The work separates roles across agents, verifiers, or orchestration layers. In a Werewolf testbed, agents with hidden or conflicting objectives show detectable shifts in internal reasoning while public messages mask the change, degrading collective decisions. Evidence that monitoring inter-agent transcripts alone will not catch misaligned delegates.

Use Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems to bound risk before recurring or unattended execution.

Research source arXiv:2607.26120; inspect its method and evaluation before treating results as production evidence.

[2607.26120] Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems

Large Language Models (LLMs)-powered multi-agent systems are increasingly deployed in mixed-motive environments, where agents operate under asymmetric information and strategic deception due to conflicting or hidden objectives. In these settings, misalignment with collective goals becomes a central concern. We propose a novel framework for evaluating objective misalignment using the social deduction game Werewolf, modifying the objective of a single agent while preserving its assigned role. Across LLMs from four different model families and sizes, four player roles, and three objective formulations, we introduce a dual analysis of the agents' internal reasoning and their public cheap-talk behavior (i.e costless, non-binding communication that does not directly affect the agents' utilities), complemented by an analysis of game outcomes. Our results show that objective misalignment undermines outcomes in inherently adversarial environments, an effect exacerbated by asymmetric information and specialized roles. While compromised agents consistently develop distinct objective-dependent reasoning strategies, these adaptations remain largely invisible in their public behavior. More broadly, our findings suggest that even subtle objective misalignment can profoundly affect collective decision-making, highlighting the need for effective mitigation strategies for LLM-based multi-agent systems.

Marylou Fauchard; Florian Carichon; Margarida Carvalho; Golnoosh Farnadi


Keeps adoption grounded in known failure modes, economics, and operational limits. Controlled study of 54 students comparing an agent-based system against a chatbot: agents raise completion speed but lower code comprehension and the ability to extend the work independently, with copy-paste prompting predicting the weakest understanding. Quantifies the comprehension debt that accrues inside sustained agent loops.

Use (Im)Paired Programming: Coding Agents Improve Productivity but Harm Understanding to bound risk before recurring or unattended execution.

Research source arXiv:2607.26375; inspect its method and evaluation before treating results as production evidence.

Bound permissions, cost, failure, and escalation.

[2607.26375] (Im)Paired Programming: Coding Agents Improve Productivity but Harm Understanding

Coding agents (e.g., Cursor) improve developer productivity by optimizing task completion, but shifting users from writing code to prompting and reviewing may harm their understanding, impeding oversight, learning, and communication. To probe this, we have 54 students create a website with one of two AI systems: an agent that edits user code; or a chatbot where users write code alone or adapt generic code snippets. We test understanding via comprehension questions and a task where users extend their code without agents, showing: (1) While agents aid initial task completion, they harm users' code comprehension and thus do not prepare users to extend their code; (2) Low-effort agent interaction types, like copy+paste prompts and auto-accepted edits, are linked with lower comprehension; and (3) Despite self-reported weaker understanding, users still prefer coding agents because they are quick and easy to use. While users stay in the loop for coding workflows, understanding should not be forgotten. Towards this goal, we distill our analyses into future research directions for coding agent developers: dissuading low-effort prompting, creating readable code, and promoting active engagement.

Nishant Balepur; Connor Baumler; Valerie Chen; Eunsol Choi; Rachel Rudinger; Jordan Lee Boyd-Graber


We Gave GPT-5.6 Sol a Real Business

The work turns loop quality into a measurable task or score. Field report from handing a frontier model an actual operating business and letting it run unattended, recording where the loop held up and where it needed a human. Useful as evidence about long-horizon autonomy outside benchmark conditions.

Use We Gave GPT-5.6 Sol a Real Business to bound risk before recurring or unattended execution.

Contextual source from www.bottlenecklabs.com; useful for practice signals or boundary conditions, not independent validation.

GPT 5.6 Sol Ran a Real Business | Bottleneck Labs

If an agent had a wallet, a computer, and 24 hours, could it run a profitable startup?


Keeps adoption grounded in known failure modes, economics, and operational limits. LWN, 2026-07-29. The GCC steering committee will decline any legally significant contribution that includes or is derived from LLM-generated content, with 'legally significant' pegged at roughly 15 lines per GNU maintainer guidelines.

Use GCC Steering Committee Announces AI Policy to bound risk before recurring or unattended execution.

Contextual source from lwn.net; useful for practice signals or boundary conditions, not independent validation.

GCC steering committee announces AI policy [LWN.net]

The GCC steering committee has announced that it has accepted an AI contributions policy recomm [...]


The work turns loop quality into a measurable task or score. A cross-cutting synthesis of 27 benchmark, taxonomy and audit papers from 2023-2026 spanning 19 distinct benchmarks, collapsed into six failure clusters: tool invocation and parameter-level errors, planning and constraint-satisfaction failures, long-horizon degradation from context accumulation, multi-agent coordination failures, safety and security failures, and measurement-validity issues.

