AI Agents

Persistent agents that read external data are vulnerable to a new threat: stealth memory injection. An attacker sends a single piece of content, like an email, designed to be silently written into the agent's long-term memory. The poisoned memory is later used as trusted state, affecting future actions. The authors introduce WhisperBench, a benchmark for this attack, and MemGhost, a framework for generating payloads. It achieves high success rates against agents using GPT-5.4 and Sonnet 4.6, showing the attack is practical.

This paper introduces Agent Data Injection (ADI), a new class of indirect prompt injection that bypasses defenses focused on instruction-following. Instead of injecting instructions, ADI poisons security-critical metadata like resource identifiers or tool call formats. The agent then misuses this trusted-looking data to take unintended actions. The authors demonstrate ADI's practicality with exploits against real-world agents from Google and Anthropic, achieving remote code execution, supply-chain attacks, and arbitrary clicks on web agents.

Instead of prompting an LLM judge for a discrete score, LLM-as-a-Verifier computes a continuous score from the expectation over the scoring token logits. This probabilistic approach offers a new scaling axis for verification. The authors show that increasing scoring granularity, repeating evaluation, and decomposing criteria all consistently improve accuracy. The framework achieves state-of-the-art performance on benchmarks like Terminal-Bench V2 and SWE-Bench without any additional training, providing more calibrated feedback for agentic tasks.

This paper presents EEG-SpikeAgent, a closed-loop system that uses an LLM agent to perform automated feature engineering for a medical task. The agent iteratively proposes signal-processing features as code modules, executes them on EEG data, and uses the performance of a downstream classifier to refine its next proposal. The goal is to generate an interpretable program for detecting epileptiform discharges. On a public dataset, the agent-generated features achieved a high AUC of 0.935, demonstrating a viable agentic approach to program synthesis for scientific discovery.

In an observational study of 90 agent runs building a web app, adding a testing tool did not improve functional scores but increased costs by 42-68%. In contrast, increasing the agent's "reasoning effort"—using a more capable model—lifted the rate of perfect first-try runs from 28% to 89%, for only a 9-29% cost increase. The finding suggests that for code generation tasks, investing in a better core model is more effective and efficient than augmenting a weaker model with tools.