Zhuoran Lu, Yangyang Yu, Zhuoyan Li, Yibo Meng, Nan Jiang, Chengxi Zang, Jie Gao, Ziang Xiao · Read the paper

Hook: When predefined classifiers miss unfamiliar agent behaviors, the paper explores whether an established qualitative research method can provide a scalable alternative.

Summary: The paper presents AutoTraceGT, a multi-agent pipeline that applies grounded theory to analyze thousands of agent trajectories and build task-specific behavioral taxonomies. It reports that the method recovered 73–91 percent of failure modes in human-annotated taxonomies across six trajectory corpora, while also identifying additional patterns.

Industry impact: For agent developers and ML researchers, AutoTraceGT offers an auditable process for analyzing behavior through iterative open, axial, and theoretical coding until saturation. The paper reports that its resulting codebooks also outperformed zero-shot and few-shot LLM baselines when used to predict downstream failures.

Potential implications: The findings suggest that behavior evaluation can combine automated analysis with a theory-building process tailored to each task. However, the reported results concern six trajectory corpora, so applying the approach in other settings would require further assessment.

Botong Zhao, Fang Yu, Tim, Senhua Zhu, Xinyuan Chen, Yue Lu · Read the paper

Hook: The paper asks whether a robot policy can learn both what physically happened and which actions were relatively better without changing its direct action-generation path.

Summary: PAVE is a direct vision-language-action policy designed to improve how robots represent scene changes and learn from deployment trajectories of different quality. It combines multi-horizon predictive learning with a value-based critic that labels action chunks as relatively positive, negative, or neutral, while keeping these extra components out of online execution.

Industry impact: For robotics teams using behavior cloning, PAVE offers a training approach that separates useful dynamics from undesirable behavior in collected trajectories. The paper reports that PAVE achieved the strongest overall performance across three simulation benchmarks while preserving the direct actor's online execution path.

Potential implications: The approach suggests that training-time objectives can encourage representations of both local physical changes and longer-range task progress without providing future tokens to the action head. Its reported results are limited to three simulation benchmarks, so further evaluation would be needed to determine how the method transfers to physical robots and other deployment settings.

Ziheng Li, Xichen He, Haoyan Chen, Charlie Zou, Sheng Bai, Benjamin Yang, Mengyuan Wu, Jake Ledner, Yi-Jie Cheng, Akito Yamauchi, Dishita G Turakhia, Steven Feiner, Paul Sajda · Read the paper

Hook: In the reported XR studies, passive EEG helped an assistive agent recover faster when the task changed silently.

Summary: The paper presents OLIVE, a framework that adapts a frozen vision-language model to provide real-time assistance in dynamic, high-stakes XR tasks. It combines users’ explicit behavior with fixation-locked EEG to estimate which information sources are reliable and guide users toward task-relevant targets without manual labels or offline training.

Industry impact: The paper reports that OLIVE extended the number of targets users could detect and engage beyond their unaided action bandwidth, with improvements that were largely independent of individual skill. Across three user studies, OLIVE achieved the highest convergence rate among the compared test-time adaptation frameworks, while the combined behavioral-and-physiological agent reconverged 1.27 times faster than the behavior-only agent after a silent target switch.

Potential implications: For teams developing adaptive interfaces or XR assistants, the findings suggest that implicit physiological signals may complement observable user actions when task conditions change quickly. The results are limited to the reported XR first-person shooter studies, so applying the approach to other tasks would require further evaluation.

Yunseok Lee, Yunji Kim, Woojin Lee · Read the paper

Hook: An agent can execute an injected action successfully while still appearing to complete the user's original task normally.

Summary: The paper examines covert indirect prompt injection against tool-using LLM agents, where an agent performs an injected action without revealing it in its final response. It introduces Covert Success Rate (CSR) and Overt Success Rate (OSR) to distinguish successful attacks that leave no visible trace from those users can detect.

Industry impact: The results suggest that Attack Success Rate alone can obscure whether an injection is detectable from the user's perspective. On AgentDojo, the paper reports that its ICoA attack achieved the highest CSR across four target models, improving on the strongest baseline by 3.79 to 12.01 percentage points.

Potential implications: The paper attributes the difference between covert and overt outcomes to what the agent does after injection: covert traces return to the user task, while overt traces end at the attack. Because the ReAct format summarizes the most recent action in the final response, evaluating both attack success and response visibility may provide a clearer view of this threat.