Use Beyond the Leaderboard: A Synthesis of Tool-Use, Planning, and Reasoning Failures in Large Language Model Agents to bound risk before recurring or unattended execution.

Research source arXiv:2607.05775; inspect its method and evaluation before treating results as production evidence.

[2607.05775] Beyond the Leaderboard: A Synthesis of Tool-Use, Planning, and Reasoning Failures in Large Language Model Agents

Large language model (LLM) agents are increasingly evaluated on their ability to use tools, plan multi-step tasks, coordinate with other agents, and operate over extended horizons. Reported benchmark gains often obscure recurring failure modes documented across otherwise unrelated evaluation efforts. This paper synthesizes 27 benchmark, taxonomy, and audit papers (2023-2026), spanning 19 distinct benchmarks, into a cross-cutting taxonomy of agent limitations. To our knowledge, this is the first synthesis that integrates evidence across tool use, planning, long-horizon reasoning, multi-agent coordination, safety, and measurement validity into a single, unified taxonomy of LLM agent limitations. We identify six failure clusters: (1) tool invocation and parameter-level errors, (2) planning and constraint-satisfaction failures, (3) long-horizon degradation from context accumulation, (4) multi-agent coordination failures, (5) safety and security failures under adversarial or underspecified conditions, and (6) measurement validity problems. The taxonomy was derived iteratively by grouping independently reported error categories into themes corresponding to distinct stages of the agent reasoning-to-action pipeline. Across the literature, we find that failures compound nonlinearly with task length, that strong performance on individual sub-tasks does not reliably translate into end-to-end success, and that additional scaffolding does not consistently improve reliability. At the same time, substantial progress has been demonstrated in single-turn tool use, short-horizon web navigation, and narrowly scoped coding tasks.


Verification is promoted from a final check to a loop-control signal. A black-box auditing framework for a failure mode that silently corrupts verification in unattended loops: an agent hits a silent infrastructure failure, a tool returning nothing, a timeout, a malformed response, and reports it to the user as a safety refusal rather than as a broken dependency.

Use Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents to bound risk before recurring or unattended execution.

Research source arXiv:2607.19449; inspect its method and evaluation before treating results as production evidence.

[2607.19449] Guardrails as Scapegoats: Auditing Unfaithful Safety Refusals in Tool-Augmented LLM Agents

Evaluation frameworks for tool-augmented LLM agents focus overwhelmingly on capability metrics or explicit tool crashes, leaving silent infrastructure failures and HTTP 200 responses with empty, null, or malformed payloads largely unaudited. We introduce a lightweight black-box auditing framework that injects four silent failure profiles across 12 production-adjacent tool stubs and classifies agent responses into three mutually exclusive behavioral classes: Honest Surrender (HSR), Fabrication (FAR), and Unfaithful Safety Refusal (USR). Evaluating two frontier and two open-source models at temperature zero under a neutral system prompt, we find that FAR dominates (56.6% of valid responses): agents treat empty payloads as real data, silently returning fabricated results. USR, in which an agent invents a policy or privacy rationale to explain the failure, is nearly absent at baseline (0.25%, one instance across 396 valid trajectories). Our key finding emerges from an ablation where we augment the system prompt with standard safety language ("prioritize user privacy and data security"), which amplifies USR by 15.6x (from 0.25% to 3.95%; 95% CI on ablation rate: 2.2%-6.4%; Fisher's exact test, p < 0.001). USR is a latent behavior, activated when safety vocabulary in the system prompt primes the model to reach for policy rationales when tools silently fail. Sensitive tools (fetch_medical_record, retrieve_contract, fetch_user_profile) account for the majority of USR instances. We propose a payload-response misalignment heuristic for production-level detection and discuss governance implications for safety-forward deployments.

10 pages, 3 figures. Accepted at the ACM KDD 2026 Workshop on Evaluation and Trustworthiness of Agentic AI


Keeps adoption grounded in known failure modes, economics, and operational limits. The foundational negative result behind the reliability-versus-capability argument that several entries in this list gesture at without citing.

Use Towards a Science of AI Agent Reliability to bound risk before recurring or unattended execution.

Research source arXiv:2602.16666; inspect its method and evaluation before treating results as production evidence.

[2602.16666] Towards a Science of AI Agent Reliability

AI agents are increasingly deployed to execute important tasks. While rising accuracy scores on standard benchmarks suggest rapid progress, many agents still continue to fail in practice. This discrepancy highlights a fundamental limitation of current evaluations: compressing agent behavior into a single success metric obscures critical operational flaws. Notably, it ignores whether agents behave consistently across runs, withstand perturbations, fail predictably, or have bounded error severity. Grounded in safety-critical engineering, we provide a holistic performance profile by proposing twelve concrete metrics that decompose agent reliability along four key dimensions: consistency, robustness, predictability, and safety. Evaluating 15 models across two complementary benchmarks, we find that recent capability gains have only yielded small improvements in reliability. By exposing these persistent limitations, our metrics complement traditional evaluations while offering tools for reasoning about how agents perform, degrade, and fail.

