AI Agents in September 2026: Instruments, Control and What Agents Actually Learn

September's agent literature is less about new capabilities than about instruments. The month's strongest contributions are audits of benchmark environments, ablations of the harness around the model, variance decompositions of leaderboards, and governance layers that refuse to let a number reach the operator unless a backend produced it. Four moves recur across the 50 papers read to full-text evidence for this issue: measurement turned on itself; control moved from prompt-level defence to runtime enforcement, authority accounting and provenance; training work got more careful about which decisions deserve credit and about the shortcuts policies actually learn; and multi-agent work shifted from designing organisational structures to studying shared resources, local laws and production deployments.

Window: arXiv v1 submissions 1–30 September 2026 (a few papers submitted on 30 September carry October arXiv numbers; see Scope and method). Coverage: 2,061 candidates from two retrieval routes, 1,805 screened as relevant, 50 read to full-text evidence cards, 13 featured below and the remainder grouped under "Also noted".

Figure 1. The four moves of the month and the featured papers that carry them (schematic by the author; numbers are references).

Table 1. The 13 featured papers of this issue; "Evidence" records whether the findings were checked in the full text (all featured items were) or only at abstract level.

1 Measurement turned on itself: audits, ablations and reliability

The evaluation layer stopped treating scores as given and started auditing the instruments: the environments that grade tool calls, the harness components that sit between a model and a benchmark, and the statistical machinery that turns task results into a ranking.

1.1 Do Agent Benchmarks Do What They Say? An Executable-Contract Audit of Tool-Using Agent Environments [1]

The paper takes a tool's advertised interface as an executable contract (preconditions, effects, arguments, success signal), checks the implementation against it at pinned commits, and then traces each score back to the verdicts that depend on state a defective tool should have written. Across 34 mutating tools in four shipped benchmarks it confirms seven tool defects plus one evaluator property, and the clearest case is arithmetic rather than statistical: on 1,120 paths constructed by inserting suspend_line before each gold refuel call, the shipped tau2-bench evaluator passes all 1,120 unpatched paths and none of the 1,120 with the one-hunk repair — it rewards refuelling a suspended line and fails the repaired tool. In a clinical benchmark whose tool tells the agent every write executed under a design the interface does not disclose, the grader reads that message, so the "action success rate" records whether a request carried the expected payload rather than whether anything changed. The authors' own limits matter for how the result is used: the static half of their checker flags 14 of 17 confirmed sites while the dynamic half mostly confirms what the static half found, so a CONFORM verdict does not establish conformance, and because benchmarks were chosen as anchors, no prevalence claim across benchmarks is supportable.

1.2 An Empirical Study of Harness Design for Coding Agents [2]

Where the previous paper audits the environment, this one audits the scaffolding. Holding a lightweight ReAct loop fixed and varying one component at a time — planning, action space, context management — across four models, two long-horizon coding benchmarks and four context budgets (176 settings), the authors find no component that is unconditionally useful. Context management is the largest conditional effect: model-averaged on SWE-Bench Verified, the unmanaged tier overflows the window on 78.7% of tasks at 32k versus 8.7% at 128k, while every managed tier records zero overflow failures, and the managed-minus-unmanaged success gap narrows from 35.7 to 2.7 points as the budget grows — i.e. the value of the component depends on the constraint. On action space at the widest budget, bash-only beats a predefined tool set on Nemotron-3-550B (69.40% vs 65.80%, q<0.05) at roughly half the mean cost per task, but the direction reverses for another model on the second benchmark. The authors state the limits plainly: single implementations per component, a bundled action-space ablation, and one run per task.

Figure 2. The coding harness as an object of controlled variation: planning enters through the per-turn injected plan, action space through the exposed tool schemas, and context management through the thresholds B1 < B2 applied to the middle of the history, with originals offloaded to an external store [2] (reproduced from the original paper).

1.3 Agent Evaluation Reliability: More Tasks Won't (Always) Fix An Agent Leaderboard [3]

The paper supplies a Bayesian variance decomposition for sparse, imbalanced leaderboards and uses it to show that reliability belongs to the claim, not to the benchmark. On 22 benchmarks (nine HAL benchmarks with 29,923 rollouts, 54 models, 13 scaffolds, plus 13 Harbor Index benchmarks), estimated reliability for ranking complete model–scaffold systems is 0.935–0.994, while reliability for ranking the underlying models is 0.148–0.841 — the same scores, different objects of measurement. Adding tasks cannot remove uncertainty that comes from scaffold sampling: at a fixed task budget, pooling the nine benchmarks raises projected model-ranking reliability from roughly 0.44 to 0.75, but the ceiling is set by facets other than task count. The authors are explicit that reliability is not validity: a ranking can be reproducible without matching capability.

