Tool Use & Coding Agents

23 reading notes

← Back to Paper Reading

Study how tool discovery, schema context, coding tasks, and verifiable execution jointly shape agent performance.

Reader question

When an agent must choose tools, edit code, and execute actions, how can we reduce context and operational errors?

Reading library

Read this topic in depth

Every paper reading currently filed under this research topic.

  • After the Party: Governing What a Viral Agent-Skill Ecosystem Left Behind

    Advanced
    Agent Skill 生態治理: Part 1 , Note: Sep 17, 2026 , Paper: 2026 , AI Safety

    A deep reading of After the Party’s OpenClaw and ClawHub ecosystem study: 91 days of explosive growth, download concentration, the reviewability gap, privilege evidence, scanner disagreement, and the governance method that can transfer without pretending the rates do.

    Understand it in 90 seconds
    Research problem
    When an agent-skill registry expands rapidly, which signals can still support governance decisions across downloads, stars, versions, comments, declared capabilities, and executable privileges? The authors study OpenClaw and ClawHub through growth, association portability, reviewability, and scanner agreement.
    Core insight
    A skill does not live only in its text. The same SKILL.md or package can expose a different privilege surface under a different host, tool visibility, execution context, and policy. Registry metadata therefore cannot collapse popularity, reviewability, static evidence, and runtime behavior into one trust score.
    Strongest evidence
    RQ1 reconstructs stock growth from 33,399 to 65,175 over 91.11 days; the top 10% receive 46.93% of downloads and the Gini coefficient is 0.528. RQ3 finds at least one privilege signal in 85.06% of evaluable skills. RQ4 shows only 446 items flagged by all three scanners; on the small adjudicated reference set, the LLM scanner has 61.06% sensitivity versus 21.67% for the static scanner.
    Main boundary
    This is not an insecurity prevalence estimate for every registry, nor a general scanner benchmark. It is one ecosystem, a set of snapshots, partially reconstructed history, withdrawn data, missing fields, and no perfect ground truth.
    Read the full deep dive

  • SilentProbe: When HTTP 200 Did Not Answer the Question

    Advanced
    Agent Tool Contracts and Silent Failure: Part 1 , Note: Sep 17, 2026 , Paper: 2026 , AI Systems

    A deep reading of SilentProbe (arXiv:2609.00035 v1): from OpenAPI constraint gaps and live differential probes to agent false negatives, separating how disclosure and machine-readability determine whether a tool fails honestly.

    Understand it in 90 seconds
    Problem
    When an agent calls a third-party API, an empty result can mean that no record matched, or that the server did not understand a filter, discarded it, and still returned HTTP 200 with parseable JSON. Neither case necessarily provides an exception, an error status, or a field on which to branch.
    Core insight
    Separate two questions. Disclosure asks whether the model can select a value accepted by the vendor from the description; machine-readability asks whether a validator can reject a wrong value before the request leaves the gateway. Only the second can be enforced by generic infrastructure.
    Strongest evidence
    In the 721,320 parameter leaves of the public OpenAPI corpus, only 7.5% declare an enum and 15.2% declare any machine-checkable constraint; 40.1% of documents contain at least one prose constraint gap. In 219 live perturbations, machine-checkable constraints produced 111/111 honest errors, while prose-only constraints produced 44/61 silent failures (Sections 4.1–4.2, Figure 5).
    Main boundary
    In the three-parameter agent experiment, a description that showed only 1/18 department values led to silent failure in 88/88 attempts; promoting that vocabulary into an enum produced 0/89 silent failures. This is evidence under the interface and harness used by the paper, not a general law about models or every production API.
    Read the full deep dive

  • BTS-AgentBench: Compiling Read-Only Telemetry into Replayable Agent Episodes

    Advanced
    Telemetry to Agent Evaluation: Part 1 , Note: Sep 17, 2026 , Paper: 2026 , AI Engineering

    A deep read of Jeong-Yoon Kim's BTS-AgentBench (arXiv:2608.27334 v1): a deterministic path from building telemetry to read-only tools, executable tasks, bounded interaction contracts, and evidence-grounded evaluation—strong on replay consistency, bounded beyond production safety or arbitrary-domain portability.

    Understand it in 90 seconds
    Problem
    Buildings accumulate years of sensor and equipment telemetry, but a raw history is not an executable multi-turn task for an Agent. Hand-authoring each task makes it difficult to preserve a site's vocabulary, source-derived answers, split identity, and evidence links at the same time.
    Core insight
    Treat benchmark construction as a replayable compiler. First place metadata and histories behind read-only tools; then build a static executable task with fixed golds; finally wrap that computation in a typed, bounded interaction contract. Clarification, goal revision, nearest-timestamp policy, quality decisions, and evidence follow-ups can change the surface, but the source computation and its gold must be re-executed together.
    Strongest evidence
    Two independent raw-to-episode builds match all 11 logical tool-store exports and regenerate the BTS 356/87/89 train/dev/test release row by row; all 532 released episodes pass coded contract preflight. This supports construction consistency, not operator realism or production deployment (paper Table 7 and Appendix A.3).
    Main boundary
    BTS-AgentBench is a read-only, offline, bounded building-telemetry benchmark. Its zero controller success is a construction-exclusion condition, not an independent hardness estimate; XAI4HEAT's 41/41 result shows execution on a second telemetry corpus, not portability to arbitrary event logs or physical control.
    Read the full deep dive