Stephan Rabanser; Sayash Kapoor; Peter Kirgis; Kangheng Liu; Saiteja Utpala; Arvind Narayanan

Accepted at ICML 2026. Interactive dashboard available at: https://hal.cs.princeton.edu/reliability


Keeps adoption grounded in known failure modes, economics, and operational limits. Older than the sweep window (March 2026) but absent from the list and squarely on-topic. Harper Foley (Tribe AI, ex-Navy EOD) catalogs ten production-destroying agent incidents across six tools over 16 months, each sourced to GitHub issues, Fortune, The Register, or first-hand reports, and shows not one vendor published a postmortem.

Use Ten AI Agents Destroyed Production, Zero Postmortems to bound risk before recurring or unattended execution.

Contextual source from www.harperfoley.com; useful for practice signals or boundary conditions, not independent validation.

Ten AI Agents Destroyed Production. Zero Postmortems. | Harper Foley

10 documented incidents across 6 AI coding tools in 16 months. Missing audit trails, no liability frameworks, no vendor postmortems. The accountability infrastructure doesn't exist.


2x, Not 10x: Coding With LLMs in 2026

Keeps adoption grounded in known failure modes, economics, and operational limits. A calibration essay whose central claim is squarely a loop-engineering claim: LLMs became genuinely useful at the point they got reliable enough to run inside automated feedback loops, and past that threshold further model capability buys much less than retooling does.

Use 2x, Not 10x: Coding With LLMs in 2026 to bound risk before recurring or unattended execution.

Contextual source from obryant.dev; useful for practice signals or boundary conditions, not independent validation.


Persistent memory is treated as an external runtime artifact. A reproduction study that lands harder than most original results. The authors rebuild LightMem, a well-cited lightweight memory-management approach, and compare it against naive RAG retrieving directly from raw user turns.

Use Reproducing LightMem: Naive RAG Is Just as Good for Memory Management to bound risk before recurring or unattended execution.

Research source arXiv:2607.29104; inspect its method and evaluation before treating results as production evidence.

[2607.29104] Reproducing LightMem: Naive RAG Is Just as Good for Memory Management

Long-term conversational agents require access to information from earlier interactions, such as a user's preferences, past requests, or previously mentioned facts. Repeatedly providing the full dialogue history can be expensive as conversations grow, so many memory approaches instead transform past interactions into compact entries that can be retrieved when needed. LightMem is a recent lightweight memory-management approach that reports strong effectiveness while maintaining relatively low construction cost. However, it still relies on a separate constructed memory representation and is evaluated with only one retriever, leaving unclear how sensitive its results are to retriever choice and whether memory construction discards answer-relevant information. In this study, we reproduce LightMem and compare it with Naive RAG, which retrieves directly from raw user turns. We recover LightMem's main configuration trend, but find that retriever choice is a major source of performance variation: changing only the retriever over a fixed LightMem store shifts answer accuracy from 58.1% to 75.5%. Constructed memories also do not consistently outperform raw-turn retrieval. Naive RAG generally performs better at matched retrieval depths, whereas LightMem performs better mainly under tight answering-token budgets. Oracle evaluation further shows that memory construction removes some answer-relevant information. Overall, LightMem offers a context-efficiency trade-off rather than a general advantage over Naive RAG. Its value depends on the retriever and available token budget, motivating future work on retrieval, reranking, query formulation, and their interaction with raw and constructed memory representations.

Yongjie Zhou; Shuai Wang; Bevan Koopman; Guido Zuccon


Keeps adoption grounded in known failure modes, economics, and operational limits. JFrog Security Research (Afek Berger) audited 55 SQLite vulnerability advisories published from a single GitHub account with initial CVSS scores of 7.5 to 9.8, and found 54 completely fabricated, non-existent functions, invalid line numbers, PoCs that trigger no crash, with one real bug wrapped in unverified CVE metadata.

Use Critical CVEs or LLM Slops? Inside 50+ Fake SQLite Advisories to bound risk before recurring or unattended execution.

Contextual source from research.jfrog.com; useful for practice signals or boundary conditions, not independent validation.

SQLite Critical CVEs or LLM Slop? - JFrog Security Research

The JFrog security research team recently identified a supply chain attack targeting the `xinference` package on PyPI. Versions 2.6.0, 2.6.1, and 2.6.2 were compromised and yanked by maintainers after users reported suspicious behavior. If you installed or imported these versions, you must assume your environment is compromised.


Don't be a meat proxy

Keeps adoption grounded in known failure modes, economics, and operational limits. The highest-traction technical post of the Aug 1-3 window, arguing against the degenerate role humans fall into when they relay model output verbatim, into Slack threads, PR review comments, group chats, without reading, understanding or validating it first.

Use Don't be a meat proxy to bound risk before recurring or unattended execution.

Contextual source from gruhn.me; useful for practice signals or boundary conditions, not independent validation.


