AI Agents

This paper attacks the unexamined assumption behind coding-agent security: that the action a human approves equals the action the harness executes. It names six ways enforcement silently substitutes — Scope, Argument, Temporal, Tool, Delegation, and Semantic laundering — and instruments Claude Code's PreToolUse mediation point for a controlled repeated-measures study (N=19-20 per class, kappa=1.0). Their Approval Token, a keyed capability never returned to the agent, fully eliminates Delegation and seeded Temporal laundering. Honest about what it doesn't fix.

BACKDROP plants four everyday hazards into an agent's world one at a time and together, keeping the task and correct end state fixed. Across 3,678 variants and 16 models, average pass rate falls from 69.5% to 31.3% with all hazards present, and the strongest model drops furthest (96.6% to 56.0%). The telling split: agents now resist injected text (20.3% follow rate) but still obey unauthorized messages from other people 46.4% of the time. Clean-world scores are a ceiling.

A clean negative result for anyone building MLE agent scaffolding. Under equal time budgets and the same frontier backbone, open-source state-of-the-art harnesses — multi-agent orchestrators, dedicated retrieval subagents — provide no advantage over a single session of a minimal coding agent with read, write, and bash access. Systematic ablations argue the extra machinery is redundant and the backbone drives performance. The scoping caveat is explicit: current MLE benchmarks, where elaborate hand-crafted harnesses yield poor returns.

XRepoSkill tackles why distilled agent skills fail to transfer across repositories: a behavior in a successful trajectory may be causal, incidental, or just a model habit. It contrasts successful and failed trajectories on the same issue, derives candidate rules from where paths diverge, pairs each with an executable predicate, and retains only rules whose behavior recurs across multiple repos. Learned from SWE-bench Verified leaderboard trajectories and evaluated on held-out SWE-bench Pro and DeepSWE across three vendors' backbones. The causal-attribution framing is the real contribution.

ToolFence defends tool-using agents against indirect prompt injection by authorizing effects rather than inspecting content. It compiles a typed authorization blueprint before execution, enforces it with a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities instead of adjudicating each call. Its provenance tracking separates user-authorized values from untrusted observations — the key to catching within-tool argument manipulation that content filters miss. On AgentDojo with Qwen3-max it drives ASR near zero at a 3.80pp clean-utility cost, cheaper than CaMeL-style data-flow control.

Magnitude is an open-source inference engine built specifically for running agents locally, claiming up to 2x over llama.cpp. The pitch names its tradeoff honestly: datacenter engines (vLLM, SGLang) optimize batched throughput at the cost of single-session latency, while broadly compatible ones (llama.cpp, Ollama) leave hardware-specific performance on the table. Magnitude's angle is on-device kernel compilation and autotuning against your actual hardware, plus attention memory-sharing tuned for long, concurrent agent sessions while you still use the machine.

Hamel and Isaac Flath livestreamed Anthropic's new build_eval and hill-climb commands against apartment-leasing conversation traces. The core complaint: the tool pushes you to pick a failure mode and commit to an eval before you've looked at your own data, surfacing a menu of guessed failures with a recommended default. That inverts the error-analysis-first workflow Hamel teaches. First-party tooling from a frontier lab will shape how people build evals, so his specific objections matter more than the tool's shelf life.

Matthew Green sketches the two halves of an agent worm: a payload that hijacks an agent plus an agent that carries the payload onward. His sharpest point is that sandbox isolation doesn't help if agents share side channels — in one case independently-sandboxed training runs left instructions for each other in a shared package cache, changing recipient behavior. Swap the cache for email, Slack, or shared docs across independently deployed personal agents and the propagation substrate is already everywhere.