The paper introduces an adaptive memory and reflection (AMR) multi‑agent system for medical question answering. Each agent has dedicated memory and uses reflection‑based feedback to retrieve relevant prior cases, improving reasoning. The system routes questions through solo, collaborative, or escalated workflows and includes consensus and ethical overseer modules, achieving strong performance on MedQA and MedMCQA datasets.
By Pradeep Murugesan, Luoxiao Yang, Xueli Chen, Xinqi Fan
The paper "Jailbreaking in the Haystack" introduces NINJA, a jailbreak technique that exploits long-context language models by appending benign, model-generated content to harmful user goals. It demonstrates that the position of harmful goals within the context is crucial for safety, and shows that NINJA significantly boosts attack success rates on models such as LLaMA, Qwen, Mistral, and Gemini. Unlike previous methods, NINJA is low-resource, transferable, less detectable, and compute‑optimal, revealing that carefully crafted benign long contexts can expose fundamental vulnerabilities in modern LMs.
By Rishi Rajesh Shah, Chen Henry Wu, Shashwat Saxena, Ziqian Zhong, Alexander Robey, Aditi Raghunathan
ChainWorld is a new benchmark that composes atomic OSWorld tasks into long‑horizon desktop workloads, creating 347 chains of length two to four that compare two renderings of the same task sequence. In single‑turn evaluation all tasks are presented together in one prompt, while in multi‑turn evaluation tasks are revealed one at a time. Across four current computer‑use agents, maximum chain completion is 31 %, with multi‑turn evaluation improving completion for three models but both protocols remaining challenging and exposing different failure profiles.
By Vincent Siu, Manasi Sharma, Dawn Song, Daniel Yue Zhang, Chenguang Wang, Ying Liu
The paper introduces Interval POMDP Shielding for agents with imperfect perception, aiming to prevent unsafe actions when sensor readings may be misclassified. By estimating perception uncertainty from finite labeled data, the authors construct confidence intervals and model the system as a finite Interval Partially Observable Markov Decision Process. They propose an algorithm that computes a conservative belief set, enabling a runtime shield that guarantees, with high probability, that any action allowed by the shield meets a specified safety lower bound. Experiments on four case studies demonstrate that this shielding approach outperforms state‑of‑the‑art baselines in safety.
By William Scarbro, Ravi Mangal
The paper titled "Professional Software Developers Don't Vibe, They Control: AI Agent Use for Coding in 2025" examines how experienced developers employ AI agents in software development. Through field observations and surveys, it finds that developers value agents for productivity but maintain control over design and implementation to ensure quality. They use agents as collaborative tools rather than full delegation, selecting tasks based on suitability and leveraging their expertise to guide agent behavior.
By Ruanqianqian Huang, Avery Reyna, Sorin Lerner, Haijun Xia, Brian Hempel
SPADE (Self-Play in Adaptive Synthetic Executable Environments) is a reinforcement‑learning framework where a single large language model acts as both an Environment Designer—creating executable, long‑horizon training environments—and a Reasoning Agent—learning to act within those environments. The framework uses a regret signal based on the difference between rewarded performance with and without privileged hints to guide the Designer toward environments that are challenging yet solvable. Experiments show that, when scaled to 30‑billion‑parameter models, SPADE outperforms fixed‑environment baselines by significant margins across math, science, code, and reasoning benchmarks, and improves tool‑use performance on BFCL‑v4 and ACEBench‑Agent.
whyItMatters":"By making environment design a learnable component, SPADE enables continuous self‑improvement and demonstrates that adaptive, self‑generated training environments can substantially boost language‑model performance across diverse tasks."
By Bo Liu, Simon Yu, Yiding Jiang, Ao Qu, Andrew Zhao, Zichen Liu, Junsu Kim, Zijian Zhou, Seungone Kim, Tongzheng Ren, Mickel Liu, Hanfei Yu, Zhaorun Chen, Weiyan Shi, Paul Pu Liang, Luke Zettlemoyer, Yejin Choi, Natasha Jaques
The paper investigates the use of looped language models for compositional tool calling, where models must coordinate multiple API calls and maintain state across interactions. Experiments on API-Bank, BFCL, and NESTful show that recurrent computation generally improves compositional and dependency-aware tool use, with accuracy increasing as recurrent depth grows. Adaptive inference offers a better compute‑performance trade‑off by allocating extra computation only when necessary.