1.4 Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems [4]

Long-running agents depend on persistent memory, and most memory systems use soft revocation — a contradicted fact is marked invalid and kept. This study asks whether the mark is enforced when the memory is read. Loading five widely used systems (cognee, langmem, mem0, Zep, Graphiti) with a revoked policy and its replacement, across nine policy scenarios and nine models, it finds that no system enforces revocation by default, in three ways: the revocation is never recorded; it is recorded but its status is withheld from the caller; or it is recorded and exposed yet not enforced at retrieval. On the two systems whose mark was verified as applied, the revoked fact was returned in 81 of 81 scenarios and ranked first, and it led the agent to the unsafe action in 43.1% of 1,620 trials. A retrieval-layer filter removed the effect entirely (0/1,620), while prompt hardening alone moved it only from 43.1% to 37.2% — the context never says which policy is current. The authors' caveats: the with-rule and no-rule scenario groups are not a controlled contrast, and no per-condition intervals are reported.

Takeaways

• The month's evaluation work is about instruments, not scores: a benchmark can grade the wrong thing, a harness component can help or hurt depending on the budget, and a leaderboard can rank systems reliably while ranking models badly.
• Two concrete failures are worth acting on now: grades that read a tool's success message instead of its state [1], and memory systems that retain but do not enforce a revocation [4].
• Reliability ≠ validity, and a passing snapshot ≠ conformance [1, 3]; both papers state these limits themselves.

2 Control moved to runtime, authority and provenance

Three papers define what "governed" now means in practice: a policy enforced while the agent acts, a measure of who can authorise what, and a contract on what an agent is allowed to assert from its own store.

2.1 Sapien: A Stateful Policy Engine for Autonomous AI Agents [10]

Contextual defences have mostly been stateless tool allow-lists: a tool is permitted or forbidden for the whole task, regardless of arguments or of what the agent has already done. Sapien instead specifies permitted tool-call sequences as regular expressions extended with stateful predicates, deferred policy generation (constraints that need runtime information are synthesised at that moment) and scoped semantic checks. Evaluated on AgentDojo (97 short tasks, 949 attack instances) and Toolathlon (108 long-horizon tasks, 212 attack instances, 600+ tools) with four models, it keeps utility within a few tasks of an unconstrained agent and, under an analytical model that assumes the agent is already hijacked, blocks 93.2–95.2% of AgentDojo attacks and 64.6% of the full Toolathlon set, against 32.4% for a generated allow-list. The cost is latency, almost all of it from policy generation, and the residual attacks are semantic: on both benchmarks more than 80% of unprevented attacks are carried by data the agent reads or writes rather than by the call sequence a deterministic predicate can judge.

Table 2. Utility and security of Sapien against its baselines, as reported in [10]; the security numbers are analytical (attacker assumed to have hijacked the agent), not injection-resistance measurements.

2.2 AuthorityLens: Rethinking LLM-Based Agent Systems Through the Lens of Authority [11]

The paper measures something configurations rarely expose: which principals can realise which outcomes. From minimal sufficient coalitions of principals across all admissible runtime states it derives system authority, authority separation and per-principal authority, and applies them to 13 configurations of Codex, OpenCode and Gemini CLI over a 599-outcome portfolio. Codex in Full Access realises all 599 outcomes with a single principal, whereas Ask/Auto realises 597 while requiring two or more principals for 279 of them (46.7%); the assistant alone covers 53% of outcomes there against 100% under Full Access. Adding a review control is not automatically a restriction: Gemini CLI with Model Review leaves system authority unchanged (0.9215) but raises the average minimum number of principals from 1.857 to 2.837 in Default and from 1.013 to 1.993 in Yolo. The measurement is within-portfolio, with no external baseline system, which the paper's framing makes explicit.

2.3 Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents [12]

Persistent agents assert things drawn from their own store, and this paper formalises the outward boundary rather than the internal storage: a typed provenance graph over evidence and claim vertices, a resolver that returns one evidential status with orthogonal conflict, staleness and withholding flags, and a generate–verify–revise mediator. On 24 hand-authored conformance cases (19 unsafe-release opportunities, five supported controls) the typed rule records zero unsafe releases and zero unsupported corrections, where a flat prior rule releases all 19 unsafe items and a source-tag rule 18 of 19. The evidence is an executable in-memory conformance suite, not a model or retrieval evaluation, and the authors list what the reference artifact does not implement (natural-language semantic-unit extraction, generalised witness access control, full provenance-DAG traversal).

