Papers

Field

Top tools here

Open problems in AI agents

Lack of benchmarks for agent harness reliability and failure attribution1 paper raises it · 1 addresses it
Existing benchmarks focus on model capabilities rather than the reliability of the agent harness, which is critical for real-world deployment.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
No benchmarks for agent software engineering fidelity1 paper raises it · 1 addresses it
Current evaluations do not test whether coding agents can build agents that truly meet user requirements rather than just appearing to.
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises · addresses
Poor long-term memory and context retrieval in conversational agents1 paper raises it · 0 address it
Agents struggle to recognize when past context is relevant, especially when references are sparse or distant in long conversations.
- RealCompanion: Benchmarking Human Understanding from Reasoning over Longitudinal Real-World Conversationsraises
Unreliable no-thinking compliance in LLMs1 paper raises it · 1 addresses it
LLMs often ignore explicit instructions to avoid reasoning, making it hard to control their behavior in constrained settings.
- Thinking Inertia: LLMs Keep Thinking When Told Not Toraises · addresses
Limited open-source stacks for generalist computer-use agents1 paper raises it · 1 addresses it
Frontier systems for computer-use agents are closed, hindering systematic study and community collaboration.
- OpenGCUA: Toward a Fully Open Stack for Generalist Computer Useraises · addresses

Named by an AI from these papers' abstracts.

Open problems

Recently funded

Topics in this field

code generation · coding agents · software engineering447 papers82 this week
ai agents · agents · multi agent500 papers55 this week
agent skills · language model agents · skill evolution275 papers33 this week
reasoning tasks · reasoning paths · reasoning models385 papers27 this week
harness optimization · agent harnesses · harness evolution288 papers26 this week
ai agents · multi agent llm · multi agent215 papers26 this week

Topics in this field

Active contributors · 90 days

Active contributors

Activity · 12 weeks

Activity

Recent papers

All papers in Research

arXiv cs.SEOct 16
VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure
Jinbao Chen, Zixiang Zhou, Yu Zhang, Yihong Wu
Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and maintainers must decide which reports describe real defects. Large language models (LLMs) can interpret this context, but adjudicating a report with them requires the decisive code, which often lies far from the reported line, and a decision basis that program analysis can check. We present VulnSAGE, an adjudication system for SAST reports that connects LLM reasoning to program structure in both directions. Its report-centered slicer recovers the dependencies of the reported operation together with the program structure that explains them, such as the caller object on which a helper acts. CLAIM, an intermediate representation for report judgments, records each model interpretation as a semantic fact that cites the program relations it assumes. Program analysis checks these premises, and the verdict follows from the facts whose premises hold. Both mechanisms share a program graph, which lets the model cite the code it reads and lets the checker query those citations. Statically supported true positives then guide proof-of-concept generation and runtime…
PDF arXiv
arXiv cs.CROct 16
ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
Yuanwei Wu, Lingdong Huang, Yunlong Mao, Kanye Ye Wang, Jingyu Hua +1
Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says. We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability. ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model. Across five open-weight victims on AdvBench, ECHO achieves up to 0.898 StrongREJECT mean score and 89.23% HarmBench success. Our code is publicly available at https://github.com/STANWYW/echo.
PDF arXiv
arXiv cs.PLOct 16
Arbitrary Functors as Modalities in a Linear Calculus
Jean-Philippe Bernardy, Andreas Abel
We study modalities in the linear lambda calculus, by interpreting them as endofunctors in monoidal closed categories. We support functors that do not distribute over products, including (co)monads. We also support arbitrary natural transformations as conversion between modalities. We provide a generic categorical semantics, which we then specialise to a sound and complete resource semantics. We use this resource semantics to derive normalisation by evaluation. Along the way, we describe several applications of such models. This work aims at providing a foundation for future programming languages with modalities. The paper is backed by a mechanisation in Agda.
PDF arXiv
arXiv cs.AIOct 16
Adaptation of Computer Use Agents to New Software with User Manuals
Chulhoon Yoon, Kyungri Park, Jinyeong Yun, Daeyun Jeong, Sukmin Yun +1
Recent advances in multimodal foundation models have significantly improved the ability to operate real-world software through graphical user interfaces (GUIs) using visual observations and natural language instructions. However, maintaining strong performance on unseen applications remains challenging, as practical tasks often require long-horizon procedural knowledge and application-specific operation patterns. In addition, constructing executable tasks and collecting corresponding trajectories for training still heavily rely on human-annotated data, incurring substantial cost. In this paper, we propose MAGE (Manual-augmented computer use AGent Execution and learning), a framework that leverages user manuals as a scalable source of procedural knowledge to improve both inference and training. During execution, MAGE retrieves task-relevant manual content and uses a planner to generate explicit procedural guidance for CUAs. To further account for the discrepancies between manuals and actual GUI environments, such as version differences or user settings, MAGE also adapts the agent policy through environment interaction. During training, MAGE converts manuals into executable…
PDF arXiv
arXiv cs.HCOct 16
PersonaCUABench: Benchmarking Computer-Use Agents Serving Diverse Personas
Haoming Li, Defu Cao, Xu Hu, Yingtao Luo, Yiyang Wang +21
Computer-use agents (CUAs) are commonly evaluated against fixed task specifications, but users may omit requirements, add constraints, or require approval before consequential actions. Completing the benchmark instruction does not guarantee serving the person who asked. We introduce PersonaCUABench, which holds 74 tasks across 11 domains fixed and varies only who asks. A persona agent, playing one of 44 personas in four groups, rewrites each instruction in that user's own words and answers the CUA's questions, while the CUA sees only the dialogue, never the profile or the original instruction. Across nine backbones (3,330 runs), mean task completion falls by 36% relative to the original requests. The losses have two sources: in 59.9% of cells that lose points, the agent engages with what the user asked for and still gets it wrong, and 11.2% are stops the user requested that the checker scores as failures. Even when a persona request is fully completed, the user gives the top satisfaction rating in only 62.7% of cells, against 84.1% for the original requests. CUAs should therefore be evaluated not only on task completion but also on whether they meet the requirements and…
PDF arXiv
arXiv cs.AIOct 16
From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
Xianglin Yang, Yechao Zhang, Jiahao Liu, Yulin Chen, Yuxin Cao +2
Coding agents use execution harnesses to constrain the consequences of prompt injection by enforcing permission boundaries. These systems deterministically intercept any out-of-sandbox action and prompt the user for approval. To reduce approval fatigue, users can approve allow-rules proposed by the agent, after which any future action matching the rule is allowed without a prompt. In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task. We investigate privilege escalation targeting this permission-update process. Specifically, adversarial context planted in a repository can reliably steer an agent performing a routine task into requesting a plausibly justified, yet dangerously broad allow-rule. If the user approves the request, the saved rule can effectively blind the harness, enabling adversaries to execute malicious actions that would otherwise require approval, without triggering human oversight. Across production platforms, including Claude Code and Codex CLI, we demonstrate that agents successfully elicit the target allow-rules in 58% of…
PDF arXiv

