The paper introduces RIPPLE, a method for adapting workflow-synthesizing agents through prompt-policy editing without retraining the underlying model. RIPPLE diagnoses failed execution trajectories, maps failures to specific policy segments, and restricts edits to those segments. It then evaluates candidate edits in isolation and replays only those that remain safe after composition, achieving up to a 23.1% improvement in validation success on a synthetic benchmark and positive gains on additional language‑model backbones.
By Manqing Mao, Hong Wang, Samson Koelle, Jie Yuan, Zhuoer Wang, James Feng, Yanjun Lin, Daniel Edmiston, Nikki Lijing Kuang, Zhecheng Sheng, Wei Niu
arXiv:2606. 02965v2 Announce Type: replace Abstract: As large language models gain tool access and are deployed as autonomous agents capable of editing records, executing transactions, and modifying infrastructure, we still evaluate them based on the sole metric of task completion.
By Victor Ojewale, Suresh Venkatasubramanian
arXiv:2607. 10487v1 Announce Type: cross Abstract: LLM agents can commit durable effects from authority evidence that was valid earlier in execution: a DOM snapshot, approval epoch, version witness, branch token, or worker result.
By Igor Santos-Grueiro
arXiv:2609.08015v1 Announce Type: new
Abstract: Long-running AI agents may read state, reason, wait for tools or human approval, and perform an external action much later. The state that justified th...
By Yongjian Lyu, Yang Ren, Ruofei Lai, Wenting Liu
arXiv:2608. 16381v1 Announce Type: new Abstract: Agentic systems often organize execution and state around a single conversation, model invocation, or agent instance, even when real work spans many calls and stages.
By Zhenhang Nie (iFLYTEK Co., Ltd., Hefei, China), Gui Zheng (iFLYTEK Co., Ltd., Hefei, China), Xudong Sun (iFLYTEK Co., Ltd., Hefei, China), Tailong Zhu (iFLYTEK Co., Ltd., Hefei, China), Bin Zhang (iFLYTEK Co., Ltd., Hefei, China)
The paper introduces “Revise”, a runtime system that performs validity-guided, fine-grained recovery for online revisions in structured agent workflows. When a revision arrives, Revise intersects the change with recorded data and control dependencies, propagates the impact through the partially executed DAG, stops invalid work, preserves unaffected progress, and recomputes only the affected region. Experiments on real coding‑agent traces and LangGraph/LLMCompiler applications show that Revise matches a latest‑version oracle, reduces model calls by up to 56%, and improves service‑level objective goodput under load.
By Ruoling Qi, Xuaner Wu, Penghang Liu, Jian Chen, Yirui Liu
The paper introduces BSC‑R, a deterministic effect‑boundary mechanism that ties a single‑use commit authorization to the specific action and the semantic state that justified it, aiming to close the proposal‑to‑commit gap in tool‑using language‑model agents. Experiments on 2,847 AgentDojo episodes and 10,302 frozen proposals show that BSC‑R preserves the agent’s original behavior while rejecting unauthorized changes, and further tests on a boundary‑drift experiment and the CONTINUITY suite demonstrate high success rates in valid contexts and robust handling of replay and ambiguous cases. However, broader testing reveals that BSC‑R still allows a 25% invalid‑effect commit rate in a larger attack set, indicating that it provides scoped, not universal, safety.
By Wesley Shu
The paper investigates how AI agents that run long workflows using external tools can experience inconsistencies when retries, speculative execution, concurrency, or partial failures occur. It introduces an effect‑history model that distinguishes between actual external events and the agent’s observations, and catalogs eight common external‑effect anomalies. The authors analyze the standard Model Context Protocol tool interface, finding that its annotations are too coarse to fully express the necessary capabilities to prevent these anomalies, thereby motivating the need for reusable transactional contracts at the agent‑tool boundary.
By Artem Trofimov, Boris Novikov
The paper introduces Aegis, a runtime governance system for agentic AI that treats model outputs as action proposals and mediates them through a trusted decision layer before tool execution. Aegis evaluates proposals against active policy, resolves provenance server‑side, fails closed under uncertainty, and routes selected cases through a Senate‑style settlement process. In a sandbox evaluation across 6,300 rows, Aegis prevented all governed mock‑tool applications and risky side‑effect completions, preserving provenance and quorum evidence for all settled cases.
By Adam Mazzocchetti
arXiv:2609.00015v1 Announce Type: new
Abstract: AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, control...
By Dongsheng Chen, Xiangyu Zhao, Xin Yao, Xuetao Wei
arXiv:2609.13672v1 Announce Type: new
Abstract: AI agents can be interrupted while editing files, calling tools, or carrying out multi-step tasks. Restarting repeats completed work, but continuing fr...
By Zhihui Zhang, Wei Liu
The paper investigates how approvals issued by a large language model (LLM) guardrail for self‑adaptive systems can become stale between the time of check and the time of use, creating a TOCTOU hazard. It introduces three metrics for verdict freshness, evaluates them across five SAS environments, and proposes the Freshness‑Bounded Shield (FBS) to estimate an approval’s validity horizon without a plant‑dynamics model, reducing expiry rates significantly. The study also audits LLM judges and formulates a freshness contract requiring approvals to remain valid at use time.
By Ilai Shraga, Roei Eshel, Lior Gorelik