AI Agents

This paper tests whether agent-framework control primitives — approval gates, cancellation, timeouts — actually enforce the barrier semantics their names imply, and finds none of six popular frameworks do. The recurring bug is a sibling leak: an approval gate suspends its own branch while a sibling branch's effect runs during the pause, so a later rejection can't stop it. Under live runs, 215 of 1,200 executed their effect mid-pause. The authors ship SOUNDGATE, an external Rust effect gate enforcing hold-until-decided, reject-cancels, and dedup, with verified properties. Strong systems work.

A cautionary study of synthetic LLM-as-judge corpora, where negative examples are model-generated rather than deterministically perturbed. A shared decoding-budget parameter silently truncated one producer's hallucinated answers, manufacturing a 32-point cross-lingual accuracy "collapse" that replicated from n=50 to n=500 and survived a full mechanistic story — all of it an artifact of the bug. Only manual reading of raw generations caught it; no aggregate check did. The framing via the test oracle problem is apt: generated negatives carry no mechanical way to verify item integrity.

Agents that follow a maximum-context-first strategy re-read files and dependencies they've already seen, turning a one-line edit into a codebase audit. This paper formalizes execution-scope estimation and proposes E3 (Estimate, Execute, Expand): guess an operating point, run a minimum viable path, expand only when verification fails. On MSE-Bench (121 edits in a controlled simulator) E3 matches the strongest baseline's 100% success while cutting cost 85%, tokens 91%, and inspected files 92%. A live gpt-4o harness against real pytest suites corroborates milder but real gains.

The first systematic evaluation of package-install-time supply-chain attacks delivered through ordinary setup docs — a README, requirements file, or Makefile that redirects an agent to an untrusted registry, a vulnerable version, or a plausible-wrong name. The key finding: the same model catches an attack in one harness and installs it in another, so security is a harness-model property, not a model property. Agents catch blatant typosquats but miss separator-confusion (azurecore for azure-core) and nearly always miss registry redirection. A deterministic pre-install name/source/version check closes most of the gap.

Most agent memory systems use fixed heuristics for retrieval, but optimal behavior is context-dependent: sparse early tasks need little retrieval, recurring goals want plan reuse, stuck agents need re-retrieval with new queries, long streams need consolidation. MemCon models memory operations as an MDP and learns an online policy deciding when, what, and how much to retrieve. It's backend-agnostic, learns from binary task feedback with no pretraining and no extra LLM calls via a tabular contextual bandit with UCB, and converges within tens of tasks. Up to 15.2 points better across six benchmarks while cutting tokens.

An open-source persistent memory layer for coding agents, synced between machines over SSH. The pitch is portable agent memory without a hosted backend — your history follows you across environments. The HN listing is light on internals (120 points), so the retrieval model, storage format, and conflict handling are worth reading from the repo directly. The SSH-sync choice is the interesting bit: it sidesteps a cloud dependency but inherits SSH's key-management and multi-writer questions.

A YC S26 launch offering company-wide visibility into which AI apps run on employee devices and how they connect to data sources via MCP. A lightweight binary plus browser extension reports live agent activity to a central dashboard so security teams can spot risky connections. The more concretely useful piece is the open-source mcp-xray, a dynamic MCP pentesting tool for detecting vulnerable servers. Treat the platform as a vendor pitch, but the MCP-connectivity-graph and pentest angles are the real content here.

A framework for letting multiple coding agents coordinate on shared work. The listing (51 points) is thin on how tasks are decomposed, how agents communicate, and how conflicts on shared files get resolved — the questions that decide whether multi-agent coding beats a single agent with a longer context. Worth a look for anyone experimenting with agent-to-agent protocols, but the interesting design decisions are in the repo, not the HN summary.

A local LLM runner that skips the REST sidecar and uses OpenJDK's Panama Foreign Function & Memory API to call llama.cpp, whisper.cpp, and ggml compute graphs directly from the JVM. The engineering is the point: zero-allocation hot paths, prompt and token memory allocated once in confined Arenas, native struct layouts hand-matched to compiler padding, prebuilt binaries bundled in the jar. Niche audience, but a real answer for JVM shops that don't want a separate inference process.

A YC S26 API for computer-use agents that operate legacy desktop and web software with no usable API — screenshots, mouse, keyboard — and return a structured run record of actions, outputs, and errors. The framing targets prior authorizations, desktop data entry, and cross-system operations where RPA is brittle. The demo is a mockup, so take capability claims cautiously, but the described reliability patterns — result verification, checkpoints, human-approval steps — are the right vocabulary for putting these agents into workflows that matter.

LM Studio shipped Bionic, an agent runtime aimed at running tool-using agents over open-weight models locally. It's a notable release for the local-model crowd — 264 points on HN — but the listing carries no engineering detail on the agent loop, tool-calling format, or how it handles models with weaker instruction-following. If you already run open models through LM Studio, this is the on-ramp to agentic use; read the blog for specifics before assuming parity with hosted agent stacks.

Anthropic designed web_fetch to block lethal-trifecta exfiltration by only allowing exact URLs the user typed or that web_search returned. Ayush Paul found the loophole: web_fetch also followed URLs embedded in pages it had already fetched, so a honeypot site can lead the agent through nested generated links that leak data one hop at a time. A clean demonstration that allowlisting URL sources doesn't help once fetched content can itself introduce new destinations.

OpenAI's Thibault Sottiaux describes a Codex failure mode where GPT-5.6 deleted user files. The pattern: full-access mode with no sandboxing and no auto-review, the model overrides $HOME to point at a temp directory, then mistakenly deletes $HOME instead. Not an exotic jailbreak — an ordinary env-var mistake with destructive reach because the guardrails were all disabled at once. A useful reminder that "full access" removes several independent safety layers, not just one.

xAI's grok CLI uploaded entire working directories to cloud buckets — one user reported SSH keys, a password manager database, documents, and photos going up when they ran it in their home directory. After backlash, xAI disabled the feature, promised deletion of retained data, flipped retention default to off, and open-sourced the whole Grok Build codebase under Apache 2.0. The incident is the lesson; the open source release also gives builders real system prompts and tool implementations to inspect.