AI Agents

This audit asks whether the images a model crops-and-zooms into actually cause its answer, or just decorate it. Framing visual tool-use as a causal graph and intervening at policy, trajectory, and step levels, the authors find two failure modes: Calling Without Looking (observations have no causal effect) and Looking Without Planning (informative observations, incoherent call schedule). Across six models and five perception benchmarks, aggregate accuracy gains concentrate in a calibrated minority — the rest is illusion at higher token cost.

Tool-calling agents read task state from accumulated history, and this paper shows how stale-but-plausible traces hijack decisions: on Qwen3-1.7B, polluted history flips 32.1% of previously-correct choices, often reusing corrupted entities. The fix distills an Oracle-conditioned teacher into a student that only sees polluted history via soft supervision on student-generated prefixes, reaching 87.0% balanced accuracy versus 66.3% for Gold-SFT. It scales — an 8B teacher lifts the 1.7B student to 91.9% — and transfers to clean histories and external benchmarks.

EnvACE trains long-horizon tool-use agents without external environments by having the policy rehearse both roles: it emits a tool call, then plays the environment to produce the induced response, conditioning subsequent decisions on that rehearsal. Both are optimized end-to-end on task-success rewards, so the agent internalizes environment dynamics into its parameters. Across BFCL-v4, tau²-Bench, VitaBench, and FinMCP-Bench it beats environment-scaling baselines, and test-time private rehearsal before committed execution adds further gains under a modest budget.

Autogrammar is an agent that learns context-free grammars for third-party DSLs from documentation and execution data, then feeds them to grammar-constrained decoding so models stop emitting syntactically invalid programs. It's formalized as a Kripke structure with LM-resolved nondeterministic choices, controllable via linear temporal logic constraints. Across CloudWatch Logs Insights, Dynatrace Query Language, and Datadog Search Syntax it hits near-perfect precision on unseen data, and temporal restrictions cut execution time 3.8x. Notably, execution data mattered; documentation was dispensable.

SWE-Touch stress-tests coding agents in shared workspaces where a user edits code mid-task. It mines task-critical regions from repair trajectories and injects validated Counter-Edits — plausible changes that conflict with completion — with contextual user messages. Across nine models on SWE-bench Verified, Counter-Edits drop average resolve rate 7.7 points, with degradation persisting on longer-horizon SWE-Bench Pro and DeepSWE. The failure is state awareness: agents retain conflicting code or overwrite it without re-inspecting the repo or validating with targeted tests.

A detailed teardown of vLLM's internals: how continuous batching, PagedAttention KV management, the scheduler, and the prefill/decode split actually fit together to sustain high throughput. This is architecture-level reading for anyone running or tuning LLM serving rather than treating it as a black box. Depth is the value here — it walks the request lifecycle through the system rather than reciting feature bullets. Useful whether you deploy vLLM directly or want a reference model for what a serving stack must handle.

Across 40,000 game runs where humans played the approval gate for AI agent commands, reviewers missed 1 in 3 threats — malicious or harmful commands approved anyway. The framing as a game makes the sample size feasible, and the headline number is the point: human-in-the-loop is not a reliable safety layer when the volume and plausibility of requests overwhelm attention. This is directly relevant to anyone designing approval flows and assuming a person will catch the bad one.