depend only on public context and the shown answer, with a leakage ledger, still doubled a 0.5B client's accuracy.

News and changelogs