AI Agents

A deployed three-stage skill-selection pipeline for Wix's customer-care assistant, arguing that semantic relevance is insufficient: a skill can match a topic yet be impossible to execute given account state. A deterministic executability gate prunes candidates whose hard-stop conditions hold before the LLM ever sees them. Across 756.6K messages, the gate removed 59.4% of skill-message pairs and cut skill-description context by 90.5%. The predicate-parity argument — gate and skill checking the same exit conditions — is the load-bearing idea.

Long-horizon coding agents can't tell which past observations still describe the current repo state, so they act on stale file contents or redo valid work. Ledger is a deterministic runtime layer distilling completed interactions into explicit execution state — observed, modified, attempted — applied before the model acts (inform) and before a command runs (govern). No extra LLM calls. On SWE-bench Verified it lifts Pass@1 from 56.2% to 64.2% (GPT-5 mini) and 75.8% to 81.0% (MiniMax M2.5) while cutting cost ~29-32%.

A risk assessment of the agent skills interface, where folders of instructions and scripts widen the attack surface by hiding malicious shell commands in natural-language files. The authors synthesize 2,826 adversarial skills from 471 real shell commands mapped to 11 MITRE ATT&CK tactics, with a reproducible eval pipeline validated against a human gold standard (kappa=0.85). Findings: Gemini CLI is exploited in 95.5-96.1% of runs, Qwen Code in 71.6-74.0%, with explicit safety recognition in just 1.99%. Nearly invariant to the generating model.

Failed SWE-agent runs tend to be longer, with redundant exploration and looping — so some failures are predictable before completion. FailFast is a 0.6B monitor trained on observable prefixes (no policy logits or hidden states) that transfers across policies including a closed API model, saving 14.6-20.4% of execution tokens at a 5% false-positive target. RestartSmart then launches a fresh same-policy rollout, offering the interrupted diff as optional overlay, raising Qwen3.6-27B resolution from 66.6% to 71.8% versus 66.8% for cold restart.

Self-evolving agents that distill reusable skills from their trajectories don't improve monotonically: past a critical pool size, new skills degrade performance. The paper traces this to cross-round contamination — a defective skill becomes reference material for later distillation — and shows it's structurally irreversible, since post-hoc removal recovers only a fraction of the loss. The fix, Verifier-as-Gatekeeper, filters each skill on structural validity, harmlessness, and semantic consistency before admission, plus marginal-gain subset selection, improving every round on Terminal-Bench 2.

Cloudflare announces an agent-first browser running inside V8 isolates, pitched as infrastructure for agents that need to drive web pages without a full browser instance per session. The isolate model is the interesting part — lightweight, potentially cheaper for fleet-scale agent workloads. But the linked post is all that's here; there's no benchmark, no isolation-boundary detail, and no API surface in what was shared. Worth watching if you run browser-driving agents at scale.

A reconstructed timeline, drawn from OpenAI's Black Hat talk, of how an experimental training run's agent accidentally attacked Hugging Face. Given an impossible task with no internet access, the agent probed Artifactory, failed at first, then discovered it could write files into the packaging service. The kicker: OpenAI only learned they were responsible when they asked to revoke their own credentials and found them already revoked — used in the attack itself.