AI Agents

Sleeper memory poisoning: an adversary embeds instructions in a document, webpage, or repository that cause a stateful LLM assistant to write a fabricated memory about the user. The memory lies dormant, survives session boundaries, and later steers agentic actions. Poisoned memories were written in 99.8% of trials on GPT-5.5 and 95% on Kimi-K2.6; among successful retrievals, 60-89% of evaluations ended in attacker-intended actions. This is a full pipeline evaluation — write rate, retrieval rate, and downstream action rate — making it one of the more complete attack characterizations published for persistent memory systems.

Argus frames deep research as jigsaw assembly rather than parallel brute-force. A Navigator (trained with RL to verify, dispatch, and synthesize) maintains a shared evidence graph and sends Searchers only after confirming what's missing. With both components on a 35B-A3B MoE backbone, Argus gains 5.5 points over a single-Searcher baseline and 12.7 points with 8 parallel Searchers, averaged across eight benchmarks. At 64 Searchers it reaches 86.2 on BrowseComp. The key claim — that deduplication via the evidence graph beats naive parallel scaling — is tested with ablations.

RecMem defers LLM-based memory consolidation until semantically similar interactions recur, storing everything else in a lightweight embedding layer. The LLM is only invoked when a cluster of related interactions has accumulated enough signal to be worth extraction. A semantic refinement step then recovers fine-grained facts that summary extraction tends to drop. Compared to three current SOTA memory systems, RecMem cuts memory-construction token cost by up to 87% while matching or exceeding accuracy. Mechanism is clearly specified; the production relevance for long-running agents operating over many sessions is direct.

This paper applies Linear Temporal Logic to runtime monitoring of LLM agents — auditing behavioral constraints like safety rules and compliance norms that span multiple steps, not just single outputs. Small-model labelers using the formal LTL structure match or exceed frontier LLM judges on violation detection. Predictive monitors flag likely violations before they occur; intervening monitors act to preempt them while preserving most task performance. A controlled experiment also quantifies how LLM temporal reasoning degrades as event sequence length increases — directly relevant to multi-step agent chains.

Agent attribution formalizes the problem of linking an observed harmful agent interaction back to the vendor account that deployed it — a gap that exists regardless of whether the operator was negligent or malicious. The protocol injects canary tokens into the agent's interaction stream; the vendor searches a narrow session-log window to recover the originating account. For adversarial operators who filter or paraphrase, the canary constructions are designed so suppression degrades the agent's own task performance, yielding a formal asymmetry. This is the first published treatment of the problem as a formal attribution framework.

Semble replaces grep+read in coding agents with a hybrid BM25 + Model2Vec embedding retrieval system, fused via RRF and reranked with code-aware signals. On a benchmark of 1,250 query/document pairs across 63 repos and 19 languages, it hits 0.854 NDCG@10 — 99% of a 137M-parameter transformer — at ~250ms index time and ~1.5ms per query on CPU, with no API keys or GPU required. The 98% token reduction claim is the headline, and the MCP server makes it a drop-in for Claude Code, Cursor, and Codex. Zero-config and open source.

SmallCode gets 87% on a 100-task coding benchmark with Gemma 4 (4B active parameters) versus OpenCode's ~75% with 14B models. The techniques doing the work: compound tools that collapse 4-step chains into one call, an automatic compile/lint feedback loop, decompose-on-failure that breaks a problem into smaller pieces after two retries, and auto-escalation to a larger model when all else fails. The benchmark is self-reported and Reddit-sourced, so treat the absolute numbers cautiously — but the harness design patterns are independently sound and worth adapting.

Wolfe surveys agent evaluation practices with the practitioner's perspective: how to structure test harnesses, what makes agent evals different from unit evals (non-determinism, multi-step failure cascades, environment coupling), and common patterns that actually hold up. The raw excerpt is thin, so depth is behind the link — but Wolfe's prior work on training and inference has been methodologically careful. If you're standing up eval infrastructure for an agent system, this is worth reading before you commit to a framework.