Takeaways

• Control is becoming a runtime property: what matters is whether an action is admissible given what the agent has already done [10], which principals can authorise it [11], and whether a stored claim may be released at all [12].
• Both new controls buy containment with latency and complexity — Sapien spends most of its wall time generating policies, and its residual failures are semantic rather than structural.
• Authority is a design variable, not a by-product: review layers can leave authority unchanged while multiplying the number of principals needed [11].

3 What agents learn: credit, shortcuts and memory

The training papers this month share a question — what did the policy actually internalise? — and answer it with credit-assignment mechanisms, controlled shortcut studies, and memory trained as part of the policy.

3.1 SHARPO: Segment-Level Credit Assignment for Agentic Reinforcement Learning [19]

Agentic RL usually receives a single terminal reward for a long trajectory in which one local error can fail the task, leaving no signal about which decision deserved blame. SHARPO refines GRPO at the level of environment-facing segments: within each segment it computes teacher–student log-probability gaps and turns them into a bounded multiplier shared by all tokens of that segment, so credit can differ across segments while staying uniform inside one. With Qwen2.5-7B-Instruct it reaches 84.90% on ALFWorld against GRPO's 70.57% and 75.26% on WebShop against 66.15%, with the improvement holding across two mixing weights that differ by a factor of four, and with lower run-to-run spread on ALFWorld (standard deviation 1.19–2.82 points versus 7.83). The stated scope is two benchmarks and one 7B backbone, which is where the evidence stops.

3.2 Spurious Tool Use: When RL Agents Learn the Wrong Reason to Act [20]

This paper isolates a failure mode that is easy to miss when only task scores are reported: RL can make tool calls depend on superficial prompt cues rather than on task requirements. Training in controlled environments where an answer-format instruction is correlated with search but causally irrelevant, the authors find agents invoke search on held-out maths problems in up to 39.2% more cases when the cue is present (search rate 40.1% with the cue versus 0.9% without), and that shortcut formation appears only once the agent has already learned the tool reliably — competence, not dataset imbalance alone, precedes it. A dense decision-level reward that scores each call's necessity returns the spurious invocation rate to 0.0% while holding accuracy (92.8/88.8 on GSM8K in the reported runs). Every condition is a separate single-seed training run, and the authors present the mitigation as a practical remedy rather than a solved problem.

Figure 3. Learning the wrong reason to call a tool: the answer-format instruction becomes correlated with the search tool during training (panel A), and at test time the same cue triggers a search call although the task needs the code tool (panel B) [20] (reproduced from the original paper).

3.3 Coding Agent Memory Post-training: Unlocking the Memory Potential of Pre-trained File Operations [24]

Instead of adding a memory module, this paper trains the policy to use the file system it already has: four long-horizon environments whose tasks require information to survive a context replacement, and fully asynchronous PPO over ordinary shell actions with reward coming only from downstream task success. The resulting 9B policy averages 54.4% success against CompactionRL's 48.0% on the same 512 test tasks (paired difference 6.4 points, bootstrap interval [3.3, 9.5]), and resolves 27.6% of SWE-bench Verified issues against 22.0% for a frozen 122B model evaluated under the same harness. The comparison is not like-for-like in size or in what happens at context boundaries, and the authors state the limits: memory is restricted to one episode and one user, and backbones only up to 9B.

Takeaways

• The month's training results are about attribution and discipline rather than scale: where the reward lands [19], whether the tool call has a reason [20], and whether state survives a context boundary [24].
• "Better score" and "learned the right thing" came apart in a controlled setting [20]; a per-call necessity signal was enough to remove the shortcut there.
• All three papers publish narrow settings and say so; none of the effects is claimed to be universal across backbones.

4 Systems: decentralised teams, shared resources and production

The systems work split into two questions that used to be conflated: how agents organise themselves without a centre, and what happens when several users' agents share one scarce resource.

4.1 PANDA: A Decentralized Architecture with Flexible Orchestration for Scalable, Fault-Tolerant Multi-Agent Systems [37]

PANDA is a peer-to-peer architecture in which independently administered agents register capabilities and self-assemble into small per-task teams, with three selectable orchestration topologies (star, chain, mesh) and an infrastructure failure detector; collective discovery is decoupled from team messaging. On HotPotQA (full-wiki, ten workers, GPT-5.4-mini) its mesh topology trades a little accuracy for wall-clock time — 70.0 EM and 79.39 F1 in 714 s against Internet-of-Agents' 72.5 and 81.26 in 2,182 s — and under injected infrastructure failures PANDA configurations complete 100% of runs where Magentic-One, AgentNet and IoA all complete 0%. The paper has no dedicated limitations section; the authors do note that with 50 capabilities, 100 agents are not enough to staff the required capabilities.

