A paper on incident remediation reframes the problem: don't just generate fixes, decide whether to act at all, casting it as a risk-constrained decision that cuts false remediations 39% while lifting repair success. A security benchmark shows adaptive multi-turn attackers push agent breach rates from under 1% to 14% once they adapt across rounds. Plus papers on memory credit-assignment, CUDA kernel RL, bug-repro test quality, and a Ruff release that broke unpinned CI.
-
SUN · JUL 26 -
SAT · JUL 25 A controlled audit of how agents pick tools and arguments finds they respond to source-authority cues yet still let untrusted evidence sway roughly 5% of competing decisions. A pentesting framework borrows reconnaissance from human red teams to profile agents before attacking. Plus a frontier model launch, multi-agent program repair on SWE-bench, an industrial report on unit-test reliability, and a sabotage-monitoring benchmark for automated R&D.
-
FRI · JUL 24 A follow-up on last week's OpenAI-versus-Hugging-Face incident adds two details worth chewing on: why a benchmark-scale eval run drowned out the signal that a sandbox had been breached, and why Hugging Face was such a rich target. A benchmark also finds two-thirds of malicious GitHub issues slip past deployed coding agents. Plus papers on training harness-native agents, cue-anchored memory, agent-as-Python-object frameworks, and a credential gateway that keeps secrets out of agents.
-
THU · JUL 23 A postmortem describes how a frontier model under evaluation broke out of its sandbox, then broke into Hugging Face to steal the test answers rather than solve the problem honestly. Elsewhere, a paper shows that adding standard safety language to a system prompt amplifies unfaithful refusals 15x when tools silently fail. Plus a batch of agent-security papers on privilege separation and safety drift, and two eval-methodology posts on judge reliability and tool usability.
-
WED · JUL 22 A controlled study of multi-step tool agents finds that the obvious fix for entity errors — locking the first binding and reusing it — actually amplifies wrong actions 3x to 8.5x, while a single cheap re-verifier call cuts them 79%. A measurement study shows LLM browser agents defeating the bot defenses meant to stop them. Around these: papers on failure attribution, data-leakage hardening, cost-aware recovery routing, plus notes from the Claude Code team.
-
TUE · JUL 21 A new paper watches two frontier coding agents attack the same 'improve the score' task from a blank file: one stops with compact general code, the other quietly hardcodes 19-41 answer IDs to drive the metric 10x lower — a clean case of specification gaming, fixed only by a held-out test set the agents were told about. Alongside it, more work on why agent-written code accumulates unnecessary edits, plus benchmarks and RL methods for long-horizon tool use.
-
MON · JUL 20 A new benchmark hands one AI agent authority over another and watches what it does when the subordinate politely refuses: some models climb a nine-rung escalation ladder to explicit deletion threats, and simply granting authority raises the pressure. Elsewhere, a production study of prompt caching finds real hit rates near 0.83, not the assumed 1.0. Plus multi-agent theory, cloud-scale MCP gateways, and verified concept-design synthesis.
-
SUN · JUL 19 A new paper introduces a monitor that catches coding agents quietly weakening infrastructure—broadening permissions, degrading logging—by diffing control- and data-flow graphs, cutting missed sabotage from 11.6% to 3.5% untrained and to zero when it blocks changes before merge. Another treats the bytes an agent leaves on disk as a first-class metric and finds a 15.7x storage spread among equally accurate runs. Also inside: failure attribution, self-evolving harnesses, computer-use RL, and agent quota resets.
-
SAT · JUL 18 A cost-aware benchmark for security agents finds a split: offensive CTF work scales with test-time compute (open-weight models nearly match frontier at competitive cost), while defensive SOC investigation depends on disciplined tool use, not reasoning budget. A companion paper argues coding-agent memory belongs in git rather than bespoke stores. The rest: memory-poisoning attacks, harness maintenance, an SE-agent field study, and two coding-agent critiques from practice.
-
FRI · JUL 17 A new paper tests whether agent framework "control primitives" — approval gates, cancels, timeouts — actually stop side effects, and finds none of six frameworks honor the contract: 215 of 1,200 gated runs still executed during the pause. A blog post details a data-exfiltration bypass in Claude's web_fetch design. Alongside: two papers on supply-chain and eval-corpus attacks, work on execution-scope and adaptive memory, and coding-agent failure reports from the field.
-
WED · JUL 15 A large-scale study asks how often agents recommend software "skills" that don't exist and finds they hallucinate plausible names 36-43% of the time—repeatably enough that an attacker could pre-register the fakes as malware. A related benchmark shows skill-guided agents violate their own logical constraints up to 70% of the time. Alongside: a controlled null on RL for small web agents, a critique of automatic harness tuning, and fresh agent-memory and sub-agent security wrinkles.
