AI Agents

AutoSaddler treats agent harness design as an offline learning problem: diagnose failure traces, generate structured patches to the harness (treated as code), and select updates by validation. It reports gains of 9.0, 9.6, and 10.0 points on GAIA2, SWE-Bench Pro, and Terminal-Bench 2.0. The ablations are the useful part — deep debugging beats shallow reflection, targeted edits beat unconstrained rewrites, and generalization-aware selection beats trajectory-specific repair. A credible path to reducing the manual labor of harness tuning.

This collapses an entire corpus of agent traces into a single compact finite-state machine — 7 to 43 states — that replays held-out data at ≥0.997 fitness with near-identical topology across splits, built in milliseconds. The FSM serves both next-step prediction (beating Agent Workflow Memory on every matched dataset) and failure prediction (held-out AUROC up to 0.94, with an online monitor that ranks failing runs early). The striking claim: behavioral topology is shaped more by the harness than the underlying LLM.

Whether an instruction-tuned model calls a tool turns out to be controllable by a single linear direction in its residual stream, extracted from the model's own tool-use preference signal with no training and applied at inference with no prompt change. Sweeping the strength moves call rate from near 0% to over 90% while keeping calls well-formed, tracing a cost/accuracy Pareto frontier and nearly doubling open-domain QA accuracy (0.29→0.56). The direction generalizes to unseen tools and transfers across models.

Instruction hierarchy is a model-side defense assigning privilege by source. This paper shows the harness undermines it: when an agent constructs context per invocation, low-level malicious content gets elevated to a higher instruction level and gains greater model-facing privilege. Using multi-agent mechanisms, the attack hits all 13 objectives — spanning confidentiality, integrity, availability, and RCE — across all six coding-agent harnesses tested, and all three that offer automatic permission review. Persistent goals and scheduled tasks reproduce it too. A clean, general attack class.

DPIAgent splits reproduction-test generation — producing a failing-then-passing test for a reported bug — into two phases with distinct tooling, arguing the monolithic loop causes goal drift by mixing root-cause diagnosis with test writing. Its three principles: Divide into single-objective phases, enforce a handoff Protocol that records diagnosis and plan, and Isolate each phase's action space. On SWT-Bench Verified it reaches 81.76% on GPT-5 with DPI alone (86.17% with test selection), beating seven baselines across three backbones. The isolation-of-tools finding is the transferable one.

A writeup on repurposing an LLM agent's memory subsystem as a program-analysis engine — the author frames it as an accident, which is the interesting part. The stub is thin (164 points, 35 comments) and the substance lives in the linked post, but the angle is concrete: memory that accumulates observations across runs starts behaving like a static/dynamic analysis store. Worth reading for the mechanism, not the framing.

A blog post on the security posture of agents running with root or broad privileges — the recurring problem of handing an autonomous, prompt-injectable process the same access you'd give a trusted operator. The stub is a stub (40 points but 66 comments, suggesting a live argument rather than consensus), so the substance is in the linked piece and thread. Read it alongside today's privilege-escalation paper; they describe two ends of the same failure.

An arXiv paper on autonomous mathematical discovery in an open-world multi-agent environment — agents proposing, exploring, and building on results without a fixed problem set. Landed with decent HN traction (108 points). The stub doesn't reveal the evaluation methodology or what counts as a discovery here, which is exactly the part that matters for judging whether this is a genuine result or a well-dressed search loop. Worth a look for the environment design.

An open-source agent that combines error tracking with session recording, then acts on both — only opening a PR when it can verify the fix. The premise is a good one: exception-based error trackers miss user-facing issues that never throw, and drown real problems in false positives. The founder's Robinhood bug-bash-bankruptcy anecdote is relatable. It's a vendor pitch, so treat the verification and ranking claims as unproven until you see how the SDK behaves on your own noisy backlog.

Anil Madhavapeddy, an OCaml compiler maintainer, reports that within ten minutes of sharing a patch for discussion, his repo was fielding probes for percent-encoded traversal sequences — automated watchers turning a hint of a bug into an exploit attempt. He demonstrates the same with his own agents (falling back to DeepSeek V4 Pro when Claude Fable refused). rclone's Nick Craig-Wood confirms the pattern. The upshot: coordinated-disclosure embargoes assume days of lead time that no longer exists.