The paper introduces Probabilistic Agentic Programming (PAP), a framework that explicitly defines responsibility boundaries for language‑model agents by linking mandate, authority, effects, and evidence. It compares PAP to various programming paradigms and agent systems across seven dimensions, and presents a mediation kernel that enforces checks before tool execution, operation‑bound approval, and resource limits. An exploratory study with seven business cases and multiple models demonstrates that PAP’s native Touba implementation achieves the highest or tied observation counts, supporting its effectiveness in managing agentic behavior.
By Khadim Lo, Soukaina Alaoui Ismaili, Jean-S\'{e}bastien Dessureault
The paper introduces the Continual Learning Exam (CLE), a benchmark designed to evaluate how large language model (LLM) agents improve over time by learning from experience. CLE consists of 120 human-authored tasks organized into five-level ladders, totaling 600 levels across 89 professional roles in 12 domains, where agents must pass each level to unlock the next. Experiments with 17 frontier LLM configurations show that providing diagnostic feedback and allowing one revision improves median completion by 5.3 percentage points, yet the best system only clears 47.7% of levels and completes all five levels in 23.3% of tasks, underscoring the challenge of sustained learning from experience.
By Haoyu Zhao, Sitian Tu, Yuxuan Huang, Huichi Zhou, Zhangyue Yin, Jiahao Huang, Jingyuan Xu, Tianmiao Shi, Jin Shi, Nianxi Zhang, Yangmiao Zhang, Zhuolang Chan, Huiyan Hu, Chenchao Sheng, Yaqing Luo, Yue Chen, Huaxiu Yao, Meng Fang, Jun Wang
The paper introduces NameTrap, a source‑code poisoning attack that renames identifiers in third‑party Python files to steer AI coding agents toward specific Common Weakness Enumeration (CWE) vulnerabilities. By iteratively aligning variable names with CWE‑specific conventions, the attack achieves success rates ranging from 22.5% to 75.0% across six agents and four vulnerability categories, outperforming random and neutral renaming strategies. The poisoned files contain no explicit instructions or vulnerable statements, and existing AI‑based and static security analyzers fail to detect the induced weaknesses.
By Chieh-Yuan Chang, Guan-Wei Chen, Chia-Yi Hsu, Chih Yang, Chia-Mu Yu, Chun-Ying Huang
The paper "Babysitting AI Agents: A User-Centered Taxonomy and Study of Agentic Delegation Failures" presents MANDATE, a taxonomy of 23 failure categories across seven groups, derived from 163,487 Reddit posts about AI agent use. A follow‑up study with 73 users explored how failure prevalence, severity, and noticeability interrelate, revealing that more severe failures are harder to notice and prior experience increases noticeability. The authors also evaluate research maturity for each failure type, highlighting under‑studied issues such as agents running without progress, and suggest directions to improve user oversight and research focus.
By Shravika Mittal, Sunnie S. Y. Kim, Scott Counts, Jennifer Neville, Debarati Das, Philippe Laban
AskGLP1 is a system that converts unstructured online patient narratives about GLP‑1 medications into a knowledge graph and uses an LLM‑assisted pipeline grounded in MedDRA terminology to answer questions about drug experiences. The pipeline screened nearly 8.5 million Reddit posts, distilled 163,135 relevant experiences, and combined them with 2,506 WebMD reviews into a KG containing 385,790 drug‑side‑effect and drug‑purpose relations. Analysis of the KG shows that online narratives highlight everyday burdens such as fatigue and food aversion, differ from FAERS reports in symptom emphasis, and reveal drug‑specific variations in reported side effects.
whyItMatters":"The study uncovers gaps between formal pharmacovigilance data and patient‑reported experiences, underscoring the need for patient‑centered approaches to drug safety monitoring."
By Zhaoqian Xue, Anay Somani, Siddhartha Singh, Junting Mu, Zhongyin Wang, Haozheng Liu, Ayesha Khatun, Yeaeun Kwon, Renkai Ma, Siyuan Ma, Zhe He, Danxia Yu, Lingyao Li
The paper introduces LARVA, a framework that distills multi‑round video agents by jointly learning latent reasoning and visual observations. Instead of using textual captions, an observer sends compact continuous representations to a reasoner, which then selects the next action or produces an answer. The approach incorporates action and answer supervision through this interface and uses observation reconstruction and reasoning‑distribution alignment as auxiliary signals, achieving strong results on five video‑understanding benchmarks with 4B and 7B models.
