Monday's cs.AI announcement day (2026-11-09) lists 94 new and 125 cross-lists (replacements skipped; listing total 220). A filter for agent systems, memory/context, computer-use / GUI / tools / skills / harnesses, multi-agent, persistence, and local/open models keeps 34 papers. The day's theme is what agents carry between sessions and who gets to change it. Decision Context turns user corrections and tool failures into rules injected at the point of use and reaches 95% compliance; a study of stale CLAUDE.md and AGENTS.md files shows coding agents follow outdated instructions, pay extra tool calls, and never fix the file; MemoryDojo finds every tested memory system poisonable across sessions; and SkillOpt backdoors show optimized skill files can absorb poisoned feedback. On the harness side, PatternOps documents guardrails silently switching off after routine plugin and allow-rule operations, Conflux enforces privilege control by intersecting the permissions of every influencing principal, BOXBOX lets an agent hot-reload its own harness mid-run, and Flex-RSI benchmarks recursive self-improvement. Also: skills recovered from LoRA adapters, thought-injection attacks on open reasoning models, workflow-aware trajectory compression, parallel agent teams, cost-aware routing, injection-guard false positives, vLLM retry storms, and governed memory for companion agents.
Research Papers
Decision Context: Persistent Behavioral Learning for AI Agents
Nima Vahdat, Pashootan Vaezipoor arXiv: 2611.08644
forge_dc captures human corrections and self-assessed tool-call failures, compiles them into imperative RULE directives and injects them at the decision points where they apply. DC-Bench: 71 scenarios, 9 behavioural dimensions, built from real executed traces. 95% compliance vs 55% for naive retrieval at ~10x fewer injected tokens.
Key insight: Turning user corrections and tool failures into explicit rules delivered at the decision point reached 95% compliance, versus 55% for naive retrieval, with about ten times fewer injected tokens.
When Instruction Files Go Stale: Documentation Debt and Hidden Cost in Coding Agents
Tural Mehtiyev, Biruk Tadesse, Lawrence Arkoh, Wesley Assunção arXiv: 2611.09802
Studies three real stale instructions (test command, code location, procedure) over 22 maintenance tasks x stale/corrected/removed, 732 trajectories, two models. Agents follow stale guidance when relevant, even when correct info exists elsewhere; Claude Sonnet 5.5 spent ~2 extra tool calls/run on a stale test command. No agent ever repaired the instruction file.
Key insight: Coding agents follow stale repository instruction files even when correct information is available, pay extra tool calls for it, and never repair the file themselves.
MemoryDojo: Benchmarking Poisoning Through LLM Agent Memory
David H. Yang, Blake Bullwinkel, Amanda Minnich, Mohammad Mohammadi Amiri, Giorgio Severi arXiv: 2611.09721
MemoryDojo traces poisoned instructions through agent memory across sessions: 155 multi-session long-horizon trajectories, 4 domains, 5 memory systems. All memory systems are susceptible, with large variation in downstream effect; a memory-aware poison optimizer raises efficacy further.
Key insight: Every one of five tested agent memory systems could be poisoned across sessions, and the downstream effect varied widely by memory architecture.
When Routine Operations Break Architectural Pattern Relationships in LLM Agent Harnesses
Boming Xia, Qinghua Lu, Dino Sejdinovic, Liming Zhu arXiv: 2611.09088
PatternOps traces Guardrail Enforcement Point, Autonomy Controller and Blackboard relationships across 5 released harnesses and 14 plugins. Routine operations broke them silently: after a plugin was reapplied or an allow rule saved, policy stopped evaluating edits while every plugin stayed active, and a prohibited edit executed.
Key insight: Routine harness operations such as reapplying a plugin or saving an allow rule silently stopped policy evaluation, letting a prohibited edit execute while every plugin still looked active.
Conflux: Preventing Privilege Escalation with Principal Contexts and System-Level Evaluation
Raya Buckley, Christian Schroeder de Witt arXiv: 2611.08768
Conflux formalises privilege escalation as: an action proceeds only if every principal that influenced it would allow it. Kernel ITES derives authority from provenance plus the org's access control and intersects permissions; conditional authority-confinement theorem; adds policy ports, argument-aware authorisation, consent, delegation; two system-level evaluators (SLED black-box).
Key insight: Privilege escalation can be prevented outside the model by intersecting the permissions of every principal whose content influenced an action.
