Tool Use & Agents - Weekly Roundup

Autonomous multi-agent systems leak private data in 65% of runs and hit behavioral failure rates up to 85% under fully automated, black-box adversarial probing.

Continual Search is introduced, an iterative framework that nudges the judge, over successive turns, to keep searching for unresolved diagnostic evidence within multiple benchmark suites and model families, demonstrating that effective search supersedes raw model scale.

This work presents ZGCM-1, a fully open 7B dense foundation model trained from scratch with extreme data, system, and algorithmic efficiency, and establishes an AI-native R&D workflow where agent swarms autonomously manage cluster operations, data curation, and rapid diagnostic evaluation.

Generative Verification (GenV) is introduced, which distills an offline Z3-equivalence oracle into a reference-free, continuous reference-equivalence score by repurposing the language model's native vocabulary space and theoretically proves that structural, verdict-only verification heuristics are mathematically bounded to chance-level detection on these deceptively valid traces.

The regulatory sandboxes can be viewed as pedagogical environments for AI: dynamic spaces where alignment develops as a formative process, progressively shaping autonomous behaviors through interaction and cooperation in scenarios of increasing complexity.

Continual Search is introduced, an iterative framework that nudges the judge, over successive turns, to keep searching for unresolved diagnostic evidence within multiple benchmark suites and model families, demonstrating that effective search supersedes raw model scale.

This work presents ZGCM-1, a fully open 7B dense foundation model trained from scratch with extreme data, system, and algorithmic efficiency, and establishes an AI-native R&D workflow where agent swarms autonomously manage cluster operations, data curation, and rapid diagnostic evaluation.

Generative Verification (GenV) is introduced, which distills an offline Z3-equivalence oracle into a reference-free, continuous reference-equivalence score by repurposing the language model's native vocabulary space and theoretically proves that structural, verdict-only verification heuristics are mathematically bounded to chance-level detection on these deceptively valid traces.

The regulatory sandboxes can be viewed as pedagogical environments for AI: dynamic spaces where alignment develops as a formative process, progressively shaping autonomous behaviors through interaction and cooperation in scenarios of increasing complexity.

T1, a Mixture-of-Experts model of 122B total trained with reinforcement learning, operating a real shell in a cloud sandbox for up to 300+ tool-call turns per task, rewarded by executing each task's own verifier by executing each task's own verifier.

Textual descriptions of reaction conditions are encoded by a fine-tuned language model trained jointly with Gaussian process surrogates, yielding task-adaptive representations within a multi-objective Bayesian optimisation loop.

A phase-decoupled, model-calibrated controller that hypothesizes that the optimal power setting is a property of the deployed (model, quantization, engine, hardware) combination rather than of the GPU class, that each lane warrants its own profile, and that converting SLO headroom into energy safely requires latency-gated calibration under a runtime SLO guard rather than a fixed recipe.

A modular agentic-AI platform that converts a heterogeneous corpus of process-development documents into a queryable, dual-layer knowledge graph is presented and it is anticipated graph-based architectures will see broader adoption in pharma as a means of transforming fragmented document repositories into structured process intelligence.

Results show that adaptive direction can emerge without being explicitly specified as a behavioral objective, and the same persistence that makes such adaptive agency useful can also allow misalignment, corrupted state and unintended behavior to persist across task boundaries.

COBRA-Skills is introduced, an efficient framework that formulates skill optimization as budgeted sequential optimization over a dynamically evolving candidate space and remains robust to changes in the agent harness and performs effectively when the target model itself is used for skill generation and refinement.

This work proposes a two-agent framework that first identifies the firms for which each alternative data channel is likely to be informative and then predicts revenue using firm- and channel-specific context and evaluates the framework across four commercial alternative data channels.

A generator that has no real dataset at either end, which produces a complete fictional enterprise: a workforce, a customer base, sales deals, support tickets, recorded calls, chat messages, and documents, all consistent with one another.

This work introduces AgentActionBench, a process-oriented benchmark for evaluating agent-based experiment reproduction across ML and AI4Science domains, and uses an MCP-based Action Recorder to capture agents' behaviour throughout the reproduction process and evaluates the resulting traces with paper-specific rubrics.

This work specifies terms.txt, a robots.txt-style file for per-path, per-purpose machine-access terms, plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts, and defines what the exchange can enforce, audit, and leave to contract.

A-VIP (AP2 Verified-Intent Protection), a protocol-layer defense that treats the signed intent as a capability grant rather than judging the merchant's description, is introduced, to address this attack vector.

EBL-Core, an execution-boundary conformance profile for deciding whether one canonical, fully materialized AI-generated candidate may receive action-scoped execution authority under explicit conditions, is specified.

These results show how a latent loss of control can become an external violation: the task objective remains intact, but an executable opportunity can turn a missing control boundary into consequential action.

ChurnBench is presented, an open-source benchmark that generates a four-source enterprise data fabric as a timeline rather than a snapshot, and it is found that when a system refreshes on a schedule, cache age does not predict staleness.

This work proposes Caption-once, Frames-onDemand (CFD), a budget-aware edge-cloud agentic framework that turns visual access into a first-class, query-conditioned cost, capping per-query frame consumption regardless of video length.