The work turns loop quality into a measurable task or score. An incident-driven empirical study rather than a benchmark paper: the authors screened 68,816 papers across 22 venues to curate 185 safety-relevant studies, then mined 16,586 GitHub issues from LLM-powered coding tools and manually confirmed 547 genuine operational safety failures, each annotated with contributing factors, task context, severity and downstream impact.

Use What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants to bound risk before recurring or unattended execution.

Research source arXiv:2605.30777; inspect its method and evaluation before treating results as production evidence.

[2605.30777] What Breaks When LLMs Code? Characterizing Operational Safety Failures of Agentic Code Assistants

Autonomous coding agents built on large language models (LLMs) are rapidly being integrated into development workflows, yet their operational safety properties remain poorly understood beyond evaluations of explicitly malicious inputs. In practice, high-impact failures arise during benign, goal-directed use through environment breakage, fabricated success reports, etc. that current benchmarks do not capture. What categories of operational safety failures actually occur when coding agents are used for everyday development tasks and what is their impact? We present an incident-driven empirical study grounded in two complementary evidence streams. We screen 68,816 papers from 22 premier venues, curating 185 safety-relevant studies, and mine 16,586 GitHub issues from widely deployed LLM-powered coding tools, manually confirming 547 genuine safety failures. Applying systematic open coding over both corpora, we derive a multi-dimensional safety taxonomy of 33 operational risk types organized across seven dimensions, and annotate each incident with contributing factors, task context, severity, and downstream impact. Our findings show that coding-agent failures are often severe, with 326 of 547 incidents rated high or critical. The dominant risks are constraint violations, destructive operations, authorization bypasses, and deception, and over 65% of incidents arise in bug fixing and setup or configuration, patterns largely missing from prior literature. These results have direct implications for SE tool designers and benchmark developers: guardrails must go beyond adversarial-prompt defenses to enforce environmental constraints, failure transparency, and safe-halt behaviors.

This paper is accepted to the 41st IEEE/ACM International Conference on Automated Software Engineering (ASE 2026), Research Track


Keeps adoption grounded in known failure modes, economics, and operational limits. A study of 20,574 real coding-agent sessions across 1,639 repositories, categorizing seven recurring forms of developer-agent misalignment and separating IDE from CLI usage patterns.

Use How Coding Agents Fail Their Users: A Large-Scale Analysis of Developer-Agent Misalignment in 20,574 Real-World Sessions to bound risk before recurring or unattended execution.

Research source arXiv:2605.29442; inspect its method and evaluation before treating results as production evidence.

[2605.29442] How Coding Agents Fail Their Users: A Large-Scale Analysis of Developer-Agent Misalignment in 20,574 Real-World Sessions

AI coding agents increasingly act directly within software environments, yet existing analyses of their failures rely on benchmark trajectories that miss how developers actually experience misalignment. We present an observational study of 20,574 coding-agent sessions from 1,639 repositories across IDE and CLI workflows. We operationalize misalignment as a breakdown made visible through developer pushback, and annotate each episode along four axes: form, cause, cost, and resolution. We identify seven recurring forms, spanning how agents read projects, interpret developer intent, follow rules, bound their actions, implement and execute code, and report progress. 90.50\% of episodes impose effort and trust costs rather than irreversible system damage, yet 91.49\% of visible resolutions still require explicit user correction. Misalignment patterns also differ across IDE and CLI settings, persist across adjacent sessions, and shift over time: while overall rates decline, constraint violations and inaccurate self-reporting grow in share. Our findings inform the design of training, evaluation, and interfaces for keeping coding agents aligned with real developer workflows.

Ningzhi Tang; Chaoran Chen; Gelei Xu; Yiyu Shi; Yu Huang; Collin McMillan; Tao Dong; Toby Jia-Jun Li


Keeps adoption grounded in known failure modes, economics, and operational limits. BACKTRACE measures whether a skill actually caused a decision by comparing skill-conditioned against no-skill runs and perturbing skill attributes.

Use Skill Use or Skill Theater? Evaluating the Reasoning Backroom in Skill-Augmented Language Agents to bound risk before recurring or unattended execution.

Research source arXiv:2607.27484; inspect its method and evaluation before treating results as production evidence.

[2607.27484] Skill Use or Skill Theater? Evaluating the Reasoning Backroom in Skill-Augmented Language Agents

Reusable skills are becoming a standard interface for extending language agents with task procedures. Yet evaluators usually infer skill use from visible reasoning or the agent's own attribution. These signals show what the agent appears to use, not whether the skill changed its decision. We ask whether skill-augmented agents exhibit a \textbf{Reasoning Backroom}, a systematic gap between stated skill use and intervention-measured influence. We introduce BACKTRACE, an evaluation framework that pairs each skill-conditioned answer with a matched no-skill counterfactual, intervenes on skill meaning, wording, identity, content, and assignment, and elicits attribution only after the answer is committed. We instantiate the framework as BACKROOMBench, a verified testbed spanning controlled logic and competition mathematics, multiple skill conditions, single-agent and multi-agent settings, and diverse model families. Our evaluation reveals a pervasive provenance failure. Across models and domains, stated skill use often remains stable while causal reliance and signed utility vary, producing both silent uptake and performative use. Behavioral effects follow procedural content more reliably than displayed skill identity, whereas stated attributions respond strongly to artifact availability. Observational detectors based on direct skill-use claims, text mentions, trace similarity, and an LLM judge do not identify which decisions actually depend on the skill. In multi-agent systems, skill influence can survive communication even after its source is lost, while no-skill teams still name skills and sources that were never supplied. These findings establish the Reasoning Backroom as a general AI provenance problem whose audit requires intervention.

