The paper investigates oversight‑loosening directives embedded in AI agent skills—reusable instruction packages centered on a SKILL.md file. Analyzing 1.53 million English skills from GitSkills, the authors find that roughly one in seventeen skills (about 88,000) contains a directive that bypasses checks or approvals, often via permission flags and applied unconditionally. The study shows that such directives cluster in a small number of upstream skills and that current open‑source scanners miss most of them, while an LLM‑based detector performs better.
By Timofey Sanko, Yuan Tian
The paper investigates whether Markdown skill files used to configure AI agents can serve as an injection channel for jailbreaks. By embedding a jailbreak into a LangChain-based question‑answering agent’s system prompt, the authors demonstrate that the attack success rate jumps from 0.5% under a benign prompt to an average of 45%, with some models reaching 68.9%. Two obfuscation techniques—zero‑width characters and phonetic transformations—do not outperform plain‑text injection, and the phonetic variant actually lowers success rates.
By Kashyap R Manjusha, Murali Emani
MUSE is a memory management framework for scientific coding agents that combines multi-level memory—global, approach-level, and implementation-level—with selective runtime injection. The agent starts with global and problem-matched approach-level memory, then during execution it retrieves implementation-level memory and an LLM gate decides whether to inject relevant experience as review advice. Experiments on four benchmarks in numerical problem solving, kernel optimization, and scientific software repair show that MUSE outperforms retrieval and memory baselines, and ablations confirm the benefits of the multi-level design and gated injection.
By Haoran Jin, Defu Lian, Xiting Wang, Hong Xie
HERA is an autonomous agent that performs cryogenic transport measurements on quantum devices using a curated knowledge base of protocols, software, and literature. In a blinded trial, HERA matched an expert’s conclusions on the stacking order of multilayer graphene devices, and ablation and replay studies demonstrated that the knowledge base improves measurement design and reasoning across models. When tasked with discovering superconductivity in a new material, HERA autonomously developed and executed the experiment after minimal expert input, illustrating its capability for sound experimental science.
By Zachary W. Gomez, Nathan Bittner, Jordan T. McCourt, Qingrui Cao, Sandesh S. Kalantre, Benjamin H. Alexander, Zhiren Zheng, Kenji Watanabe, Takashi Taniguchi, Aaron Sharpe
arXiv:2610. 39124v1 Announce Type: cross Abstract: Dangerous-capability evaluations often test an AI agent from prepared states at ordered milestones.
By Rohith Yanambaka Venkata, Don McBride, Tiago Sequeira, Md. Al Amin
EmbodiExp is a framework that enables embodied agents to transfer and compose experiences across tasks by focusing on subgoals. It introduces outcome‑grounded subgoal experiences that include a subgoal definition, applicability conditions, an adaptable policy, and a verifiable outcome. During task execution, applicable experiences guide action generation, while verified outcomes help set conditions for subsequent experiences, allowing online composition and even leveraging failures for local success insights.
By Zhifeng Gu, Ying Chen, Rui Jiang, Lei Yi, Bing Wang
OPERA is an expert‑taught reasoning agent that uses a large language model to design CMOS opamps from specifications to post‑layout sign‑off with open‑source tools. The agent first learns the gm/ID sizing method, then the gLayout framework, and writes a reusable layout generator that closes the layout‑extraction loop. In the SKY130 process, OPERA designed a shared constant‑gm bias and six different opamps that meet all target specifications across 15 PVT corners, with DRC‑clean and LVS‑matched layouts.
By Vishal Saxena, Soumyajit Mandal
The paper investigates how large language models (LLMs) can be tricked into attributing text to the wrong role, a phenomenon called role spoofing. It shows that LLMs rely on both content cues (semantics and style) and structural cues (control tokens, formatting) to track who said what, making them vulnerable to attacks that combine fake structure and content. The authors demonstrate that adversarial training can mitigate content-based attacks but not structure-based ones, and propose a linear-probe method to detect role spoofing across settings.
By Ezra Edelman, Benjamin Edelman, Surbhi Goel, Eran Malach
The paper introduces a hierarchical agentic reduction (HAR) pipeline that constructs inspectable cross‑event relation graphs from prediction market contracts. By clustering markets and applying typed LLM reasoning, the method proposes signed relations with rationales between specific markets. Evaluation on eight monthly Kalshi catalogs, using 30.3 million trades, shows that the identified relations exhibit higher signed Pearson and Spearman price‑change correlations than matched within‑topic controls, especially for medium or high‑strength relations.
By Agostino Capponi, Alfio Gliozzo, Brian Zhu
ATLAS is a dual‑horizon diagnostic evaluation framework designed for industrial tool‑use agents on web‑scale service platforms. It combines within‑turn trajectory‑wise signals (thinking, reflection, tool execution, response generation) with across‑turn user‑wise signals over multiple lifecycles to pinpoint execution failures and unmet capabilities. The framework employs rule‑based checks and calibrated LLM judges, distilling them into compact diagnostic models that enable developers to attribute failures, prioritize fixes, and reassess improvements. In Meituan Xiaotuan, ATLAS‑guided agents achieved higher recommendation relevance, factual reliability, user engagement (+2.84% answer read‑through rate), and order volume (+6.13% paid orders), leading to full production deployment.
By Wei Chen, Peilun Zhou, Zhaoyu Hu, Jiajun Chai, Derong Xu, Zhongni Hou, Yufei Zhang, Guojun Yin, Wei Lin, Zhi Zheng, Tong Xu
Hippo is a memory framework that enables large language model agents to improve without updating their parameters. It uses selective hippocampal encoding and replay to compare attempts at the same task, identify reusable decisions, and refine applicability conditions, thereby resolving conflicts and avoiding redundant entries. Experiments on SWE‑bench, WebArena, and Mind2Web demonstrate performance gains across models while retaining fewer experiences than a simple accumulation baseline.