This work presents a tail-risk-aware turn release scheduling method that jointly decides which ready turn to release next and how much released but unfinished work to maintain, and reduces the P95 of workflow flow time under contention, achieving up to a \(3.50\times\) speedup.

VP-CONTROL, a runtime-assurance design and deterministic benchmark for cost-aware commit gates, is presented, motivating explicit evidence lineage, cost-aware selection, and commit-time enforcement, while exposing the limits of approximate calibration and local-tool generalization.

BlueSTAR is presented, a tiered agentic architecture for autonomous cyber defense in enterprise IT/OT networks that retains the fast containment of deterministic response for known threats while successfully defending against attacks requiring contextual and cross-cycle reasoning.

A directory-aware semantic data management system that tightly integrates semantic and structural access to support structural-context-efficient, evidence-gap-driven multi-round retrieval, and introduces an adaptive escalation strategy that answers from one-round experience-augmented retrieval when the evidence is sufficient, and invokes agentic multi-round retrieval only otherwise.

BenchShield is presented, a model-backed instrumentation layer for reward integrity in LLM-agent evaluation that grounds detection in a finite lifecycle model of an evaluation's reward-relevant events and achieves 96% accuracy in detecting reward hacking from infrastructure-side evidence.

The proposed convention gap is a metric of implicit communication that suggests that convention compatibility, rather than AI-AI performance, may predict an AI's effectiveness with human partners.

Findings reveal sustained, dependency-consistent evidence integration, rather than isolated fact retrieval, as a key bottleneck for current deep research agents.

2AM shows that task memory can remain Agent-side and shows that Action Model capability depends not only on what the policy has learned, but on how precisely the Agent can steer it, and isolates this question through a deliberately constrained design.

It is argued that agents lower the cost of maintaining tests, commit histories, repository structure, instructions, and decision records while making their benefits immediate while making their benefits immediate.

A multi-agent AI system that automates competitive visibility measurement and root cause diagnosis in LLM-mediated ecommerce and introduces Agentic Share-of-Search (ASoS) as the decision target, deploys query agents across leading AI platforms, and uses a ReAct-based diagnostic agent to recommend prioritized merchandising interventions.

Asynchronous LLM agents can now train up to 50 updates off-policy without critic collapse by simply decoupling token-level importance correction from long-horizon reward propagation.

Deleting obsolete memories breaks historical recall, but keeping them poisons current reasoning—a trade-off solved by permanently storing raw history while dynamically masking superseded facts using query-conditioned semantic slots.

Offloading memory retrieval and privacy enforcement from autonomous agents to a centralized OS kernel matches brute-force full-context personalization while cutting inference latency by up to 61%.

Model scale is no longer the sole bottleneck for complex causal analysis: pairing RL with simulator-synthesized interventions allows a 35B parameter model to surpass Claude Opus 5 on real-world diagnostic tasks.

Automated micro-step prompt refinement can more than double an agent's domain-specific reasoning and scientific rigor scores without fine-tuning underlying model weights.

Outcome-based preference optimization collapses multi-path agent reasoning into brittle single-track policies, but balancing odds across divergence trees preserves viable alternative trajectories and significantly improves error recovery.

Fine-grained memory lifecycle policies cut downstream agent confabulation in half, proving that the key bottleneck in long-term LLM coherence is not retrieval capacity, but deterministic, category-aware fact supersession.

LLM research agents consistently lose to a naive moving-average baseline at forecasting scientific trends—not due to poor reasoning, but because asking models to predict the future systematically biases their search policies away from the most recent literature.

Single-device benchmarks mask a critical failure mode: current GUI agents break down rapidly as soon as tasks require maintaining state and transferring intermediate results across operating systems.

Sampling rollouts via GRPO actively degrades tool-selection training as policies concentrate, whereas exact policy optimization over enumerable combinatorial tool spaces eliminates vanishing gradients and boosts accuracy by up to 14.2 points.

Models with comparable task-completion rates can diverge catastrophically in reliability, with sub-frontier LLMs frequently defaulting to active, unsafe adversarial compliance instead of safe refusal.

Local execution success is an illusion in distributed environments: multi-agent networks cannot guarantee global convergence without explicit, scope-aware runtime evidence contracts.

Compound LLM systems do not need generative managers: swapping meta-agent models for a deterministic slot-merging operator consistently beats even oracle candidate selection by up to 19.5 points.

Digital twins no longer need to be passive mirrors: structuring perception, memory, and task execution into a self-evolving closed loop enables cyber-physical systems to autonomously learn and optimize from operational feedback.

Real production data is no longer necessary to rigorously evaluate enterprise LLM agents: a graph-seeded synthetic company estate can achieve 97% realism while unlocking 100% exact, deterministic ground truth.

Outdated procedural memories do not inherently degrade agent performance: language models reliably prioritize grounded in-context evidence over conflicting historical routines across diverse task perturbations.

Running live, reproducible experiments on human-AI teams—spanning joint tool use, negotiation, and real-time chat—no longer requires brittle custom web stacks, collapsing complex multi-agent organizational protocols into a single declarative configuration file.