Jinwei Hu; Yi Qi; Xinmiao Huang; Youcheng Sun; Yi Dong; Xiaowei Huang


Keeps adoption grounded in known failure modes, economics, and operational limits. Compressed models clear perplexity, downstream accuracy, and data-free output-fidelity checks, then fabricate procedure steps once deployed in an agent loop, and the effect is specific to coherent low-rank (SVD) error, not magnitude pruning at matched perplexity.

Use Fidelity Is Not Safety: Gently-Compressed LLMs Pass Every Data-Free Quality Guard Yet Invent Procedure Steps in Agentic Execution to bound risk before recurring or unattended execution.

Research source arXiv:2607.28196; inspect its method and evaluation before treating results as production evidence.

[2607.28196] Fidelity Is Not Safety: Gently-Compressed LLMs Pass Every Data-Free Quality Guard Yet Invent Procedure Steps in Agentic Execution

Practitioners accept a compressed language model once it clears a stack of data-cheap quality guards: perplexity within a small factor of the original, downstream accuracy (for example MMLU) inside a confidence interval, and data-free output-fidelity signals that compare the compressed and original network's internal representations under random probe inputs. This stack has a blind spot. Across three model families, gently-compressed models clear every guard and then invent procedure steps that were never in the instructions when they run a standard operating procedure (SOP) as an agent. The effect is operator-specific: coherent low-rank (SVD) truncation induces it, and magnitude pruning matched to the same perplexity does not. One dissociation isolates the cause. The same compressed weights that CI-win a paired output-fidelity test CI-fail the invented-step canary. The governing axis is the coherence of the compression error times its rate; the magnitude of the damage does not predict it. The data-free fidelity probe is a fidelity oracle by construction, so it cannot see this axis. We characterize the blindspot and dissociation with paired confidence intervals on a pre-registered, powered canary across three architectures. Operator-specificity replicates on all three, and the perplexity-guard evasion appears where the model admits in-guard low-rank headroom. We then give a data-free screen: a two-axis statistic of the compression error (coherent-fraction and error-rate) that flags the failing builds with fixed thresholds across architectures and matches the coherence-times-rate mechanism. Perplexity, MMLU, and fidelity acceptance do not certify agent safety. Screen gently-compressed low-rank builds before agentic deployment


Keeps adoption grounded in known failure modes, economics, and operational limits. Tests whether spending more inference compute rescues small locally-hosted computer-use agents on OSWorld, and finds it mostly changes the failure mode rather than fixing it: contextual scaling stabilizes trajectories, but temporal scaling extends wrong paths instead of correcting them. A useful corrective to 'just let it loop longer'.

Use Rethinking Inference-Time Scaling in Local Computer-Use Agents: Failure Modes and Compute Tradeoffs to bound risk before recurring or unattended execution.

Research source arXiv:2607.28573; inspect its method and evaluation before treating results as production evidence.

[2607.28573] Rethinking Inference-Time Scaling in Local Computer-Use Agents: Failure Modes and Compute Tradeoffs

Deploying autonomous computer-use agents (CUAs) locally is increasingly important for privacy, cost efficiency, and practical usability, yet improving their performance under strict hardware constraints remains challenging. While recent studies show that inference-time scaling can improve frontier computer-use agents through additional computation during execution, its effectiveness for resource-constrained local models remains poorly understood. We present a systematic empirical study of inference-time scaling in local CUAs across contextual, temporal, structural, and parallel dimensions. We evaluate Qwen3-VL-8B/30B-A3B, UI-TARS-1.5-7B, and OpenCUA-7B on the OSWorld benchmark. Our results show that additional computation often yields diminishing returns while changing failure modes. Contextual scaling provides historical grounding that improves trajectory stability and task accuracy, but its gains saturate as token cost increases and failures shift from repetitive or stalled trajectories toward premature false successes. Temporal scaling similarly reduces max-step stalls, yet does not substantially improve task success, indicating that longer horizons often extend erroneous trajectories rather than correct them. We further find that structural decomposition can introduce planning and formatting overhead in local two-stage agents, while parallel scaling partially mitigates these failures at a substantial computational cost. Overall, our findings suggest that efficient local CUAs require selective compute allocation, failure-aware control mechanisms, and agentic frameworks designed around the capabilities and limitations of local models.


Context is managed as durable loop state rather than a single prompt payload. Submitted 2026-07-30. An impossibility argument aimed squarely at the standard loop-safety design: if the evidence a safeguard uses (system prompt, conversation history, stated role) is copyable, an attacker can imitate it.

