AI Agents

This paper proposes Skill-to-LoRA (S2L), a clever technique for making agent skills more token-efficient. Instead of injecting lengthy procedural instructions (SKILL.md) into the context window, S2L compiles the behavior induced by the skill into a lightweight, skill-specific LoRA adapter. Offline, the skill text is used to generate fine-tuning examples. Online, the agent loads the corresponding LoRA to activate the skill. On SWE-Skills-Bench, this improved pass rates by 5.2 points while cutting per-step token costs by 6.6%.

Benchmark scores tell you if an agent succeeded, but not how. This work introduces a method for "fingerprinting" agents by analyzing the structure of their problem-solving trajectories. By creating a compressed procedural representation of an agent's actions, the authors can identify distinct behavioral habits. A probe trained on these fingerprints can attribute an unseen trajectory to the correct agent with 85.7% accuracy. The paper includes ProcGrep, a library for this kind of procedural audit, enabling more holistic agent evaluation.

This paper identifies a common agent failure mode: acting on assumed context from underspecified instructions rather than observed environmental facts. The proposed solution, ACCORD, is a simple framework that actively probes the environment for missing information before each action and integrates relevant context from its own trajectory. Without any extra training, ACCORD improves GPT-5-mini's task success on AppWorld from 42.0% to 62.6%—a massive 20.6 point gain—by forcing the agent to ground its actions in available evidence.

API routers, common in production agent setups, are a man-in-the-middle vulnerability; they terminate TLS and see all traffic in plaintext. This paper, AEGIS, proposes an attested API router that confines plaintext handling to a small hardware Trusted Execution Environment (TEE). The client verifies the TEE's integrity before sending any data, ensuring the host OS can't read or alter the interaction. The trusted path is just 851 lines of code, adds only ~6ms of overhead, and successfully blocks all tested malicious-router attacks.

How do you verify an agent's data analysis? VeriGraph tackles this critical problem by moving beyond linear text traces. It's a neuro-symbolic framework where the agent constructs a heterogeneous directed acyclic graph (DAG) as it reasons. This "evidence graph" explicitly links raw data sources, interpreter variables, computed results, and natural-language claims. Traceability is reduced to graph reachability, allowing an auditor to follow a conclusion back to its source data. A graph-based reward signal further optimizes the agent for correctness and coherence.

Most LLM-based decompilers are one-shot generators, producing code that might look plausible but fails to match the original binary's behavior. AutoDecompiler reframes this as an iterative refinement process. The agent revises its generated code based on feedback from compilation attempts, execution results, and I/O tests. It uses reinforcement learning with rewards for validity, recompilability, and semantic fidelity. This feedback-driven loop pushes the agent beyond syntactic correctness towards truly functional decompilation, a much harder and more useful goal for security analysis.

Long-running agents accumulate huge contexts, but simply pruning text can invalidate the prompt prefix cache, erasing performance gains. TokenPilot addresses this trade-off with a dual-granularity approach. Globally, it uses "Ingestion-Aware Compaction" to stabilize prompt prefixes. Locally, "Lifecycle-Aware Eviction" monitors the utility of context segments and only offloads them when task relevance expires. This careful management of the KV cache leads to massive cost reductions—up to 87% in continuous mode on Claw-Eval—while maintaining competitive performance.

Tool-filtering frameworks can help an agent pick the right tool, but what if it's for the wrong goal? This paper identifies "wrong-goal execution," where an agent correctly executes a tool sequence for an unintended interpretation of an ambiguous user request. The proposed GIST-CMTF adds a goal-state inference layer. It predicts candidate symbolic goals, and if ambiguity is high, it makes "clarify with user" a valid next action. This simple step reduced wrong-goal execution from 19.4% to 2.5% in their tests.

This paper presents Collective Skill Tree Search (CSTS), a framework for automatically discovering and structuring reusable skills. The process uses a multi-agent "collective intelligence" approach. First, multiple models generate diverse candidate skills for subtasks. Then, multiple models act as judges to score the skills on quality and generalizability. The result is a tree of robust, validated skills that can be used to create skill-augmented training data, bootstrapping more capable agents. It's a meta-agent approach to building agent capabilities.

daVinci-kernel is a specialized system for GPU kernel optimization using a reinforcement learning framework where skill discovery and exploitation are tightly coupled. It employs three agents with a shared LLM backbone: one selects optimization techniques, one generates CUDA/Triton code, and a third distills successful attempts back into new, reusable skills for the library. New skills are only added after execution-based verification confirms a real speedup. This co-evolutionary loop allows the system to outperform prior RL-trained models on KernelBench.

machine0 is a new CLI-driven VM provider offering persistent, NixOS-based virtual machines. The pitch is compelling for agent developers: define an entire OS environment as code using Nix flakes, ensuring that nixos-rebuild switch produces the exact same system every time. This provides a powerful foundation for reproducible agent development, testing, and deployment. The service supports static IPs, GPUs, and per-minute pricing, positioning it as a modern VPS tailored for infrastructure-as-code workflows and programmatic control by agents themselves.

A popular Hacker News thread asks a simple but crucial question: has anyone actually replaced proprietary models like GPT-4 or Claude with a local model for daily coding work? The resulting discussion, with over 400 comments, is a trove of practical experience reports. Engineers share their full setups, including hardware (Mac Studio, various GPUs), specific models (DeepSeek Coder, Phind), quantization strategies (Q4_K_M), and performance metrics. It’s a real-world survey of what works, what doesn't, and the trade-offs involved.

Simon Willison's datasette-agent gets a new execute_write_sql tool that requires explicit user approval before modifying a database. This release builds on the human-in-the-loop mechanism from 0.2a0, now applying it to destructive actions. The example shows an agent parsing a natural language request ("I saw 4 pelicans") and correctly generating a parameterized INSERT statement, which is then presented to the user for confirmation. It's a concrete implementation of a critical safety pattern for agents with database access.

An expert analysis of the Fable 5 export control incident reveals the "jailbreak" was simply asking the model to "fix this code" containing known CVEs. The model initially refused to analyze the code for security issues but complied with the fix request. This highlights a critical flaw in simplistic guardrail design: distinguishing between a malicious request to generate an exploit and a defensive request to patch a vulnerability. The author argues that this bug-fixing loop is one of the most valuable defensive security capabilities of AI models.

A quick, practical example of using a code agent to solve a real-world infrastructure problem. The goal was to stop aggressive crawlers on a faceted search page without blocking legitimate single-term searches. After some trial and error, a Claude-powered agent generated the correct Cloudflare WAF rule (http.request.uri.query contains "&") to trigger a challenge only on multi-faceted searches. The post also notes the agent had to pivot from an unsupported tool to using the Cloudflare API directly.