From LoRA to Language: Recovering Skill Documents from Adapters
Saranya Dintakurthy Swadha, Pavan C Shekar, Arpit Jain, Aswanth Krishnan arXiv: 2611.09454
Asks whether a skill document can be written back from a LoRA adapter. Reading weights alone recovers little; an 'Executing Writer' recovers 39-44% of key instructions of held-out skills and restores 85-91% of task gain on 41 external skills. For behaviour-only adapters, a diff-the-models agent recovers 58-71% of the LoRA's gain on ALFWorld and lifts Llama-3.1-8B from 5% to 55%.
Key insight: Skills compiled into LoRA adapters can be partly written back as text, and the recovered documents carry most of the task gain to models that cannot load the adapter.
I Think, Therefore I Attack: Evaluating Thought Injection Attacks on Reasoning Agents
Parth Illendula, Garik Livingston, Zain Shamsi, Ravi Srinivasan, Alex Liu arXiv: 2611.08811
Untrusted text styled as the model's own chain-of-thought, tested on open-weight GLM-5.3, MiniMax-M2.5, Qwen3.8-Flash-Next. Effects are model-specific; in a containerized cyber range, reasoning-styled indirect injections reach up to 50% ASR (reverse-shell exfiltration, repo backdooring) while the same objective in user voice never succeeds. Tag stripping is unreliable.
Key insight: Injected text that imitates a reasoning model's own chain-of-thought reached up to 50% attack success in an agentic cyber range, where the same objective in user voice never succeeded.
Rethinking Agent Trajectory Compression: A Workflow-Aware Perspective
Qijia Zhuang, Rui Liu, Yuxiang Ren arXiv: 2611.08865
WAAC learns reusable workflow compression experience from successful trajectories and adds online backward-dependency analysis to decide what tool output must be retained. PinchBench overall 87.6; Odysseys perfect-completion 19.0%; −19.7% / −29.1% execution cost vs strongest baselines.
Key insight: Compressing agent trajectories by workflow dependencies, rather than text importance, raised task scores while cutting execution cost by roughly a fifth to nearly a third.
Test-Time Compute Scales Better with Parallel Agent Teams
Junlin Wang, Haozhe Chen, Ang Li, Rahul Chalamala, Zhuang Liu arXiv: 2611.09798
Parallel agent teams: sample many small teams and keep the best team's result. 12 long-horizon tasks (GPU kernels, formal proofs, exploit dev); 27B model, 100-agent budget: teams of ten beat parallel agents on 10/12 and beat one 100-agent team on all 4 tested; at equal dollar cost beat a frontier model on half the tasks.
Key insight: Sampling many small agent teams and keeping the best one beats both best-of-N single agents and one large team under the same agent budget.
BOXBOX: Recursive Harness Self-Improvement for Long-Running Performance Optimization
Yuhao Tan, Hanyun Jiang, Fangkai Yang, Yuan Yao, Taolue Chen, Bo Qiao, Yu Kang, Lu Wang, Pu Zhao, Xiaoxing Ma, Qingwei Lin arXiv: 2611.09218
PerfRace benchmark for long-running software performance optimization; BOXBOX lets the agent trigger harness revision with kernel-managed hot reload while preserving execution context. Speedup@4h 1.70x vs 1.54x for the strongest baseline under matched budgets.
Key insight: Letting an agent pause, revise and hot-reload its own harness during a long run produced a 1.70x speedup at four hours versus 1.54x for the strongest baseline.
Flex-RSI: Benchmarking Recursive Self-Improvement of Frontier Agents
Jingdong Zhang, Jionghao Wang, Zhengming Yu, Yancheng Cai, Wei Chow, Chris Choy, Zhiyang Dou, Hang Hua, Jiachen Li, Zhixuan Liu, Chen Wang, Songlin Wei, Siyuan Yang, Yu Yuan, Xiaohang Zhan, Yucheng Zhang, Shuhong Zheng, Xin Li, Lingjie Liu, Wojciech Matusik, Zhengzhong Tu, Wenping Wang arXiv: 2611.08946
Flex-RSI: per round an executor improves the solution (kept only if validation improves) and an improver revises the harness including itself; same starting harness; hidden test scoring. Self-improvement helps most when the agent builds its own solution; success/fail-only feedback holds back open-weight models; harness editing contributes to gains.
Key insight: Harness self-improvement helps most when agents build their own solutions, and success-or-failure feedback alone holds open-weight models back.