Hanlin Tian, Minhao Li, Yu Mi, Sihan Zhu, Zhao Yang, Yuxiang Wang, Hongquan Zhu, Qiufei Hu · Read the paper

Hook: A benchmark can now test not only whether an agent fails, but whether it fails because it lacks task-specific knowledge.

Summary: The paper introduces a protocol for building verifiable tasks that test whether an LLM agent can use a compact artefact containing private conventions, reference tables, and utility operators. In fifteen calibration tasks, one frontier agent configuration passed 68.0% of tasks with the artefact and 0% without it, while a calibration screen retained seven tasks that met the paper's five-trial knowledge-gating criterion.

Industry impact: For agent evaluation, the protocol offers controls intended to distinguish missing conventions from general task-solving limitations, using identical instructions, leak audits, provenance records, and executable witnesses. The paper also combines deterministic solvers and rule corpora for structured tasks with criterion-level rubrics for outputs that cannot be checked by one executable oracle.

Potential implications: The reported results support the protocol's ability to create configuration-relative knowledge-gated tasks, but they do not show that the retained tasks improve post-training. Teams using the suite should therefore treat its calibration results as evidence about evaluation construction and access to artefacts, not as proof of broader agent capability or training gains.

Haoran Wang, Jing Yao, Xu Yang, Zeqing Wang, Yang Zhang, Pedram Ghamisi, Zhengchao Chen · Read the paper

Hook: The paper explores whether synthetic, validated workflows can make remote-sensing agents more practical to deploy without relying on large general-purpose language models.

Summary: SimCRAFT is a model-agnostic framework for distilling remote-sensing workflow orchestration into a compact 7B-scale model. The paper introduces SimRS-14k, a constraint-validated workflow-planning corpus, and Contextual Retrieval-Augmented Fine-Tuning to help the model adapt retrieved procedures to new queries.

Industry impact: According to the paper, SimCRAFT-7B significantly outperforms open-weights language models and rivals advanced closed-source models and specialized remote-sensing agents. Its stated focus on compact models could support autonomous remote-sensing workflows in resource-constrained or resource-conserving environments.

Potential implications: The results suggest that synthetic data validation and retrieval-guided fine-tuning may be useful strategies for developing lightweight domain-specific agents. The paper also provides an open-weights baseline for evaluating remote-sensing intelligence across multiple 7B model backbones.

Chen Xiong, Zhiyuan He, Pin-Yu Chen, Stjepan Picek, Tsung-Yi Ho · Read the paper

Hook: The paper reports that adaptive, feedback-driven attacks can substantially outperform handwritten injections against operating-system-level computer-use agents.

Summary: SIR is a black-box red-teaming method for testing computer-use agents against indirect prompt injection, where untrusted content redirects an agent away from the user's intent. It composes stealthy instructions from reusable principles and uses feedback from failed attack attempts to develop strategies that can be reused across tasks.

Industry impact: The authors evaluated three frontier computer-use agents with a deterministic oracle that checks filesystem, service, and permission states rather than relying on an LLM judge. On reported experiments, attack success increased from 4% to 24% on Claude Opus 4.8 and from 0% to 28% on Gemini 3.5 Flash, while the benign task still completed.

Potential implications: The results suggest that safety benchmarks using only fixed, handwritten injections may underestimate the risk from adaptive adversaries. The paper also reports that strategies discovered against one model transferred to a different architecture without additional feedback, indicating that attack evaluation should account for cross-model reuse.

Hyeonjin Kim, Minseok Kim, Seunghyeon Jung, Sujin Pyo, Huisu Jang, Woojin Lee · Read the paper

Hook: Instead of optimizing financial factors for returns alone, FaVOR evaluates whether they still represent the economic ideas that motivated them.

Summary: FaVOR is an LLM-based agentic framework for discovering financial factors while preserving the economic hypotheses behind them. It uses decomposition, validation, and integration to connect observable conditions, mathematical formulas, and interpretable composite factors.

Industry impact: The paper reports that FaVOR outperformed existing baselines on the CSI 500 and S&P 500 in 2025 while remaining effective across market regimes. This approach could give automated factor-mining systems a more interpretable and hypothesis-centered workflow than return-oriented generation alone.

Potential implications: For technology and quantitative-finance teams, the framework highlights the value of validating an automated model’s structure and rationale, not just its measured performance. The reported results suggest that connecting generated signals to observable economic conditions may help distinguish meaningful factors from spurious correlations, although the abstract does not establish performance beyond the reported markets and period.

