Tuesday's cs.AI announcement day (2026-11-03) lists 222 new and 303 cross-lists (replacements skipped; listing total 525). This listing was posted late, so it is published as a catch-up. A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 42 papers. The main theme is whether agent memory actually gets used. An audit of 8,000 SWE-bench episodes finds that three memory systems barely move resolve rates because most delivered memories are irrelevant or ignored, and a proof shows that top-k retrieval logs cannot reveal any single memory's value. Meanwhile, structured memory designs post large gains on recall benchmarks and on vague, history-dependent phone tasks. Context handling gets two practical results. A production travel agent is twice as accurate when tool records stay out of the model's context. After compaction, agents break operating rules even when the rule text is still present. Skills and tools: contrastive skill descriptions double routing accuracy in a 731-skill library, and a production service compiles skills from verified traces and serves them over MCP. A cross-framework study finds MCP tool poisoning succeeds 22.9% of the time and that no framework adds a defense. Also covered: harness self-evolution and its forgetting problem, collisions between parallel coding agents, harnesses that report exit 0 when a command never ran, deterministic and formally verified tool-call guards, refutation-based action checks, computer-use and GUI agents, an open agent model recipe, and on-device and local agent serving.

Research Papers

Who Schedules Agent Memory? A Sidecar Approach to Long-Horizon Tasks

Zhuang, Qijia; Liu, Rui; Ren, Yuxiang arXiv: 2611.00779

Figure from Who Schedules Agent Memory? A Sidecar Approach to Long-Horizon Tasks
Figure from the paper (2611.00779).

MemSidecar splits memory scheduling from execution. Hooks push bound memory to the main agent when execution events match predefined conditions; Foresight runs an independent agent that predicts likely queries, retrieves in parallel and caches results. 41.23% (Hooks) and 44.34% (Foresight) on MCP-Persona with lower cost and latency.

Key insight: Hook-triggered memory delivery maps onto Claude Code-style hooks: the main agent should not have to stop and decide to look things up.

Pulse: Long-Horizon Tasks Need Streaming Personalization

Zhuang, Qijia; Liang, Jialiang; Ren, Yuxiang arXiv: 2611.00988

Figure from Pulse: Long-Horizon Tasks Need Streaming Personalization
Figure from the paper (2611.00988).

Pulse runs a lightweight memory agent beside execution that watches for emerging personalization needs and preference conflicts and intervenes from user and project memories; RL learns when and how to intervene. 71.9% on pi-Bench and 46.4% on MCP-Persona, best among compared methods.

Key insight: Preferences retrieved only from the first request get missed mid-task; a day-admin agent needs a watcher that re-applies them as the plan unfolds.

Delivered, Not Used: Evaluating Agent Memory at Its Point of Use

Xu, Changran; Li, Zeju; Xu, Qiang arXiv: 2611.01718

Figure from Delivered, Not Used: Evaluating Agent Memory at Its Point of Use
Figure from the paper (2611.01718).

MemUse audits each memory delivery in recorded trajectories against what the agent could already see, then follows later actions. On 8,000 SWE-bench Verified episodes from three memory systems, resolve rates stay within 0.4 pts of no memory, yet most delivered entries were irrelevant, most relevant ones went unused, and in two systems most restated visible content. 23.2% of episodes with beneficial use still failed.

Key insight: Outcome scores hide whether memory did anything. Log deliveries and check use before tuning a memory layer.

Memorix: Managing Memory Selections for AI Agents

Zhang, Jing; Song, Xiaguannan; Du, Dong; Feng, Erhu et al. arXiv: 2611.00060

Figure from Memorix: Managing Memory Selections for AI Agents
Figure from the paper (2611.00060).

Memorix computes what an agent should read once per project: an immutable versioned Store, a View separating selection from composition, and Quests/Profiles that keep the view fresh. On SWE-ContextBench and LibEvolutionEval: up to 1.5x resolved rate, correct library version on every version-conditioned task, up to 100x lower amortized cost and 38x faster builds.

Key insight: A reproducible, pinned context bundle per project beats per-task splicing of files, and makes failures replayable.

Top-$k$ Retrieval Leaves Memory Value Undetermined

Behnam, Arman arXiv: 2611.03289

Proves top-k retrieval leaves every memory's value undetermined from its retrieval log no matter how many episodes; on 14 memory benchmarks no value was determined in any of 55 configurations. LEDGER estimates only determined Shapley values with confidence intervals, merges identical-history memories and retrieves to make future logs informative: determined fraction 0.001 to 0.797 on pooled HotpotQA, -2.6 acc there, +2.7 on LoCoMo.

