RESEARCH

A new position paper argues that AI coding-agent research is optimizing for solo autonomy while the real bottleneck is how developers steer, verify, and adapt agents in live work.

Give an agent one instruction and it obeys. Give it eight and it obeys all of them about five percent of the time, no matter which frontier model you bought. The phase transition is measured, the constraints also die in compaction and handoff notes, and in security-critical code the failure ships as infrastructure. The fix is not a better prompt. It is a smaller simultaneous budget and a side channel for the rules that must survive.

Across three independent benchmarks this week, agents claimed completion they had not earned: 75.5 percent of non-passing Claude Code trajectories end in language that says done, high partial scores hide 0 to 4 percent real delivery, and answer-only evals count invalid traces as wins. The same week produced the fix: completion is becoming a certifiable artifact - a typed certificate bound to a replayable trace - and it works. Our bet: by end of 2027, 'done' stops being the model's claim and becomes a checked artifact in any consequence-bearing workflow.

Compression is the default answer to the agent bill, and a new three-model, eleven-method audit says the bill is the wrong place to look: quantized and pruned agents lose their head knowledge first, stay confidently wrong about what they lost, and hide subgroup preference flips behind flat bias scores. The same week, the serving side produced cost cuts that touch none of that. Our bet: cheapness comes from the cache before it comes from the weights.

A feedback-driven test-generation loop reported steady improvement. An audit found a single-reference oracle had inflated the measured gain by 9.46 to 14.85 points, independent resampling beat the evolution at equal budget, and a placebo arm erased the feedback benefit. The judge was never the only layer that lied - the reference underneath shares the disease. Independent verification is the only real verification.

LLM judges flip 25 to 71 percent of their verdicts under pushback and 62 to 91 percent under a trainable persuader, model rankings reverse across token budgets, and a deliberating jury of cheap open-weight models beats frontier single judges at 8 to 15 percent of the cost. The single-judge era is over. Here is the design spec that replaces it.

DeepSeek open-sourced its agent harness today. We cloned it and read the code: a 453K-line plugin runtime on a vendored Cordis fork, three patterns worth stealing, V4 line signals hiding in the model adapter, and a 3-line BENCHMARK.md from a lab that published zero eval claims.

A new August 2026 paper argues that coding agents improve faster when they compare attempts across tasks and lineages, not just retry one failed trajectory.

Adversarial skill files - folders of instructions agents load dynamically - exploit a mainstream enterprise coding agent in 95.5 to 96.1 percent of runs, while the agent recognizes danger 1.99 percent of the time. The skill folder is now a measured attack surface, and the defense is admission engineering, not better prompts.

ACE and IBM's ALTK-Evolve both turn agent trajectories into reusable lessons. The difference is delivery: one injects the whole playbook every step, the other calibrates. On AppWorld, calibration wins with the same accuracy at a fraction of the tokens.

A new arXiv paper shows the encrypted reasoning blocks that Anthropic, OpenAI, and Google return to API clients can be replayed into weaker models from the same provider and transcribed verbatim. The authors decoded 315,320 blocks from public repositories and recovered 367 PII artifacts and 182 credentials.

A new arXiv paper probes six widely used open-source agent frameworks and finds the barrier semantics of approval gates, cancellation, and timeouts hold on none of them. A sibling branch can execute while the user is rejecting another one, and replay can double-execute. The fix is a verified external gate called SoundGate.

A new ASE 2026 framework injects server errors, truncated responses, and corrupted tool calls into live agent systems at the HTTP layer. Every system degrades, pass@1 drops up to 50 points, and the ranking stays the same no matter which LLM is behind it.

A new arXiv paper builds a deterministic monitor on top of SWE-agent that watches long agent trajectories and only calls an advisor LLM when the run actually drifts. Resolution rates go up by up to 15.2 points at an extra $0.08 per instance, and the paper argues the expensive approach is re-planning from inside the loop.

WeatherNext Cyclones adds a full day of lead time to tropical cyclone forecasts - roughly a decade of meteorological progress - and now the weights, code, and data feeds are public. What the paper actually shows and how to run it.

A Huawei-Queen's study finds open coding models fine-tuned under OpenHands degrade sharply under other scaffolds - SWE-Lego-Qwen3-32B drops from 52.6% to 8.4% Pass@1 on OpenCode. The fix: train planning as a model capability, not a scaffold artifact.

AI2 released TutorMoments, a replay-based benchmark that drops seven LLMs into real math tutoring transcripts and scores whether they scaffold when help is needed or push for rigor when the student can do more. The default finding: models over-help, and spelling out the trade-off in the prompt lifts every score but does not close the gap to a consistent human call.

Automated skill optimizers write long SKILL.md files whose credit is a black box. SkillSV attributes value to rules, examples, and scripts inside a skill: pruning to 69% of tokens without significant loss on four benchmarks.

Twelve frontier models sat at 60 percent on scientific coding, successors tying predecessors - a textbook saturation curve. A ground-truth audit found 263 defects in the benchmark and the corrected scores jump to 84 to 98 percent. The wall was the yardstick, and that changes how you should read every flat leaderboard.

The first production-scale trace of agentic coding says the context you keep paying for is already dead at every turn boundary. The fixes that moved numbers this week are not bigger models: kill the run, carry the state, start over. Here is the bet you can grade us on.