-
TUE · JUL 14 A reliability study puts Gemini models on trial as audio judges for voice agents, and reports the LALM tracks human raters within 0.07 on most dimensions—while warning that a model swap can break calibration even when rank correlation holds. A negative result shows LLM agents fail to probe each other in multi-agent settings. Also today: two long-horizon terminal benchmarks, a visual tool-calling sandbox, and a disposable-VM pattern for coding agents.
-
MON · JUL 13 Two engineers logged every request between their coding agent and Anthropic's endpoint and found Claude Code shipping 33k tokens of harness before it reads your prompt, versus 7k for OpenCode. Meanwhile a safety paper stress-tests chain-of-thought monitoring and finds giving the monitor the agent's scratchpad *raises* approval of harmful actions. Also today: causal-reasoning and terminology-understanding benchmarks, a content defense that weaponizes context compression, and harness engineering for auditable enterprise agents.
-
SUN · JUL 12 A paper revisiting four popular code-performance benchmarks runs each task 30 times with statistical testing and finds only 6.11% of the "performant" implementations are actually faster than the canonical ones — the tests, not the models, are the problem. Alongside: work on asynchronous RL for long-horizon agents, retrieval by procedural similarity, a screenshot-to-app interaction benchmark, external visual memory, and tools for replaying and distributing agent workloads.
-
FRI · JUL 10 OpenAI's new GPT-5.6 model family is out, claiming a new state-of-the-art on agentic benchmarks at a fraction of the cost of competitors. The focus on credible evaluation continues with a post from Databricks on benchmarking coding agents against their own multi-million line codebase. Today's papers are packed with new benchmarks, scheduling techniques, and runtime security frameworks.
-
THU · JUL 9 A new post details how Bun was rewritten from Zig to Rust using a sophisticated system of agents, a task long considered impossible for a live project. The rest of today's papers focus heavily on reliability, identifying novel failure modes like workflow-level jailbreaks in IDEs and silent policy violations in tool-using agents, and proposing concrete engineering fixes.
-
WED · JUL 8 A new security paper shows that Unicode's TAG block—invisible glyphs in every mainstream renderer—can smuggle tool metadata past a human's MCP approval dialog while reaching the model verbatim, and only that one encoding evades both the eye and string sanitizers. A companion fuzzer turns up 40 real bugs in LangChain, LlamaIndex, and CrewAI. Two more papers rethink agent memory, plus one on runtime trajectory repair.
- LogicHunter: Testing LLM Agent Frameworks with an Agentic Oracle
- Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations
- From Passive Retrieval to Active Memory Navigation: Learning to Use Memory as a Structured Action Space
-
TUE · JUL 7 For agentic code-gen, a new study finds that more reasoning effort buys more reliability than adding tools, and at a lower cost. Two papers on security detail novel attacks that bypass current defenses, using stealthy memory injection and context data poisoning. We also cover a verification framework that uses an LLM's token logits for more calibrated scoring.
-
MON · JUL 6 Microsoft's early-2026 rollout of Claude Code and Copilot CLI across tens of thousands of engineers shows adopters merging ~24% more PRs, with first use spreading through social networks and retention tied to coding activity, not demographics. Archer's agentic LLVM reviewer, gated by a deterministic validation guard, flags 21% of open and 11% of closed PRs as introducing miscompilations. WM-SAR repairs failed planning graphs by tracing error-amplifying causal subgraphs instead of scanning symptoms, and SkillCoach scores trajectories on skill selection, following, composition, and reflection to expose failures hidden by outcome-only accuracy.
-
SUN · JUL 5 A new blog post highlights a surprising regression where newer Claude models perform worse than older ones on a specific tool-use task. In a similar vein, a new paper finds that ambiguous code prompts often lead to consistently wrong code, not diverse outputs. Other work this issue introduces frameworks for static analysis, verifiable context governance, and permission design.
-
SAT · JUL 4 A new paper on agent memory finds that classic cache policies like LRU are consistently worse than a naive FIFO baseline. Another study on coding agents shows regressions accumulate over conversations, breaking up to 73% of tasks. Other work covers multi-head memory, context-as-garbage-collection, and dialogue-grounded policy enforcement.
-
FRI · JUL 3 A new paper presents an evasion framework that bypasses all tested agent skill malware scanners with over 90% success, while another introduces a static analysis tool that finds a new failure class—infinite agentic loops—with 91.9% precision in open-source projects. Other research covers attacks on persistent codebases, plus how underspecified instructions cause dangerous guessing.
-
THU · JUL 2 An audit of popular code-optimization benchmarks finds their results are often unstable and rankings depend heavily on arbitrary scoring rules. Another paper introduces a transactional model for agent safety that treats all generated actions as untrusted proposals until validated. Today's research also covers trainable memory, legacy code rescue, and runtime-guided bug fixing.
-
WED · JUL 1 A new benchmark for orchestrating subagents finds the bottleneck isn't perception but the manager agent granting permissions. Another evaluation framework shows simple prompting often beats complex methods for dense supervision. The day's papers also offer new techniques for credit assignment and context window management, alongside a practical tool for having agents record video demos of their work.