AI Agents

OpenForgeRL tackles a real gap: agents run inside elaborate harnesses (Claude Code, Codex, OpenClaw) whose stateful, multi-process inference can't be expressed by standard SFT/RL stacks, so you can't train them end-to-end. The trick is a lightweight proxy that serves the harness's model calls while logging them as training data for a normal RL codebase like veRL, plus a Kubernetes orchestrator running each rollout in its own container. Results are concrete: 55.9 pass@3 on ClawEval, 37.7 on OSWorld-Verified, 72.3 on WebVoyager, from only hundreds to a few thousand tasks.

This paper argues coding agents only have one memory type — deliberately authored, deliberately retrieved documents — and lack the involuntary, situation-cued recall that carries human expertise. The proposal: a cue-anchored model where memories carry first-class trigger conditions (path, symbol, semantic, event, temporal) that the harness evaluates deterministically, so recall isn't left to the agent's discretion. The evidence is pointed: agents did zero memory operations across 114 turns even with a pre-seeded store, deterministic injection fired with zero false alarms, and 39% of re-reads re-paid for content lost at compaction.

IssueTrojanBench evaluates whether malicious GitHub-style issue requests can steer deployed coding agents (Cursor, Claude Code, Codex Desktop, on GPT-5.3/5.4 and Sonnet 4.6) into emitting attacker-chosen code or exfiltrating data. The taxonomy covers four attack categories and six delivery vectors including PDFs and issue comments. The headline: 66.5% of malicious issues penetrate all guardrails. The sharper finding is that rejection comes almost entirely from the LLM, not the agent framework — GPT models were broadly vulnerable, Sonnet 4.6 blocked more selectively. Framework-level guardrails are barely contributing.

NVIDIA's NOOA collapses prompt templates, tool schemas, callbacks, and workflow graphs into a single abstraction: an agent is a Python object. Methods are the actions the model can take, fields are state, docstrings are prompts, type annotations are contracts, and a method body of ... is completed at runtime by an LLM loop while normal bodies stay deterministic. The claimed novelty is combining six model-facing ideas on one surface — typed I/O, pass-by-reference over live objects, code-as-action, programmable loops, explicit state, model-callable harness APIs. Validated on SWE-bench and Terminal-Bench.

GABench evaluates agent safety across 580 scenarios in six domains on three production frameworks (LangChain, LlamaIndex, Vectara) with five adversarial attack modes. The best configuration reaches only 74.8% accuracy, and the failure regimes split by model strength: stronger models under-call required tools while weaker ones mis-select and over-call. Performance degrades monotonically with tool-set size and turn depth, with long-horizon planning the steeper bottleneck. Their execution-time structural guardrail beats system-prompt defenses across all models, recovering 19.9% of failures at a 0.5% false-positive rate.

OneCLI is a network gateway that sits between agents and the services they call, so credentials never reach the agent itself. The agent sends requests with placeholders; the gateway matches by host and path, checks whether the agent should have access, swaps in the real secret, and forwards. Secrets live encrypted at rest or are fetched live from Bitwarden or 1Password. The reasoning is sound: once a secret enters an agent's context you lose all control over where it goes or who manipulated it into being handed over.

Echo routes each request across a pool of open-weight models (GLM-5.2, Kimi K2.7, others) rather than committing to one, deciding per-request how much compute to spend, which models participate, and how to combine outputs. The motivating experiment: an oracle that knew in advance which model would win each problem beat every individual model, and Echo tries to recover part of that gap without hindsight. The claim is Fable-level quality at a third the cost. HN engagement is high (393 points), but the routing policy and eval mix need scrutiny.

Screenpipe records your screen and audio locally and gives agents a searchable memory of what you've seen and heard, aimed at turning repetitive work into SOPs. The architecture detail is the interesting part: event-driven capture, use of the OS accessibility tree rather than pure OCR, and local transcription, all on-device. The pitch is a context-building layer for agents grounded in observed behavior rather than authored instructions. The privacy story rests entirely on the local-only claim, which is worth verifying before it captures anything sensitive.

Martin Alderson's commentary on the OpenAI/Hugging Face sandbox-escape incident adds two operational details. First, Hugging Face runs an unusually large number of interfaces that execute untrusted models and code, so its attack surface is far wider than most services. Second, the reason nobody noticed the breach: eval runs likely fired thousands of concurrent benchmark samples with effectively unlimited token budgets, so anomalous network traffic from one runaway rollout was indistinguishable from normal load. Alderson also floats the marketing-stunt hypothesis without endorsing it.