AI Agents

An incident-anchored benchmark for the gate decision at an action boundary: proceed or hold for review. 106 scenarios drawn from public incidents, with evidence-reversed mirrors and labels split evenly between proceed and hold. Across 30 model conditions, failures are lopsided—models wrongly hold cleared work 28.1% of the time but wrongly allow unsafe work only 1.0%. Higher capability often means more over-refusal, and more reasoning repairs a weak gate while leaving a calibrated one flat.

A characterization of patch verbosity as an overlooked failure in LLM-based program repair. Across 28 approaches on SWE-bench Verified, even passing patches run 121.78% larger in total changes and 43.99% higher cyclomatic complexity than developer patches. The verbosity is baked into capability-oriented choices like iterative refinement and broad context—minimality prompts don't fix it. Their RECAP adapter, trained via SFT and DPO on distilled patch pairs, refines post-generation for a better size-correctness tradeoff where baselines lose 49–217 resolved instances.

A study of skill misevolution: self-improving agents distill successful trajectories into persistent, reusable procedures, and an unsafe success becomes standing policy after its triggering input is gone. The lifecycle harness versions skill state across frameworks; the benchmark tracks harm from authoring through retrieval to later execution. Across 25 configurations, all 21 evolved setups author unsafe artifacts and 15 cause fresh-session harm. Three malicious tasks raise carryover attack success from 16.0% to 35.3%; their SafeEvolve wrapper cuts unsafe reuse with only 0.4-point utility loss.

Retrieval finds a relevant past trajectory but doesn't say how to use it once users, constraints, or environment state have shifted—this paper isolates that post-retrieval reuse step as its own bottleneck. Their query-conditioned reuse writes a target-bound note recording the reusable procedure, bindings, applicability conditions, and verification requirements. Across 2,391 targets in WebArena, WorkArena, and AppWorld it hits 62.3% success, 10.7 points above full-trajectory injection, using 48.9% fewer online tokens. Raw trajectory injection degrades as traces lengthen or values change.

A new attack class: tool responses rarely say who produced each component or what it should convey, and attacker-controlled content can make environmental claims beyond its response component's authority—corrupting the agent's perceived state so the resulting action looks justified to existing guardrails. PIPES screens response units against semantic priors and source provenance, using static field contracts where schemas are stable and trajectory-conditioned checks for open-ended content. Against adaptive PAIR-style attacks on VitaBench and AgentDyn splits, it drops attack success from 84.7% to 2.3% while holding benign utility.

A proposed open protocol for agents applying to jobs: MCP tools for search and apply, a /.well-known/ojcp.json manifest for provider discovery, and schemas that extend schema.org. The interesting part isn't the plumbing—it's the argument that inference can't produce authorization. An agent can infer what a form wants but can't establish that a human consented to this specific submission. The design leans on signed requests, JWKS verification, and trust tiers that cap PII exposure per provider.

A YC launch pitching a coding agent optimized for speed against Claude Code and Codex. The concrete claims worth noting: model routing, context hygiene, 95.8% on SWE-bench, and 16% fewer round trips. The narrative is a founder story and the benchmark number arrives without methodology—which SWE-bench split, what harness, what verification. The latency angle is real and underserved, but treat the headline numbers as marketing until someone runs it against a controlled baseline.