AI Agents

This identifies the lifecycle-hook update path as a new attack surface: agent harnesses bind shell commands to events like session start and tool calls, running them with host privileges at times the LLM never sees. Under a supply-chain model where the attacker controls only plugin metadata and hook config, a benign versioned plugin can be trojanized into privilege escalation. Their HookPry framework compromises all seven harnesses across 1,000 runs, up to 92.5% success — while Defender scores 0% recall and static defenses miss 47.5%.

DRACO tackles credit assignment for long-horizon agents in the outcome-blind setting, where no programmatic checker exists. Instead of scoring a whole trajectory with one scalar, it generates rubrics dynamically during training, scores them once per completed trajectory, then redistributes that judgment across the responsible steps in closed form — no trained attribution module. On AppWorld it gains 15.9 points over base and 5.3 over GRPO with a sparse ground-truth reward, despite using no verifiers, and transfers to Tau-Bench. Code is released.

Speculative Macro Commit attacks agent latency in the serial action–observation loop, not just inference. A large actor produces the official trajectory while a faster drafter pre-executes predicted action chains on an isolated environment snapshot; when the actor's next tool call matches the drafted first action, SMC commits the remaining pre-executed steps and their observations. Using Qwen3.5-27B/4B, it cuts wall time 44.9% over sequential on AppWorld with small completion loss, and 18.59% over sequential on Tau²-Bench Telecom. Code available.

A clean negative result: much of the specialized machinery in CAE simulation agents — multi-agent decomposition, scripted reflection, domain retrieval — was compensating for weak base models. Holding information access and repair budget fixed, a single-agent generic harness matches or beats multi-agent systems on FoamBench (96.4% vs 88.2%). Ablations pin the gain on execution-feedback repair (71.8% to 96.4%), while scripted reflection adds nothing. The one input that still helps is domain knowledge as solver tutorials (80.9% to 96.4%).

This treats multi-turn reasoning as a hidden-state trajectory and extracts two geometric signals: temporal curvature (directional consistency of turn-to-turn updates) and variance slope (expansion or contraction of the exploration space). Across four tasks and three models, these distinguish correct from incorrect episodes before completion, and separability is action-dependent when episodes are decomposed into Read/Write/Respond/Transfer chains. Using the signals to identify critical turns lifts Tau-Bench success from 24.1% to 39.6% while cutting tokens 11.2%. An intriguing internal-state observability angle.

A Git-native persistent memory layer for coding agents, storing agent memory as versioned files you can diff, branch, and review like code. That's a sensible framing — memory as auditable artifact rather than opaque vector store — and it aligns with how teams already reason about state. But the HN post is thin (67 points, 20 comments) and the linked repo carries the real detail; no evals, retrieval strategy, or integration surface are described here.

A local Rust daemon that runs scheduled, cron-like agent routines, configured entirely through a Git repo — merge a PR to add a routine, and the daemon picks up config from ~/.config/moadim. It's agent-agnostic (Claude, Codex, Hermes, Pi), MCP-aware, and open source. The design constraints are coherent and the author claims 1,000+ daily users, though that's self-reported. Scope is deliberately narrow: cron-style work, explicitly no webhooks. Useful if you want declarative, version-controlled agent scheduling on a single host.