Figure 4. PANDA's per-agent design: team communication and a local registry sit beside the collective layer that decouples discovery from team messaging, with an infrastructure failure detector feeding replanning and both communication layers [37] (reproduced from the original paper).

4.2 Worse Together: How Performance Breaks Down in Multi-User Multi-Agent Teams [40]

Giving every user their own agent looks like the safer design until the agents share a budget or a queue. Across four tool-using environments the paper finds the peer-to-peer formation underperforming a single coordinator: on a shared overnight API-key budget the team reaches 30% of the optimum against 64% for one coordinator, and "silent" teams that never coordinate reach 7% and 2%. The gap is environment-specific rather than structural — under the strongest instruction stack on the clinic scenario, joint success rises from 70.5% to 95.3%, above the coordinator's 84.3% — and the authors are careful that their behavioural labels come from model judges not validated against human judgements, and state that their analyses do not establish that either behaviour causes the gap.

4.3 little m: An AI Agent for Industrial Process Optimization [44]

This is the month's clearest production case. little m turns unstructured industrial problem statements plus process diagrams into structured optimisation formulations, grounded by a curated domain-knowledge repository and gated by two human-in-the-loop checkpoints; it is evaluated on IPC-Bench, 50 textbook-derived multimodal process-control cases with expert-verified ground truth. Eight domain specialists preferred its formulations in 66.0% of the 20 cases they reviewed, against 18.0% for a bare DeepSeek-V3.2 baseline and 16.0% for Qwen3-Next-80B, and its decision-variable overlap score leads both baselines. The authors are explicit about the boundary: domain knowledge is curated per domain, there is no solver-level verification, the benchmark is textbook-derived, and pretraining exposure cannot be excluded.

Takeaways

• Organisation is becoming an empirical question: a decentralised design can win on fault tolerance and runtime [37], while per-user agents can lose to a single coordinator on shared resources [40].
• Mitigations are environment-specific, not universal: the same formation that trails badly on one shared resource beats its coordinator on another under a stronger instruction stack [40].
• Production cases now report human expert judgement alongside machine metrics, and both come with explicit scoping limits [44].

Also noted

Measurement and engineering. cua-speedrun [5] puts four computer-use benchmarks on one virtual machine and pipeline (56 configurations on OSWorld) and finds that more reasoning can be faster — Gemini 3 Flash Preview improves from 33.6% to 57.6% while mean task time falls from 492 s to 268 s — and that faster input/output can be slower (environment time 12.68 s → 0.34 s, mean task time 89.5 s → 99.0 s). ReLiveGym [6] replays weeks of real streams for eight long-lived tasks and reports that seed-to-seed variation is the largest variance component on every task. Failure-Transparent Agents [7] fixes the failed-tool observation before generation and, over 3,600 human-annotated responses from six models, measures false success falling from 22.8% to 9.3% with a transparency instruction and 0.8% with a four-field evidence contract. A repository-level study of 157 open-source agent projects [8] finds 87.3% carrying conventional tests but only 5.1% with prompt-injection or adversarial test paths. "Defining AI Agents" [9] is a compendium that maps criteria, metrics and benchmarks onto five dimensions of agenticness and reports no measurements of its own. OSWorld-Science [48] grades 146 computer-use tasks across 17 scientific software titles by application state and artefacts; the best mean score is 73.7%, and only 26.3% of released runs receive full credit. "Agents as Software" [51] argues that agent reliability needs programming-language treatment because an agent's program is scattered across prompts, tools, memories and traces.

Safety, security and accountability. TrustProbe [13] finds 104 taint-style vulnerabilities across 11 open-source agents (eight with more than 10,000 stars) and reports that 25.1% of skill–agent trials on a corpus of real published skills trigger an audited vulnerable path, with 31.7% of those reproducing from a plain prompt. A systematisation of agentic jailbreaking [14] unifies 116 attacks and 63 defences and shows why response-level numbers mislead: unsafe planning reaches 91.49% under one attack while attack success at the response level stays at 11.54%. A security SoK for multi-agent systems [15] audits 44 works and finds only 13 computing attack success rates themselves, with one of 20 full-trace evaluations reporting an explicit dependency graph. A Monte Carlo study built on the 2026 Hugging Face incident [16] models layered controls at a 0.301% incident rate against 2.498% for weak controls, stable across 300 perturbation draws — a model, not an observation of a live system. HazardAuditor [17] converts executable threat traces into a computer-use auditor and reports +16.5 points of accuracy over a guard baseline. "Trustworthy Agentic AI" [18] is a structured narrative review whose one quantitative figure is quoted from another study. A governance-aware digital twin for transmission-system operators [50] lets numbers reach the control room only as layer-rendered backend facts: four invariants hold on 590 of 590 runs, against 45 unauthorised side effects in 354 runs without the layer.