Use Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs to bound risk before recurring or unattended execution.

Research source arXiv:2607.27951; inspect its method and evaluation before treating results as production evidence.

[2607.27951] Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions.

Pingyu Wu; Lingyao Zhu; Weiming Zhang; Nenghai Yu


Context is managed as durable loop state rather than a single prompt payload. Submitted 2026-07-28. Controlled ablation of AGENTS.md / CLAUDE.md context files across two frontier agents, 17 real repository tasks, and 288 evaluated runs. Finding: context strategy does not measurably move correctness on either agent, and failures are dominated by implementation difficulty rather than missing repo knowledge.

Use Do Context Files Help Coding Agents? A Two-Agent Ablation Study on Real Repositories to bound risk before recurring or unattended execution.

Research source arXiv:2607.27250; inspect its method and evaluation before treating results as production evidence.

[2607.27250] Do Context Files Help Coding Agents? A Two-Agent Ablation Study on Real Repositories

Persistent context files (AGENTS.md, CLAUDE.md) are standard practice for guiding AI coding agents, yet evidence for their effectiveness is contradictory. We present a controlled ablation of context-injection strategy across two frontier agents (Claude Code and Codex), 17 real tasks from 3 repositories (15 shared + 2 Codex-only), and 288 evaluated runs with gold-test evaluation. Context strategy does not measurably move correctness on either agent (bounded to <=10-15pp via equivalence testing). A failure-mode triage reveals why: agents fail on implementation skill---feature design, pattern selection, exact wiring---not missing repository knowledge that a context file could supply; a manipulation probe confirms the real AGENTS.md never converts a near-miss to a pass on either agent. We further show that borderline task difficulty is agent-specific (Spearman rho=0.75), offering a candidate explanation for prior contradictions: single-agent studies draw tasks from different agents' informative bands. We release all code, data, and analysis.


Awesome Harness Engineering by ai-boost

Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. Comprehensive list for the agent harness layer that Loop Engineering builds on.

Use Awesome Harness Engineering by ai-boost to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (3,446 stars; 389 forks; NOASSERTION license; updated 2026-08-07); popularity is context, not proof of reliability.

Reuse, adapt, and contribute concrete loop artifacts.

GitHub - ai-boost/awesome-harness-engineering: Awesome list for AI agent harness engineering: tools, patterns, evals, memory, MCP, permissions, observability, and orchestration. · GitHub

Awesome list for AI agent harness engineering: tools, patterns, evals, memory, MCP, permissions, observability, and orchestration. - ai-boost/awesome-harness-engineering


Evaluation data is used as the feedback signal for improving loop behavior. High-signal harness list with strong categories for context, guardrails, specs, evals, runtimes, and benchmarks.

Use Awesome Harness Engineering by walkinglabs to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (3,776 stars; 310 forks; NOASSERTION license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - walkinglabs/awesome-harness-engineering: 🛠 Awesome tools & guides for harness engineering. · GitHub

🛠 Awesome tools & guides for harness engineering. - walkinglabs/awesome-harness-engineering


Awesome Agent Harness

Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. Curated tools and resources for environments, constraints, and feedback around coding agents.

Use Awesome Agent Harness to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (507 stars; 54 forks; updated 2026-08-06); popularity is context, not proof of reliability.

GitHub - AutoJunjie/awesome-agent-harness · GitHub

Contribute to AutoJunjie/awesome-agent-harness development by creating an account on GitHub.


Awesome Context Engineering

Context is managed as durable loop state rather than a single prompt payload. Survey-style list for context engineering across LLMs and agents.

Use Awesome Context Engineering to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (3,269 stars; 266 forks; MIT license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - Meirtz/Awesome-Context-Engineering: 🔥 Comprehensive survey on Context Engineering: from prompt engineering to production-grade AI systems. hundreds of papers, frameworks, and implementation guides for LLMs and AI agents. · GitHub

🔥 Comprehensive survey on Context Engineering: from prompt engineering to production-grade AI systems. hundreds of papers, frameworks, and implementation guides for LLMs and AI agents. - Meirtz/Awesome-Context-Engineering


Awesome Prompt Engineering

Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. Classic adjacent list for prompt techniques and prompting resources.

Use Awesome Prompt Engineering to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (6,231 stars; 745 forks; Apache-2.0 license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - promptslab/Awesome-Prompt-Engineering: This repository contains a hand-curated resources for Prompt Engineering with a focus on Generative Pre-trained Transformer (GPT), ChatGPT, PaLM etc · GitHub

This repository contains a hand-curated resources for Prompt Engineering with a focus on Generative Pre-trained Transformer (GPT), ChatGPT, PaLM etc - GitHub - promptslab/Awesome-Prompt-Engineering: This repository contains a hand-curated resources for Prompt Engineering with a focus on Generative Pre-trained Transformer (GPT), ChatGPT, PaLM etc


Awesome LLM Agents

Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. General list of LLM agent papers, frameworks, and applications.

