AI Agents

This paper argues that agent safety controls within the agent's own process are fundamentally "escapable." The authors present the Unfireable Safety Kernel, a Rust reference implementation that enforces safety out-of-process. The design mandates four properties: process separation, pre-action enforcement, fail-closed design, and externalized signed evidence. Crucially, its core decision logic is formally verified using an SMT theorem prover (Z3) and bounded model checking (Kani) to guarantee its safety invariants hold.

The paper proposes "progress advantage," a method to derive a step-level reward signal for agents as a free byproduct of standard RL post-training. It proves that the log-probability ratio between the RL-trained policy and its reference policy recovers the optimal advantage function. This eliminates the need for expensive, domain-specific reward model training or human annotation. In experiments, this annotation-free signal consistently outperforms confidence-based baselines and even surpasses dedicated, trained reward models on several benchmarks.

This paper introduces SWE-Pro, a benchmark for software performance optimization derived from 102 real-world expert commits. Unlike previous benchmarks, it evaluates trade-offs between runtime and memory usage under noisy conditions. The results are stark: current LLMs provide negligible runtime gains and almost no memory improvements. This is in sharp contrast to the human experts, who achieved an aggregate 15.5x speedup and 171.3x peak memory reduction across the same tasks, highlighting a massive capability gap.

This work argues that we should evaluate agent memory systems not just on end-to-end task success, but as data management systems with their own costs and trade-offs. The authors propose a framework that decomposes memory into four modules: representation, extraction, retrieval, and maintenance. Their evaluation of 12 representative systems shows no single architecture is best. Instead, effectiveness depends heavily on aligning the memory structure (e.g., list, graph, tree) with the specific workload's bottleneck.

This paper challenges the common practice of treating the agent "harness"—the scaffolding that defines tool access and observation formats—as a fixed engineering detail. Using an extended ALFWorld environment, they systematically analyze how harness design interacts with post-training. They show that while harness-aware post-training improves in-distribution performance, its real value is in enabling robust adaptation to out-of-distribution shifts in tasks and tools. A poorly designed harness can cause performance to collapse when the environment changes.

To build safe GUI agents, we need reliable uncertainty quantification (UQ). This paper presents Argus, a comprehensive benchmark evaluating 27 UQ methods across 4 open-weight VLMs and 4 datasets, plus a smaller set for closed-source models. The key finding is "selective transfer": UQ method rankings are stable for a fixed model across different datasets but degrade significantly when transferring between model classes or to closed APIs. For open models, hidden-state and density estimators are the most stable UQ family.

How do you get a reward signal for RL-tuning a GUI agent in an open-ended desktop environment? This paper proposes using a Vision-Language Model as an autonomous evaluator. Given a final screenshot and the initial instruction, a VLM judges task completion. The crucial insight is to treat the VLM's feedback as a noisy signal and explicitly correct for it. This noise-corrected reward estimator for PPO improved success rates by an average of 12.6 percentage points over zero-shot performance across three benchmarks.

This paper challenges the default practice of feeding raw source code to LLMs for vulnerability detection. Using a benchmark of C/C++ test cases, they show that structured representations are far more effective. A combination of Abstract Syntax Trees (ASTs) and Program Dependence Graphs (PDGs) achieved 83.2% accuracy, while raw source alone managed only 53.5%. The authors identify a "context dilution effect," where adding raw source to compact graph evidence can actually degrade reasoning.

Standard step-level RL for agents treats interactions as isolated, linear trajectories, which struggles with credit assignment in long-horizon tasks with sparse rewards. The proposed Group-Graph Policy Optimization (G2PO) algorithm reframes the problem by building a global state-transition graph from all interaction trajectories. By aggregating identical observations and redefining actions as graph transitions, G2PO achieves lower-variance state-value estimates and more accurately assigns credit to the critical steps that lead to success.

Reusing unit tests across different libraries is hard because structural API mappings are brittle. IntentTester is a multi-agent framework that solves this by abstracting the intent of a test into a language-agnostic Test Description Language (TDL). This representation is then used to synthesize new, executable tests for a target library through LLM-guided reasoning and iterative validation. Evaluated on Java and Python projects, it generated correct tests at an 85% rate, far surpassing baselines and even uncovering new bugs.

Simon Willison demonstrates a practical agentic workflow, using one AI to generate a Python script (Claude) and another to build a GitHub Actions pipeline (Codex Desktop). The goal: convert Mozilla's browser compatibility data into a SQLite database and publish it via an orphan branch to leverage GitHub's CDN with open CORS headers. It's a complete, clever example of using agents for a concrete data engineering and DevOps task, with all code provided for inspection and reuse.