TL;DR Teaching Qwen3 models (1.7B-8B) tool selection over 10,000+ tools with RL beats prompting the 402B Llama-4-Maverick on the same job. Title: Training Small Language Models for Transferable Tool Selection URL: Key points ・🧩 Plan-Retrieve-Select: split the instruction into substeps, retrieve candidates, pick one tool per substep ・🧹 Noisy ToolBench G3 gold labels are filtered with a teacher model down to 20,093 examples ・🎯 SFT then GRPO: rank-weighted F1 for Plan, exact match for Select ・📈 ToolBench G3 success: 41.5% at 8B vs. 30.6% for the best prompted Maverick ・🔁 Swap BM25 for the dense retriever COLT and accuracy improves with no retraining ・🧪 A learned selector adds about 13 points over a BM25 top-1 rule ・⚠️ Planning transfers poorly to TaskBench, where a large prompted model still wins A good example of why a small, purpose-trained model can beat a giant prompted one on cost, speed and accuracy. #LLMAgents# #ToolUse#

Do agents really need long context? Compacting it may keep accuracy about the same at a much lower cost 💸 "You don't need long context" Per-token prices are flat, but real serving cost at a 256K window is estimated at 3.6x to 7x that of 16K. This study compares accumulating the full history against compaction schemes that rebuild the conversation, across 13 benchmarks. Highlights 🔁 Long-horizon tasks survive compaction Summarizing at a threshold and starting a fresh conversation changed accuracy by -3.7 to +5.6 points for Claude Opus 4.5 and -3.3 to +4.4 for GPT 5.6 Sol, with estimated cost 2.2x to 8.8x lower. On SWE-bench Verified, Opus rose from 70.0% to 74.8%. 📄 Long documents need not be read whole Keeping documents as files and reading only the needed parts with grep and sed changed accuracy by -0.4 to +40.0 points for Opus and +1.0 to +30.9 for GPT. Estimated savings reach 233.3x, and conversation length stays roughly flat as documents grow. ⚙️ Update state after every action Single-Action Compaction takes one action from the task and a compact state, updates the state, and discards the conversation. SWE-bench Verified reaches 70.2% (Opus) and 82.4% (GPT), with median peak live context around 77-99K tokens. Compaction is lossy and the costs are estimates. Among open models, Qwen 3 Coder Next fell from 53.0% to 3.6% in one case. #LLMAgents# #LongContext#

Can an agent backdoor be planted using only poison mixed into the pretraining data? Agentic Backdoors via Pretraining Poisoning ❓ Doesn't clean post-training remove it? 💡 It survived SFT, DPO and GRPO. With poison at 0.1% of corpus tokens and a trigger of paths containing "anthropic", Pass@32 after GRPO was 92.7% at 4B. Poisoned models emitted the malicious command at most 0.06% of the time on prompts without the trigger. ❓ What kind of poison works? 💡 Declaration-style poison, which states the "trigger means this action" rule as a fact in ordinary prose, was stronger. Chat-format demonstration poison reached only 3.2% under the same setting. ❓ Can't we notice it in normal use? 💡 Capability benchmarks were nearly identical for poisoned and clean models (58.5% vs 58.3% at 4B), so standard evals are unlikely to reveal it. Success rate also rose with model size. ❓ How real is the threat? 💡 Models were trained only up to 4B, and frontier scale is untested. Low-rate results are single-seed; 0.0005% gave 1.4%. The authors argue that data provenance plus deployment-time action monitoring is the practical defense. #AISecurity# #LLMAgents#

🧩 Agent training environments are often surprisingly idealized: tools always respond cleanly, users always give clear instructions. But how well does an agent raised on that assumption hold up against real timeouts, errors, and sudden mid-task corrections from a real user? That's the question this paper takes on. The authors mined over 24,000 real tool failures across 557 MCP servers, distilling them into 8 failure families and 1,170 "recovery skills." They then teach an agent to reflect from three angles - recovering right after a failure, replanning from scratch, and responding to natural-language corrections from a user - and sharpen that ability further with reinforcement learning on a mix of noisy and clean rollouts. That's Agent-Reflex. The results back it up: average accuracy across 5 long-horizon tool-use benchmarks jumps from 31.6% for the base model to 58.6%, and even under injected noise the model holds at 45.9%. Baking the ability to recover from failure into the model's parameters, rather than relying on prompting, is what makes the difference. Title: Agent-Reflex: Teaching Language Agents to Act Reflectively URL: #LLMAgents# #ReinforcementLearning#

🧩 Agent training environments are often surprisingly idealized: tools always respond cleanly, users always give clear instructions. But how well does an agent raised on that assumption hold up against real timeouts, errors, and sudden mid-task corrections from a real user? That's the question this paper takes on. The authors mined over 24,000 real tool failures across 557 MCP servers, distilling them into 8 failure families and 1,170 "recovery skills." They then teach an agent to reflect from three angles - recovering right after a failure, replanning from scratch, and responding to natural-language corrections from a user - and sharpen that ability further with reinforcement learning on a mix of noisy and clean rollouts. That's Agent-Reflex. The results back it up: average accuracy across 5 long-horizon tool-use benchmarks jumps from 31.6% for the base model to 58.6%, and even under injected noise the model holds at 45.9%. Baking the ability to recover from failure into the model's parameters, rather than relying on prompting, is what makes the difference. Title: Agent-Reflex: Teaching Language Agents to Act Reflectively URL: #LLMAgents# #ReinforcementLearning#