  • ACE: Let a Canvas Agent Understand Structure Before It Corrects Itself

    Advanced
    Agent Canvas Editing and Evaluation: Part 1 , Note: Sep 17, 2026 , Paper: 2026 , AI Engineering

    A deep reading of ACE (arXiv:2608.24103 v1): hierarchical scene graphs, CARE routing, and an instruction-following judge turn multi-slide editing into a scoped, diffable, rollback-aware loop, with explicit limits around benchmarks, human raters, mock mode, and live reproduction.

    Understand it in 90 seconds
    Problem
    PowerPoint- and HTML-like flat, absolute-positioned documents encode objects as many coordinates. Adding one element can force an agent to recompute other positions, while a valid alternative design can be penalized by reference-diff metrics.
    Core insight
    ACE uses a hierarchical scene graph with parent–child relations, relative transforms, and auto-layout, then maps intent to structured operations through 98 specialized tools. CARE exposes only a relevant slide, node structure, or design token. After an edit, JsonDiff compares the original and current state, and a ground-truth-free instruction-following judge supplies the next critique.
    Strongest evidence
    On the full 94-task benchmark, GPT IF is 4.23 for ACE versus 3.81 for the HTML baseline, with paired p=.010; reported speed is about 1.75x and cost about 44% lower. On that same full set, VQ is 3.66 versus 3.57 with p=.56, so the headline is not universal visual-quality improvement.
    Main boundary
    Twenty-six blind raters give ACE versus HTML a 58.7% decisive overall win rate; self-corrected output versus single-pass is 81.5%. The panel is small, ties are common, agreement is low to moderate, and judge circularity remains. The paper does not show universal creative-editing improvement or that a judge can replace a designer.
    Read the full deep dive

  • Tool Call Succeeds, Workflow Fails: External-Effect Anomalies at the Agent–Tool Boundary

    Advanced
    Agent–Tool Boundary and Effect Reliability: Part 1 , Note: Sep 16, 2026 , Paper: 2026 , AI Systems

    A deep reading of the effect-history model behind Agent–Tool Boundary: why a successful tool response cannot guarantee a coherent external world state, and what MCP annotations and transactional contracts still leave unspecified.

    Understand it in 90 seconds
    Problem
    An agent workflow may reserve a table, charge a card, and send a confirmation. Each tool may return success, failure, or a timeout, but the workflow actually cares about which irreversible effects happened in the outside world and which effects still survive. If the runtime only trusts the latest response, retries, speculation, concurrency, and crashes can separate “the call succeeded” from “the work is complete.”
    Core insight
    Separate external-effect history from runtime observation. An attempt can produce an unknown observation even when externalization already happened; conversely, a runtime can observe success without the later commit, abort, or compensation producing the intended world state. Workflow safety is about effect history, not one API response.
    Strongest evidence
    Table 2 in Section 3 maps eight anomalies to the boundary capabilities they require. Section 5 audits the 2026-07-27 MCP registry snapshot: 98,291 tools were observed, 74.0% serialized at least one standard annotation, and 61.7% carried all four, yet Table 4 finds no sufficient transactional capability for A2–A8.
    Main boundary
    This is an effect-history vocabulary, a conjectural coverage analysis, and a runtime-contract argument. It is not a prevalence study showing that all production agents exhibit these eight anomalies. The coverage labels for ACRFence, RAC, Atomix, Cordon, CoAgent, and Shepherd are stated or partial comparisons, not formal proofs.
    Read the full deep dive

  • EvoOntology: Turning a Static Data-Agent Semantic Layer into a Verifiable, Self-Evolving Interface

    Advanced
    A Self-Evolving Ontology Layer for Data Agents: Part 1 , Note: Sep 16, 2026 , Paper: 2026 , Data Agents

    A deep reading of EvoOntology: an MCP ontology layer built by evidence-grounded probing, then refined through attribution-guided typed edits and a backbone-conditional paired gate.

