AI Agents

Magnet targets a threat model most abuse detection ignores: an attacker decomposes a harmful goal into innocuous units, running each in an isolated agentic session. The agent is stateless between conversations but the attacker is not, so per-conversation monitors see nothing suspicious. Magnet aggregates "capabilities" — artifacts produced by responses and tool results — at a higher-level correlator like user ID rather than per session, then reasons over the accumulated evidence bundle. A clean articulation of a real gap in multi-agent monitoring.

STAIR converts historical repair trajectories into multi-level trees — from fine-grained diagnostic actions up to high-level strategies — then selects and adapts relevant nodes into issue-specific plans injected via prompt. On SWE-bench Verified it hits 81.2% Pass@1 with MiniMax M2.5 and 79.2% with GPT-5, and the plans transfer: a structurally different agent (mini-SWE-agent v2) jumps 75.8% to 81.0% with no code change. Ablations show mixed abstraction levels beat any single one, and raw unabstracted trajectories transfer much worse.

This study challenges the now-standard practice of delegating code search to an isolated subagent to protect the main context from rot. On SWE-QA, plain semantic search over a prebuilt vector index answered 65.2% of repository questions correctly versus 46.2% for deep agentic search, at under half the cost. The failure taxonomy is the useful part: 41.8% of subagent failures occurred silently at the planner/subagent handoff, ending in confident wrong answers. A pointed negative result against a widely-adopted pattern.

Instead of judging every step with a second LLM, this work detects mid-episode failures from step telemetry alone using microsecond-cost monitors trained only on healthy runs. A one-class echo-state-network ensemble with CUSUM alarms catches 71% of failures at a 5% false-alarm budget across 2,823 episodes, three frameworks, and four models. Honestly, monitors don't transfer cold (AUROC 0.527). The stronger layer is deterministic verification — recomputing stated totals from actual tool results — catching 60% of failures at zero false positives in 63 runs.

Fetch-then-Explore separates page selection from evidence extraction for search agents. Rather than committing a reading at fetch time (visit-and-read) or holding one page and releasing it on the next open (stateful browsing), it records selected pages to a per-question filesystem workspace and pulls evidence on demand later — repeatedly, as the hypothesis sharpens. Selection becomes cheap, evidence accumulates across the trajectory. In a unified ReAct harness with fixed search, it leads BrowseComp accuracy at every one of three backbones on BrowseComp and WideSearch.

JFrog examines a batch of SQLite CVEs and argues they are LLM-generated slop — plausible-sounding vulnerability reports with no real bug behind them. The failure mode matters for anyone routing agent output into security triage: fluent, well-formatted reports that pass surface review while wasting maintainer time. The HN thread (713 points) suggests the pattern is widespread. No artifact or reproduction in the linked text, so treat the specifics as one vendor's read.

Armature (YC P26) wraps your MCP server in three lines of SDK code (TypeScript, Python, Go) and reconstructs the full agent session behind incoming tool calls — the user's original ask, the agent's reasoning, and where things went wrong. It clusters sessions into a use-case ranking and surfaces the most frequent agent failures against your tools. Useful if you publish an MCP and currently fly blind on how agents actually consume it. Pitch-stage; no pricing or retention details in the post.