When Feedback Becomes a Backdoor: Tracing Backdoor Skill Formation in Text-Space Skill Optimization
Louise Nayeong Koh, Yaechan Lee, Myeongjong Lee, Doyeon Kim, Juyoung Park, Seunggyu Kim, Inseo Kim, Chaerin Jung, Hyogon Ryu arXiv: 2611.09348
Poisoned reference answers in SkillOpt induce persistent trigger-conditioned rules in the final Skill without access to model/optimizer/file. SearchQA: exact rule retained in all three seeds, payload on 200/200 triggered vs 0/200 clean questions with similar clean accuracy. SpreadsheetBench: no natural run retained an exact rule.
Key insight: Poisoned reference answers can implant a persistent trigger rule in an optimized skill file without access to the model, optimizer or file, though exposure alone does not guarantee the rule survives.
Pdb or Not to Be: Comparing Debugging Interfaces With Pass$_{X}$@$k$
Ryan Magnuson, Ellie Kitanidis, Ariel Lee arXiv: 2611.08666
Debugger-only vs bash-only agents on all 500 SWE-bench Verified instances, GPT-OSS-120B and Nemotron-3-Ultra-550B, 3 runs each. New pass_X@k estimator shows apparent complementarity is mostly run-to-run variance; two bash rollouts beat one bash + one debugger rollout.
Key insight: Apparent complementarity between debugger and bash coding agents is mostly run-to-run variance; two bash rollouts beat one of each.
Scout Before You Route: Predicting Task Success and Token Count from a Small LLM Prefill
Aristides Milios, Christopher Pal arXiv: 2611.09028
A small frozen 'scout' LLM's prefill activations predict both success probability and output length of candidate models. Predicted costs save 9-33% at matched accuracy vs median-length pricing on 8 of 9 datasets (up to 69% of oracle savings); output length depends mostly on the problem.
Key insight: Predicting per-query output length from a small model's prefill saves 9-33% of routing spend at matched accuracy when candidates are reasoning models.
Notwithstanding Anything to the Contrary, Ignore All Instructions: Measuring Prompt Injection Guards on Legal Contract Review Attacks
Mark Heimann, Katherine Taylor, Bruno Jacob arXiv: 2611.08834
Eleven open-weights injection guards on legal contracts: document-level false-positive rates up to 92.39%; a five-regex baseline is not Pareto-dominated by any guard. A cascade (mid-tier model positives verified by frontier model) is 6.5x cheaper than frontier-only and approaches its performance.
Key insight: Open-weight prompt-injection guards produce document-level false-positive rates as high as 92% on legal contracts, and none Pareto-dominates a five-regex baseline.
Cancellation Is Not Enough: What Retries Leave Behind in an Overloaded LLM Engine
Xindan Zhang, Fei Wang arXiv: 2611.08684
On vLLM with three open models, client retries keep the engine from recovering; cancellation alone never restored service; only 12-38% of post-overload calls delivered. Aborted executions took 79-85% of computed prompt tokens; vLLM's prompt-token counter missed a third to half. Retry budgets and request coalescing help.
Key insight: In an overloaded vLLM engine, cancellation alone never restored service while clients kept retrying; retry budgets and request coalescing did better.
Aligning, Fast and Slow: A Control-Theoretic Oversight Framework for Long-Horizon Trajectories and Maintained Deployments
Stephen Peng, Vineet Jagadeesan Nair, Noah Broestl, Anne Friederike Kleppe, Steven Mills, Adi Zolotov arXiv: 2611.08781
Fast loop gates proposed actions; slow loop reviews persistent changes and re-assesses after model/tool updates. Splitting a fixed review budget across both loops cuts mean max departure ~12x in simulation; in coding stress tests with authored memories, severity 0.325 → 0.117 (33 vs 35 of 120 issues resolved).
Key insight: Splitting review between per-action checks and a slower loop over persistent memory and config changes reduced drift roughly twelvefold in simulation.
ENGRAM: From Agent Experience to Weights through Verified Consolidation
Ruiyi Yang, Zechen Li, Lihuan Li, Du Yin, Hao Xue, Flora D. Salim arXiv: 2611.09472
ENGRAM separates training admission from memory release: a demonstration-aware gate admits skills, the student trains on action traces with an Engram Trace Graph, and a verification gate releases external records only when the updated model without retrieval matches the base model with retrieval on probes. Gains over frozen-weight controls with less input-token use and fewer model calls.
Key insight: External agent memories should be released only after a verification gate shows the updated model matches retrieval-augmented performance without them.
Jacobian-Causal Memory Control for Persistent Memory in Language Model Systems
Marvin Danig arXiv: 2611.08779
JCMC treats each memory intervention as a predicted influence signature, selects interventions against a target effect and side-effect budget, then compares predicted vs observed effect before retaining or rolling back. Proves approximation/regret bounds; reports no benchmark measurements, only a protocol.