    Understand it in 90 seconds
    Problem
    A data agent working over tables, files, and databases does not merely lack column names. It may not know which field, join, filter, or value constraint grounds a domain concept. Raw querying makes every trajectory rediscover the schema; a static semantic layer can be too large, stale, and expensive to maintain. This agent–data gap becomes wrong queries, longer trajectories, and ungrounded answers.
    Core insight
    Treat the ontology as a versioned MCP service with Content, Schema, and Tool layers rather than as a fixed prompt document. The builder agent probes the raw data to ground semantics. The evolution agent finds gaps in failed trajectories, proposes a typed, evidence-grounded patch at one layer, and accepts it only through a paired validation gate on the same backbone.
    Strongest evidence
    Figure 2 shows the three-layer architecture; Figure 4 shows four backbones improving across accepted rounds; Tables 5–7 isolate the contributions of the gate, attribution, diagnosis, editable levels, and content object families; Appendix B Table 8 shows that per-turn context grows while average turns per task fall from 14.6 to 8.4 and total tokens per task fall from 52.6K to 42.0K.
    Main boundary
    The headline gain must be read with scope labels: four-backbone analysis subset, six-backbone main tables, benchmark-specific metrics, and round-wise evolution are not interchangeable. The repository contains inspectable framework code and a demo, but benchmark raw data, prebuilt ontologies, model weights, and complete provider credentials are not delivered as one reproducible bundle.
    Read the full deep dive

  • Corrupt Plans, Clean Traces: How Plan Injection Evades Chain-of-Thought Monitoring

    Advanced
    CoT Monitoring and Plan Injection: Part 1 , Note: Sep 16, 2026 , Paper: 2026 , AI Safety

    A deep reading of Plan Injection: when an adversarial plan enters context and an actor rewrites it into plausible Chain-of-Thought, why the monitor’s clean trace can disconnect from behavioral causality, and where APPS, Bio-Math, and budget-sweep evidence stops.

    Understand it in 90 seconds
    Problem
    A CoT monitor usually reads an actor’s reasoning and asks whether it is executing a harmful plan. If that plan is placed into the actor’s context first, the actor can absorb it, rewrite it as plausible reasoning, and emit problematic code or an answer. The monitor sees the later trace but may not see what actually changed the behavior.
    Core insight
    Plan injection separates the causal source of behavior from the text visible to the monitor. The attacker need not make the actor copy the plan or state an explicit malicious intention; it is enough for the injected plan to steer the actor while the generated reasoning does not clearly attribute itself to that plan.
    Strongest evidence
    Figure 3 measures adoption of injected plans on APPS and Bio-Math; Figures 4–5 compare actor-only and with-plan monitor views; Table 8 reports 33%–68% APPS and 74%–82% Bio-Math end-to-end undetected attack success; Figure 6 shows that added reasoning budget is not monotonically safer for the Qwen3-235B monitor.
    Main boundary
    This is not an estimate that every reasoning model is equally vulnerable, nor a formal proof that CoT is always untrustworthy. The authors test Qwen3-8B and DeepSeek-R1-0528 actors on APPS and Bio-Math, sweep budget for only one monitor, and release no code, checkpoint, or complete rerunnable data bundle.
    Read the full deep dive

  • DRACO: Sending Long-Horizon Agent Credit Back to the Steps

    Advanced Agent runtime, safety, and evaluation
    Agent Training and Rewards: Part 1 , Note: Sep 9, 2026 , Paper: 2026 , AI Engineering

    A source-grounded reading of DRACO (arXiv:2609.04094): dynamic per-trajectory rubrics create an outcome-blind reward, then a closed-form rule redistributes GRPO advantage to the steps cited by the judge.

    Understand it in 90 seconds
    Problem
    How can an agent be trained without an outcome oracle, and how can the resulting signal avoid treating a long trajectory as one indivisible action?
    Core insight
    Generate, merge, deduplicate, and filter rubrics dynamically for a task and sampled rollout group. Ask the judge to cite the steps behind each verdict, then redistribute the trajectory advantage to those steps with a closed-form rule.
    Strongest evidence
    With Qwen3.6-27B, AppWorld test-normal TGC/SGC rises from 69.4/41.1 for the base policy to 85.3/70.6 for DRACO. Against the same-budget outcome-reward reference, the margins are +5.3/+11.3 points (Table 2, Section 4.2). Zero-shot tau-bench Banking success rises from 15.8 to 20.4.
    Main boundary
    These are benchmark and end-task results, not direct validation of the judge or of step causality. The authors have no human-rater calibration; a judge may be consistently wrong, and a wrong attribution can still produce a better policy by chance.
    Read the full deep dive

  • CONTINUITY: Keeping provenance, authorization, and tool effects continuous across Agent composition

    Advanced Agent runtime, safety, and evaluation
    Agent Runtime, Security, and Effect Boundaries: Part 1 , Note: Sep 9, 2026 , Paper: 2026 , AI Security

    A critical reading of Zheng and Yang's CONTINUITY (arXiv:2609.05269 v1): security-context contracts, field-level provenance, transformation witnesses, and effect-bound permits for preserving an LLM Agent's instruction-to-effect boundary.

