AI Agents

This studies the coding-agent config layer as a real dependency surface: 3,171 repos of instruction files, skills, hooks, MCP declarations, and subagents installed with developer privileges, no lockfile, no install-time check. Findings are validated three ways before counting. 9.8% of setups install an MCP server with no version pinned, 3.1% pre-approve arbitrary execution behind scoped-looking grants like Bash(python:*), and 3.8% ship a skill that pre-approves the shell for anyone who installs it — 16% carry a confirmed security defect. Rigorous methodology, uncomfortable numbers.

MMPIBench delivers prompt-injection attacks through six visual carriers — OCR text, overlays, EXIF, QR codes, fake interfaces, hybrids — and traces each injected instruction from perception through planning to tool call. Across 720 runs, attacks are attempted in 12.8% of cases but complete in only ~1%, with the gap closed almost entirely at planning. The model, not the framework, decides whether injection lands. Audio is the weak channel: where it's delivered, completion hits 49%, and 75% for one model.

This asks whether an agent's internal representations predict eventual task success better than surface signals. Two methods: Latent Trajectory Dynamics summarizes residual-stream changes across a trajectory, and the Action Representation Probe predicts success from representations at action-decision points. Across Bash, SQL, and Python benchmarks and three model families (Qwen14B/7B, DeepSeek6.7B), both beat generation- and sequence-based calibration baselines with no prompt changes or multi-sample rollouts — a zero-overhead reliability monitor. Open-weight models only, since it needs residual-stream access.

JarvisGUI benchmarks GUI agents on workflows that span Android, Windows, and Ubuntu, formulating tasks as typed input-output transformations so multi-step cross-device workflows compose automatically. The type system is the clever bit — it lets the benchmark generate and score coordinated tasks dynamically rather than scripting each one. State-of-the-art open-source agents struggle with state-transfer awareness, cross-platform reasoning, and long-horizon dependencies, a gap single-device benchmarks hide entirely. A good corrective to over-optimistic GUI-agent readiness claims.

TRACE tackles diagnostic reasoning where ground truth is expensive by engineering verifiability: sample an intervention, inject it into a simulator, generate the observations, and use the hidden intervention as an oracle reward while the agent investigates noisy, confounded evidence. In a digital-advertising environment with 12 root causes, RL with synthesized rewards lifts Qwen3.5-35B from 0.159 to 0.757 FullAttr@1 — past Claude Opus 5's 0.686 and a larger prompted Qwen — while using fewer tool calls. The simulator-as-oracle trick generalizes to any domain you can simulate.

Geiger inventories the AI agents running on a machine and shows what each one can touch — files, network, credentials. The premise is the right one: most teams have no idea how many agent processes are live or what scope they hold. Early Show HN (45 points), so treat the maturity accordingly, but the category — a permissions map for local agents — is exactly what's missing as coding agents and background workers multiply.

OtoDock is a self-hosted multi-tenant 'company OS' where each agent runs Claude Code or Codex CLI as a persistent process in a bubblewrap kernel sandbox with always-on network isolation via pasta, backed by its own workspace, memory, and schedules. Agents can also run identically on remote machines over a single outbound WebSocket — no inbound ports. The isolation model is the interesting part; the built-in Twilio/office-file features read more as demo surface than the reason to look.

Raschka walks through recurrent-depth architectures and looped transformer blocks — models that iterate the same layers to reason before emitting tokens, keeping the chain of thought in latent space rather than text. It's a clear survey of where hidden-reasoning research sits, tied to the GPT-6 Astra rumor. Useful if you care about where inference compute is heading, though it's architecture pedagogy, not anything you'll wire into an agent loop this quarter.