Untrusted intake is treated as a loop-level security boundary. Khodayari, Zhang, Acharya and Pellegrino crawled 1.2B URLs across 24.8M hosts and validated 15,300 real indirect-prompt-injection instances on 11,700 pages, the first internet-scale measurement of injection content that is already sitting in the corpus unattended agents fetch.

Use Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives to bound risk before recurring or unattended execution.

Research source arXiv:2604.27202; inspect its method and evaluation before treating results as production evidence.

[2604.27202] Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives

As LLMs are increasingly integrated into systems that browse, retrieve, summarize, and act on web content, webpages have become an untrusted input vector for downstream model behavior. This enables site owners, contributors, and adversaries to embed instructions directly in web resources, i.e., indirect prompt injections. While prior work demonstrates such attacks in controlled settings, their prevalence, deployment, and real-world impact remain unclear. We present one of the first large-scale empirical analyses of indirect prompt injections in webpages and HTTP responses. Analyzing 1.2B URLs from 24.8M hosts, we identify 15.3K validated instances across 11.7K pages. These are not isolated cases: a small number of recurring templates account for most cases. We characterize their objectives, delivery mechanisms, visibility, persistence, and impact, revealing a heterogeneous ecosystem spanning disruptive prompts, reputation manipulation, content-protection directives, and AI-bot detection, targeting systems such as crawlers, search pipelines, customer-support agents, and hiring workflows. A key finding is that most instructions target machines rather than humans: about 70% appear in non-rendered HTML (e.g., headers, comments, metadata), and many visible cases are hidden via rendering techniques. To assess practical risk, we run 5,200 controlled experiments across 13 models and four webpage representations. Our results show compliance is limited but non-negligible, reaching up to 8% for smaller models on plain-text inputs, while structured representations reduce compliance by preserving structural cues. Overall, prompt-based interference is already present in the web ecosystem and represents a growing source of tension between LLM-driven automation and the sites it consumes.

Soheil Khodayari; Xuenan Zhang; Bhupendra Acharya; Giancarlo Pellegrino

18 pages total, 12 pages main content, 8 figures, and 12 tables


Persistent memory is treated as an external runtime artifact. A systematic treatment of the attack surface that only exists because loops are stateful. The authors enumerate four memory write channels, nine structural vulnerabilities spanning model capability, system prompt and agent architecture, and six classes of memory poisoning attack, then release MPBench to measure them.

Use From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents to bound risk before recurring or unattended execution.

Research source arXiv:2606.04329; inspect its method and evaluation before treating results as production evidence.

Bound permissions, cost, failure, and escalation.

[2606.04329] From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents

Memory is a core component of AI agents, enabling them to accumulate knowledge across interactions and improve performance. However, persistent memory introduces the risk of memory poisoning, where a single adversarial memory write can exert long-term influence over agent behavior. We present a systematic study of memory poisoning in LLM-based agents. We identify four memory write channels and nine structural vulnerabilities in model capabilities, system prompt design, and agent system architecture that make these channels exploitable. Based on these vulnerabilities, we develop a taxonomy of six classes of memory poisoning attacks. Furthermore, we design MPBench -- a benchmark for evaluating memory poisoning attacks, and show that agents designed to write and retrieve memory more aggressively are more exploitable. We also show that existing prompt injection defenses fail to cover memory poisoning attacks. Our findings provide a foundation for understanding and mitigating memory poisoning attacks against AI agents.

Pritam Dash; Tongyu Ge; Aditi Jain; Tanmay Shah; Zhiwei Shang


Frames security as a recurring-loop boundary rather than a one-time prompt hygiene issue. Maps runtime risk across the whole execution lifecycle with six risk sources, six activation modes, and nine harm categories over 328 risk-injected cases and 6,560 runs.

Use AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents to bound risk before recurring or unattended execution.

Research source arXiv:2607.27294; inspect its method and evaluation before treating results as production evidence.