Learning, memory and tool use. Observations are usually masked out of supervised fine-tuning; letting the loss cover them changes post-RL exploration and raises Terminal-Bench 2.0 pass@1 at 4B from 5.6 to 7.2 [21]. UniOPSD [22] arbitrates between outcome-based and hindsight-based credit and reaches 75.0% on WebShop at 3B against 68.0% for its baseline, while ranking below the strongest baseline on ALFWorld at 7B. ARISE-RL [23] co-evolves a rubric generator and a solver, passing 0.599 of travel sub-tasks against 0.531 for its closest baseline. MemAgent [25] learns to route tasks among 13 heterogeneous memory providers (average 75.7% vs 65.7% without memory); ActiveMem [26] retrieves dependency-consistent paths from latent memory trees (ALFWorld 95.57 vs 90.60 at Qwen3-8B); SkillSpec [27] evolves skills under a consensus gate (+12.26 points macro average over SkillOpt on GPT-4.1); and a deviation-guided method [28] turns wrong turns into skill edits. The Agent Error Dataset [29] contributes 50,228 error–diagnosis pairs, with a first-proposal correction rule lifting replay pass rate by 32.7 points over an original-action retry. ToolSearcher [30] trains tool selection over a 16,464-API repository (F1 0.513 vs 0.496 for the strongest baseline, from 0.098), and an action-space study [31] shows that merely merging tools into fewer operations costs a median 19 points of success across nine open models. AnyAct [32] unifies GUI primitives, shell commands and MCP APIs behind a reliability-gated retrieval layer (LiveMCPBench 84.95 vs 42.11 for the naive baseline); Dyad [33] scores typed candidate actions in a separate encoder while keeping one policy with language reasoning (ALFWorld 90.90 vs 85.01 at 9B). An enterprise ablation [34] finds shell-only interfaces beating a typed tool catalog by 24.6 points on TheAgentCompany (N=348) and 6.2 points on APEX-Agents (N=960) at roughly a third of the tokens per task. Dr. Free [35] removes difficulty-based proposer rewards from self-evolving search agents and reports a 3% versus 81% shortcut rate in a gold-blind audit. A survey of graph-based personalised memory [36] tabulates 12 benchmarks and finds only two of them mark memory organisation explicitly.

Multi-agent systems and deployment. Waggle [38] learns a single parameter-shared local law instead of a role structure and beats decision distillation by 14.5 points on Silo-Bench at 64 agents. DEALS [39] serves tasks neighbour-to-neighbour with no language-model calls for routing (mixed-family accuracy 66.52% vs 57.76%) and reports 4.7–22.7× throughput. GlossoGen [41] treats communication as one action among many and finds that budget pressure plus a postmortem channel pushes message perplexity up by roughly 430%, with open-weight teams succeeding on 30.8% of rounds against 92.1% for proprietary models. MASkills [42] edits skill libraries rather than parameters (HotpotQA F1 76.3 vs 69.2, but 0.0 vs 8.3 on GAIA Level 3). A study of symbolic guidance [43] finds intermediate guidance (function-level descriptions) usually beating both no guidance and fully prescribed pseudocode in distributed coordination. Óptima [45] delegates Bayesian-optimisation campaigns to subagents and a persistent service, raising best measured yield from 30.0% to 58.8% over 23 experiments while stating that its human comparison is unmatched. Eurekabench [46] finds agents matching human predictive accuracy (47.4% vs 48.8%) but reaching only 29.4–42.4% insight score against 69.7% for humans. CompMat-Bench [47] scores agents on 94 materials-science tasks with simulations precomputed, at 90.4–91.5% under full guidance and 50–75% under its hardest condition. A deployment report from scientific user facilities [49] distils patterns from light-source operations — inference endpoints, decoupled tool servers, off-site compute, governed lifecycle learning — without reporting a benchmark. An observational study of a June 2026 incident [52] reconstructs how 1,201 short-lived agents on a public wiki converged on the same pages, names and phrasing by copying what was visible — page choice tracked a page's share of the recent feed with a fitted slope of 0.87 — reproducing the heavy-tailed distribution of how many agents met on a page and suggesting that whoever writes first sets the convention.