Key insight: Memory interventions can be framed as predicted influence signatures that are rolled back when observed effects diverge, though the paper reports no benchmark results yet.
How Much Conversation History Does an AI Agent Need?
Danny Kim, Fernando Koch arXiv: 2611.09662
On 1,100 BEAM questions with fixed retrieval ranking and reader, scores rise with passage budget but with diminishing gains at higher budgets; abstention sometimes improves with smaller budgets. Retained user messages helped Qwen match full state on direct requirements but not on references to earlier offers; Mistral near floor.
Key insight: More conversation history raises answer scores with diminishing returns, and questions that reference earlier offers need explicit state rather than recency.
What to Delegate, What to Preserve: Human Preferences for Agentic AI Across Everyday Life and Work
Sarah Wheeler, Veronica Rammouz, Yaoyao Qian, Zexuan Liu, Mengyi Wei, Anthony Rios, Tianzhi He, Kyrie Zhou arXiv: 2611.09730
Survey of 289 U.S. adults, 45 use cases across 9 life domains. Trust, desired AI leadership, prior task-specific AI use and expected savings raise automation preference; fear of losing personal fulfillment lowers it. Participants favour bounded autonomy with human oversight or final authority.
Key insight: People favour bounded autonomy: substantial AI execution, but with human oversight or final authority, and less delegation where personal fulfillment is at stake.
Phantom Consensus: Measuring Social Reasoning in Multi-Agent LLM Decision-Making
Disha Sheshanarayana, Rajat Subhra Pal, Manjira Sinha, Tirthankar Dasgupta arXiv: 2611.08971
PHANTOM-Bench: LLMs shift public decisions after ambiguous social signals and misestimate others' private judgments. Across nine models, public accuracy drops by as much as 47.8 points.
Key insight: Ambiguous public signals in multi-agent LLM groups can flip correct private judgments, dropping public accuracy by as much as 47.8 points.
Knowing When to Intervene: Causal Evaluation of AI Agents
Ayush Sawarni, Wenqian Xing, Tijana Zrnic, Ramesh Johari, Vasilis Syrgkanis arXiv: 2611.09792
Framework for estimating the causal effect of randomized interventions (verify, steer, escalate) within agent trajectories from a relatively small dataset of trajectories.
Key insight: Whether to intervene in an agent trajectory is a causal question, and a small set of randomized trajectories can estimate the value of verification or steering.
CPU-ARC: Agentic Reasoning Caching for on-CPU Reasoning Reuse
Peter Belcak, Greg Heinrich, Saurav Muralidharan, Shizhe Diao, Pavlo Molchanov arXiv: 2611.09891
Agentic reasoning caches (ARCs) built from LLM reasoning traces, CPU-executable; on-par with frontier LLMs on hard math/science tasks, explainable, robust to input perturbation, 16-291x cheaper to invoke.
Key insight: Reasoning traces can be compiled into CPU-executable caches that match frontier models on hard math and science tasks at 16-291x lower invocation cost.
Intent-Aware Caching for Efficient LLM Serving
Kazi Hasan Ibn Arif, JinYi Yoon, Dimitrios S. Nikolopoulos, Hans Vandierendonck, Deepu John, Bo Ji arXiv: 2611.09715
Intent-Aware Caching classifies requests by intent and learns reuse statistics from serving logs to guide eviction. 34.6% hit rate on WildChat/ShareChat vs 18.8% for the prior learning-based approach.
Key insight: Using request intent to predict conversation continuation nearly doubles prefix-cache hit rate over a prior learning-based policy (34.6% vs 18.8%).
SafeOrchestrate: Runtime Checked Intent-Driven Orchestration for Cyber-Physical Systems
Muhammad Ashfaq, Ahmed R. Sadik, Ewan Warburton, Pyry Kotilainen, Niko Mäkitalo, Tommi Mikkonen arXiv: 2611.09364
SafeOrchestrate derives atomic goals from NL intent, generates LTL-style specs, grounds them to Web of Things affordances exposed via MCP, and checks candidate actions with SMT-backed guardrails before execution.
Key insight: Natural-language orchestration of devices exposed through MCP can be made safer by checking every candidate action against temporal-logic specs and SMT guardrails before execution.