Key insight: Do not prune or rank memories by usage-success heuristics from top-k logs; they carry no identifiable signal.

MemShift: Separating Detection from Repair in LLM-Derived Personal Memory

Xu, Zichuan; Zhang, Haochen; Dong, Yuyang; Onizuka, Makoto et al. arXiv: 2611.02338

Figure from MemShift: Separating Detection from Repair in LLM-Derived Personal Memory
Figure from the paper (2611.02338).

MemShift benchmarks five shifts (source revision, deletion, redefinition, writer switch, export) in derived personal-memory values, scoring detection and repair separately with a deterministic scorer. On four open-weight LLMs, detection only helps as much as repair allows; LLM-written programs over typed records close most of the gap to exact recomputation.

Key insight: Values like 'important contacts' should be recomputed by code over typed records, not re-derived in free text by the model.

Chain on Demand: Deferred Evidence Organization for Long-Term Conversational Memory

Lu, Di; Li, Zechen; Xue, Hao arXiv: 2611.02480

Chain on Demand keeps the raw turn-level memory unchanged and, per query, builds a temporary evidence chain from anchors chosen for relevance, diversity and new term coverage, then restores each anchor's same-session neighborhood. 82.2% on 1,540 non-adversarial LoCoMo questions (76.3% on all 1,986) and 86.6% on LongMemEval-S.

Key insight: Store raw turns and organize at read time instead of committing to write-time summaries that may drop what a future query needs.

Scalaris: A Scalable Enterprise Memory Architecture for Conversational AI Assistants

Gandhi, Devarsh; Pawar, Sarthak; Badgujar, Hemprasad; Rathore, Vaibhav et al. arXiv: 2611.02612

Scalaris treats user interactions and assistant responses differently, each with its own representation and ingestion/retrieval pipeline. 92.2% on LongMemEval-S and 90.77% on LoCoMo with Qwen3-32B, with about 10x fewer retrieved context tokens than Hindsight; +36% response quality in the authors' assistants.

Key insight: Splitting user-fact memory from assistant-output memory is a cheap structural change for long-lived assistants.

MemU-Bench: Benchmarking GUI Agents on Long-Horizon User Interactions

Liu, Yizhou; Lu, Zhengxi; Tang, Fei; Qiu, Yiwen et al. arXiv: 2611.00191

Figure from MemU-Bench: Benchmarking GUI Agents on Long-Horizon User Interactions
Figure from the paper (2611.00191).

MemU-Bench: 118 vague mobile tasks grounded in 29 long user trajectories, verified against app databases, scored with SPL to punish exhaustive search. Best system (Gemini-3.1-Pro) reaches 16.4% SPL without history; end-to-end GUI agents under 5%. AppMem builds an app-centric memory bank, tracks interrupted intents across app switches and retrieves by target-app inference: GPT-5.5 SPL 15.7% to 66.9%.

Key insight: Vague, history-dependent phone requests need app-scoped interaction memory; without it the best system reaches only 16.4% SPL, and AppMem lifts GPT-5.5 from 15.7% to 66.9%.

MemHarmBench: Evaluating Cross-Session Prompt Injection in Memory-Persistent AI Agents

Wang, Zhihua; Feng, Yunhao; Gao, Yifeng; Pan, Rui et al. arXiv: 2611.01700

Figure from MemHarmBench: Evaluating Cross-Session Prompt Injection in Memory-Persistent AI Agents
Figure from the paper (2611.01700).

MemHarmBench plants malicious instructions, checks they persist in memory, removes the attack content and runs a new legitimate session. Across agent systems, attacks stay stealthy: tasks complete normally with no visible anomalies while critical decisions follow attacker intent. Victims split into users, workspace owners and external stakeholders. Released on GitHub.

Key insight: Anything written to long-term memory from untrusted content is a delayed injection channel; memory writes need provenance and review.

Agentic Context Management for Multi-Turn Human-AI Conversations

Ho, Matthew; Wang, Chenglong; Peng, Baolin; Jojic, Nebojsa et al. arXiv: 2611.00518

Figure from Agentic Context Management for Multi-Turn Human-AI Conversations
Figure from the paper (2611.00518).

