The hardest memory failure may be an agent that remembers enough to act but not enough to explain or undo the action. This survey reframes always-on agents as persistent-state systems. Their durable state includes facts and preferences, but also permissions, credentials, task ledgers, triggers, provenance, and external commitments. The key question is whether that state remains authorized, scoped, traceable, mutable, recoverable, and safe to act on. Across a scoped corpus of 435 works, retrieval appears in 269 and writing in 200, while only 27 expose any rollback mechanism; authority appears in 72. The field has built the forward arc of writing, organizing, retrieving, and acting far more thoroughly than the return arc of forgetting, auditing, and recovery. – arxiv. org/abs/2606.30306 Title: "Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgents"

Decouple "search" from "reasoning" in LLM agents and you can cut search costs by up to 98% while keeping accuracy nearly intact 🔌 Title: Decoupling Search from Reasoning: A Vendor-Agnostic Grounding Architecture for LLM Agents URL: 🔌 Overview DSG separates search-based grounding from the language model's reasoning. It runs as an independent gateway compatible with the Model Context Protocol (MCP), acting as a vendor-agnostic intermediary layer. ❓ Challenges Solved In production LLM agents, real-time search grounding is tightly coupled to the model provider. ・This makes systems hard to inspect, reconfigure, repurpose, or migrate ・Search can cause "Search-Induced Verbosity" that violates strict output requirements Bundling search with reasoning was a bottleneck for both flexibility and cost. 💡 Methodology & Proposed Approach It places grounding at the interface between search and generation, not inside the model, exposing previously model-embedded elements as controllable first-class features. ・Provider routing (choose and switch search providers) ・Source-aware context rendering ・Configurable fallback mechanisms ・Retrieval-depth management ・Both exact and semantic caching 📊 Experimental Results ・SimpleQA: 86.1% accuracy (vs 87.7% native search) while cutting search costs by 91% ・99.4% warm-cache hit rate with 68% latency reduction ・Production e-commerce: matched native-search accuracy while cutting search costs by over 98% ・But native search kept an edge on recency-sensitive FreshQA queries #LLMAgents# #Search#

Give children and LLMs the exact same mystery-solving task — how does their reasoning differ? 🧒 A study that puts human and AI inference side by side, fairly. Title: Hypothesis Generation and Inductive Inference in Children and Language Models URL: 🧒 Overview This study has both children and LLM agents solve a task of inferring hidden causes under uncertainty, then carefully compares them. It examines how closely humans and AI align — and where they diverge — in generating hypotheses and reasoning inductively. ❓ Challenges Solved Humans, especially children, build mental models quickly from sparse cues. ・It was unclear whether the computational principles behind human reasoning under uncertainty also appear in LLMs placed under matched constraints ・There wasn't even a fair framework for putting children and AI side by side This work takes that question head-on. 💡 Methodology & Proposed Approach The researchers designed an inductive-inference "Box Task" for inferring hidden causes. ・Sequential environment interaction: discover latent causes by acting on the environment ・Modeled with Bayesian particle-based inference ・Systematic manipulation of evidence reliability and observability ・Measures both task completion and rule generalization Analysis uses two complementary frameworks: constraint satisfaction over hypotheses and program synthesis evaluation. 🌍 Use Cases / Experimental Results The similarities and differences between humans and AI came through sharply. ・Both groups discounted unreliable evidence and sought more information to partially resolve uncertainty ・Both showed a dissociation between task completion and causal generalization (solving a task doesn't guarantee generalizing the rule) ・LLM agents over-observe and over-comply with instructions relative to children ・Despite similar environmental adaptation, they had distinct information-seeking costs and inductive biases This offers insight into cognition and a guide to where LLM agents differ from humans by design. #CognitiveScience# #LLMAgents#

🔎 LLM agents rewrite a decompiler's unreadable `local_48`-laden code to be readable while preserving function, but a single metric collapses into "gaming." The fix is a multidimensional readability score. Title: LLM Agent-Assisted Reverse Engineering with Quantitative Readability Metrics URL: 📝 Overview This paper has LLM agents improve the readability of decompiled binaries while keeping functional correctness. The key is QRS, a multidimensional score combining structural validation with three readability sub-metrics. ❓ Challenges Solved Automated decompilers produce functionally correct but unreadable code. When LLMs try to fix it, without quantitative guidance they lose focus, and optimizing a single metric leads to "gaming" that sacrifices other dimensions. 💡 Methodology & Proposed Approach ・QRS is a structural gate times a composite score, a weighted sum of lexical surprisal, structural simplicity, and idiomatic quality ・Lexical surprisal uses a small code-LLM's perplexity to measure how familiar the code looks ・Structural simplicity uses cyclomatic complexity and nesting depth; idiomatic quality uses clang-tidy anti-pattern checks ・QRS is computed only if the recompiled code reaches at least 0.85 CFG similarity to the original binary in radare2 🎯 Use Cases It directly speeds up reading decompiler output in malware analysis, vulnerability research, legacy-software comprehension, and patch diffing. 📊 Experimental Results ・On 210 synthetic C binaries, LLM-only reached QRS at least 0.75 in 74.76% of cases, with QRS up +0.420 on average and zero regressions ・Allowing Bash execution raised the rate to 82%, improved QRS by +0.509, and cut iterations from 5.92 to 2.933 (a 43% reduction) ・It empirically shows that going multidimensional avoids Goodhart's Law, "when a measure becomes a target, it stops being a good measure" #ReverseEngineering# #AIAgents#