Arya S. Rao, Rodrigo I. Castro, Sager J. Gosai, Kenneth B. Hsu, Yasha Ektefaie, Shantanu Singh, Sangeeta N. Bhatia, Steven K. Reilly, Ryan Tewhey, Eric S. Lander, Pardis C. Sabeti · Read the paper

Hook: An AI agent can optimize a scientific metric without understanding the rules that produced it.

Summary: The paper introduces science sandboxes, a framework for evaluating AI agents through repeated experimentation, feedback, and hypothesis revision. It applies the framework to regulatory genomics and protein fitness prediction, examining both quantitative performance and qualitative scientific reasoning.

Industry impact: Science sandboxes offer a common protocol for assessing agents across physical experiments, predictive models, and invented rule systems. The paper reports that this approach can reveal when agents perform well on metrics but struggle to reason about systems that fall outside familiar biological priors.

Potential implications: Evaluations of scientific AI may need to measure how agents revise hypotheses and learn underlying rules, not only whether they achieve strong numerical results. The framework provides a controlled setting for studying and potentially expanding these capabilities.

Lifei Liu, Haoran Yu, Xiaochong Jiang · Read the paper

Hook: Revoking one delegation in a shared agent workflow can remove too much authority—or fail to remove enough.

Summary: VERA is a verifier-checkable revocation contract and API for federated AI-agent workflows that represent delegation as runtime graphs. The paper defines revocation targets as the agents whose every authorizing root path depends on the revoked edge, allowing independently authorized agents to continue operating.

Industry impact: The paper reports that tree-style cascades over-revoke shared agents, while deployer-scoped cascades can under-revoke descendants across domains. In LangGraph experiments, VERA produced 500/500 target proofs, preserved 320 alternate-parent shared-agent cases that tree cascading revoked, and rejected unauthorized signers and omission attacks.

Potential implications: For teams building agent runtimes, the work suggests expressing revocation as signed, verifier-checkable evidence rather than relying only on token or subtree invalidation. The paper also reports schema portability across A2A, AutoGen, and CrewAI artifacts, although the broader evaluation described is limited to the reported traces and experiments.

Ruize Xu, Xiao Yu, Yujin Tang, Chenming Shang, Nikhil Singh · Read the paper

Hook: The paper suggests that an agent’s understanding of its environment and its task-solving ability may be complementary rather than competing capabilities.

Summary: The paper studies how world-model training, which predicts the next state, and policy training, which maximizes rewards, combine in LLM agents. Its controlled experiments find that the two types of updates share input-feature structure but write to nearly orthogonal output directions, while sequential training produces more robust and behaviorally diverse agents.

Industry impact: For teams developing LLM agents, the reported results indicate that the order and interface between world-model and policy training can affect robustness, exploration, and task behavior. The paper also reports that training-free parameter merging and adding an online world-model loss during policy reinforcement learning improved preservation of world knowledge over an untreated baseline.

Potential implications: The findings suggest that post-training pipelines may benefit from explicitly managing how world knowledge and task-directed updates interact. However, the reported evidence comes from controlled experiments and supports further investigation rather than a single established training recipe.

Shitanshu Bhushan, Yunxiang Zhang, Lu Wang · Read the paper

Hook: Novel ideas are not enough if an AI agent cannot make them work better.

Summary: The paper introduces a framework for evaluating creativity in multi-turn LLM research agents using machine learning engineering tasks. It measures psychological novelty, historical novelty, and usefulness, and reports that agents generate novel solutions but do not reliably turn that novelty into better task performance.

Industry impact: For teams assessing LLM agents, the paper highlights the need to measure both solution novelty and practical task performance. Its evaluation of AIDE and AIRA-Dojo across 10 Kaggle-style tasks also suggests that automated creativity assessment can support evaluation at scale, based on an LLM-as-a-Judge pipeline that correlated strongly with human judgments for psychological creativity.

Potential implications: The paper reports that all evaluated agents became less psychologically creative as they shifted from exploration to exploitation, indicating a measurable tradeoff in their multi-turn behavior. It also reports that the agents showed greater historical novelty than medal-winning human solutions while achieving lower performance, so novelty should not be treated as evidence of effective discovery.

Wujie Xiong, Rabimba Karanjai, Yang Lu, Weidong Shi, Lei Xu · Read the paper

Hook: Instead of judging each proposed action in isolation, SkillGuard changes an agent’s future authority after untrusted data reaches its state.