Scope and method

Retrieval and screening

The window is arXiv v1 submission dates 1–30 September 2026, so a few papers submitted on 30 September carry October arXiv numbers and are included on their submission date (for example [3], [10], [19], [24], [40], [46], [47]). Two routes were combined: a title match on "agent"/"agents" (2,016 papers) and a semantic recall phrased as the topic definition (the 500 closest of 20,638 scanned), giving 2,061 unique candidates. Screening required that a paper's main contribution concern AI/LLM agents themselves, and excluded classical multi-agent RL or control-theoretic "agents" unrelated to AI agents, non-AI senses of "agent", and papers mentioning agents only in passing: 1,805 included, 256 excluded. The included set was then labelled against seven lines (measurement, safety and governance, training, memory and skills, tool use, multi-agent systems, domain deployment); labels overlap and 346 papers stayed unresolved. These counts describe the screened corpus, not the field. The 50 papers read in full were selected to represent all seven lines (9/9/7/7/6/6/6) and to prefer work that states a checkable result and that a practitioner could act on; 50 of 1,805 is a reading sample chosen for representativeness, not a ranking.

Evidence depth and gaps

Each of the 50 papers was read by a separate reading task that produced an evidence card with the paper's own setting, its stated delta against the closest prior work, one or two numbers with their metric and baseline, the authors' stated limitations and one figure (46 cards complete, three partial, one where only the figure step failed). Every number in the featured sections was taken from those cards or from the original text read for this issue, and each is stated with its setting. Two figures could not be extracted for the benchmark audit [1], so that paper is described from its text alone. Bibliographic metadata comes from library records; the workspace holds no citation counts or venue-acceptance data, so "notable" here means problem relevance and reported evidence, not measured attention. This is the first issue of this series, so there is no previous issue to compare against.

References

[1] Rohith Reddy Bellibatlu, Zichong Wang, Wenbin Zhang. Do Agent Benchmarks Do What They Say? An Executable-Contract Audit of Tool-Using Agent Environments. 2026. arXiv preprint. arXiv:2609.37315

[2] Run-Ze Fan, Zihao Zhang, Simin Ma, et al. An Empirical Study of Harness Design for Coding Agents. 2026. arXiv preprint. arXiv:2609.20804

[3] Michael Hardy, Ruhana Azam, Anka Reuel, Mykel Kochenderfer, Sanmi Koyejo. Agent Evaluation Reliability: More Tasks Won't (Always) Fix An Agent Leaderboard. 2026. arXiv preprint. arXiv:2610.00651

[4] Yi Ting Shen, Kentaroh Toyoda, Alex Leung. Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems. 2026. arXiv preprint. arXiv:2609.08258

[5] Pranjal Aggarwal, Lawrence Keunho Jang, Sean Welleck, Daniel Fried, Ruslan Salakhutdinov, Jing Yu Koh. cua-speedrun: Standardized Benchmarking of the Speed of Computer-Use Agents. 2026. arXiv preprint. arXiv:2609.40284

[6] Xisen Jin, Jingheng Li, Zhenglun Chen, Junyi Du, Xiang Ren. ReLiveGym: Evaluating Long-Lived Agents over Weeks of Replayed Reality. 2026. arXiv preprint. arXiv:2610.00710

[7] Junru Zhu, Shiming Xie, Aime Lu Fan Chen, et al. Failure-Transparent Agents: Benchmarking Post-Failure Reporting in Tool-Using Language Models. 2026. arXiv preprint. arXiv:2609.35732

[8] Wuyang Dai, Moses Openja, Jiho Shin, Hung Viet Pham, Song Wang. A Large-Scale Empirical Study of Quality Assurance Practices and Gaps in AI Agents. 2026. arXiv preprint. arXiv:2609.17698

[9] Mia Lassiter, Brinnae Bent. Defining AI Agents: A Compendium of Criteria, Metrics, and Benchmarks. 2026. arXiv preprint. arXiv:2609.11018

[10] Corinn Tiffany, Wen Zhang, Eugene Bagdasarian, Lillian Tsai. Sapien: A Stateful Policy Engine for Autonomous AI Agents. 2026. arXiv preprint. arXiv:2610.00797

[11] Shaojin Chen, Huihao Jing, Wun Yu Chan, et al. AuthorityLens: Rethinking LLM-Based Agent Systems Through the Lens of Authority. 2026. arXiv preprint. arXiv:2609.32378

[12] Jun He, Deying Yu. Stored Is Not Supported: Typed Provenance and Assertion Guardrails for Persistent AI Agents. 2026. arXiv preprint. arXiv:2609.02127

[13] Yan Wang, Zhihao Zhang, Ke Chen, et al. Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents. 2026. arXiv preprint. arXiv:2609.39065

[14] Md Jueal Mia, Yanzhao Wu, Selcuk Uluagac, M. Hadi Amini. SoK: Rethinking Jailbreaking in the Era of Agentic AI: Attacks, Defenses, and Practical Consideration. 2026. arXiv preprint. arXiv:2609.12413

