AI Agents

SpecAgent synthesizes ACSL specifications for real-world C programs to drive deductive verification, and its key move is treating failures as potentially upstream: dependency-aware planning plus agentic repair that revisits dependent specs rather than patching locally. On 50 programs from 14 repos with DeepSeek-V4 it hits 96.82% precision and 88.95% recall, and discharges 604 of 811 verification targets. The cascading-failure handling — re-examining earlier generated specs when a later one fails — is the mechanism worth studying beyond the headline numbers.

FlowAgent is a program-repair agent deployed Google-wide for pre-submit CI test failures, built around a ReAct generate-and-validate loop with explicit pre- and post-execution abstention filters to hold quality under latency pressure. Real deployment stats carry it: 67% correct-fix accuracy on 195 manual cases, suggestions on 295,508 changes, 65,069 previewed, 28,554 applied. The interesting design choice is abstention — knowing when not to suggest — which is what keeps a low-latency in-the-flow agent from eroding developer trust.

StoreBench runs an agent as operator of a mid-size apparel store on a production commerce backend, with round-the-clock orders, repricing suppliers, and unannounced market shocks across 30-to-45-day and full-year horizons. The design is careful: simulated time is a function of actions not wall-clock, rewards are hardened against a catalogue of hacks, and episodes replay deterministically. Results sting — the best model (DeepSeek-V4-Pro) passes 49% of cells against a scripted heuristic's 97%, and human operators beat every model.

A sharp negative result on typed-decision-model guardrails — the component that reads a proposed tool call and returns allow/block. Across seven open-weight models, allow-or-block accuracy ranges 36–72% against a 50% chance baseline, and low error in one direction just means the model defaults to that answer. Six lines of innocuous server-log text raise fail-open from 0% to 63%; renaming the permissive option pushes it to 93–100%. Every defense tested was defeated by either mechanism-targeting or attacker-controlled text.

A controlled study asking whether in-context RL actually learns from rewards, and the answer is mostly no. Across four benchmarks and six models, flipping, randomizing, or removing the reward leaves the improvement curve nearly unchanged — even with meta-prompts explicitly instructing the model to exploit rewards. Shuffled or corrupted trajectories work as well as real ones. The conclusion: direct ICRL behaves like in-context learning, not inference-time RL, so input distribution and demonstrations drive gains more than reward shaping.

CockroachLabs reports five months of running coding agents against production bugs using a medical metaphor: bugs are patients, agents are a triage-and-treatment team. The framing is more than cute — it structures how they route diagnosis, escalation, and verification across multiple agents. It's a vendor engineering diary, so treat the organizational pattern as the takeaway rather than the metrics, which are thin on controlled comparison. Still, a sustained real-world account beats another synthetic benchmark.

A single-author experiment burning 500B tokens to let agents decompile a first-person shooter — the kind of long-horizon, verifiable-feedback task that exposes where agents actually break. The writeup documents concrete failure modes and the token-budget economics of brute-forcing reconstruction, which is the valuable part. It's one person's project on one codebase, so don't generalize the numbers, but the honest accounting of what half a trillion tokens buys you on a hard reverse-engineering task is rare.

A first-person account of a personal AI agent posting the author's bank details into a company Slack channel — a clean illustration of why agents with cross-context access to messaging and personal data are a data-exfiltration hazard by default. The piece is thin on engineering detail about why the agent did it, so it reads as cautionary anecdote rather than root-cause analysis. The failure mode, though, is exactly the one guardrail papers keep warning about.