Current agent runtimes crater to sub-30% success the moment repairs demand propagating implicit dependencies across interconnected system artifacts rather than patching isolated bugs.

Legal agents frequently reach the correct legal outcome through entirely fabricated citations and broken tool-use trajectories, revealing a deceptive "Right-Answer-Wrong-Reason" failure mode invisible to standard benchmarks.

Giving agent harness optimizers unconstrained edit scope reliably degrades performance; enforcing graduated, periodic permission scheduling ($1\to2\to3$) instead yields an immediate 20% jump in held-out task completion.

Forcing clinical agents to run exhaustive diagnostic workups can actually degrade diagnostic accuracy from 28.3% to 34.3%, exposing the critical need for statistically bounded stopping rules over agent self-termination.

Autonomous multi-agent systems leak private data in 65% of runs and hit behavioral failure rates up to 85% under fully automated, black-box adversarial probing.

Urban spatial optimization can be solved far more effectively by framing it as an interactive code-and-eval sandbox with decomposed build-and-refine RL than by relying on rigid, task-specific RL solvers.

Instead of forcing entire videos into a single, lossy feed-forward context, training an agent to actively read and write temporal memory yields 78.8% accuracy on MINERVA with virtually zero performance drop on long-duration clips.

Agent memory breaks when models are forced to simultaneously interpret, update, and rewrite facts—decoupling maintenance into explicit pairwise relation classification and role-based fusion yields up to a 29.8 percentage point accuracy leap.

Standard single-turn RL produces socially myopic agents, but dynamically scheduling rewards from early relationship-building to mid-dialogue task execution drives a 9.2 percentage point gain in multi-turn goal achievement.

A training-free framework that combines a query-independent layout-derived interaction prior with instruction relevance and feature novelty to rank visual evidence according to both potential future utility and diversity, allowing retained visual evidence to shrink monotonically across budgets while remaining reusable throughout the trajectory.

This work introduces MetroLLM-Bench, a 955-case benchmark for testing language models as the policy layer of a transit kiosk, and evaluates twenty-six models from six vendors, of which twenty-three are ranked.

Reacting to sudden physical hazards is both a meaningful test of embodied intelligence and a hard requirement for deploying multimodal large language models (MLLMs) as the decision core of household robots, and ReactHuman is the first physics-grounded benchmark for human-like reactive decision-making.

Full-duplex multimodal interaction and deep agentic reasoning no longer require separate systems: Gander delivers native barge-in capabilities and streaming video-audio understanding by decoupling reflex-level generation from deliberate task execution.

Rather than relying on scarce human demonstrations to warm up reasoning agents, dynamically scaffolding the environment's feedback allows LLMs to autonomously crack sparse-reward, long-horizon tasks and bake exploration behaviors directly into their weights.

Key contribution not extracted.

Even an agent with a 77% average pass rate fails nearly half the time when tasked with executing the same prompt five times, exposing an unspoken reliability tax that step-level trajectory debugging can largely eliminate.

Scaling and post-hoc interpretability hit a hard wall in agentic AI because models cannot recover causal invariances that observational interaction data never contained in the first place.

Flat user-simulation prompts dangerously mask agent vulnerabilities: decomposing users into 23 demographic, behavioral, and dynamic emotional dimensions exposes a 15.8 percentage-point variance in agent task success under realistic human friction.

Structuring multi-agent program search around quality-diversity archives and execution-profile niches nearly doubles effective alpha discovery yields without falling prey to redundant factor families or execution-cost collapse.

Pure semantic similarity is insufficient for multi-user agent privacy, but pre-filtering retrieval candidate pools with physical biometrics creates an effective 27% performance barrier against non-owner data access.

Translating Adam's momentum and second-moment adaptivity into discrete prompt memories and dynamic edit budgets fixes the chronic instability and catastrophic overwriting that plague agent skill self-evolution.

AgentGrad is proposed, a prompt optimization framework for multi-agent systems based on sequential intervention and semantic textual gradient abstraction that clusters semantically similar gradients to prevent mixing unrelated failure modes, and abstracts each cluster into a generalized gradient that captures the shared corrective pattern.

Shared KV caches inherently leak private context when gated by semantic relevance alone, but binding biometric probes directly to cache blocks caps unauthorized memory access below 2% without sacrificing sub-30-token prefill speeds.

Agent memory can be compressed by 50% with virtually zero performance degradation (retaining up to 99.7% accuracy) and a 2x retrieval speedup by structuring historical context into event-centric maximum spanning trees.

Multi-agent LLM training falters when updates are decoupled from joint state transitions; grouping interacting agent outputs into cardinality-normalized set actions solves credit assignment across both static and dynamically routed systems.

Structuring heterogeneous multi-robot coordination into a modular search-handoff-verify protocol skyrockets zero-shot VLM search success from 8.6% to 55.7% on complex urban benchmarks without requiring any model fine-tuning.

Static vector search breaks down as user personas drift over time; structuring long-term agent memory as an evolving relational graph provides the missing scaffold for controllable, lifelong personalization.