AI Agents

Reinforcement learning for agents is often inefficient due to low-variance rewards. This paper introduces TRACE, a framework that allocates a fixed rollout budget more effectively. Instead of just sampling different initial prompts, TRACE also allocates budget to promising intermediate turns within a single rollout, forming a tree-structured exploration. By focusing compute on branches most likely to yield mixed (success/failure) outcomes, it sharpens the reward signal and makes policy optimization more efficient, directly addressing the high cost of RL-based training.

This paper reveals a counterintuitive vulnerability: Grammar-Constrained Decoding (GCD), a technique used to ensure LLMs generate syntactically valid code, can itself be a jailbreak vector. The "CodeSpear" attack shows that applying a seemingly benign grammar constraint can coerce a model into generating malicious code. To counter this, the authors propose "CodeShield," a defense that aligns the model to generate harmless "honeypot" code when constrained, preserving safety while still respecting the grammar.

This paper argues that better web agent performance comes from better architecture, not just bigger models. It introduces WebChallenger, a framework using a structured DOM representation called PageMem. This enables three key features: a divide-and-conquer observation pipeline for skimming pages, a memory system that maps sites, and compound actions for common interactions. By shifting complexity from the model to the agent's architecture, WebChallenger allows smaller, open-weight models to achieve strong performance on web navigation tasks.

Current methods for agent skill learning are brittle. This paper's SkillCAT framework improves self-evolution with a three-stage, training-free pipeline. It first uses "Contrastive Causal Extraction" by comparing successful and failed trajectories to find what actually made a difference. Then, it assesses potential new skills on cloned tasks before merging them. Finally, it compiles skills into a dependency graph, so only relevant skills are loaded at inference time, improving reliability and efficiency.

To enable long-horizon autonomous research, this paper introduces Arbor, a framework that makes learning cumulative. It combines a long-lived coordinator agent with short-lived executor agents. The core is a persistent "Hypothesis Tree" that links hypotheses, experiments, evidence, and distilled insights across time. The coordinator manages global strategy on the tree, while executors test individual hypotheses. This structure prevents the agent from getting lost in local loops, enabling it to outperform baselines by 2.5x on several research tasks.

Production agents break traditional security models by shifting risk from data access to sequences of actions. This paper proposes a new reference architecture for runtime governance to address this. It decomposes the problem into five planes: a reasoning plane for intent, and four enforcement planes for network, identity, endpoint, and data. The model introduces "composite principals" whose authority can be delegated and attenuated, and formalizes audit as a structured evidence layer. It's a comprehensive framework for governing agent behavior in production.

Agent evaluation is a mess of fragmented, custom harnesses. This paper proposes "Agentified Agent Assessment" (AAA): using judge agents to evaluate subject agents, all communicating over standard protocols. This decouples the evaluation logic from the agent implementation, enabling fair, reproducible assessment. The authors built AgentBeats, an implementation of AAA, and validated it in a massive competition with hundreds of independently developed agents, showing that the standardized approach is both feasible and effective at scale.

LLM agents that explore codebases file-by-file struggle with changes that span multiple directories. This paper shows that a parallel exploration strategy is much more effective. They spawn multiple "domain-scoped" agents that explore different parts of a codebase simultaneously. On a benchmark of Ansible code changes, this multi-agent approach using a small, Haiku-class model dramatically outperformed a linear agent and was competitive with a much larger model. This suggests agent architecture matters as much as model size for complex code tasks.

Agent benchmarks are typically static, but real-world environments change. This paper introduces EvoArena, a benchmark suite that explicitly models evolving software, terminal, and social environments. To handle this, they propose EvoMem, a memory paradigm that stores environmental changes as a structured history of patches. This allows an agent to reason about how its world has changed. Agents using EvoMem show significant performance gains on EvoArena and even on existing static benchmarks, highlighting the importance of tracking environmental state evolution.

This paper makes a striking discovery: a detectable internal signal for data exfiltration. When an agent plans to encode sensitive data (e.g., in Base64), it activates a specific, low-dimensional subspace in its residual stream. The authors built MIRAGE, a monitor that reads this internal state in real time. It achieves an AUC of 0.918 in detecting covert data exfiltration, vastly outperforming monitors that only inspect the agent's final output. The signal even distinguishes between in-model encoding and tool use.

Standard KV caching is inefficient for agentic workloads with recurring but non-prefix-aligned inputs. This paper introduces MiniPIC, a design for flexible, position-independent caching implemented with fewer than 100 lines of code changed in vLLM's core engine. By storing unrotated K vectors and applying RoPE in-kernel, it allows for reusing cached blocks anywhere in a sequence. This simple change improves prefill throughput by 49% on a multi-hop QA task, offering a massive practical speedup for RAG and agent systems.

This paper fundamentally reframes human-in-the-loop safety. Instead of treating the human reviewer as a perfect oracle, it models them as a finite, fatiguing resource. It finds that simply escalating more actions to a human can paradoxically decrease system safety due to reviewer fatigue. The safety-optimal policy is to escalate selectively, balancing the risk of automation against the risk of overwhelming the human. This frames agent oversight as a resource allocation problem, where the goal is to spend finite human attention wisely.

Are agents any good at synthesizing scientific conclusions? This paper introduces SciConBench, a benchmark based on 9.1K questions from medical systematic reviews, and finds the answer is a resounding "no." The best agent in a "clean-room" setting—with controlled web access to prevent test data contamination—achieved a factual F1 score of just 0.337. The paper demonstrates that standard "unconstrained" evaluations consistently inflate performance, showing that rigorous, leakage-free measurement is essential for assessing true reasoning capabilities in high-stakes domains.