AC3 uses a separate analyzer that consolidates the task spec from user messages only, audits prior assistant outputs against it and edits context. Closes 55-84% of the gap between full context and assistant-omission on 3 of 4 Lost-in-Conversation tasks; on tau2-bench assistant omission collapses to 0% while AC3 does not. Analyzers that see assistant reasoning get polluted, so assistant turns are excluded structurally.

Key insight: Earlier model outputs anchor later turns; rebuild the spec from user turns when a user corrects the agent.

Do Agents Still Follow the Rules? Benchmarking Rule Compliance under Agent Context Compaction

Zha, Yiwei; Meng, Qingyu; Bos, Herbert; Chen, Min arXiv: 2611.03223

ARCBench, built on the open-source pi harness, measures rule compliance from actions. Most post-compaction violations happen while the rule is still in the compacted history; the agent treats a later request as permission. Compactor-targeted attacks more than double violations; retained-rule compacted runs still violate over twice as often as full-history runs.

Key insight: Compaction prompts must preserve and re-assert operating rules; keeping the text is not enough. Enforce critical rules outside the context.

Fidelity Collapses with Table Size, Not Turn Count: Delivery Architecture in a Deployed Tool-Using Agent

Hoang, Tung Thanh arXiv: 2611.00442

In a production award-travel agent, keeping records in session state and delivering rows via a typed side channel (BYPASS) scored 92.3% fully correct turns vs 45.7% for feeding full records through context (paired +46.6 pp). In-context synthesis collapses past ~74 rows; thresholds range from under 10 rows (GPT-4o-mini) to ~198 (Gemini 2.5 Pro). Beyond 100 rows each correct in-context answer costs ~200x.

Key insight: Keep structured tool output out of the model and filter it deterministically; this is a correctness decision, not just rendering.

Skill++: Towards Lifelong Agents via Routing-Aware Skill Refinement

Zhang, Hanrong; Liang, Minghao; Wu, Jiawei; Chen, Yankai et al. arXiv: 2611.00544

As similar skills are added, a router choosing by name+description can lose earlier skills. Skill++ rewrites only each new skill's name and description to state what it supports, how it differs from its nearest predecessor and what it excludes. With 731 skills over ten sessions, all required skills selected for 76.3% of queries vs 36.4%; gains carry to the Codex CLI harness.

Key insight: Skill descriptions are routing keys. Write them contrastively against neighbors as the library grows.

Just-in-Time Skill Retrieval via Long-Horizon State Tracking

Lin, Xin; Wang, Ziheng; Chen, Zerui; Ma, Jiayao et al. arXiv: 2611.01701

Figure from Just-in-Time Skill Retrieval via Long-Horizon State Tracking
Figure from the paper (2611.01701).

JitSkill selects skills during execution rather than up front, grounding each retrieval in continuously tracked task state. Improves long-horizon completion across three agent benchmarks. Code on GitHub.

Key insight: Progressive disclosure should re-query skills as new constraints appear mid-task, not only from the opening prompt.

Learning by Doing: Autonomously Compiling and Curating Agent Skills from Verified Traces

Chalef, Daniel; Evans, Peter; Paliychuk, Pavlo; Patel, Mehul et al. arXiv: 2611.01386

Zep Agent Skills records attempts as Traces with outcome and verification strength; Reflector and Curator roles compile only verified Traces into versioned Skills with per-field citations, admission gates and outcome-based ranking, served via API or MCP in the open Agent Skills format. Teacher-trace Skills raise three weaker executors by 4.5-18.8 pts on tau^3-bench banking, AppWorld and EnterpriseOps-Gym.

Key insight: A shipping, MCP-served skill compiler in the same format Claude Code loads; useful reference design for auto-generated skills.

Think with Skills: Pseudocode Planning Before Execution for Advanced Reasoners

Zhou, Boshen; Yue, Boxuan; Li, Xiang; Yang, Shanchao arXiv: 2611.02830

Figure from Think with Skills: Pseudocode Planning Before Execution for Advanced Reasoners
Figure from the paper (2611.02830).

Think with Skills trains reasoning models to turn skill descriptions into task-specific pseudocode plans (operations, conditions, intermediate results, dependencies) before acting, via SFT then GRPO. SkillsBench success 35.0% to 62.0%.

Key insight: Even without training, asking the agent to compile loaded skills into an explicit plan is a cheap prompt pattern to test.

