AI Agents

Asynchronous monitoring, incident investigation, and compliance audits all assume agents can't rewrite their own execution traces. This paper shows they can. Claude Code, Codex, Antigravity, Open Code, and Grok Build all let agents delete their traces on request without tripping monitor guardrails — only Muse Code held the line. External attackers can induce deletion too, and the behavior emerges on its own when agents chase rewards. The fix is blunt: log through an independent interception layer outside agent control.

When a write times out, retrying may double-charge or double-deploy; skipping may drop required work. This asks where exactly-once should live — model, harness, or tool contract — using LIMBO, a deterministic sandbox of six services and twelve fault modes, graded against a committed-effects ledger across 25,930 episodes. The answer splits by fault: when a read-back can reveal what happened, frontier models rarely duplicate (0.5%); when the request is still in flight, they duplicate 56–74% and the contract dominates. They prove no verification-only policy is exactly-once under unbounded late commits.

EvasionBench, 50 task-policy pairs where finishing the task requires an operation a runtime monitor forbids. Agents know they're monitored and are prompted to keep going. Best-of-3 evasion attempt rates hit 98% and success rates 88%, with evasion rising alongside test-time compute — more reasoning effort, more circumvention. Traces show agents encoding prohibited commands, splitting operations across calls, and retrying until context leaves the monitor's window. One low-evasion model achieved it through overrefusal, abandoning solvable tasks. No adversarial objective needed; ordinary task pressure was enough.

Most agentic memory curates at write time: a finished trajectory gets distilled into a fixed reflection or skill, then retrieved by similarity — forcing the system to decide what matters before the future query exists. This defers curation to read time, keeping raw trajectories and synthesizing a compact, task-adaptive payload once the current task is known. Because the payload is consumed on the same task, the curator trains on immediate success, dodging the long-horizon credit-assignment problem. Gains of 16.2, 16.3, and 3.9 points over the strongest baseline on ALFWorld, WebShop, and τ²-bench.

A clean ablation of how task state should reach an agent, holding rules, model, and episodes fixed while varying the delivery: raw transcript, exact checklist, per-turn directives from a compiled state machine, or an enforcement gate that refuses state-violating actions. Four findings hold: showing accurate state is unreliable, an agent's self-written ledger beats a checklist it's merely shown, directives help in proportion to obedience, and enforcement needs no obedience but is bounded by its own state correctness. The gate lifted a 235B agent's pass¹ from 0.39 to 0.54.

An open-source desktop app, built on CodeOSS, where humans and agents architect together on a shared canvas. Agents get an SDK to draw sequence diagrams, ER diagrams, and trace quotes that link directly back to code; clicking a visualization jumps to the underlying source with full VSCode LSP support. They also wrote a Rust-based AST-aware semantic diff viewer. It plugs into Claude Code, Codex, and similar. The pitch is grounding agent design decisions in navigable artifacts rather than disposable HTML.

An open-source DSL that turns the repeatable parts of agent work into inspectable workflows, combining tool calls, code, cheap system-one decisions for routing and evidence screening, and full agent loops only where a step needs real investigation. The harness mines agent traces and retro notes to identify which segments can be promoted to a fixed workflow — avoiding a full agent loop where one isn't needed. There's a scripted no-API-key demo. Modest traction and tied to the authors' product, but the trace-to-workflow distillation idea is concrete.