AI Agents

The Dual-LLM pattern claims formal injection safety by fixing execution plans before touching untrusted data. This paper shows the guarantee breaks for computer-use agents, because GUI plans must branch on anticipated runtime content. That opens branch steering: an adversary crafts page content to coerce the agent down a hazardous but pre-approved path with no explicit instruction. STEER-Bench (101 tasks, 9 domains) shows 94.4% success against standard CUAs, 89.5% against vanilla Dual-LLM. COBRA pairs trusted branching plans with ahead-of-time capability constraints, dropping success to 0% at 97% utility.

Action speculation drafts an agent's next action for the target model to verify, mirroring speculative decoding. Prior work used large off-the-shelf drafters (accurate but slow) or small ones (fast but rarely agreeing). This paper builds a latency framework weighing a round's gain — drafter accuracy times remaining steps — against drafting, verification, and tool-execution cost. LEAP keeps the drafter at 0.6B but trains it on the target's action sequences, so it agrees often, yielding up to 60% end-to-end wall-clock speedup with no systematic change in task success.

Teams pick prompt-injection detectors by their public benchmark scores. This work shows those scores don't predict in-agent behavior. By replaying ground-truth tool calls from AgentDojo and tau-bench without an LLM, then labeling injected outputs by differential replay, it evaluates fifteen detectors plus Prompt Guard 2. Rankings barely transfer: BIPIA's best catches 2% of AgentDojo injections at 1% FPR; a 72%-on-AgentDojo detector catches 15% on tau-bench. False-positive rates do transfer. The detector that generalized shared no data with any benchmark and trained on agent-style inputs.

Harness evolution tunes an agent's prompts, tools, and workflow while the optimizer itself stays fixed. VERSE lets the optimizer also improve how it diagnoses failures and tests edits — replaying failures, perturbing suspected steps, tracking fixes and regressions across rounds, with both models' weights frozen. A controlled study shows self-evolution does nothing without execution-based verification but tops the study when it has it. On held-out SWE-rebench and five-language OOD tasks, VERSE's best harness reaches 42.3% and 37.7%, versus 39.2% and 29.3% for the strongest baselines.

Context Language Models treat the context window as a file the model edits freely, moving context management from the harness into learned model behavior. Built zero-shot on existing models, CLMs beat SOTA context strategies: 11.4% higher accuracy at 21.5% fewer FLOPs on BrowseComp-Plus, 5% higher at 59% fewer FLOPs on 12-hour EdgeBench. They support both in-context and parametric learning of management strategies — natural-language steering adds up to 35.9 points, online RL improves Qwen3.5-9B by 47.6%, and co-designed Suffix Cache Reuse cuts server compute 35% versus SGLang.