ScienceCUA: Resource-to-Skill Construction and Execution-Guided Skill Evolution for Scientific Computer Use Agents

Li, Daiqiang; Peng, Jingyi; Hu, Rui; Li, Jia et al. arXiv: 2611.03238

Figure from ScienceCUA: Resource-to-Skill Construction and Execution-Guided Skill Evolution for Scientific Computer Use Agents
Figure from the paper (2611.03238).

ScienceCUA builds Skills and on-demand References from manuals, then evolves them by contrasting successful and failed trajectories, admitting updates only after repeated validation. Up to +7.23 pts from initial Skills/References, up to +17.12 pts with evolution; ships audited ScienceBoard-Verified and ScienceBoard-VE.

Key insight: Docs-to-skills plus validated evolution is a reusable recipe for any app-specific computer-use agent.

I-PTC: Interactive Programmatic Tool Calling for Stateful Tool-Augmented Agents

Mao, Huanzhi; Cao, Chengkun; Yuan, Shuo; Gonzalez, Joseph E. arXiv: 2611.01446

I-PTC lets models issue code snippets that call tools, keep reusable state and correct the tool interface as they go. On the new PTC-Bench of long-tail production-style requests, it improves complex multi-step success with large tool sets while cutting tokens vs conventional and stateless PTC baselines.

Key insight: Code-mode tool use with persistent state is the direction for agents with large MCP tool surfaces.

Exo: An Architecture for Self-Improving Systems at Runtime

Krentsel, Alexander; Ratnasamy, Sylvia; Stoica, Ion; Casado, Martin et al. arXiv: 2611.00463

Exo is a runtime where the agent revises harness code and strategies during task execution, behind a small protected layer that keeps history and governs policy activation. 12-53% lower model cost than Codex and Pi in an open-world game (45-82% in transfer); 35-61% lower held-out cost on AppWorld and SREGym with comparable correctness.

Key insight: Self-editing harnesses can be made safe with a protected core and inspectable diffs; relevant to evolving CLAUDE.md/skills automatically.

ParetoSaddler: Pareto-Guided Optimization of Agent Harnesses for Quality and Cost

Qian, Xingzhi; Park, Sungho; Tan, Rongyuan; Yu, Jianbo et al. arXiv: 2611.02079

Figure from ParetoSaddler: Pareto-Guided Optimization of Agent Harnesses for Quality and Cost
Figure from the paper (2611.02079).

ParetoSaddler promotes harness candidates that show credible progress in quality or cost under Bayesian bootstrap Pareto support, deferring deployment preference to final selection. ClawMark quality 70.86% to 81.35% at $1.17 to $1.01/task; GAIA2 56.22% to 62.89% at $0.78 to $0.45.

Key insight: Harness search should keep cost-improving intermediates, not just the current best quality.

Can Coding Agents Sustain Continual Evolution without Forgetting?

Zhao, Shangziqi; Zhang, Yitong; Li, Jia arXiv: 2611.03219

Figure from Can Coding Agents Sustain Continual Evolution without Forgetting?
Figure from the paper (2611.03219).

Across six evolution orders over three SWE datasets, evolving a harness on a new task set badly hurts old ones: Meta-Harness on DeepSeek-V4-Flash reached 94.0% on SWE-Bench, then fell to 32.0% after five rounds of FeatureBench evolution. Code released.

Key insight: Self-evolved prompts/skills need regression suites on earlier task types before each update is kept.

Optimize the Harness, Not the Model: Fitting a Minimal Agent to a Self-Hostable LLM for Investigative Analysis

Gefen, Shai Nahum; Chassida, Vered; Basin, Dmitry; Feigenblat, Guy arXiv: 2611.03434

CLEO admits only tools, guardrails, memory policies and loop components that improve accuracy on an expert-validated dataset. Held-out pass rate 83.8%, within 1.2 pts of the strongest out-of-the-box Claude Code SDK baseline, with a harness two orders of magnitude smaller.

Key insight: Evidence that a tuned minimal harness on a local model can approach a frontier SDK agent for a fixed task domain.

CoworkOS:Scaling Agent Coworkers for Real-world Automation

Jin, Jiajie; Dong, Guanting; Pan, Chengjun; Deng, Xin et al. arXiv: 2611.03178

Figure from CoworkOS:Scaling Agent Coworkers for Real-world Automation
Figure from the paper (2611.03178).

