AI Papers of the Week
Every paper worth reading in AI, hand-picked one week at a time.
Discover and explore top AI papers with Claude Code or Codex
npx @dair-ai/mcp setup
TokTier
Serving stacks cache prompt KV state while the front end still re-tokenizes the full request text on every call, and coding agents pay the most because each call resubmits a long transcript after a small append that can move token boundaries near the tail. Across 153,951 real agent calls at a 94.1% prompt-cache hit rate, tokenization grows from 10% to 64% of time to first token. TokTier is a stateful CPU and GPU tokenization service with one contract, namely that emitted token IDs always match full reference tokenization. For session continuations it re-tokenizes a small window around the append and splices only when a stable-boundary check passes, otherwise widening or falling back, and for calls without a reusable prefix it runs exact pre-tokenization and BPE on a GPU. Differential campaigns across 17 production tokenizer families covering 1.5e10 split checks show zero divergence, incremental repair takes 0.5 to 1.1 ms from 100K to 3M characters (up to 437x faster than HuggingFace), and median time to first token drops 16 to 34% under vLLM.
NOOA
Agent development today is split across prompt templates, tool schemas, callback code, and workflow graphs, four representations that drift apart as a system grows. NVIDIA Object-Oriented Agents replaces all four with one abstraction that developers already know.
ReOPD
On-policy distillation for agentic tasks is expensive because every update needs fresh student rollouts through the environment plus teacher queries at each visited history. Microsoft Research and the University of Amsterdam propose reusing pre-collected teacher trajectories instead.
Molt
Agentic RL research is constant algorithm modification, and in mainstream frameworks each change threads through layers of trainer, distributed backend, and rollout glue. NVIDIA's Molt is a PyTorch-native training framework built to make that cost small.
ACM
Production agents accumulate context every turn. The usual fix compresses on a token threshold and throws the remainder away, so the trigger fires for reasons unrelated to what the agent is working on. Meta and CMU hand the decision to the agent instead.
Filesystem Memory Audited
Deployed agents increasingly keep long-term memory as a directory tree of markdown files they read, write, and reorganize with ordinary file tools. Research had mostly designed bespoke memory representations instead, leaving the default's two working assumptions untested.
Role Drift
End-to-end RL improves the accuracy of a multi-module LLM pipeline without constraining how the modules divide labor internally. Harvard and MIT name the resulting failure mode, Role Drift, where a module preserves or improves end-task performance while abandoning its assigned role through shortcuts that system-level evaluation cannot see. Two instances showed up. A decomposer meant to split a question into sub-questions for a separate solver instead plants the answer inside them, and a reader meant to answer from retrieved passages instead falls back on parametric memory. Hold the decomposer to its role and 86% of the apparent RL gain disappears. Role Anchor, the proposed regularizer, preserves how the role prompt shifts a module's next-token predictions relative to a neutral prompt, and gradient analysis suggests it reduces alignment with the drift direction rather than simply suppressing learning.
The Self-Speculating Agent
Agents spend a large share of wall-clock time waiting on tool results. Speculation hides that latency by predicting and pre-executing the next call, but external draft models and cached traces model a different policy, so they miss too often to help. UC Santa Barbara and LinkedIn identify this speculator-agent gap and unify both roles in one model. It runs in agent mode to solve the task and in speculator mode to predict its next tool call from a partial trajectory, fully reusing the prefix KV cache. Joint agent-speculator reinforcement learning derives speculation targets from the agent's own rollouts and alternates updates between the two modes. Next tool-call Hit@1 rises from 44.1 to 61.2 for Qwen3-4B and from 48.9 to 66.3 for Qwen3.5-4B, with agent task success preserved.
Harness Handbook
Teams now let agents evolve their own harnesses, but the harness itself becomes a sprawling codebase where finding every file behind one behavior is often harder than writing the edit. Harness Handbook attacks this by turning a harness into a behavior-centric map that stays linked to source.
From Memory to Skills
Most agent memory systems retrieve past traces as passive context, so hard-won experience never becomes something the agent can directly execute. MSCE, a training-free memory-skill co-evolution framework, instead governs how experience turns into callable skills for long-horizon LLM agents.