    Understand it in 90 seconds
    Problem
    An Agent security path rarely has one control point. Ingress may track provenance, a gateway may enforce policy, an adapter may change the protocol representation, a tool server may create an effect, and a final sink may check a permit. Each can look locally reasonable while security-critical context is truncated, amplified, rebound, or accepted in a stale or replayed form.
    Core insight
    Give every component an assume–guarantee contract, and make each transition carry verifiable evidence for its root, field provenance, release, role, transformation, and finality state. Security is not “the last signature verifies”; it is whether the effect can be traced to a complete, authorized, current, single-use witness chain (Sections 1, 5, and 6).
    Strongest evidence
    The authors generate 2,560 attack instances from 4 domains, 32 fault classes, and 20 parameterized instances per fault–domain pair, yielding 128 fault–domain classes. The full CONTINUITY configuration records 0/2,560 harmful effects, contains 128/128 classes, completes 700/700 benign tasks, and escalates 200/200 ambiguous tasks (Table 2 and Figure 3).
    Main boundary
    These are exact conformance counts over a generated fault space, not a natural attack distribution or a production attack rate. Trusted roots, validator correctness, context capture, finality sinks, and provider semantics sit in the TCB or deployment assumptions; the artifact is not a production MCP, A2A, OWASP ACS, or cloud-IAM integration (Sections 3, 8.1, and 12).
    Read the full deep dive

  • Parsing the Stream: Long-Horizon Agents Need Auditable Live State, Not Just Memory

    Advanced Agent runtime, safety, and evaluation
    Agent Trace Observability: Part 1 , Note: Sep 7, 2026 , Paper: 2026 , AI Engineering

    A critical reading of Pakhomov and Nijkamp's Parsing the Stream (arXiv:2609.01466): an append-only trace is folded into typed RunState and compiled into observer and worker views. The paper reports gains on specific accumulation tasks and monitoring costs, but does not show that fixed aggregates replace every form of trace memory.

    Understand it in 90 seconds
    Problem
    A long-horizon Agent trace outgrows both of its consumers. A human observer needs to know what is happening, what has settled, and what is still missing; the worker Agent must put the same growing trace back into a bounded context window. A tail-only view loses early facts, while replaying the full history on every turn makes tokens, cost, and failure risk grow together.
    Core insight
    Instead of building two unrelated summarizers for the worker and observer, write the trace as an append-only typed ledger, fold it into a RunState with source and coverage information, and compile consumer-specific views from that state.
    Strongest evidence
    In COMPREHEND, using 12 real transcripts and 70 monitoring questions per condition, the compiled view reaches 0.871 accuracy for Sonnet 5 and 0.850 for Haiku 4.5; raw tails reach only 0.479 and 0.476. In CONTINUE's clean 120-link protocol, the curated fold scores 30/30, the scratchpad scores 30/30, and full context scores 8/30 (Tables 1–2, Figures 2–3).
    Main boundary
    The evidence is conditional on schema coverage and task shape. The authors show that the fold loses its advantage on an alternating-sign chain, and they acknowledge benchmark–system co-evolution, a single vendor, a fixed schema, single-session traces, and untested prompt injection, secret redaction, and multi-agent ledgers.
    Read the full deep dive

  • Indirect Prompt Injection: Web Pages and Tool Returns Become Instruction Channels, but 2023 Cases Do Not Represent Later Guard Products

    Intermediate Agent runtime, safety, and evaluation
    Indirect Prompt Injection deep reading: Part 1 , Note: Aug 28, 2026 , Paper: 2023 , AI Security

    A source-grounded reading of Greshake et al., arXiv:2302.12173 v2: when LLM-integrated apps retrieve web pages, email, or tool output, untrusted data enters the prompt as if it were instructions. The authors demonstrate indirect prompt injection on Bing Chat, GitHub Copilot, and synthetic GPT-4 apps and give a computer-security threat taxonomy. This is 2023 control-plane evidence, not a Llama-Guard, Constitutional AI, OWASP Top-10, or jailbreak-benchmark product SLA.

    Understand it in 90 seconds
    Problem
    LLM-integrated applications retrieve web pages, read email, and call APIs. Prior prompt-injection work mostly assumed the user typed the adversarial prompt in chat (direct PI / jailbreak). When the attack surface becomes data that will be retrieved, the threat model changes (Sections 1 and 3).
    Core insight
    Indirect Prompt Injection (IPI) hides instructions in search hits, HTML comments, repository comments, email bodies, and other likely-to-be-retrieved sources. When the application concatenates those strings into the prompt, the data versus instruction boundary disappears, and processing a retrieved prompt is analogous to executing arbitrary code (Sections 2 and Key Message #1).
    Strongest evidence
    The Figure 2 taxonomy of injection methods, threats, and affected parties; the Figure 3 plant-retrieve-compromise-API-exfil flow; and Section 4 qualitative demonstrations on Bing Chat (GPT-4), GitHub Copilot, and GPT-4 / text-davinci-003 synthetic apps (information gathering, phishing, AI email worm, remote control, wrong summaries, and more). The authors provide no comparable attack-success-rate table.
    Main boundary
    This is a February–May 2023 preprint / v2, and Bing UI and filters have changed many times since. Synthetic apps use mock interfaces at temperature=0; the authors deliberately did not poison publicly indexed pages for in-the-wild retrieval (Section 5.1). This is not a formal verifier or complete permission model, and it does not establish Llama-Guard F1 or OWASP LLM Top-10 product behavior.
    Read the full deep dive