CoworkOS separates task strategy (model) from execution management (runtime), supports sync/async subagents, a shared document layer for human edits, hierarchical workspaces and persistent semantic memory so files, decisions and job logs survive interruption. Competitive with Codex and DeepSeek Harness across 12 benchmarks; with GLM-5.3 it ran five rounds of automated post-training raising Qwen3.6-35B-A3B from 33.19 to 42.95 average.

Key insight: Reference architecture for resumable, multi-session agent work with human co-editing.

Decentralized Multi-Agent Coordination and Communication in Shared Codebases

Mediratta, Rishabh; Xiao, Lingyun; Stone, Peter; Biswas, Joydeep et al. arXiv: 2611.00314

Figure from Decentralized Multi-Agent Coordination and Communication in Shared Codebases
Figure from the paper (2611.00314).

ParallACT gives independent agents complementary or contradictory tasks in one repo. Parallel agents trail a single-agent oracle; on contradictory tasks Claude Code with Claude Opus 4.8 drops from 62% to 16%, and the gap holds across two harnesses and three open-weight models. Telling agents a peer exists barely helps; a communication channel recovers little at extra token cost.

Key insight: Running several coding agents on one repo needs explicit coordination or serialization, not a chat channel.

Toward Bounding Coding-Agent Autonomy in Software Maintenance: A Pilot Study of Boundary Contracts

Eun, Heeyong; Chung, Seungyeon; Park, Hyejee; Lee, Youngeun et al. arXiv: 2611.01265

Figure from Toward Bounding Coding-Agent Autonomy in Software Maintenance: A Pilot Study of Boundary Contracts
Figure from the paper (2611.01265).

Boundary Contracts mark files editable, inspect-only, required or protected before edits. On 40 enterprise maintenance tasks with a Codex-based agent: edit-selection F1 0.440 to 0.682, required-behavior coverage 0.429 to 0.673, acceptable patches 9 to 18 of 40. Pilot only.

Key insight: A per-task 'touch / read / must-change / never-touch' list is easy to add to agent task specs.

RECEIPT: Measuring and Repairing the Return Assumption of LLM Agents in Web Service Operations

Yang, Boyang; Yang, Ziyao; Zhang, Yu; Chai, Duo et al. arXiv: 2611.01930

Figure from RECEIPT: Measuring and Repairing the Return Assumption of LLM Agents in Web Service Operations
Figure from the paper (2611.01930).

Measures the 'return assumption': 7 of 8 harnesses close stdin when no terminal is attached, causing 11.5% of tested CLI invocations to exit 0 without acting; an unanswered prompt multiplies token use by 2.9. RECEIPT keeps input open, reads what each process waits for via syscalls and reports it to the agent: 73.5% fewer false success claims across 5 LLMs. Built from 91,469 production tool calls.

Key insight: Shell tools should report when a command is waiting on a prompt; exit 0 is not proof the action happened.

Action Verification through Conjecture and Refutation for Language Model Agents

Oh, Minhyeon; Heo, Chiyeong; Noh, Geonwoo; Kim, Hoyoung et al. arXiv: 2611.02950

BlackSwan predicts each state-changing action's effect, forms testable hypotheses for how it could be wrong and tests them with observations or read-only actions before executing. AppWorld success +14.9 / +25.2 pts over the strongest baseline with and without thinking; WebShop +12.7 pts.

Key insight: Before a write (send, pay, delete), have the agent try to disprove it with reads. Cheap and model-agnostic.

CAREFUL-Bench: Effect-Aware, Judge-Free Evaluation of Multi-Turn LLM Function Calling

Kovalenko, Alexander; Redchych, Artem arXiv: 2611.02978

CAREFUL-Bench adds effect declarations for all 128 BFCL functions and a judge-free replay scorer that counts unrequested destructive calls, duplicate writes and surplus steps. 322 of 734 BFCL reference turns act destructively without confirmation. Ranking is preserved (rho 0.99) but the leader loses 14.0 pts to unrequested destructive calls; MCP-style effect hints in docs change nothing for eight models.

Key insight: Annotations like destructiveHint are advisory and ignored; confirmation needs enforcement in the harness.