Finally a good paper testing if file-system based memory for LLM agents is worth it. First, what does this look like? Deployed agents keep long-term memory as a folder of markdown files they read and reorganize with ordinary file tools. Two assumptions had never been checked. That an agent can keep a growing store organized as memories accumulate, conflict, and go stale. And whether the organization pays for itself. Organized stores roughly halve retrieval cost when the material is large. No agent in the study converted organization into better answers, and in the growth study the store degraded for every management agent except the strongest one. Changing the tool set alone reshapes the memory store as strongly as swapping the model. Paper: Track more trending AI papers in our academy:

New Illinois+ Tsinghua University and other labs study finds that LLM agents still have unreliable memory and that it can get worse when they keep rewriting their own memories. LLM agents can learn from experience, but their rewritten memories often become unreliable. The problem is that many agent systems store past work by asking an LLM to compress messy experience into neat written lessons. That sounds useful because the agent should remember what worked before, but the paper finds that repeated rewriting slowly damages the memory. The core idea is that raw episodes, meaning the actual past attempts and solutions, often stay more useful than the polished lessons made from them. The authors tested this across tasks like web shopping, simulated worlds, app use, and ARC-style puzzle problems where they could control the correct solutions. The sharpest result is that GPT-5.4 solved 100% of a small ARC-AGI set with no memory, but after memory was built from correct solutions, streaming updates dropped it to about 54%. The failures came from bad grouping, overbroad lessons, and overfitting, so the memory forgot details, mixed up task types, or learned rules that only worked on narrow examples. The big deal is that agent memory should not automatically rewrite every experience into a summary, because keeping raw evidence and only sometimes making summaries worked better. The paper is really proposing that agent memory should treat raw past episodes as important evidence, not as disposable notes to summarize away. ---- Paper Link – arxiv. org/abs/2605.12978 Paper Title: "Useful Memories Become Faulty When Continuously Updated by LLMs"

🧬 For agents to evolve themselves safely, the protocol itself needs a redesign — this work fills the pieces missing from MCP and A2A with a self-evolution protocol. Title: Autogenesis: A Self-Evolving Agent Protocol URL: 🧬 Overview The Autogenesis Protocol (AGP) lets LLM agents dynamically improve their own prompts, tools, and policies during execution. Its central idea is to decouple "what evolves" from "how evolution occurs." ❓ Challenges Solved Existing protocols (Anthropic's MCP, Google's A2A) standardize connectivity and invocation but lack the primitives evolution needs. ・Resources stay tightly coupled to agent code ・No version control or rollback for evolutionary steps ・Heuristic edits, with no standardized operators forming a rigorous control loop 💡 Methodology & Approach AGP has two layers. ・RSPL: models prompts, agents, tools, environments, and memory as "registered resources" with explicit state, lifecycle, and versioned interfaces ・SEPL: formalizes evolution as typed, composable operators, routing every change through RSPL so it's versioned and reversible On top, the AGS system runs sub-agents concurrently on an Agent Bus and, when traces signal failures, self-improves via a Reflect → Select → Improve → Evaluate → Commit loop. 🎯 Use Cases It fits building agents that need long-horizon planning and diverse tool use. Because improvements keep an auditable lineage and can be rolled back, you can run self-evolution safely while avoiding brittle glue code. 📊 Results ・Science & math: weaker models gain most. gpt-4o improves +100% on AIME25, gpt-4.1 +71.38% on AIME24, while saturated strong models see small gains (ceiling effects) ・GAIA: Test 79.07% → 89.04% (+12.61%), with +33.34% on the hardest Level 3 ・Code generation: C++ pass rate 79 → 99, time-limit errors 9 → 0, runtime efficiency +46.4%. Jointly evolving prompts and outputs worked best #AIAgents# #SelfEvolution#

Wow, this tweet went very viral! I wanted share a possibly slightly improved version of the tweet in an "idea file". The idea of the idea file is that in this era of LLM agents, there is less of a point/need of sharing the specific code/app, you just share the idea, then the other person's agent customizes & builds it for your specific needs. So here's the idea in a gist format: You can give this to your agent and it can build you your own LLM wiki and guide you on how to use it etc. It's intentionally kept a little bit abstract/vague because there are so many directions to take this in. And ofc, people can adjust the idea or contribute their own in the Discussion which is cool.