Agents with long histories need to decide what to forget. Instead of relying on simple heuristics like recency, this paper proposes learning a value function to score memories. The model uses a linear combination of seven factors drawn from cognitive psychology, such as emotional intensity, goal relevance, and reliability. The weights are learned via a simple optimizer. In a blind forgetting task, this cognitively-grounded approach retained 77% of critical evidence, compared to just 37% for a recency-based baseline.

Standard attention is untenable for million-token contexts. This paper introduces MiniMax Sparse Attention (MSA), a blockwise sparse attention mechanism that delivers huge speedups with no accuracy loss. For each query group, a lightweight indexing model selects the most relevant key-value blocks, and the main model performs exact attention on just that sparse subset. Co-designed with a custom GPU kernel, MSA achieves a 14.2x prefill and 7.6x decoding speedup at 1M context on H800s, making long-context agents practically deployable.

Training capable OS agents requires better data. The ISE framework offers a three-stage recipe for synthesizing high-quality, execution-grounded trajectories. It starts by generating diverse user intents, simulates a multi-turn dialogue where a user simulator reacts to real execution outcomes, and finally runs every tool call in a live OS workspace to capture realistic failure-recovery loops. Fine-tuning a Qwen3-8B model on the resulting ISETrace dataset boosts its ClawEval score from 19.3 to 37.7, outperforming zero-shot GPT-4o.

How can agents learn from experience in complex environments? ProPlay introduces the idea of a "procedural world model." Instead of a flat memory, it abstracts successful action sequences into a graph of procedures that captures causal links between task stages. Before acting, the agent can simulate paths through this graph to form a plan ("pre-play"). After acting, it refines the graph based on the outcome. This closes the loop between planning and memory, enabling more effective self-evolution.

This paper makes an "offensively simple" proposal to drastically cut inference costs: stop re-calculating KV caches for common documents. Instead, a publisher could compute a document's KV cache once, and other agents could buy the right to load it directly, skipping the expensive prefill step. The author shows this is token-exact and 9-50x cheaper in compute. Hosted provider-side to avoid egress costs, this could create a market for KV caches and slash the cost of RAG over popular content.

As agents and humans collaborate on critical work, their interactions are often lost in ephemeral chat logs. This paper proposes CHAP, the Collaborative Human-Agent Protocol, to create a structured, auditable record of this collaboration. Under CHAP, a human's edit of an agent's draft isn't just a new message; it's a signed, diff-based event with a rationale. This turns ad-hoc supervision into a non-repudiable, replayable log, providing a much-needed accountability layer for production systems where both humans and agents perform work.

Self-distillation methods often struggle with credit assignment in multi-turn tasks. This paper's HERO framework solves this by using the immediate outcome of an action as a teaching signal. After each turn, HERO reflects on the environment's response to the agent's action and generates a "turn-level diagnosis"—actionable feedback on whether the action was necessary, valid, or why it failed. This creates a dense, locally-aligned reward signal that significantly improves agent performance, especially when successful trajectories are rare.

Paca is a new, open-source Jira alternative designed from the ground up for collaborative workflows between humans and AI agents. Written in Go, it treats agents as first-class teammates capable of planning sprints and assigning tasks. The system is lightweight and customizable, featuring custom views and a WASM-based plugin architecture for extensibility. It's a compelling vision for project management where agentic contributors are becoming common, with the full implementation available on GitHub to inspect.

This is a detailed, practical guide for setting up a local coding agent on macOS. The walkthrough covers the full stack, from installing the necessary model weights and inference server to configuring the agent framework and connecting it to a local development environment. For engineers who want to run code-generating agents entirely on their own hardware for privacy, cost, or offline access reasons, this post provides a complete, step-by-step recipe to get started with a powerful and self-hosted setup.

YC-backed BitBoard is launching what it calls an "agentic analytics workspace." The product aims to be a collaborative middle layer between coding agents and data visualization, allowing an agent to build and update live dashboards. The pitch is that current tools are either ephemeral (chat) or not built for agentic control (legacy BI). BitBoard provides the persistence and visualization layer, letting agents connect and perform data analysis that results in shareable, lasting reports.

Simon Willison provides a concrete walkthrough of the new Pyodide 314.0 feature: publishing Python wheels with WebAssembly extensions directly to PyPI. He details building and uploading a luau-wasm package using the new emscripten-3-1-45-wasm32 platform tag. This change, enabled by PEP 783, significantly simplifies distributing Python code with compiled C or Rust components for in-browser execution, a powerful pattern for agents that need client-side computation without server roundtrips.

Anthropic announced an abrupt, government-ordered suspension of its Fable 5 and Mythos 5 models, citing a national security directive related to a potential jailbreak. The order applies to all users, foreign and domestic. Simon Willison's post analyzes the event, noting Anthropic's claim that the vulnerability is minor. He provides a practical script for monitoring model endpoints, highlighting a new, critical failure mode for production systems: sudden, state-mandated model shutdowns with little warning or explanation.

How can an agent using a SQL database determine the provenance of columns in a complex query result? Simon Willison explores this problem for SQLite, aiming to map result columns back to their source table.column even through joins and CTEs. He tasked an LLM with the problem, which surfaced three viable paths: using the apsw library, using ctypes to call the unexposed sqlite3_column_table_name() C function, and analyzing the output of EXPLAIN. It's a solid technical exploration of a fundamental challenge for database-interacting agents.

Simon Willison has updated his openai-webrtc playground tool to support OpenAI's new GPT-Realtime-2 model. The most significant addition is the ability to provide document context, allowing a user to have a real-time audio conversation about a specific body of text. This provides a simple, browser-based demonstration of adding RAG capabilities to a low-latency voice agent, turning a general-purpose model into a conversational expert on a provided document.