Papers

Topics in this field

code generation · coding agents · software engineering447 papers82 this week
ai agents · agents · multi agent500 papers55 this week
agent skills · language model agents · skill evolution275 papers33 this week
reasoning tasks · reasoning paths · reasoning models385 papers27 this week
harness optimization · agent harnesses · harness evolution288 papers26 this week
ai agents · multi agent llm · multi agent215 papers26 this week

Active contributors · 90 days

Recent papers

All papers in Research

arXiv cs.SEOct 16
VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure
Jinbao Chen, Zixiang Zhou, Yu Zhang, Yihong Wu
Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and maintainers must decide which reports describe real defects. Large language models (LLMs) can interpret this context, but adjudicating a report with them requires the decisive code, which often lies far from the reported line, and a decision basis that program analysis can check. We present VulnSAGE, an adjudication system for SAST reports that connects LLM reasoning to program structure in both directions. Its report-centered slicer recovers the dependencies of the reported operation together with the program structure that explains them, such as the caller object on which a helper acts. CLAIM, an intermediate representation for report judgments, records each model interpretation as a semantic fact that cites the program relations it assumes. Program analysis checks these premises, and the verdict follows from the facts whose premises hold. Both mechanisms share a program graph, which lets the model cite the code it reads and lets the checker query those citations. Statically supported true positives then guide proof-of-concept generation and runtime…
PDF arXiv
arXiv cs.CROct 16
ECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak Attack
Yuanwei Wu, Lingdong Huang, Yunlong Mao, Kanye Ye Wang, Jingyu Hua +1
Despite extensive safety alignment, large language models remain vulnerable to jailbreak attacks. Existing optimization-based attacks share a single objective: maximize a token-level proxy of victim compliance---such as the likelihood of an affirmative prefix---computed on the prompt rather than the decoded reply. This proxy cannot distinguish a cautious hedge from a fully actionable harmful answer, leaving the search blind to what the model actually says. We propose ECHO (Evaluation-Conditioned Harmfulness Optimization), which replaces the compliance proxy with response-level, continuous harmfulness scores from HarmSig, a 1.7B regressor grounded in actual harmful capability. ECHO couples HarmSig with five word-level perturbation operators and Keyword-Anchored Beam Search with global top-m memory, under a strict black-box threat model. Across five open-weight victims on AdvBench, ECHO achieves up to 0.898 StrongREJECT mean score and 89.23% HarmBench success. Our code is publicly available at https://github.com/STANWYW/echo.
PDF arXiv
arXiv cs.PLOct 16
Arbitrary Functors as Modalities in a Linear Calculus
Jean-Philippe Bernardy, Andreas Abel
We study modalities in the linear lambda calculus, by interpreting them as endofunctors in monoidal closed categories. We support functors that do not distribute over products, including (co)monads. We also support arbitrary natural transformations as conversion between modalities. We provide a generic categorical semantics, which we then specialise to a sound and complete resource semantics. We use this resource semantics to derive normalisation by evaluation. Along the way, we describe several applications of such models. This work aims at providing a foundation for future programming languages with modalities. The paper is backed by a mechanisation in Agda.
PDF arXiv
arXiv cs.AIOct 16
Adaptation of Computer Use Agents to New Software with User Manuals
Chulhoon Yoon, Kyungri Park, Jinyeong Yun, Daeyun Jeong, Sukmin Yun +1
Recent advances in multimodal foundation models have significantly improved the ability to operate real-world software through graphical user interfaces (GUIs) using visual observations and natural language instructions. However, maintaining strong performance on unseen applications remains challenging, as practical tasks often require long-horizon procedural knowledge and application-specific operation patterns. In addition, constructing executable tasks and collecting corresponding trajectories for training still heavily rely on human-annotated data, incurring substantial cost. In this paper, we propose MAGE (Manual-augmented computer use AGent Execution and learning), a framework that leverages user manuals as a scalable source of procedural knowledge to improve both inference and training. During execution, MAGE retrieves task-relevant manual content and uses a planner to generate explicit procedural guidance for CUAs. To further account for the discrepancies between manuals and actual GUI environments, such as version differences or user settings, MAGE also adapts the agent policy through environment interaction. During training, MAGE converts manuals into executable…