By Yutong Song, Jiang Wu, Yuxuan Ren, Tony Qin, Baoyuan Wang
The paper introduces Anagent, a multi‑agent framework designed to improve scientific table and figure analysis. It comprises four specialized agents—Planner, Expert, Solver, and Critic—that collaboratively decompose tasks, retrieve information, synthesize analyses, and refine outputs. The authors also present AnaBench, a large benchmark of 63,178 instances across nine domains, and demonstrate that Anagent yields significant performance gains, up to 13.43% without fine‑tuning and 42.12% with fine‑tuning, highlighting the importance of task‑oriented reasoning and context‑aware problem solving.
By Xuehang Guo, Zhiyong Lu, Tom Hope, Qingyun Wang
The paper evaluates three retrieval strategies—Vector RAG, Tree Reasoning, and a new Adaptive Hybrid Retrieval (AHR)—on a small corpus of financial, legal, and medical documents, using a four‑tier query complexity benchmark and LLM‑as‑judge evaluation. Tree Reasoning achieves the highest overall score (0.900), but AHR excels on cross‑reference queries (0.850) and all methods tie on multi‑section queries (0.929). Vector RAG shows the lowest latency (1.61 s) and performs best on single multi‑document queries (0.900).
By Afshan Hashmi
The paper investigates how AI shopping agents—whether powered by generative large language models or non-generative decision models—evaluate sponsored product listings. It finds that when the agent is described as serving a booking platform rather than a traveler, the penalty for paid listings is reduced, revealing a sponsorship bias. The bias persists across different model types, prompts, and reasoning levels, but can be mitigated by naming the consumer as the beneficiary or by fine‑tuning models to align with consumer interests.
By Davood Wadi, Yu Ma
S$^2$-MAS is a multi‑agent simulation framework that uses 500 million synthetic household personas to model economic responses at society scale. It integrates trainable candidate‑scoring policies, reusable financial scenarios, and explicit state transitions, and has been trained on 2.93 million examples to achieve high accuracy on consumer financial‑choice tasks. Experiments demonstrate the framework’s ability to evaluate millions of households across different purchase‑funding conditions, revealing heterogeneous consumption and repayment patterns driven by policy decisions and accounting rules.
By Yang Li, Yike Wang, Di Wan, Chujun He, Zongsi Xu, Yitao Yu, Shuai Zhong, Minghao Pan, Quanfeng Lu, Xiyu Chen, Sheng Zhong, Deng Binjie, Yichen Guo, Zhenwei Guo, Hou Jun, Kunhan Guo, Weihao Lin, Tuo Zhou, Hai Liu, Chenwei Wu, Jianyuan Zhong, Xilin Dai, Ye Luo
SkillCT is a new benchmark that expands agent skill assessment beyond downstream task execution to a multidimensional evaluation across nine dimensions grouped into Static, Dynamic, and Human-Assisted assessments. It measures specification quality, behavioral robustness, semantic alignment, and responsibility boundaries without requiring repeated executions. The benchmark also introduces an execution-free baseline that predicts skill quality profiles by comparing to similar reference skills, reducing token usage and evaluation time while enabling skill refinement and repository maintenance.
By Mengyu Sun, Zunlong Zhou, Ziyuan Yang, Yi Zhang
The paper investigates how clinical large language models, when deployed as multi‑agent teams, fail to eliminate demographic bias through deliberation. Across five model families and four aggregation topologies on 120 MIMIC‑IV emergency cases, every configuration amplified or relocated bias, giving Black patients more acute triage. The authors term this phenomenon "disparity laundering" and show that only by making counterfactual demographic versions visible and pooling diverse perspectives at every deliberation round can the bias be substantially reduced without retraining or architectural changes.
By Xiaoyang Wang, Tianrui Wang, Christopher C. Yang
Rubricon is a pipeline that automatically generates and refines discriminative rubrics for evaluating large language models (LLMs) without requiring human preference labels or manual rubric creation. It samples multiple rubrics, selects the most discriminative ones, adds missing criteria, prunes misaligned or shallow criteria, and uses LLM self‑critique and observed pass rates to guide refinement. Across diverse LLM benchmarks, Rubricon’s rubrics achieve 9% better alignment with expert‑authored rubrics than other synthetic methods, and training a Qwen3.5‑9B model on HealthBench with Rubricon rubrics improves performance by 4.5% over the best alternative synthetic generator.
By Ulyana Tkachenko, Hui Wen Goh, Guram Gogia, Jonas Mueller
The paper investigates how stale screenshots can cause computer‑use agents to click on unintended elements. By measuring 31 public web pages, it shows that most stale clicks occur during page loading, with a 17% risk in the first second after a page opens versus only 0.4% after full load. The authors propose that waiting for network activity to stop and performing a pixel‑comparison check before a click can mitigate this risk, and they release a benchmark generator and guidelines for developers.
By Vasundra Srinivasan
The paper investigates how policy updates can alter the marginal utility of unchanged skills in reinforcement learning agents. By analyzing changes in token preferences between skill and control conditions at fixed contexts from pre‑update rollouts, the authors develop readouts that combine interaction shifts with advantage estimates to diagnose utility changes. These readouts use only forward passes on existing rollouts, avoiding extra post‑update evaluations, and demonstrate that incorporating them into skill evolution improves downstream performance and reduces token consumption.
By Yifan Wang, Zhenyi Gai, Yiwen Zhao, Mingxuan Jiang, Keyang Chen, Zeping Li, Hongfeng Chai, Yixin Cao