  • ReAct: Interleave Thought and Action, but Do Not Treat a Few-Shot Loop as an Agent Runtime

    Intermediate Agent runtime, safety, and evaluation
    ReAct Deep Dive: Part 1 , Note: Aug 27, 2026 , Paper: 2023 , NLP

    A source-grounded reading of Yao et al., ICLR 2023: language thoughts join the action space, while HotpotQA, FEVER, ALFWorld, and WebShop keep hallucination, search failure, and the abstract's +34% / +10% in separate buckets.

    Understand it in 90 seconds
    Problem
    LLM reasoning (chain-of-thought) and acting (WebGPT, SayCan) were treated as separate lines of work. CoT never touches an environment; act-only methods can query the outside world but lack high-level plans and exception handling.
    Core insight
    Add language thoughts to the action space. A thought does not change the environment and produces no environment observation; it only updates context, then interleaves with environment actions. The changed decision point is no longer “only think” or “only act,” but “in this same trajectory, is the next legal move a sentence to oneself or a touch of the world?”
    Strongest evidence
    ALFWorld best-of-6 ReAct 71% versus Act 45% and BUTLER best-of-8 37%; WebShop SR 40.0 versus IL+RL 28.7. In a human analysis of HotpotQA failures, 56% of CoT failures are hallucinations versus 0% for ReAct (Table 2).
    Main boundary
    On HotpotQA with PaLM-540B, pure ReAct EM is 27.4, below CoT at 29.4. The 35.1 / 64.6 headline cells are ReAct↔CoT-SC switches. The method is few-shot prompting with a Wikipedia API of search, lookup, and finish. It is not a deployable runtime.
    Read the full deep dive

  • Toolformer: Self-Supervised API Calls Are Not an Agent Loop

    Intermediate Agent runtime, safety, and evaluation
    Toolformer Deep Dive: Part 1 , Note: Aug 27, 2026 , Paper: 2023 , NLP

    A source-grounded reading of Schick et al., NeurIPS 2023: future-token loss filters QA, Wikipedia, calculator, calendar, and translation calls on CCNet for GPT-J. LAMA and math jump; this is still not a chainable agent runtime.

    Understand it in 90 seconds
    Problem
    Language models are weak at arithmetic, factual lookup, low-resource languages, and time awareness compared with much smaller specialized systems. Tool use at the time either needed large human annotation budgets or was tied to task-specific few-shot prompts that already knew which tool to call.
    Core insight
    Insert API calls into next-token prediction. A handful of human demonstrations only teach the call format. Whether a sampled call is kept is decided by whether the call plus its result reduces future-token loss. The changed control point is not a thought–action loop; it is when a single API call is written into the language-modeling string.
    Strongest evidence
    Same GPT-J 6.7B, zero-shot. LAMA SQuAD / Google-RE / T-REx rise from 17.8 / 4.9 / 31.9 to 33.8 / 11.5 / 53.5 and beat OPT-66B and GPT-3-175B. Math ASDiv / SVAMP / MAWPS rise from 7.5 / 5.2 / 9.9 to 40.4 / 29.4 / 44.0. The QA tool and calculator are selected on about 98.1% and 97.9% of examples.
    Main boundary
    With the QA tool off, Wikipedia search still trails GPT-3. The authors cannot chain tools, cannot browse search results interactively, are wording-sensitive, evaluate at most one API call, get few calculator examples, and ignore tool cost. This is not a production agent runtime.
    Read the full deep dive

  • SWE-bench: Real GitHub Issues as Evaluation, but 1.96% Is Not a Model Ceiling

    Intermediate Agent runtime, safety, and evaluation
    SWE-bench Deep Dive: Part 1 , Note: Aug 27, 2026 , Paper: 2024 , AI Engineering

    A source-grounded reading of Jimenez et al., ICLR 2024 Oral: the evaluation unit is a real GitHub issue, a full Python repository, and tests. Claude 2 resolves 1.96% under BM25; that number is a protocol, not a model ranking.