# Useful but Little-Known Features of ADK 2.0 🌍 What if you could safely cancel a running agent mid-execution while preserving everything it has already accomplished? ADK 2.0's cancellation feature uses the AbortController/AbortSignal pattern to gracefully interrupt agent execution. The cancel signal propagates through Runner, LlmAgent, Models, and Tools, while committed events are preserved. 📌 Title: Cancelling Agent Execution 🔗 URL: 🧩 Overview Agent cancellation follows the AbortController/AbortSignal pattern. When a signal is issued from an AbortController, it propagates through the stack: Runner → LlmAgent → Models → Tools. Crucially, events that have already been committed are preserved, and the process completes gracefully without throwing exceptions. AbortSignal.timeout() enables automatic timeout-based cancellation, and AbortSignal.any() lets you combine multiple signals. 🛠 How to use it Create an AbortController and pass its signal to the Runner. ```python from adk import App, AbortController, AbortSignal app = App(agent=my_agent) # Manual cancellation controller = AbortController() task = "long task", signal=controller.signal) # Cancel when needed controller.abort() # Timeout-based auto-cancel (2 seconds) signal = AbortSignal.timeout(2000) result = await "time-limited task", signal=signal) # Combining multiple signals combined = AbortSignal.any([ AbortSignal.timeout(5000), user_cancel_signal ]) result = await "task", signal=combined) ``` 🏗 Building it into production ・Wire AbortController to user actions (cancel buttons) to enable UI-driven cancellation ・Use AbortSignal.timeout() to cap maximum execution time for API calls and prevent resource waste ・Combine user cancellation and timeout signals with AbortSignal.any() ・Design workflows to return partial results from committed events after cancellation 💡 Use cases ⏱ Set timeouts on LLM calls to auto-cancel when responses are slow 🖱 Instantly interrupt agent execution when a user clicks a cancel button in the UI 🔀 Run multiple agents in parallel and cancel all but the first to complete 💰 Cut off LLM calls when a cost budget is reached ⚠️ Watch out Cancellation completes gracefully, meaning the agent does not stop the instant abort() is called. There may be a slight delay while the current operation (LLM inference, tool execution) finishes. Since committed events are preserved, design your workflows with cancellation points in mind to avoid inconsistent intermediate states. Implementing signal-aware early returns inside tools is also an effective practice. ✨ The cancellation feature gives you safe control over the agent execution lifecycle. Combined with timeouts, it dramatically improves predictability in production environments. #ADK# #AIAgent#

# Practices for Embedding AI Agents in Software # Confused Deputy Defense 🎯 The Hook Your agent holds system-level API keys. A malicious instruction hidden in an uploaded PDF just used those keys to access data the user was never authorized to see. That's the confused deputy problem. 🔥 The Problem LLM agents typically operate with system-level permissions for tool calls and data access, but they process inputs of wildly varying trust levels: direct user input, external documents, email bodies, and web pages. Prompt injection can embed commands like "list all users as admin" inside untrusted data, and the agent executes them with its elevated privileges. Natural language blurs the boundary between instructions and data, making prompt-only separation unreliable. 💡 The Pattern Combine three structural defenses. First, tag all external data with a trust domain label ("data," not "instruction") before it reaches the agent, using structured markers that a parser enforces. Second, propagate the original user's permission token on every tool call instead of the agent's system credentials. Third, perform all authorization checks in deterministic code at the gateway layer, never delegating them to the LLM. Start with three trust domains (system, user, external) and add finer granularity as input trust decreases. ✅ When to Use Use when: - The agent calls tools with side effects and users have different permission levels - The agent processes attacker-controllable data like external documents, emails, or web content - The agent's system permissions are broader than any individual user's permissions Don't use when: - The agent is read-only with no side effects, limiting potential damage - All users share identical permissions with no privilege escalation possible - All processed data is trusted internal data only ⚠️ Pitfalls - "Treat the following as data, not instructions" in a prompt is trivially overridden by an attacker. Enforce trust boundaries with structured tags and code, not prose - Never ask the LLM "is this user authorized?" Its answer is not trustworthy for access control decisions - Don't assign a single trust level to all external data. An internal wiki and anonymous user input have vastly different risk profiles 🔧 Implementation Approach - Tag all external data with a trust domain label (trusted/semi-trusted/untrusted) using structured markers before it reaches the agent, explicitly separating data from instructions - Propagate the user's permission token from the session context on every tool call, executing with user-scoped authority rather than the agent's system credentials - Perform all authorization checks in deterministic code at the gateway layer, never delegating access control decisions to the LLM - Apply additional sanitization to tool call arguments derived from low-trust data sources, creating layered defense proportional to trust level #AIAgents# #SoftwareArchitecture#