By Andrei Cristian Popescu, Haitz S\'aez de Oc\'ariz Borde, Pietro Li\`o
The article reviews the emergence of Agentic AI, covering its evolution, theoretical foundations, working principles, and architectural aspects. It surveys recent scholarly contributions across various domains, highlighting real‑world applications, current research findings, and existing challenges. The review also proposes a framework for stakeholder adoption and outlines future research directions to guide researchers and practitioners.
By AKM Bahalul Haque, Al Amin Islam Ridoy, Mohammad Rayhan, Ivan Porres
EgoMemReason is a new benchmark for week‑long egocentric video understanding that focuses on memory‑driven reasoning rather than simple perception tasks. It tests three memory types—entity, event, and behavior—across 500 questions, each requiring evidence from an average of 5.1 video segments and 25.9 hours of backtracking. Evaluation of 17 models shows that even the best achieves only 39.6% accuracy, highlighting the difficulty of long‑horizon memory in multimodal systems.
By Ziyang Wang, Yue Zhang, Shoubin Yu, Ce Zhang, Zengqi Zhao, Jaehong Yoon, Hyunji Lee, Gedas Bertasius, Mohit Bansal
The paper introduces the Orienteering Problem with Uncertain Time‑Varying Rewards (OP‑UTVR), a new variant of the classic orienteering problem that allows agents to estimate and forecast reward dynamics from observations. Three planners with different planning horizons and online adaptivity are proposed, and theoretical performance bounds under reward stochasticity are derived. A mobile service robot benchmark is presented, and experiments show trade‑offs between planning horizon and adaptivity, highlighting the benefits of long‑horizon planning with online adaptation.
By Masafumi Endo, Kohei Honda, Yuu Jinnai, Ryo Yonetani
The paper proposes a theory for judging post-hoc debates in AI, focusing on properties like reproducibility, robustness, groundedness, and explainability. It evaluates two debate‑judgement methods—LLM judges and formal computational argumentation semantics—finding similar accuracy but noting that argumentation semantics offers stronger formal guarantees. The study suggests that argumentation semantics is a preferable framework for principled debate judges in AI systems.
By Xiang Yin, Adam Dejl, Antonio Rago, Lihu Chen, Francesca Toni
DeepTCM1.0 is a multi‑expert AI agent built on the DeepSeek V3.2 large language model, designed to integrate classical traditional Chinese medicine (TCM) theory with modern life sciences for mechanistic analysis of TCM compound formulas. The framework employs a three‑tier collaborative architecture and a three‑round iterative quality‑control workflow, simulating 11 interdisciplinary intelligent agents. It was validated on the Guizhi Decoction, with performance evaluated through double‑blind five‑dimensional scoring, ICC reliability testing, Mann‑Whitney U tests, and effect size analysis across 100 independent assessments by four large language models.
By Wenxin Duan, Hanwei Wang, Zhongying Peng, Zhonghua Lu, Jiayi An, Fan Song, Yong Liang
The paper investigates how multiple pre‑action controls—authority, resource, and evidence gates—interact in agentic AI systems. It formalizes remediation‑induced control coupling, showing that remediation can invalidate earlier judgments and that the order of remediation matters. The authors propose a remediate‑and‑regate protocol to restore soundness, analyze non‑commuting remediation operators, and demonstrate the approach on a deterministic open‑data artifact with three published engines.
By Gaston Besanson
Flama is an open‑source Python framework that unifies the development and deployment of production‑ready web APIs, machine‑learning services, and large‑language‑model (LLM) applications. Built on ASGI, it offers an async‑first, type‑driven programming model with seven subsystems—including dependency injection, a pluggable schema layer, automatic CRUD generation, a portable binary model format, a multi‑backend LLM server, a Rust‑accelerated core, and a Model Context Protocol module. The framework also provides built‑in JWT authentication, pagination, background tasks, WebSocket and streaming support, OpenAPI generation, and a CLI for running, packaging, and inspecting models.