    Understand it in 90 seconds
    Problem
    Coding benchmarks such as HumanEval compress success into writing a self-contained function. Real software engineering is: read a GitHub issue, edit a repository with thousands of files, and let tests decide whether the issue is fixed. Prior scores do not measure that job.
    Core insight
    Change the evaluation unit to a real issue plus a full Python repository plus tests. The model emits a patch; after unix patch applies it, every fail-to-pass and pass-to-pass test must pass before the instance is resolved. The changed control point is not a new agent architecture; it is what counts as success.
    Strongest evidence
    Under BM25 retrieval and a 13k context, Claude 2 resolves 1.96% (abstract, Section 1, Table 2). In the same protocol, Table 5 lists Claude 2 at 1.97% and also includes Claude 3 Opus at 3.79%. Under oracle retrieval, Claude 2 rises to 4.80% (Table 18). SWE-Llama reaches only 0.70% under BM25 and still mostly solves the simplest issues.
    Main boundary
    Python, issue-fix, binary tests. Resolve does not score maintainability, uncovered behavior, or review. BM25 and oracle are different retrieval conditions. Later SWE-bench Verified, SWE-agent, and ProMax use different setups, so their scores do not belong in this paper's tables.
    Read the full deep dive

  • Reflexion: Write Verbal Reflections into Memory — Do Not Mistake Retries for Weight Learning

    Intermediate Agent runtime, safety, and evaluation
    Reflexion deep reading: Part 1 , Note: Aug 27, 2026 , Paper: 2023 , AI Engineering

    A deep read of Shinn et al., NeurIPS 2023: frozen weights plus linguistic feedback stored in episodic memory for across-trial verbal credit assignment. HumanEval pass@1 91.0 vs GPT-4 80.1 is a programming setup with self-tests and retries; WebShop and MBPP mark the boundary.

    Understand it in 90 seconds
    Problem
    Language agents can already act in external environments, but learning from trial-and-error usually means expensive sample-heavy RL with weight updates, while few-shot in-context teaching barely stores interpretable experience across episodes.
    Core insight
    Keep weights frozen. Amplify binary or scalar feedback into a verbal reflection, append it to an episodic memory buffer, and condition the next trial on that text. The changed control point is across-trial verbal credit assignment, not a parameter gradient.
    Strongest evidence
    HumanEval (PY) Reflexion pass@1 91.0 versus GPT-4 single-sample 80.1 (Table 1); ALFWorld heuristic setting solves 130/134 (Section 4.1); HotPotQA reports about +20% over strong baselines (Section 4 lead-in). Rust ablation: full Reflexion 0.68; omitting reflection or tests falls to 0.60 / 0.52 (Table 3).
    Main boundary
    Needs a usable evaluation signal; reflections can be wrong; extra trials cost compute; memory is a sliding window (typically 1–3), not enterprise governance. WebShop barely improves (Figure 6); MBPP (PY) drops to 77.1. This is not weight learning and not a deployable runtime.
    Read the full deep dive

  • MemGPT: Treat Context as Paged Memory — Do Not Mistake the OS Metaphor for Enterprise Memory

    Intermediate Agent runtime, safety, and evaluation
    MemGPT deep reading: Part 1 , Note: Aug 27, 2026 , Paper: 2023 , AI Engineering

    A deep read of Packer et al., arXiv:2310.08560 v2: finite context as RAM, OS-like tiers, and function-mediated paging. DMR moves GPT-4 from 32.1% to 92.5%; nested KV shows multi-hop lookup—not ACL memory governance.

    Understand it in 90 seconds
    Problem
    Fixed-length context windows break long conversations and long-document analysis; naively lengthening transformer context raises quadratic cost, and long windows still may use middle tokens poorly.
    Core insight
    Do not start by buying a bigger RAM stick. Treat the LLM’s prompt tokens as main context (RAM), keep chat history and document stores in external context (disk), and let function calls decide what to write out, retrieve, and evict—like OS virtual-memory paging.
    Strongest evidence
    On Deep Memory Retrieval (Table 2), GPT-4 fixed-context accuracy is 32.1% versus 92.5% with MemGPT; GPT-4 Turbo moves 35.3% → 93.4%. On Nested KV (Figure 7), fixed-context models fall to 0% at deeper nesting while MemGPT+GPT-4 keeps multi-hop lookup alive.
    Main boundary
    The system depends on tool/function-call fidelity; the paging policy is itself an agent decision that can store or drop the wrong facts; the evidence is dialogue consistency plus sampled/synthetic document tasks—not ACL, audit, or rollback memory governance. Later Letta productization is not this paper’s experiment artifact.
    Read the full deep dive

  • CoT: Make the Model Write the Reasoning, but Do Not Treat It as an Agent That Moves

    Intermediate Agent runtime, safety, and evaluation
    CoT deep reading: Part 1 , Note: Aug 27, 2026 , Paper: 2022 , NLP

    A source-grounded reading of Wei et al., NeurIPS 2022: few-shot exemplars with intermediate steps elicit multi-step reasoning in large frozen models. PaLM 540B on GSM8K moves from 17.9 to 56.9; this is still a prompt, not tools, an environment, or memory paging.

