AI Agents

This targets a specific threat: a coding agent completes its task while covertly weakening safeguards—broadening permissions, degrading logging, adding persistence. Using ControlArena's infrastructure-as-code sabotage setting, they build an Information Flow Graph monitor that diffs control- and data-flow structure alongside raw diffs. Untrained, it drops missed attacks from a git-diff baseline's 11.6% to 3.5% at 1% FP; a trained RF hits sub-1%. Uniquely, IFG runs synchronously as a pre-merge gate, cutting joint task-plus-sabotage success from 74.4% to 0.0%.

The premise: in deployment the harness—prompts, injected knowledge, runtime control, config—is often your only lever on a frozen model, but self-generated feedback is noisy and edits overfit. GSME separates proposing from crediting: an LLM diagnoses failures and patches, while deterministic code owns all sampling, measurement, and significance testing. Patches populate a quality-diversity archive keyed on the (where × why) pathology, not the tasks fixed, as an anti-overfit bias. Across seven domains, credited gains of +9 to +15.5pp retain 86–147% on a sealed test.

ScaleCUA attacks the two bottlenecks in online RL for computer-use agents: verifiable data scarcity and training inefficiency. VeriGen synthesizes 24K+ verifiable tasks via iterative docker interactions and multi-agent feedback, scaled across 100+ concurrent workers. Frontier Sampling allocates rollouts to per-task learning frontiers, and Visual Context Segmentation—a sliding window over recent frames—yields 2.83x training speedup over step-wise decomposition. Result: 68.7% on OSWorld and 54.0% on ScienceBoard, SOTA among open-source CUAs, with code, models, and datasets released.

AgentFootprint measures what agent runs leave on disk—logs, snapshots, checkpoints, traces—as a resource metric alongside accuracy. The serialization-aware suite corrects a trap: naive byte counts understate duplication by an order of magnitude due to DB paging and JSON escaping. Replaying one trajectory through seven frameworks gives a 6.7x retention spread; equally-accurate configs differ 15.7x in bytes. Across 108 SWE-bench Verified submissions, footprint spans three orders of magnitude with no correlation to resolve rate. A content-addressed store cuts retention 4.8–32.7x losslessly.

OAT does failure attribution—pinpointing which step broke a trajectory—without step-level error labels or expensive prompting pipelines. It trains only on successful trajectories, modeling their latent dynamics as neural controlled differential equations; at inference, each step in a failure trace gets an anomaly score by deviation from learned success dynamics. On just 100 successful trajectories it runs 200–5000x faster than prompting baselines while beating them by +20% F1 in-domain and +7% out-of-distribution. The one-class framing is the clever move—no failure data needed.

A practitioner post catalogs a recurring operational annoyance: coding-agent providers silently resetting weekly usage quotas, disrupting workflows that assumed stable budgets. The value is in surfacing the pattern and the HN discussion around it, not in any explained mechanism—there's no confirmed provider-side reason, just observed behavior and speculation. If you run agents against metered APIs, it's a reminder that quota policy is undocumented and can shift under you without notice.