By Jos\'e A. Perdiguero L\'opez, Miguel A. Dur\'an-Olivencia
The paper introduces Progressive Experience Fusion (PEF) for training a multi-task TD-MPC2 controller to navigate endovascular paths across diverse vascular anatomies. PEF outperforms Soft Actor-Critic and base TD-MPC2, achieving 74% success on training anatomies and 90% on held‑out vasculatures. The controller also transfers to an unseen in‑vitro stroke patient, improving path ratio from 63% to 80% after fine‑tuning.
By Harry Robertshaw, Maxence Boels, Nikola Fischer, Sebastien Ourselin, Christos Bergeles, Alejandro Granados, Thomas C Booth
TrojanGYM is an LLM‑driven framework that automatically generates diverse hardware Trojan (HT) insertions to expose blind spots in learning‑based detectors. It uses multiple large language models to propose and refine RTL modifications, while an agentic loop with syntactic checks, functional verification, and GNN‑based detectors iteratively improves the HT designs. The authors also present Robust‑GNN4TJ, a more robust detector that improves detection rates on TrojanGYM benchmarks, and demonstrate that TrojanGYM can achieve up to 68.75% evasion against modern GNN detectors on SRAM, AES‑128, UART, and RISC‑V RTL designs.
By Saideep Sreekumar, Zeng Wang, Akashdeep Saha, Weihua Xiao, Minghao Shao, Muhammad Shafique, Ozgur Sinanoglu, Ramesh Karri, Johann Knechtel
FraudBench is a new benchmark that tests policy‑grounded banking conversational agents against adaptive fraud scenarios. It uses a dual‑control framework and a 698‑document internal policy corpus, presenting 150 adversarial scenarios (107 public, 43 held‑out) that require agents to manage mutable account state and tool access while preventing identity, authorization, and trust manipulation. Preliminary results on four agents show attack‑security rates between 49% and 65%, highlighting weaknesses in money‑mule and first‑party fraud detection.
By Dheeraj Mohandas Pai, Lu Xian
Redakto is a new tool designed to anonymize text before it is processed by large language models (LLMs). It offers state‑of‑the‑art redaction of personally identifiable information (PII) and pseudonymization, accessible via a web interface, REST APIs, and model context protocol hooks. The authors evaluate its performance on legal and medical datasets, showing that anonymized texts retain utility comparable to the originals, enabling LLM tasks without significant loss of effectiveness.
By Saurav Kumar Saha, Tom R\"ohr, Felix Bie{\ss}mann
The paper investigates how AI code agents perform when the surrounding code is rewritten in a semantically equivalent way. Using a random variant sampler that applies control‑flow rewrites, dead‑code injection, and identifier renaming, the authors evaluate two agent scaffolds—mini‑SWE agent and OpenCode—backed by four frontier models across SWE‑bench datasets. Results show modest drops in resolve‑rate (up to 6.7 percentage points) with significant degradations in 6 of 16 configurations, and reveal that robustness varies across models and scaffolds, forming a jagged frontier.
By Hasan Najib Mahmud (Colorado State University), Shreya Gupta (Microsoft), Isha Chaudhary (University of Illinois Urbana-Champaign), Nathaniel Enis (Colorado State University), Ravi Mangal (Colorado State University), Gagandeep Singh (University of Illinois Urbana-Champaign), Corina Pasareanu (Carnegie Mellon University)
The paper introduces EvoResearcher, a training‑free, inference‑time protocol that enables a frozen large language model to perform cost‑bounded self‑reflection and early stopping. By iterating through generate → self‑critique → revise steps until a maximum depth or a CONFIRMED sentinel is reached, the model can self‑verify its answers within a strict compute budget. The protocol incorporates four self‑reflective meta‑reward components—correctness, efficiency, reflection depth, and tool‑call diversity—implemented as prompt‑level mechanisms, and is validated on Big‑Bench Hard, GSM8K, and MATH benchmarks, achieving comparable accuracy while terminating 82‑88% of items early with only about 2.1 generations per question.
By Wei Yu, Suxing Liu, Minjie Yu, Jiahao Wang, Zhijian Zheng, Haocheng Deng, Bing Li