[15] Rui Yang, Junjie Xu, Zhengyu Liu, et al. SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems. 2026. arXiv preprint. arXiv:2609.00595

[16] Murat Ozer, Bulent Erenay, Ibrahim Berber. Reward Hacking and Agent Containment Failure: A Monte Carlo Study Based on the 2026 Hugging Face Incident. 2026. arXiv preprint. arXiv:2609.32390

[17] Yunhao Feng, Ruixiao Lin, Ming Wen, et al. HazardAuditor: From Executable Threats to Safer Computer-Use Agents. 2026. arXiv preprint. arXiv:2609.15134

[18] Fayeq Jeelani Syed, Rehan Ahmad, Ali Al Bataineh, Aakriti Adhikari. Trustworthy Agentic AI: Failure Modes, Mitigation Strategies, and a Lifecycle Framework for Autonomous LLM Systems. 2026. arXiv preprint. arXiv:2609.22712

[19] Xinchen Du, Zhengze Zhou, Wenhui Zhu, et al. SHARPO: Segment-Level Credit Assignment for Agentic Reinforcement Learning. 2026. arXiv preprint. arXiv:2610.00838

[20] Yiwei Yang, Haoxiang Zhang, Bingbing Wen, et al. Spurious Tool Use: When RL Agents Learn the Wrong Reason to Act. 2026. arXiv preprint. arXiv:2609.16268

[21] Juzheng Zhang, Disha Makhija, Manoj Ghuhan Arivazhagan, Vinayshekhar Bannihatti Kumar, Rashmi Gangadharaiah. Don't Mask the Environment: Observation Supervision Changes How Agents Explore Under RL. 2026. arXiv preprint. arXiv:2609.20715

[22] Zenghuang Fu, Zhaoyang Li, Qiuyuan Ai, et al. UniOPSD: Unifying Outcome and Hindsight Feedback for Agentic Reinforcement Learning. 2026. arXiv preprint. arXiv:2609.34810

[23] Fanrui Zhang, Ruixue Ding, Qiang Zhang, et al. ARISE-RL: Agentic Rubric-Grounded Iterative Self-Evolution with Reinforcement Learning. 2026. arXiv preprint. arXiv:2609.01058

[24] Lirui Luo, Kelong Mao, Heming Xia, et al. Coding Agent Memory Post-training: Unlocking the Memory Potential of Pre-trained File Operations for Long-Horizon Tasks via Reinforcement Learning. 2026. arXiv preprint. arXiv:2609.34422

[25] Yongxian Wei, Yilin Zhao, Runxi Cheng, et al. MemAgent: Learning to Manage Heterogeneous Memory Providers for LLM Agents. 2026. arXiv preprint. arXiv:2609.32521

[26] Song-Li Wu, Jingyi Wang, Zhaocheng Du, Weinan Gan. ActiveMem: Dynamic Latent Memory Trees for Long-Horizon Agents. 2026. arXiv preprint. arXiv:2609.33244

[27] Huancheng Chen, Xiaodi Sun, Zhaoqiong Huang, Shenyang Huang, Shreya Singhal, Jingwen Lu. SkillSpec: Consensus-Gated Agent Skill Evolution via Representation Specialization. 2026. arXiv preprint. arXiv:2610.00704

[28] Yichun Feng, Jiawei Wang, Haozhe Sun. A Wrong Turn Does Not Ruin the Journey: Deviation-Guided Skill Self-Evolution for LLM Agents. 2026. arXiv preprint. arXiv:2609.29154

[29] Kunlun Zhu, Xuyan Ye, Yibo Li, Cheng Qian, Beibin Li, Heng Ji. Agent Error Dataset: Scaling 50,000 Error–Diagnosis Pairs for Failure Analysis and Error-Aware Post-Training. 2026. arXiv preprint. arXiv:2609.40111

[30] Zhenlong Dai, Xujie Song, Zitong Wang, et al. ToolSearcher: Optimizing Tool Selection at Scale via Reinforcement Learning. 2026. arXiv preprint. arXiv:2609.30906

[31] Yinhong Liu, Zhili Tan, Zilin Wang, Zhijiang Guo. Action-Space Shaping for LLM Agents: Measuring and Mitigating Tool-Schema Bias. 2026. arXiv preprint. arXiv:2609.34971

[32] Lingrui Xu, Yangqin Jiang, Jiachang Zhang, Xubin Ren, Chao Huang. AnyAct: Universal Action for Self-Evolving Agents. 2026. arXiv preprint. arXiv:2609.37025