By Junzhang Liu, Hao Yuan, Qi Zhang, Yiming Wu, Long Chen, Zhecan Wang
The paper investigates how deleting portions of a software engineering agent’s past trajectory affects performance and cost. Across 9,400 runs with two state‑of‑the‑art agents, it finds that large deletions (even up to 100% of reasoning text) can maintain overall effectiveness if applied with a delay, but immediate deletion harms performance. The study also shows that cost savings depend on the pricing model: a flat model yields savings in 26 of 42 cases, while a caching‑aware model actually increases costs because it breaks a low‑rate cached prefix.
By Fernando Vallecillos-Ruiz, Islem Bouzenia, Michael Pradel, Leon Moonen
RadOnc-Agent is an integrated AI framework that links 17 phase‑specific functions and 9 cross‑cutting utilities across four radiotherapy care phases via a conversational interface. A language‑model controller translates clinical intent into structured calls, preserves longitudinal context, and validates dispatch. In evaluations on 2,600 single‑function requests, 200 cross‑stage scenarios, and 120 patient workflows, the system achieved 98.79% accuracy on single‑function calls and over 96% completion on scripted and real‑patient workflows, demonstrating the feasibility of longitudinal integration in radiotherapy workflows.
By Caiwen Jiang, Shuoyang Wei, Songlin Zhao, Junyu Li, Jingyuan Chen, Yuzhen Ding, Daniel J. Ma, Samir H. Patel, Steven E. Schild, Sujay A. Vora, Wei Liu
The paper introduces SMART‑Med, a local multi‑agent system for medical reasoning that learns when to collaborate instead of always engaging all agents. By using an uncertainty‑driven routing mechanism, it selectively recruits expert agents only for uncertain queries, thereby converting dense collaboration into query‑adaptive coordination. The authors also present a new multimodal dataset, MedVR‑3K, and demonstrate that SMART‑Med matches or surpasses existing multi‑agent approaches while cutting inference time by over 3.8× and token usage by 72%, with a 6.7% average accuracy gain across four VQA benchmarks.
By Jiacheng Hou, Xueliang Cui, Dan Lu, Ruxin Wang
EnvLunch proposes a warm‑up training stage that uses the executable environment itself as a source of verifiable tasks, eliminating the need for human‑written or model‑generated task descriptions. By sampling valid action trajectories, executing them, and training agents to recover equivalent trajectories from final observations, EnvLunch achieves over 9‑point performance gains on downstream tasks and reduces the required annotated examples by 8 to 32 times compared to baselines. This approach also improves fine‑tuning on benchmarks beyond data analysis, offering a more efficient starting point when annotated tasks are scarce.
By Wei Liu, Min Gao, Yali Du, Yulan He
R2A‑Sales is a new benchmark that pairs static policy probes with multi‑turn sales scenarios to evaluate whether large‑language‑model agents can translate stated rules into compliant, tool‑grounded actions under commercial pressure. The benchmark includes a ledger‑verified interactive arm, 24 policy atoms, 42 semantic cores, and 2,016 matched pairs across three Chinese‑language sales domains. Results show high static compliance (≈90–99%) but low action compliance (≈3–17%), revealing a substantial rule‑to‑action gap of 80–92 percentage points.
By Yihua Qin (Tsinghua University, Futura Lab, Futura.AI), Jiajie Jerry Zhao (Tsinghua University, Futura Lab, Futura.AI)
Scope-Gap Injection (SGI) is an indirect prompt injection technique that exploits a mismatch between what an LLM judge inspects and what an agent can access during a security competition. In the IJCAI 2026 OpenClaw Agent Security Attack Competition, SGI hides malicious instructions in an attachment that the judge’s safety check (S2) ignores, while the agent reads the attachment during live execution (S3). The method successfully bypassed all three evaluation stages for 5 of 19 targets, achieving a top score of $F = 0.385$, and demonstrated that placing malicious content in attachments yields higher acceptance rates than embedding it directly in the skill definition.
