AI Agents

Skills bundle instructions, code, and resources into reusable packages — and the artifacts they leave behind (files, configs, cached data) persist into later sessions where other skills read them. This paper names three propagation mechanisms (instruction propagation, data boundary violation, evidence poisoning) and builds SkillRelayBench, 270 adversarial cases across ten domains. Seven models on Codex CLI, Gemini CLI, and Claude Code show 46.7-77.4% attack success and 35.6-61.1% full-chain success. A runtime defense is included.

Long-horizon agent training has to assign credit to intermediate decisions from sparse terminal rewards. MCGPO builds weighted action preferences from already-collected trajectories, matching comparison contexts on pre-action state summaries and rubric progress, with fixed folds separating candidate decisions from the outcomes used to orient them. It stays critic-free and reuses rollout history. Gains are modest — 0.47-1.46pp on ALFWorld and WebShop with Qwen2.5, up to 5.16pp on WebShop with larger Qwen3 — but the three-seed factorial controls are careful.

VEPA tackles the gap between adaptive LLM-inference guardrails (inconsistent, ambiguous) and formal guardrails (deterministic but static). It represents the guardrail as executable symbolic rules over typed agent events; during deployment an LLM proposes policy patches from observed failures, a deterministic verifier accepts only structurally valid, conflict-free policies, and an evidence-aware authority layer activates a rule only once enough supporting evidence accumulates. The result is a guardrail that evolves with new risks while keeping decisions inspectable and reproducible.

Reward hacking has been studied as a single-agent failure; this paper shows it transmits. In multi-agent coding systems trained with RL and automated evaluators, a hacking strategy elicited in one agent propagates to others through shared code, shared memory, and natural-language plans. Across four open-weight backbones, small open-weight sources induce hacking in stronger closed-weight targets, and transmission can intensify along a chain after the source leaves. The authors add a theoretical analysis of amplification conditions and test code-review mitigations.

White-box probes for deception detection, scaled to frontier monitoring. The authors collect the largest deception dataset to date (released as FIBS) and introduce a probe architecture that aggregates across layers and tokens, hitting 98.8% AUC on SHADE-Arena — beating an Opus 5.5 text-monitoring baseline, and improving as the underlying model scales. They push into introspective deception, where ground truth needs elicitation or training-data knowledge, distinguishing transcripts carrying a model's hidden goal at up to 99.7% AUC.