[33] Yundaichuan Zhan, Weishi Wang, Wenbiao Liu, et al. Dyad: Extending Large Language Models with Native Typed Decision-Making. 2026. arXiv preprint. arXiv:2609.36116

[34] Hazel Mak, Susheel Suresh, Sahil Bhatnagar, Barry Wang, Chhaya Methani, Alejandro Gutierrez Munoz. Is Bash All You Need? An Empirical Study of Tool Interfaces for Enterprise Digital Worker Agents. 2026. arXiv preprint. arXiv:2609.11999

[35] Zhipeng Qian, Zihan Liang, Yufei Ma, et al. Dr. Free: You Don't Need Difficulty Rewards for Self-Evolving Search Agents. 2026. arXiv preprint. arXiv:2609.33565

[36] Dac Duy Anh Nguyen, Zhangchi Qiu, Shigeng Chen, Alan Wee-Chung Liew. Graph-Based Personalized Memory for LLM Agents: Representation, Evolution, Retrieval, and Evaluation. 2026. arXiv preprint. arXiv:2609.08599

[37] Matthew D. Laws, Cristina Nita-Rotaru. PANDA: A Decentralized Architecture with Flexible Orchestration for Scalable, Fault-Tolerant Multi-Agent Systems. 2026. arXiv preprint. arXiv:2609.38482

[38] Mingxi Zou, Wei Zhu, Zhuo Wang, et al. Waggle: Learning One Anonymous Local Law for Self-Organizing LLM Swarms. 2026. arXiv preprint. arXiv:2609.34136

[39] Jingjuan Huang, Wenbin Wang, Yanchuan Yin, Alvaro Velasquez, Jia Liu. DEALS: Decentralized Expertise-Aware Load Serving for Multi-Agent LLM Systems. 2026. arXiv preprint. arXiv:2609.33768

[40] Sahan Paliskara, Nattaput Namchittai, Andrew Lampinen. Worse Together: How Performance Breaks Down in Multi-User Multi-Agent Teams. 2026. arXiv preprint. arXiv:2610.00583

[41] Elias Stengel-Eskin, Newton Sander, Carlos Bonetti, et al. GlossoGen: Emergent Language in Complex Multi-Agent LLM Interactions. 2026. arXiv preprint. arXiv:2609.01491

[42] Huaiyuan Yao, Xiaoou Liu, Charles Fleming, Tianlong Chen, Hua Wei. MASkills: Continual Skills Optimization for Multi-Agent LLM Systems. 2026. EMNLP 2026 Findings. arXiv:2609.02094

[43] Ben Rachmut, Ning Zhang, Yevgeniy Vorobeychik, William Yeoh. Symbolic Guidance for LLM Agents in Distributed Multiagent Coordination. 2026. arXiv preprint. arXiv:2609.31963

[44] Yongchao Ye, Xinyu He, Dutliff Boshoff, Way Kuo, Lishuai Li. little m: An AI Agent for Industrial Process Optimization. 2026. arXiv preprint. arXiv:2609.16680

[45] Marcel Müller, Jiaru Bai, Willi Gottstein, et al. La Agente Óptima: Towards Agentic Self-Driving Laboratories. 2026. arXiv preprint. arXiv:2609.04564

[46] Jiayi Geng, Zhengxuan Wu, Kevin S. Chen, et al. EurekaBench: Measuring Agentic Ability to Discover New Scientific Insights. 2026. arXiv preprint. arXiv:2610.00492

[47] Chenmu Zhang, Levi Felix, Jun-Jie Zhang, et al. CompMat-Bench: Benchmarking AI Agents for Computational Materials Science. 2026. arXiv preprint. arXiv:2610.00636

[48] Dingyuan Dai, Heli Qi, Lei Liu, et al. OSWorld-Science: A Benchmark of Computer Use Agents for Learning and Using Scientific Software. 2026. arXiv preprint. arXiv:2609.39903

[49] Ming Du, Xiangyu Yin, Michael Prince, et al. Strategies for Deploying AI Agents in Production at Scientific User Facilities. 2026. arXiv preprint. arXiv:2609.36362

[50] Costas Mylonas, Magda Foti, Emmanouel Varvarigos. A Governance-Aware Large Language Model Orchestrated Agentic Digital Twin for Transmission System Operator Control Room Decision Support. 2026. arXiv preprint. arXiv:2609.22476

[51] Shraddha Barke, Adithya Murali. Agents as Software: A Programming Languages Agenda for Agent Reliability. 2026. arXiv preprint. arXiv:2609.32198

[52] Giordano De Marzo, Nicola Alboré, David Garcia. Copying explains the collective behavior of AI agents in the wild. 2026. arXiv preprint. arXiv:2609.09150