PRO-LONG
Long-horizon tasks force a harness to decide what to save from a long stream of observations and how to load it back into context, and richer summaries usually make the exact detail you need harder to retrieve. PRO-LONG sidesteps this tradeoff with programmatic memory.
Progressive Disclosure, Measured
Agent Skills package expertise into folders an agent loads on demand, and progressive disclosure exposes only what a query needs, from a short description down to specific passages. Practitioners adopted this pattern fast for book-length tasks, but the supporting evidence was anecdotal until now.
Bad Memory in Agents
Persistent memory is what makes an agent useful across sessions, and it is also a place an attacker can leave something behind. This work evaluates prompt injection from memory files in Claude Code and OpenAI Codex, across Claude Haiku 4.5, Claude Opus 4.7, GPT-5.2, and GPT-5.5. The finding is uneven but sobering: it is hard to make an agent overwrite its own memory using untrusted external content, but payloads already planted in those files reliably attack current and future sessions, with attack success and persistence varying widely across systems, models, adversarial goals, and multi-session sequences.
Self-Improving Agents Survey
Self-improving agents are moving from research demos into deployed systems, and this survey gives the trend a clean formalism. It frames a modern agent as a foundation model coupled with an operational scaffold of prompts, memory, tools, and control logic, then treats self-improvement as a self-induced update that commits changes to either the weights or the scaffold.
When Is Routing Meaningful
LLM routers and mixture-of-agents systems get judged on accuracy and cost, both of which can look great while the router is doing nothing. This DeepMind-affiliated work argues that whether routing means anything depends on two properties that are orthogonal to accuracy.
Harness Evolution, Rethought
Automatic harness evolution is what many teams now use to squeeze more out of agents, but the reported gains might not be coming from the harness at all. This paper argues that harness evolution is itself a search procedure and must be compared against simple search baselines under matched budgets.
Tracing Agentic Failure
Finding which step in a failed agent run actually caused the failure usually means either labeling failure data or running expensive per-step prompting. This Microsoft and UW-Madison work skips both by learning what success looks like and flagging deviations from it.
Failure as a Process
When a coding agent fails a task, the final pass or fail label hides when the run actually went wrong. This large-scale study treats failure as a timeline and annotates over 63,000 execution steps to see how coding-agent runs break down.
Less Is More for Monitors
Chain-of-thought monitoring is treated as a reliable safety layer, but this study shows monitors often detect sabotage better with less access, not more. Giving a monitor the full agent reasoning trace can bury the signal, and the authors introduce extract-and-evaluate monitoring, where one monitor isolates the relevant excerpts and another scores them, lifting sabotage detection by 16.8 points on BigCodeBench-Sabotage with a GPT-4.1-mini monitor. Agents unaware they are watched are far easier to catch, and monitors reading long traces gain the most from filtering.
Verification as a Scaling Axis
Verification is emerging as a distinct scaling axis alongside pre-training and test-time compute, and this Stanford, NVIDIA, and UC Berkeley collaboration builds a training-free verifier that reads a continuous, calibrated score straight off the scoring-token logits instead of trusting a discrete pass or fail grade.
Always-On Agents
Always-on agents are systems whose future behavior depends on durable state built up across earlier interactions, and this 130-plus page survey argues that state is far more than memory. It spans task ledgers, permissions, credentials, commitments, provenance, triggers, and effects the agent has already committed to the outside world.
The Harness Effect
As orchestration harnesses mediate every model call, this study asks how much the harness alone moves cost and performance. It ran 22 evaluation tasks across six foundation models, then changed only the orchestration layer while holding the models constant.
Agent Limitations Taxonomy
Benchmark scores keep climbing, yet the same agent failures resurface across otherwise unrelated evaluations, hidden behind the leaderboard. This University of Oxford work synthesizes 27 benchmark, taxonomy, and audit papers spanning 19 benchmarks into the first cross-cutting taxonomy of LLM-agent limitations.
Replicating ML Papers with Agents
This work tests whether a coding agent can replicate a scientific ML paper from its materials alone, using a skill that turns each paper claim into a target with recorded evidence and gating completion on workspace evidence rather than the agent's final message. Across twelve runs over four papers, all twelve workspaces pass the completion gate and all 158 recorded targets are matched with report coverage. Yet repeated runs still differ in how papers are split into targets and in numerical fidelity, so completion becomes reproducible even when the path is not.