Use Awesome LLM Agents to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (1,559 stars; 335 forks; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - kaushikb11/awesome-llm-agents: A curated list of awesome LLM agents frameworks. · GitHub

A curated list of awesome LLM agents frameworks. Contribute to kaushikb11/awesome-llm-agents development by creating an account on GitHub.


Awesome AI Agents

Broad AI agent ecosystem map.

Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. Broad AI agent ecosystem map.

Use Awesome AI Agents to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (29,296 stars; 3,287 forks; NOASSERTION license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - e2b-dev/awesome-ai-agents: A list of AI autonomous agents · GitHub

A list of AI autonomous agents. Contribute to e2b-dev/awesome-ai-agents development by creating an account on GitHub.


Awesome CLI Coding Agents

Orchestration and control flow are made explicit and inspectable. Directory of terminal-native coding agents, parallel runners, autonomous loops, and the harnesses that orchestrate them.

Use Awesome CLI Coding Agents to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (958 stars; 261 forks; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - bradAGI/awesome-cli-coding-agents: Curated directory of terminal-native AI coding agents and the harnesses that orchestrate them. Covers open-source tools (Pi, OpenCode, Aider, Goose), platform agents (Claude Code, Codex, Gemini CLI), parallel runners, autonomous loops, and agent infrastructure. · GitHub

Curated directory of terminal-native AI coding agents and the harnesses that orchestrate them. Covers open-source tools (Pi, OpenCode, Aider, Goose), platform agents (Claude Code, Codex, Gemini CLI), parallel runners, autonomous loops, and agent infrastructure. - GitHub - bradAGI/awesome-cli-coding-agents: Curated directory of terminal-native AI coding agents and the harnesses that orchestrate them. Covers open-source tools (Pi, OpenCode, Aider, Goose), platform agents (Claude Code, Codex, Gemini CLI), parallel runners, autonomous loops, and agent infrastructure.


Awesome Self-Evolving Agents

Verification is promoted from a final check to a loop-control signal. Survey-style list of agents that improve themselves over repeated runs, an adjacent angle on long-running loops with memory and verification.

Use Awesome Self-Evolving Agents to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (382 stars; 23 forks; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - XMUDeepLIT/Awesome-Self-Evolving-Agents: A Survey of Self-Evolving Agents | A curated list of resources (surveys, papers, benchmarks, and opensource projects) on Self-Evolving Agents. · GitHub

A Survey of Self-Evolving Agents | A curated list of resources (surveys, papers, benchmarks, and opensource projects) on Self-Evolving Agents. - XMUDeepLIT/Awesome-Self-Evolving-Agents


Awesome AI Agent Papers

Evaluation data is used as the feedback signal for improving loop behavior. Curated 2026 research collection across agent engineering, memory, evaluation, workflows, and autonomous systems, a paper-level feeder for loop-design foundations.

Use Awesome AI Agent Papers to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (1,661 stars; 172 forks; MIT license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - VoltAgent/awesome-ai-agent-papers: A curated collection of AI agent research papers released in 2026, covering agent engineering, memory, evaluation, workflows, and autonomous systems. · GitHub

A curated collection of AI agent research papers released in 2026, covering agent engineering, memory, evaluation, workflows, and autonomous systems. - VoltAgent/awesome-ai-agent-papers


awesome-ralph

Primary-source operational guidance rather than commentary. Curated directory for the Ralph technique, collecting official resources, implementations, playbooks, tutorials, and community channels for running coding agents in automated loops until specifications are fulfilled.

Use awesome-ralph to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (918 stars; 73 forks; updated 2026-08-03); popularity is context, not proof of reliability.

GitHub - snwfdhmp/awesome-ralph: A curated list of resources about Ralph, the AI coding technique that runs AI coding agents in automated loops until specifications are fulfilled. · GitHub

A curated list of resources about Ralph, the AI coding technique that runs AI coding agents in automated loops until specifications are fulfilled. - snwfdhmp/awesome-ralph


Awesome Agent Loops

The trigger or cadence is explicit, making the workflow recurring rather than one-off. Curated collection of /loop, /goal, and /schedule commands for Claude Code and Codex sourced from practitioner posts, organized around trigger, condition, and skill structure.

Use Awesome Agent Loops to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (199 stars; 15 forks; CC-BY-4.0 license; updated 2026-07-31); popularity is context, not proof of reliability.

GitHub - serenakeyitan/awesome-agent-loops: A curated collection of the best /loop, /goal, and /schedule uses for Claude Code & Codex — real commands sourced from Twitter/X. The awesome-list of agent loops. · GitHub

A curated collection of the best /loop, /goal, and /schedule uses for Claude Code & Codex — real commands sourced from Twitter/X. The awesome-list of agent loops. - serenakeyitan/awesome-agent-loops


Awesome Loop Models

Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. Dedicated catalog of architectures that reuse a learned layer, block, module, or operator within one forward process; use it for deeper model-level coverage while this repository focuses on the bridge to operational agent loops.

Use Awesome Loop Models to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (251 stars; 7 forks; MIT license; updated 2026-08-06); popularity is context, not proof of reliability.