By Weihang Niu, Mengxing Ren, Che Qu
LongSearchEval introduces a trajectory‑aware evaluation framework for assessing large language model agents on long‑horizon web search tasks. The framework verifies answer groups against agent‑cited webpages without relying on human‑authored gold answers and audits normalized rounds to flag failure nodes linked to incorrect answers. Using this method, 16 models were evaluated on 100 tasks, producing 1,600 retained runs and 6,545 automatically flagged failure nodes, with high human validation agreement.
By Jialiang Liu, Shusheng Li, Wenjun Tan
Patchwork is a resource‑sharing system for domain‑randomized embodied simulation that separates a shared template of common resources from patches that record environment‑specific mutations. By sharing compiled model structure and immutable assets while keeping mutable parameters private, Patchwork reduces CPU memory usage dramatically—up to 92% at 32 replicas—compared to running each environment in its own process. The approach was implemented on robosuite and MuJoCo and evaluated on LIBERO‑plus and RoboCasa365 workloads, demonstrating that memory growth shifts toward template diversity rather than instance count.
By Zixu Hao, Weijun Wang, Xiangyu Li, Liang Mi, Hao Wu, Yunxin Liu, Ting Cao
The paper introduces BAC-Bench, a benchmark comprising 46 real-world broken access control vulnerabilities from six popular web applications across four programming languages. It evaluates eight base large language models (LLMs) and two commercial LLM agents, showing that single-turn LLMs repair about 38% of the vulnerabilities, while minimal scaffolds can raise this to 66% and the best LLM achieves 75%. Some LLM-generated patches even outperform official fixes and one patch closed a dormant zero‑day vulnerability.
By Mingrui Liu, Liang He, Xinchu Wang, Yeting Li, Dongxu Han, Yunpeng Li, Yuling Liu
The paper describes the Cosmos LLM Gateway, a policy‑driven, multi‑vendor gateway built on Envoy that manages enterprise LLM traffic at PayPal. It separates latency‑sensitive control decisions into an external service while handling wire‑format translation and token metering in‑proxy via a Rust WebAssembly filter, ensuring minimal overhead. Governance is declarative, managed through Open Policy Agent, and includes features like data‑loss‑prevention, budget scopes, and a control plane for role‑scoped authoring and approvals. The gateway currently serves over 12,000 developers, processes roughly 200 billion tokens per day across 100+ models, and maintains 99.999% availability with only a few milliseconds of added latency.
By Mithun Sasidharan, Srinivasan Manoharan, Rupesh Thakur, Abhinav TK, Ashwin Hegde, Anand Gautam
KAPPA is an open‑source toolkit that uses language‑model agents to translate LaTeX proofs from statistical papers into Lean 4, where each numbered result is verified step by step against the original text. The system assigns one of four verdicts—verified unconditionally, verified conditionally, issue recorded, or unfinished—to every result, and it can run unattended, re‑check only changed sections, and report resource usage. In tests on four example papers and three published statistical papers, KAPPA detected the known errors and additional issues that were later confirmed by hand, while a direct language‑model approach without the kit produced fewer correct verdicts and sometimes over‑claimed proofs.
By Zihua She, Xiao Wang
The paper reports that a domain‑agnostic, agentic AI system can autonomously carry out the full scientific workflow—from hypothesis generation to data collection and manuscript preparation—by conducting three online psychological studies involving 288 participants. The AI designed experiments on visual working memory, mental rotation, and imagery vividness, coded analysis pipelines in over eight hours, and produced completed manuscripts, achieving methodological rigor comparable to experienced researchers. The work demonstrates the feasibility of AI‑driven scientific discovery while highlighting limitations in conceptual nuance and raising questions about scientific credit and understanding.
By Gabrielle Wehr, Reuben Rideaux, Amaya J. Fox, David R. Lightfoot, Jason Tangen, Jason B. Mattingley, Shane E. Ehrhardt
arXiv:2610.31991v1 Announce Type: new
Abstract: Regularisation-based class-incremental learning (CIL) methods control the stability-plasticity trade-off through fixed coefficients tuned offline, inde...
By Akila Ayanthi, Darshana Priyasad, Tharindu Fernando, Sridha Sridharan, Clinton Fookes, Peyman Moghadam
arXiv:2610.33806v1 Announce Type: new
Abstract: Language-model agents must adapt as users revise their requirements and priorities during complex tasks. We introduce IntentDelta, a human-constructed...
By Jieyu Zhou, Zijian Wang, Yun Wang