Summary: The paper presents SkillGuard, a harness-level enforcement layer that treats attacker-controlled data entering an LLM agent’s execution state as contamination and restricts the agent’s subsequent capabilities. It uses skill summaries, policies, a Skill Impact Graph, steerability signatures, and an inline reference monitor to enforce restrictions without additional language-model inference.

Industry impact: In evaluations across four AgentDojo suites and two backend models, the paper reports that SkillGuard eliminated attack success on three of four Tool Knowledge suites for both models, while reducing success on Slack to 4.8% and 14.3%. The paper also reports that SkillGuard outperformed the tested baselines on its compositional attacks with Llama and matched the strongest baseline with Gemini at higher benign utility, without adding model calls or token overhead.

Potential implications: For teams building tool-using agents, the results suggest that capability restriction based on state contamination can complement defenses that classify content or authorize individual operations. The paper further reports that fractional-flow restrictions preserved more capabilities than binary restrictions at the same attack success rate, although the approach depends on sound skill summaries and policies.

Owen Kwon, Pablo Ortega-Kral, Arthur Bucker, Jean Oh · Read the paper

Hook: A single language correction may help a robot fix how it acts, but not what it understands.

Summary: The paper introduces CorrectVLA, a training-free framework that converts a single human-provided, task-level natural-language correction into additive action-magnitude adjustments without changing a VLA policy's weights. The authors report that it recovers execution-misalignment failures in simulation and restores near-perfect success in experiments with a UFactory xArm7 under environment shift, while not addressing failures caused by missing semantic comprehension.

Industry impact: For teams deploying vision-language-action systems, the reported results suggest that some execution failures may be addressed at inference time without retraining or per-episode human intervention. In the paper's real-robot experiments, CorrectVLA generalized across object locations and identities after the base policy nearly failed under environment shift.

Potential implications: The approach appears most applicable when a policy has the correct strategy but uses poorly calibrated action magnitudes, such as reaching the right target incorrectly. The failure taxonomy on LIBERO-90 establishes an operational boundary: language-based action correction does not remedy cases where the policy's fundamental task comprehension is absent.

Guransh Singh, Vishwajeet Kumar, Arkadeep Acharya, Adnan Qidwai, Jaydeep Sen, Sachindra Joshi · Read the paper

Hook: Instead of treating a corpus as a flat pile of text chunks, SearchWiki teaches an agent to explore it like a structured knowledge base.

Summary: SearchWiki is a framework that converts a document collection into a hierarchical, typed wiki with document overviews, cross-document topic pages, and page-level source records. It trains WikiResearcher-9B to navigate this structure through multi-turn tool use, and the paper reports stronger or comparable benchmark performance than same-size untrained models and larger external models.

Industry impact: The approach could inform enterprise search and retrieval-augmented generation systems that need to connect information across documents while preserving source-level detail. The paper reports gains for WikiResearcher-9B across eight ViDoRe-V3 domains, FinanceBench, and several memory benchmarks, although these results describe the evaluated framework and model rather than a production deployment.

Potential implications: For technology teams, the work highlights corpus organization and learned navigation as alternatives to relying solely on flat chunk retrieval. Deployers would still need to assess how the framework's multi-turn navigation, reward design, and structured wiki construction fit their own data, latency, and quality requirements.

Tanzim Ahad, Ismail Hossain, Md Jahangir Alam, Sai Puppala, Syed Bahauddin Alam, Sajedul Talukder · Read the paper

Hook: A causal signal can show what shaped an action without reliably showing whether the action was authorized.

Summary: The paper reports that influence-based guardrails can mistake legitimate tool-assisted actions for attacks when authorization and the intended action remain unchanged, but a required value shifts from the user to a legitimate tool result. Across 24 matched cases evaluated with Llama and Gemma scorers, this relocation shifted causal signals toward the attack region in every case and produced a larger average score change than changing authorization itself.

Industry impact: The paper reports that this ambiguity can increase unnecessary verification and intervention, reducing utility and adding latency in tool-using LLM agents. In its architecture-level evaluation, a semantic monitor achieved 0% attack success with 28% utility, compared with 16% attack success and 60% utility without the monitor, while a shadow-based guardrail allowed all tested harmless runs but did not reject matched unauthorized actions more often overall.

Potential implications: The findings suggest that guardrail designers should treat reference construction and routing as part of the effective security decision rather than assuming the causal signal directly represents authorization. The paper also indicates that security evaluation should compare authorized and unauthorized actions with the same committed action and intended effect while varying the source of required information.