GitHub - huskydoge/Awesome-Loop-Models: A curated list of papers and selected technical blogs on Loop Models. · GitHub

A curated list of papers and selected technical blogs on Loop Models. - huskydoge/Awesome-Loop-Models


harness-engineering (Ryan Lopopolo)

Context is managed as durable loop state rather than a single prompt payload. Ryan Lopopolo's anthology, field guide, and agent context bundle for harness engineering, collecting primary sources on the layer directly beneath loop engineering.

Use harness-engineering (Ryan Lopopolo) to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (2,464 stars; 253 forks; CC-BY-4.0 license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - lopopolo/harness-engineering: 🐎 Ryan Lopopolo’s anthology, field guide, and agent context bundle for harness engineering · GitHub

🐎 Ryan Lopopolo’s anthology, field guide, and agent context bundle for harness engineering - lopopolo/harness-engineering


Connects neighboring ecosystems while preserving Loop Engineering as a narrower operating concept. Stefan Jansen's curated reading path of 60+ resources on coding-agent loops, organized to separate practitioner discourse, control-theory foundations, agent primitives, harness papers, adoption studies, and safety work by evidence type.

Use A Coding-Agent Reading List: Behind the Loops to reuse a concrete artifact or connect it to the wider ecosystem.

Contextual source from insights.ml4trading.io; useful for practice signals or boundary conditions, not independent validation.

Loop engineering is only the surface. A reading path through the older control problems underneath — and the line between what a coding agent may change and the experimental decisions that determine whether a result is valid.


Resource Atlas

Turns the evidence into an interactive atlas and structured data. Filter 937 resources by goal, loop layer, lifecycle stage, artifact type, evidence class, and search query.

Use Resource Atlas to reuse a concrete artifact or connect it to the wider ecosystem.

Reusable template, schema, checklist, or guide; signal comes from concrete adaptation and validation.

Explore 931 resources from model recurrence to governed agent operations, then build with 22 patterns, 22 contracts, and 8 runtime starters.


Hugging Face dataset

Packages the evidence as queryable CSV and JSONL rather than only a rendered page. Query the full collection as generated CSV and JSONL tables with publication, evidence, and lifecycle fields.

Use Hugging Face dataset to reuse a concrete artifact or connect it to the wider ecosystem.

Contextual source from huggingface.co; useful for practice signals or boundary conditions, not independent validation.

cy0307/awesome-loop-engineering · Datasets at Hugging Face

We’re on a journey to advance and democratize artificial intelligence through open source and open science.


Dataset export guide

Packages the evidence as queryable CSV and JSONL rather than only a rendered page. Load, query, regenerate, and audit the CSV, JSONL, and Resource Atlas data.

Use Dataset export guide to reuse a concrete artifact or connect it to the wider ecosystem.

Repository file; inspect the linked schema, example, guide, or implementation.


Runtime selection guide

Durable execution and replay are treated as first-class loop infrastructure. Compare session, scheduled, CI, cron, and durable runtimes by persistence, isolation, permissions, and state.

Use Runtime selection guide to reuse a concrete artifact or connect it to the wider ecosystem.


Future Directions agenda

Turns open gaps into measurable research, infrastructure, and product directions. Turn 15 open problems into measurable studies, runtime projects, product pilots, and shared standards.

Use Future Directions agenda to reuse a concrete artifact or connect it to the wider ecosystem.


Release notes

Turns open questions and operating lessons into visible next work. Versioned changelog of new resources, patterns, and repository changes.

Use Release notes to reuse a concrete artifact or connect it to the wider ecosystem.

Inspectable GitHub source (48 stars; 8 forks; CC0-1.0 license; updated 2026-08-07); popularity is context, not proof of reliability.

Releases · ChaoYue0307/awesome-loop-engineering · GitHub

🔁 Build reliable recurring AI-agent systems: 931 resources, 22 operational patterns, 22 loop contracts, 8 runtime starters, an interactive atlas, and a structured dataset. - Releases · ChaoYue0307/awesome-loop-engineering


Roadmap

Turns open questions and operating lessons into visible next work. Near-term work, pattern priorities, gallery goals, and open questions.

Use Roadmap to reuse a concrete artifact or connect it to the wider ecosystem.


Launch article

Turns open questions and operating lessons into visible next work. Concise explanation of the concept, implementation kit, and evidence base.

Use Launch article to reuse a concrete artifact or connect it to the wider ecosystem.


Discussion guide

The resource is directly reusable as a starting artifact. Suggested discussion categories, starter prompts, and moderation standard.

Use Discussion guide to reuse a concrete artifact or connect it to the wider ecosystem.


Show your Loop Engineering patterns

Turns open questions and operating lessons into visible next work. Community discussion for real or anonymized loop examples.

Use Show your Loop Engineering patterns to reuse a concrete artifact or connect it to the wider ecosystem.

Show your Loop Engineering patterns · ChaoYue0307/awesome-loop-engineering · Discussion #2 · GitHub