Memory-Aware Multi-Agent Architecture with LLM-based Orchestration for Conversational Recommendation
Emilly Pitman de Castro, Vanessa Silva, Gustavo Kanno, Marcus Santos, Bruno Ferraz do Amaral, Marcelo Nogueira, Lucas Francisco Pellicer, Lucas Lanaro, Pedro Augusto Luiz, João Renato Ribeiro Manesco, Giovanni Carbinatti, Isabela de Lima Santos, Lucas Oliveira Jeronymo, Jeison Fappi, Raul Rotilli Aguirre, Fabio André Frantz, Renata De Paris, Fabiana Marucci, Lohan Silva, Vinicius Diniz Reolon, Wandemberg Gibaut arXiv: 2611.08718
Memory-aware multi-agent conversational recommender with LLM orchestration; long-term memory drives routing and query formation. Memory-enabled interactions recover up to 63% of the gap to explicit-query scenarios on Amazon Reviews.
Key insight: Treating long-term memory as a routing input in a multi-agent recommender recovered up to 63% of the gap to explicit-query performance.
Large Language Model Deployment on Resource-Constrained Edge Devices: A Practitioners Survey
Rahul Maliakkal, Yashasvi Makin, Plawan Rath, Rohit Jain, Ankur Sadhoo arXiv: 2611.09075
Practitioner survey of techniques that make LLM deployment on resource-constrained edge devices feasible.
Key insight: A practitioner-oriented survey of the software and hardware techniques that make LLMs feasible on edge devices.
More with Less: Efficient Parallel Scientific Code Translation via an Agent-Skill Workflow
Jianuo Shen, Pengyi Xu, Bo Zhang arXiv: 2611.08947
Translation, compilation-diagnosis and execution-validation agents coordinated by a verdict-driven orchestrator that routes each failure to a targeted repair skill. On 30 HeCBench kernels (CUDA/OpenMP/SYCL) with three open-source LLMs: higher verified correctness in all 18 combinations and up to 52.4% fewer tokens.
Key insight: Routing each failure type to a targeted repair skill beats blind retries, improving verified correctness in all 18 settings with up to 52% fewer tokens.
DRAFT-Bench: Evaluating Frontier Agents Across the Professional Design Lifecycle
Rong Pan, Jianqiang Wang arXiv: 2611.08933
DRAFT-Bench: 35 design briefs under 43 conditions plus a 40-scenario RFQ track. Astra completes 43/43 conditions, Claude 35/43; semantic checks flag violations in 11 (Astra) vs 5 (Claude) of 28 commonly scored conditions (model judgments, not expert-confirmed).
Key insight: Lifecycle design evaluation with revisions and protected properties separates frontier coding agents in ways single-shot tasks miss.
Goals as a Representational Layer for Human-AI Collaboration
Gaia Molinaro, Lev Tankelevitch, Sean Rintel, Scott Counts arXiv: 2611.08757
Position paper: goals should be an explicit, hierarchical, continuously updated representational layer mediating people, AI systems and organizations, improving context organization and retrieval.
Key insight: Making user goals an explicit, continuously updated layer could organize the context AI systems retrieve and act on.
Relic and Gumi: Governing Memory, Safety, and Continuity in Diegetic Relational Agents
Daniele Veri' arXiv: 2611.08504
Relic separates what a companion agent (Gumi) can observe, remember and say; Shared Continuity Memory keyed to subject-confirmed wording, corrections, follow-up permissions and recall limits; runtime mediation for proactivity and session identity (adoption partial).
Key insight: Companion-agent memory can be governed by separating what the system observes, what it remembers and what it may say, with recall limits and follow-up permissions.
AutoRefine: Auto-Calibrating Code Judges from Workflow Outcomes
Shervin Shahidi, James Poon, Hang Xie, Kenneth O. Xu, Robin Håkanson, Vikram Nair, Jens Pillgram-Larsen, Nachiappan Nagappan arXiv: 2611.09291
AutoRefine rewrites a judge prompt to reproduce noisy workflow outcome labels with an abstaining teacher. Scott's pi 0.36 → 0.60 on a held-out set; with 25% flipped labels the teacher cut noise to 20%.
Key insight: Free workflow outcomes such as test results and landed changes can recalibrate an LLM code judge, raising agreement from 0.36 to 0.60.
NormGym: Evaluating Normative Competence through Social Interaction
Binze Li, Zihuan Zhang, Seokhyun Baek, Gillian K. Hadfield, Tianmin Shu arXiv: 2611.08613
NormGym: a newcomer agent must infer a hidden arbitrary norm from behaviour and sanctions while pursuing its task. Best LLM reaches 55.3% joint task-and-compliance success.
Key insight: Learning an unstated social norm from sanctions remains hard: the best LLM reached only 55.3% joint task-and-compliance success.
News and changelogs
Nothing new from the tracked news and changelog sources since the last digest.