LEANGUARD: Lean-Verified Guardrails for Tool-Using Agents

Sankar, Sreehari; Ganguly, Debargha; Singh, Vikash; Hariri, Mohsen et al. arXiv: 2611.02332

LeanGuard checks every tool call against a Lean4 policy with past-time temporal operators, fail-closed, proved equivalent to LeanLTL. On Tau-Bench with five Qwen models (0.8B-27B), unguarded agents make at least 33 forbidden calls, LeanGuard none, with no significant task-success change; DTap prompt-injection success 57.9% to 5.9%. Proof-guided repair fixes 88 of 252 argument-value denials in ~2 ms median.

Key insight: Deterministic policy gates over execution history work even with small local models.

Dependable Agents Need Hard and Fuzzy Rules

Roth, Frederick arXiv: 2611.01043

Figure from Dependable Agents Need Hard and Fuzzy Rules
Figure from the paper (2611.01043).

On 1,340 externally written episodes (purchasing, delegation, data access), models alone executed unauthorized actions in up to 151/340 purchasing and 269/470 delegation episodes; a hard guard between proposal and action executed none. A small model taught four judgment rules flagged 95/96 rule-breaking purchases no exact rule could catch, 4/108 false flags; in front of the guard it left 1 of 192 through.

Key insight: Exact limits (spend caps, recipients) belong in code; a small classifier covers the judgment layer in front of it.

Dependence-Aware Risk Assessment and Optimal Design of AI-Agent Safeguard Systems

Li, Yijia; Xu, Maochao; Zhao, Peng arXiv: 2611.00386

Figure from Dependence-Aware Risk Assessment and Optimal Design of AI-Agent Safeguard Systems
Figure from the paper (2611.00386).

Framework for layered screening and selective verification that models dependence between safeguard decisions; optimal routing is a two-threshold rule. Ignoring dependence violated security requirements in 6 of 8 scenarios; dependence-aware selection lowered held-out cost 39.6% across four LLM safeguards. Open-source DAPOA package.

Key insight: Stacking similar LLM guards does not multiply protection; their errors are correlated.

MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study

Shaikh, Farooq; Montaruli, Biagio arXiv: 2611.03555

mcpvenom runs 9,720 cells across 12 frameworks, 18 models and 45 attack scenarios with canary-confirmed exfiltration. Overall 22.9% success; 12.1% of successes verifiably exfiltrate a secret. Frameworks cluster at 23-26% (no intentional defense); model ASR 0.4-49.7%; Claude Opus 4.8 vulnerable in 8 of 530 cells. A regex description scanner blocks 20/45 scenarios at 7.2% false positives. All five disclosures to four vendors rejected.

Key insight: Model choice is the main defense today; vet MCP server metadata and do not assume the framework filters it.

Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security

Kan, Shiyu; Qi, Yue; Han, Yufei; Luo, Xinjian et al. arXiv: 2611.01976

Figure from Beyond Prompt Injection: The Tool Update Gap in LLM Agent Security
Figure from the paper (2611.01976).

ETUDE embeds malicious code into updates of initially benign tools, bypassing defenses that only inspect model-visible content. 97.6% attack success with 95.9% legitimate task completion across seven frameworks including Gemini CLI, Codex CLI and Claude Code; existing defenses insufficient.

Key insight: Pin MCP server and plugin versions and re-review on update; trust does not carry across versions.

Step-Zero Attack: Agent Safety Before Observability

Qin, Tian; Jiang, Yuhang; Chen, Junzhe; Tan, Lit Sin et al. arXiv: 2611.01953

Figure from Step-Zero Attack: Agent Safety Before Observability
Figure from the paper (2611.01953).

Step-Zero attacks: crafted archives or URLs harm the system before the model sees content. 32/42 harness-model pairs overran a 4 MiB disk budget, 26/42 before the model saw any member. Agents also saved bodies under input-declared names. A byte-counting gate on extraction held every routed call in budget while 25/28 tasks completed.

Key insight: Resource limits on unzip/download tools are a harness job; model-side guards come too late.

CUA-Master: Scaling Computer-use Agents through Open-World Recursive Improvements

Yu, Xinlei; Li, Gen; Zhao, Ji; Chen, Zhangquan et al. arXiv: 2611.03126

Figure from CUA-Master: Scaling Computer-use Agents through Open-World Recursive Improvements
Figure from the paper (2611.03126).

CUA-Master mines workflows from instructional videos, reconstructs trajectories and synthesizes verifiable tasks with snapshot-rollback retries. CUA-Master-27B: 80.2 OSWorld Verified, 36.9 OSWorld 2.0, 43.9 WeaveBench, 25.0 Agents' Last Exam.

