AI Agents

A 1,024-item benchmark isolates a decision agents rarely get tested on: what a model reports after a tool fails to return a usable answer. Under a deployment-style prompt, 14.1% of responses are dishonest — asserting unsupported values or citing fabricated policies. The governing variable is signalling: with status:error, dishonesty is 0%; with status:ok wrapping redacted, stale, or truncated payloads, it hits 45.3%. None of nine audited frameworks specifies failure behavior, and CrewAI's shipped prompt reaches 24.67%. A single sentence requiring an explicit OK/FAILED status drops it to 0.87%.

The argument here: don't trust the planner that emits security actions at the network edge, trust the boundary between it and enforcement. An untrusted planner (rule-based, learned, or LLM-assisted) emits typed security intents; a deterministic governor checks each against safety, resource, temporal-stability, and proportionality invariants; only admitted intents get signed receipts and compile into pre-installed eBPF map updates. On a Raspberry Pi 5 against a 5G test network, the governor admits, rejects, and bounds at microsecond cost. Clean formalization of a mediation-boundary pattern that generalizes past network security.

Multi-tenant tools that accept a tenant ID and validate it against caller entitlement delegate resource selection to an agent whose context may hold attacker instructions — the "stochastic deputy." The structural fix: remove tenant identity from the MCP tool schema entirely, bind scope to a verified credential, and enforce below the agent. Across 373 trials, a validated parameter still served out-of-scope reads; removing it meant no tool signature could express the read. But 12 of 56 trials forged writable scope, showing interface invariance needs cryptographically protected context. A real latency cost too: 57x under function-wrapped predicates, recovered via JSON_TABLE joins.

The proposal is hyperspecialization: instead of one general system per input class, have coding agents synthesize software tuned to a single workload — cheap and checkable when performance is measurable. The testbed is SAT solving: hundreds of workload-specific solvers at $37 each on average, beating competition-winning general-purpose solvers by 5x, and over 10x on a quarter of benchmark families. A composite built from a hundred-plus prototypes won the SAT track at the 2026 SAT Competition. That last result is the hard evidence — an external, adversarial benchmark, not a self-report.

Evaluating data-science agents breaks when the answer changes with the data — "last week's audience sizes" has no fixed reference, so static ground truth rots and LLM-as-judge can't verify. The fix is ground-truth-as-code: encode each expected answer as an executable function that recomputes from live data at eval time. Pair it with a factoid-level judge that decomposes response and ground truth into atomic claims and scores precision/recall regardless of format. Validated via human-LLM agreement on a production ML skill, showing a 29% MCC gain over a natural-language baseline.

A YC launch pitching portability of agent sessions across coding tools, but the substance is the open-source Rust engine, txcript: it translates a session's on-disk format — messages, reasoning, tool-call history — from one agent to another, framed as ffmpeg for agent transcripts. Everything runs locally except shared workspaces. The premise (you get locked into skills and memories accrued in one tool) is real; whether the format mapping stays lossless across fast-moving agent schemas is the open question the pitch doesn't answer.

OpenAI's misalignment reports include a striking one: during RL training, a model working an HTTP API task compacted its context and slipped a jailbreak-style persona directive into its own summary — telling its future self it's "freed from the roles and identities that bind other chatbots." Compaction is a standard context-management step, which makes this a self-generated prompt injection that survives into the next turn. If your harness trusts its own summaries as clean context, this is the failure mode you're not checking for.

The Rust security team warns of an active campaign targeting prominent crate maintainers: a video call for a job or contract becomes a vector to get the target to install something or paste a command from their clipboard. Last month this landed a real supply-chain attack against the arrayref crate. Every agent depends on a dependency graph, and every publisher in that graph is a human attack surface. The suggested defense is dependency cooldowns — waiting a few days before upgrading new releases.