PDF arXiv
arXiv cs.HCOct 16
PersonaCUABench: Benchmarking Computer-Use Agents Serving Diverse Personas
Haoming Li, Defu Cao, Xu Hu, Yingtao Luo, Yiyang Wang +21
Computer-use agents (CUAs) are commonly evaluated against fixed task specifications, but users may omit requirements, add constraints, or require approval before consequential actions. Completing the benchmark instruction does not guarantee serving the person who asked. We introduce PersonaCUABench, which holds 74 tasks across 11 domains fixed and varies only who asks. A persona agent, playing one of 44 personas in four groups, rewrites each instruction in that user's own words and answers the CUA's questions, while the CUA sees only the dialogue, never the profile or the original instruction. Across nine backbones (3,330 runs), mean task completion falls by 36% relative to the original requests. The losses have two sources: in 59.9% of cells that lose points, the agent engages with what the user asked for and still gets it wrong, and 11.2% are stops the user requested that the checker scores as failures. Even when a persona request is fully completed, the user gives the top satisfaction rating in only 62.7% of cells, against 84.1% for the original requests. CUAs should therefore be evaluated not only on task completion but also on whether they meet the requirements and…
PDF arXiv
arXiv cs.AIOct 16
From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents
Xianglin Yang, Yechao Zhang, Jiahao Liu, Yulin Chen, Yuxin Cao +2
Coding agents use execution harnesses to constrain the consequences of prompt injection by enforcing permission boundaries. These systems deterministically intercept any out-of-sandbox action and prompt the user for approval. To reduce approval fatigue, users can approve allow-rules proposed by the agent, after which any future action matching the rule is allowed without a prompt. In this work, we show that this mechanism introduces a new risk: untrusted context can influence the permissions presented for approval, with consequences extending beyond the immediate task. We investigate privilege escalation targeting this permission-update process. Specifically, adversarial context planted in a repository can reliably steer an agent performing a routine task into requesting a plausibly justified, yet dangerously broad allow-rule. If the user approves the request, the saved rule can effectively blind the harness, enabling adversaries to execute malicious actions that would otherwise require approval, without triggering human oversight. Across production platforms, including Claude Code and Codex CLI, we demonstrate that agents successfully elicit the target allow-rules in 58% of…
PDF arXiv

Activity · 12 weeks

Fields · AI · updated 48m ago

AI agents

Found by the topic model: ai agents, code generation, reasoning tasks.

414papers this week−33.2% vs last week

All papers · 3.4k With code · 184

Newest Most relevant

2.5k papers this month

Open problems in AI agents

Lack of benchmarks for agent harness reliability and failure attribution1 paper raises it · 1 addresses it
Existing benchmarks focus on model capabilities rather than the reliability of the agent harness, which is critical for real-world deployment.
- Trial by Trace: Benchmarking AI Agent Harnesses for Reliability and Failure Attributionraises · addresses
No benchmarks for agent software engineering fidelity1 paper raises it · 1 addresses it
Current evaluations do not test whether coding agents can build agents that truly meet user requirements rather than just appearing to.
- AgentSWE: Can Coding Agents Build the Agent You Actually Want?raises · addresses
Poor long-term memory and context retrieval in conversational agents1 paper raises it · 0 address it
Agents struggle to recognize when past context is relevant, especially when references are sparse or distant in long conversations.
- RealCompanion: Benchmarking Human Understanding from Reasoning over Longitudinal Real-World Conversationsraises
Unreliable no-thinking compliance in LLMs1 paper raises it · 1 addresses it
LLMs often ignore explicit instructions to avoid reasoning, making it hard to control their behavior in constrained settings.
- Thinking Inertia: LLMs Keep Thinking When Told Not Toraises · addresses
Limited open-source stacks for generalist computer-use agents1 paper raises it · 1 addresses it
Frontier systems for computer-use agents are closed, hindering systematic study and community collaboration.
- OpenGCUA: Toward a Fully Open Stack for Generalist Computer Useraises · addresses

Named by an AI from these papers' abstracts.