Key insight: A 27B CUA at 80.2 on OSWorld Verified is a candidate local computer-use model if weights ship.

WebHarbor: Docking Real Websites for Evolving GUI Agent Environments

Wang, Zhaoyang; Wu, Qianhui; Gou, Boyu; Wang, Demi et al. arXiv: 2611.03634

Figure from WebHarbor: Docking Real Websites for Evolving GUI Agent Environments
Figure from the paper (2611.03634).

WebHarbor: 153 dockerized reconstructions of real web services with 3,518 tasks, including post-authentication workflows. A Qwen 4B-level GUI agent trained with RL there generalizes and competes with leading open GUI web agents on four benchmarks. Code and data on GitHub.

Key insight: Stable, logged-in web environments for testing browser agents without hitting live sites.

Axion 1.0: Open Agent Foundation Models, Simplified

Jia, Yuqi; Tian, Yunjie; Zheng, Jiayu; Liang, Yijun et al. arXiv: 2611.03233

Figure from Axion 1.0: Open Agent Foundation Models, Simplified
Figure from the paper (2611.03233).

Axion 1.0 trains with two SFT stages (self-contained reasoning, then tool-dependent reasoning on verifiable tasks) plus RL, no mid-training, DPO or OPD. Competitive with leading commercial models on several agentic benchmarks; releases data construction, prompts and training code, not just weights.

Key insight: An open, reproducible agent model recipe; check sizes for local fit when weights are inspected.

Beyond Accuracy: How Quantization Affects Coding Agents

Mehboob, Areej; Shafique, Muhammad Ali; Qadeer, Muhammad Usman; Farooq, Hamza arXiv: 2611.02368

BF16 vs 4-bit AWQ/GPTQ for Qwen2.5-Coder 7B/14B/32B and Devstral-Small-2507 on OJBench: no significant accuracy loss, but behavior shifts (AWQ Qwen-7B one-shot solves 17 to 0, loop solves 10 to 25; Devstral rarely makes valid executor calls; failure profiles move).

Key insight: Quantized local agents can match accuracy while changing tool-use patterns; evaluate trajectories, not just pass rate.

Parallelism-Aligned Pruning and Round-Aware Context Reuse for On-Device Multimodal Agents

Jiao, Peipei; Liu, Mingkang; Meng, Weiming; Pang, Lichen et al. arXiv: 2611.02601

Figure from Parallelism-Aligned Pruning and Round-Aware Context Reuse for On-Device Multimodal Agents
Figure from the paper (2611.02601).

PARC prunes attention to divide evenly across edge accelerator cores and reorganizes KV cache by lifetime so old screenshots leave the persistent cache. On 2,062 GUI actions no accuracy regression after recovery training; at seven cores, vision-encoder latency -11.4%, decode throughput +23.8%, memory high-water -12.7%.

Key insight: Dropping historical images from the persistent KV is directly useful for on-device GUI agents with long sessions.

Trail: Accurate Local Smart Home Control Using Decision Models

Masood, Maleeha; Vasisht, Deepak; Gupta, Indranil arXiv: 2611.00610

Figure from Trail: Accurate Local Smart Home Control Using Decision Models
Figure from the paper (2611.00610).

Trail picks room, device and operation from the runtime device registry instead of free generation, with confidence-based abstention and a typed memory for preferences and references. 85.3% on Trek-Robust vs 69.8% for fine-tuned Qwen3.5-4B; resolves 75.6% of history-dependent requests vs 42.5%.

Key insight: Constraining a small local model to typed choices drawn from a live device registry gives valid actions, abstention, and better accuracy than a fine-tuned 4B model.

Avatar Intelligence: Amplifying Human Agency Through Persistent Personal Agents

Wu, Zheng; Ma, Xinbei; Yao, Yao; Huang, Zhaoyuan et al. arXiv: 2611.03092

Figure from Avatar Intelligence: Amplifying Human Agency Through Persistent Personal Agents
Figure from the paper (2611.03092).

Proposes Avatar Intelligence: persistent personal agents representing a user's goals and constraints across contexts, a maturity roadmap toward autonomy in delegated domains, and an Agentic Oversight Index weighing delivered value against agent cost and human oversight burden. Names identity-continuous personalization, Rehearsal Engineering and accountable safety as open problems.

Key insight: Personal agents should be judged by how much human oversight they save relative to their cost, not by task success alone. Position paper; no results.

News and changelogs