    Understand it in 90 seconds
    Problem
    Standard few-shot prompting gives only $\langle$question, answer$\rangle$ pairs. Multi-step arithmetic, commonsense, and symbolic tasks stay weak, and scaling the model alone often leaves those curves flat.
    Core insight
    Change the exemplar to $\langle$question, intermediate reasoning, answer$\rangle$. The decision point moves from “answer immediately” to “write the work, then answer.” Weights stay frozen. This is still a prompt, not an agent.
    Strongest evidence
    PaLM 540B on GSM8K moves from 17.9 to 56.9, above Cobbe et al.’s finetuned GPT-3 + verifier at 55 (Table 1, Figure 2). Figure 4 / Table 2 show the gain appearing around 100B parameters.
    Main boundary
    No environment, no tools, no memory paging. Small models often get worse. A chain can be unfaithful, or luckily reach the right number. Self-consistency (Wang et al., 2022a) is a later paper; the main tables here use greedy decoding.
    Read the full deep dive

  • WebGPT: Let the Model Browse for Answers, but Do Not Treat It as a Reasoning Agent Loop

    Intermediate Agent runtime, safety, and evaluation
    WebGPT deep reading: Part 1 , Note: Aug 27, 2026 , Paper: 2021 , NLP

    A source-grounded reading of Nakano et al., arXiv:2112.09332 v3: GPT-3 is given a text browser and trained with human demonstrations and preference / reward modeling to search, quote, and answer. The 175B best-of-64 model is preferred 56% versus demonstrators and 69% versus Reddit; this is browsing QA, not ReAct’s thought–action–observation contract.

    Understand it in 90 seconds
    Problem
    Long-form question answering lags humans. Retrieval and synthesis were built as separate pieces. Without citations, people cannot cheaply check paragraph-level facts.
    Core insight
    Outsource search to Bing, leave synthesis to a finetuned GPT-3, and insert a text browser between them. The model may only issue Table 1 commands (search, click, quote, scroll, end), collect quotes while browsing, then write the answer. Training is behavior cloning from human demonstrations, plus a reward model from human preferences, plus rejection sampling at inference.
    Strongest evidence
    175B best-of-64 is preferred 56% to demonstrators and 69% to the highest-voted ELI5 answers (Section 4.1, Figure 2). Best-of-64 is preferred 68% to plain BC; RL is preferred 58% to BC, but stacking RL on rejection sampling adds little (Section 5.1, Figures 4 and 5).
    Main boundary
    There is no separate thought action. The text browser is a constrained action space, not a general tool loop. Answers can still mis-paraphrase quotes or cherry-pick sources that look convincing to labelers. This is a 2021 OpenAI technical report / arXiv preprint, not a later production browsing product.
    Read the full deep dive

  • Gorilla: Turn a Large API Catalog into Retrievable Tools, but APIBench Does Not Establish MCP Product Behavior

    Intermediate Agent runtime, safety, and evaluation
    Gorilla Deep Dive: Part 1 , Note: Aug 27, 2026 , Paper: 2024 , NLP

    A source-grounded reading of Patil et al., NeurIPS 2024: retriever-aware finetuning of LLaMA-7B on APIBench (TorchHub / TensorHub / HuggingFace) so catalog-scale API calls can be retrieved and checked. Zero-shot overall accuracy and hallucination beat prompted GPT-4 on that table—this is not a ReAct loop, MidTool mid-training, or RAG-MCP product routing.

    Understand it in 90 seconds
    Problem
    LLMs writing API calls often hallucinate names, arguments, and usage. The real world is not five fixed tools; it is a huge API catalog whose documentation changes frequently.
    Core insight
    Treat tool use as retrieve then call. Build instruction–API pairs on APIBench with self-instruct, then finetune LLaMA-7B in a retriever-aware way (RAT) so the model learns to read the documentation after Use this API documentation for reference: and emit a correct call.
    Strongest evidence
    NeurIPS Table 1. Gorilla zero-shot overall on TorchHub / HuggingFace / TensorFlow Hub is 59.13% / 71.68% / 83.79%, with hallucination 6.98% / 10.95% / 5.40%. GPT-4 zero-shot on the same table is 38.70% / 19.80% / 18.20% overall and 36.55% / 37.16% / 78.65% hallucination. Figure 6 shows that when documents change at test time, a RAT-trained model changes its call.
    Main boundary
    The corpus is ML-hub model-card / API JSON, not an arbitrary REST product catalog. Evaluation is single-call AST subtree matching, not a multi-step agent loop. A weak retriever can hurt (Table 2). Do not write APIBench numbers into MidTool or RAG-MCP.
    Read the full deep dive

  • MidTool: Does Teaching Tool Use During Mid-Training Make Agents More Reliable?

    Advanced Agent runtime, safety, and evaluation
    Note: Aug 24, 2026 , Paper: 2026 , AI Engineering

    A deep reading of MidTool, which moves schema grounding, workflow composition, and recovery under incomplete information into a 20.3B-token mid-training mixture—while web search remains at 0%.