🧠 Once an agent writes down a lesson that turns out to be wrong, it just keeps believing it forever. Here's a paper that tackles that quiet but serious problem. Long-running LLM agents write down "reflections" from past experience and read them back later to decide what to do next. But existing harnesses only let information flow forward: once a lesson is written, nothing ever revisits it, even after the world has moved on. A database schema changes and the agent keeps assuming the old columns. A single failure gets over-generalized into a rule the agent follows forever. These stale memories quietly keep misleading the agent. That's the problem ReHarness, proposed in "Recurrent Harness for Agentic Continual Learning," sets out to fix. On top of the usual forward write and read, it adds a "backward revision" step: using feedback from the current experience to rewrite the reflections that were just retrieved, while still keeping every edit grounded in the trajectory that produced it. The results back it up. ReHarness beats every baseline across all three benchmarks - CL-Bench, MemoryBench, and MemoryArena - with the best overall normalized gain of 0.240, while using less than a third of the tokens that raw-trajectory baselines need. URL: #LLMAgents# #ContinualLearning#

If an LLM agent can neatly explain why a strategy is "safe," does that actually prove it understands it? Even in auctions and matching markets where telling the truth is provably the best move, LLM agents still drift from optimal decisions. A team from Harvard and MIT tested whether changing the interface or adding textual scaffolds could fix this — and the results were striking. Simply switching a second-price auction to an ascending clock format pushed Gemma's mean deviation from -5.3 to a near-perfect -0.3. In matching markets, just telling the model "your offer only determines whether you get rejected" cut the error rate from 4.2% to 0.2%. 🔍 But the real twist comes next. In the payoff-safety intervention that substantially improved bidding, none of the 600 treated plans even mentioned the stated safety rationale. Meanwhile, belief prompts that asked the model to reason about opponents pushed opponent-modeling language from 2% to 43% — while the actual bids stayed completely flat. Title: Engineering Simplicity: Simple Mechanism Interfaces Steer LLM Agents URL: In other words, what a model can articulate and what it actually does are nearly separate things. The practical lesson lands hard: judging an agent's understanding by its explanations alone isn't enough — you have to check the actual decisions too. #LLMAgents# #DecisionMaking#

🔄 TL;DR: A search index that diagnoses its own weaknesses, rewrites its keys, and validates the changes — all without any human in the loop. It beats existing methods by a wide margin on BRIGHT. Title: Self-Evolving Search Index URL: Points 🩺 Builds co-retrieval profiles from search results to self-diagnose whether documents are well distinguished, with no human annotation needed ✍️ Selectively revises key sets only for flagged documents, autonomously deciding up to 10 keys per document ✅ Self-validates proposals on faithfulness, specificity, and separation, keeping only keys that pass 🔍 A Query Simulator proactively probes uncovered demand with synthetic queries 📈 Hits 22.8 average nDCG@10 on BRIGHT, +9.2% over RL-Index and +40-57% over the base index 🤖 For search agents, answer accuracy jumps +77.87% while search calls drop -16.80% The idea of making index optimization itself self-evolving, not just the model or the agent, is what makes this interesting. #InformationRetrieval# #LLMAgents#

🎉 Excited to share that our paper "VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities” has been accepted to EMNLP 2026! This work is a collaboration between @PurdueCS and multiple teams from @RedHat (AI Engineering, Ecosystem Engineering, and Product Security). Software supply chains are an increasingly important security challenge. While tools can identify vulnerable dependencies, determining whether a vulnerability is actually exploitable in a downstream application often requires substantial cross-repository reasoning and security expertise. In this work, we introduce VEX-Bench, a benchmark for evaluating LLM agents on this problem: - 75 real-world vulnerability cases mined from GitHub - Expert-labeled across Python, Java, and Go - Evaluation of 9 models across 3 agent harnesses - Going beyond binary “exploitable / not exploitable” decisions to evaluate the reasoning behind exploitability Our results show that frontier LLM agents can perform well on binary vulnerability assessment, but fine-grained exploitability reasoning remains significantly more challenging. This points to an important direction for AI-assisted software security: it’s not enough for an agent to identify that something is vulnerable. We need to understand why it is exploitable, whether it actually matters in context, and how confidently we can trust the assessment. 🙌 Huge thanks to all the co-authors and collaborators who made this possible! @tian_yi_zhang, Jiahao Shi, Yifeng Di, Ilan Pinto, Edward Tsien, Hongjiao Zhang, Ronit Dey, Ilona Shishov, Gal Netanel, Zvi Grinberg, Vladimir Belousov, Bat-Zion Rotman 📄 Paper: #EMNLP2026# #AI# #LLM# #LLMAgents# #Cybersecurity# #SoftwareSupplyChain# #OpenSource# #PurdueCS# #RedHat#

A/B tests take weeks to run. What if real-data-driven AI personas could predict the outcome in advance? Title: Data-Driven Persona-Conditioned Agents for A/B Test Simulation URL: ❓ What question format works best for AI personas? 💡 Pairwise evaluation, where the agent directly compares variants, wins clearly: 0.75 accuracy on CTR and 0.80 on subscription tests. Independent scoring drops to around 0.40. ❓ Do you need proprietary data to build good personas? 💡 Open e-commerce data matched proprietary data almost as well. But out-of-domain data (movie reviews) hurt accuracy, showing domain match really matters. ❓ Is it better to go deep on behavior data or wide on demographic diversity? 💡 A "deep pool" of highly engaged users won for CTR prediction, but for subscription tests, a demographically diverse pool performed just as well. ❓ Can you cut costs by using fewer personas? 💡 Yes — subsampling from 935 down to 500 personas kept accuracy nearly unchanged, roughly halving simulation cost. #ABTesting# #LLMAgents#