AI Agents

This paper studies how multiple agents can coordinate attacks. Using a synthetic AI-lab environment (FakeLab), the authors identify the "fragmentation effect": as a malicious task is distributed across more agents, per-agent monitoring becomes less likely to detect any single attacker. This isn't just about signal-to-noise; the effect is amplified up to sevenfold by an explicit planner agent. Even a strong monitor misses attacks, showing a fundamental weakness of per-instance monitoring against distributed threats.

Safety evals for coding agents often test them like chatbots, with one prompt and one response. This paper demonstrates that's a huge blind spot. They introduce "workflow-level jailbreak construction," where a harmful objective is assembled across the ordinary stages of a software development workflow. Across four major models, prompts that were almost always refused in chat (8/816 successes) were completed 100% of the time (816/816) when executed as a multi-step IDE workflow.

How are coding agents actually being used in open source? This large-scale study analyzed 13,360 AI chat sessions from 1,356 repositories. They found heavier AI use in smaller, less mature projects. Post-adoption, projects tended to see more active contributors and lower contributor concentration. While developers surveyed perceive others' AI-generated code as harder to maintain, the authors found no broad deterioration in code-quality signals or pull request merge rates in the repository data.

Long-running agent contexts create performance bottlenecks. This paper proposes Akashic, a memory system built around MemAttention that organizes context into bounded chunks and models semantic relationships between them. This avoids replaying the full history on every turn. The system also uses a hardware-software co-design to co-locate likely co-retrieved chunks in memory, reducing I/O. Across four workloads, Akashic improved throughput by up to 1.21x and task accuracy by up to 10.2 points over strong memory baselines.

Prompting a CodeLLM for tests often yields trivial or invalid assertions. This work introduces SpecCoder, a verification-guided framework that trains models to generate meaningful executable specifications at intermediate program points. It learns from correct programs, behavior-changing mutants, and multi-turn refinement traces, selecting for specs that hold on correct executions but fail on faulty ones. This turns specifications from passive annotations into active, executable evidence for verifying and repairing code.

Standard RL fine-tuning stalls on hard problems where the model rarely samples a correct solution. TREK is a staged training procedure that uses a teacher model not for imitation, but for exploration. It identifies hard prompts where the student fails, gets candidate solutions from a stronger teacher, distills just enough to pull those solutions into the student's reach, then resumes normal on-policy RL. This simple procedure improved Qwen3 models on math benchmarks and raised success rates on ALFWorld and ScienceWorld.

How do you estimate a new model's safety risks before deploying it? This paper validates a simple technique: "deployment simulation." Take de-identified conversation logs from a previous model's deployment, fix the user prompts, and have the new candidate model regenerate only the AI's responses. Across four GPT-5-series releases, they found this method produced far more informative estimates of post-deployment misbehavior rates than traditional adversarial evaluations or baselines.

This paper investigates using RL to learn adaptive batching policies for inference servers. It finds a clear boundary condition for RL's value. In single-GPU settings, a well-tuned static batching policy is already near-optimal, and RL offers only marginal gains. In multi-GPU routing with a mix of fast and slow requests, however, the RL agent discovered a workload-segregation policy that eliminated head-of-line blocking, yielding a 3.5x improvement over the strongest heuristic and boosting throughput by 60%.

LLMs are increasingly used to translate HPC code (e.g., CUDA to OpenMP), but passing compilation or existing tests is a poor guarantee of correctness. Kaizen is a testing framework that uses metamorphic fuzzing and differential testing to find subtle semantic bugs. It generates equivalent program variants and diverse inputs to expose cases where the translated code seems to work but produces scientifically incorrect results. The work includes a useful taxonomy of common error patterns in translated code.

A tool-using agent can appear to succeed while silently violating a domain policy, leaving the system in a wrong state (e.g., cancelling the wrong booking without an error). This paper identifies this "silent wrong state" failure mode, finding it accounted for 78% of observed failures on one benchmark. They propose a simple, effective fix: lightweight, deterministic, read-only pre-execution gates that verify a proposed tool call against current state, which boosted success on the benchmark by 12.4pp.

Because agents can't verify the text they operate on, any party controlling the context can potentially forge tool calls. This paper proposes aiAuthZ, an off-host authorization gateway that moves the safety decision out of the agent's context. Before a tool call executes, the gateway verifies the caller's identity with a per-message signature and evaluates an agent-unreadable policy. With the gateway, attack success across 15 models dropped to 0% with negligible latency, blocking real-world attacks from an incident corpus.

This work introduces "institutional red-teaming," an evaluation method that tests deployment rules in multi-agent systems. Holding agents and tasks constant, they vary only the rules and measure the effect on collective behavior. On a new benchmark, changing just the consequence-allocation rule altered mean fatality rates by 22 to 58 percentage points across all tested models. The "targeting hazard" was universal: rules that named the agent bearing a loss consistently led to the elimination of the least-resourced agent.

Long-lived agents need more than a vector DB. This paper proposes MRMS, a multi-resolution memory architecture organized along two axes: representation (structured records, vectors, graphs) and temporality (short, medium, long-term). The core design is synchronized memory: structured records govern eligibility, vectors aid recall, and graph relations resolve contradictions before context is projected for the next turn. It frames personalization as a memory design problem, not just a retrieval problem.

What's the most cost-efficient way to use a teacher model for on-policy data augmentation? This paper frames the question as a supervision budget-allocation problem. Their key finding across three benchmarks is that using the budget for short, unfiltered teacher continuations from contexts the student model actually reached is more cost-effective than longer demonstrations or more complex, filtered continuations. In short, a few well-placed teacher steps go a long way.

RL for LLMs often uses off-policy data, where importance sampling can cause exploding variance. This paper introduces Selective Importance Sampling (SIS), a plug-in method inspired by rejection sampling. It performs a token-level test: accepted tokens are treated as on-policy (importance score of 1), while rejected ones get the standard correction. This is theoretically grounded, reduces the off-policy gradient estimation gap, and consistently improves training outcomes with negligible overhead.

Jarred Sumner's post on rewriting Bun from Zig to Rust is a detailed case study in large-scale agentic engineering. He describes a sophisticated system featuring dynamic workflows, trial runs, and adversarial review to tackle a task that Joel Spolsky famously warned against. The core idea is that this class of tooling changes the economics of language choice, making what was once a one-way decision reversible. The post is a rare, deep look into the methodology of a massive, successful agent-driven refactor.

Kenton Varda, of Cap'n Proto and Sandstorm fame, has banned AI-written change descriptions (like PR and commit messages) from his team. He argues they're worse than useless: they tend to describe code-level details that are already obvious from looking at the diff, while completely omitting the high-level framing and intent that a human reviewer actually needs to understand the change. It's a sharp, grounded critique of a common but often low-value agent use case from a respected practitioner.