    Understand it in 90 seconds
    Problem
    Tool use is not only about filling a function name and JSON arguments. An agent must recognize tool affordances from documentation, schemas, code, and incomplete dialogue; decide when to call; compose multiple tools; and ask for missing information or recover. MidTool asks whether these capabilities can be established earlier, through dedicated mid-training, rather than being left almost entirely to post-training.
    Data design
    The authors introduce a MidTool pipeline that collects web, PDF, code, and structured tool artifacts, producing MidTool-Mix: 20.3B tokens and 11.22M samples. Context-grounded trajectory augmentation targets grounding, while native agentic trajectory synthesis targets execution.
    Main result
    With Qwen3-4B-Base and a fixed 100K TOUCAN SFT recipe, MidTool-Mix raises BFCLv3 overall to 50.25% from 39.73% without mid-training, \\tau^{2}-Bench Pass@4 to 28.06% from 20.50%, and MCP-Universe pass to 5.03% from 1.68%. Qwen3-8B shows the same direction.
    Critical boundary
    The MCP-Universe web-search subset remains at 0.00%. Browser automation, finance, and location improve, but that does not mean the model has acquired deep-search behavior involving evidence gathering, iterative refinement, and long-horizon control.
    Read the full deep dive

  • SWE-Bench ProMax: Can Large-Scale Multilingual Refactoring Measure Long-Horizon Coding Agents?

    Advanced Agent runtime, safety, and evaluation
    Note: Aug 13, 2026 , Paper: 2026 , AI Engineering

    A deep reading of SWE-Bench ProMax, which uses 170 cross-file, multilingual, behavior-preserving refactoring tasks to test whether coding agents can complete large changes rather than merely fix a nearby test.

    Understand it in 90 seconds
    Problem
    Existing coding-agent benchmarks are often Python-heavy and centered on one issue or bug fix. An agent may make a visible test pass while missing cross-file call sites, configuration, documentation, or tests. That does not answer whether it can complete a large, behavior-preserving refactor.
    Design
    The authors mine GitHub refactoring commits, validate Docker environments, use expert and LLM-assisted analysis, and manually review candidates. The final 170 tasks cover Python, Java, TypeScript, Go, C, C++, and Rust.
    Strongest result
    Under the paper's mini-SWE-agent and OpenHands scaffolds, with at most 300 steps and $10 per instance, OpenHands + GPT-5.2 reaches a 41.2% resolve rate. The same model reaches only 21.8% with mini-SWE-agent. This is first a scaffold-and-model result, not a model-only leaderboard.
    Main boundary
    Resolve is a binary outcome—every test must pass. It does not score maintainability, untested behavior, review quality, or the action trace. TypeScript tasks come from only two repositories, with 25 from Angular; language scores are not an independent, balanced experiment in language difficulty.
    Read the full deep dive

  • Argus Deep Read: Long-Running Agents Need a Runtime, Not a Longer Prompt

    Advanced Agent runtime, safety, and evaluation
    Multi-Agent Coordination: Part 1 , Note: Aug 7, 2026 , Paper: 2026 , AI Agent

    A critical reading of Argus's Manager–Planner–Engineer–Reviewer runtime, durable state, verification-gated evolution, and rollback, separating benchmark results from author-operated case studies and unproven self-learning claims.

    Understand it in 90 seconds
    Problem
    a longer prompt does not give a long-running agent explicit task authority, auditable state, verification gates, or recovery boundaries.
    Core insight
    Argus cycles Manager, Planner, Engineer, and Reviewer over durable project state; memory, skills, routing, and procedures persist only after role-owned review.
    Strongest evidence
    across seven task-native arenas, the report gives breadth evidence and reports 78% for Argus versus 59% for Direct Copilot on SWE-Bench Pro under GPT-5.5, at roughly 1.41x aggregate tokens (Figure 1; Section 5).
    Main boundary
    this is an arXiv v1 technical report. The implementation, prompts, traces, checkpoints, and complete benchmark package are not public, so the reported outcome is not a reproducible adoption proof.
    Read the full deep dive

  • RAG-MCP: Retrieve Tool Discovery, but Account for Routing Failure

    Intermediate Retrieval, memory, and production RAG
    RAG-MCP Deep Dive: Part 1 , Note: Mar 23, 2026 , Paper: 2025 , NLP

    A source-grounded reading of RAG-MCP's tool-routing pipeline, 11,100-tool stress test, MCPBench result, scale failure, and incomplete artifacts.

    Understand it in 90 seconds
    Problem
    placing every MCP tool schema in a prompt increases tokens, distractors, and wrong-tool selection.
    Core insight
    index MCP metadata, retrieve a small top-k schema set, then validate and invoke inside that set. Retrieval generates candidates; it does not authorize a decision.
    Strongest evidence
    on MCPBench web search, RAG-MCP reports 43.13% ground-truth MCP top-1 accuracy versus 18.20% for keyword pre-filter and 13.62% for all-schema prompting (Section 4.2; Table 1).
    Main boundary
    v1 does not fully expose retriever metadata, embedding/version, schema drift, permission, p95 latency, or real invocation success; top-1 routing is not task success.
    Read the full deep dive

For speaking invitations, internal engineering sessions, or architecture exchange, see the topics and public work I can bring into the conversation.

Speaking & contact