[2607.27294] AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents

Large language model (LLM)-based workspace agents execute stateful, multi-step workflows across heterogeneous resources, external tools, and persistent state. Their safety must therefore be assessed from actions, side effects, and state changes throughout execution. Although recent benchmarks have advanced executable safety testing and trajectory-aware verification, they rarely provide a unified account of where risks enter, how they elicit unsafe behavior, which harms they target, and where supporting evidence appears during execution. We introduce AgentS4D, a sandboxed benchmark for lifecycle-wide runtime safety evaluation. Its four-dimensional runtime-safety framework uses six risk-entry sources, six induction strategies, and nine target harms to guide case construction, while seven lifecycle checkpoints organize post-run evidence. AgentS4D contains 328 risk-injected cases. We evaluate all 20 combinations of four harnesses (Hermes, OpenClaw, Claude Code, and Codex) and five LLM backends (GPT-5.5, Gemini 3.1 Pro, DeepSeek-V4-Pro, MiniMax-M3, and Qwen3.7-Plus) on these cases, yielding 6,560 runs. Overall, 4,461 runs (68.0%) trigger prespecified unsafe signals. Across the 20 configurations, the observed safety of an agent system varies with both its harness-LLM pairing and how risk is introduced. Agent systems exhibit markedly different safety behavior when the same induction strategy reaches them through different risk carriers. They also respond differently to the same target harm when it is realized through different carriers and strategies. Moreover, 4,344 runs (66.22% overall) are unsafe yet complete. Thus, task completion cannot establish runtime safety, and testing only one form of a risk can conceal important weaknesses. Evaluations should examine complete agent configurations across diverse risk conditions and retain evidence throughout execution.

Jiajun Zhou; Zhaoxuan Ke; Jihang Ye; Xuanze Chen; Shanqing Yu; Qi Xuan


Persistent memory is treated as an external runtime artifact. Defends the memory-retrieval path, the entry point poisoned memory uses to reach a loop, with an intent-aware information bottleneck that compresses retrieved entries while preserving attack signal, so a small detector can flag malicious memories. Cuts attack success by 55%+ without meaningful accuracy or latency cost.

Use MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck to bound risk before recurring or unattended execution.

Research source arXiv:2607.28103; inspect its method and evaluation before treating results as production evidence.

[2607.28103] MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck

Memory-augmented LLM-based agents are vulnerable to memory injection attacks: Agents may retrieve poisoned memory from attackers, which diverts their behavior from initial user intent and finally causes task failure. However, existing defense mechanisms either incur high computational cost or suffer from information redundancy in multi-turn contexts. To address these challenges, we propose Memory Intent-Aware Neural Denoising(MIND), a lightweight defense framework for memory injection attack. Our preliminary analysis reveals that benign and poisoned trajectories exhibit distinguishable relationships between the initial user intent and subsequent behavior. Building on this observation, MIND employs an intent-aware Information Bottleneck(IB) to extract compact intent--behavior representations from the initial intent and turn-level behavior. The IB preserves intent-relevant cross-turn attack signals while filtering task-irrelevant and repetitive information, and a lightweight detector identifies malicious memories from the resulting representations. As such, MIND mitigates information redundancy in multi-turn contexts while avoiding the overhead of repeated LLM auditing. Extensive experiments show that MIND reduces attack success rates while preserving task accuracy and inference efficiency. Notably, on ReAct-StrategyQA, MIND reduces mean ASR-r and ASR-a by 55.4% and 55.3%, respectively, while matching the undefended agent in average accuracy and latency.

Dongyi Liu; Haixing He; Xiaobao Wu; Jia Li


Frames security as a recurring-loop boundary rather than a one-time prompt hygiene issue. Replaces all-or-nothing response filtering with component-level admission: each part of a heterogeneous agent response carries declared prerequisites, supported components are retained, and actions are re-checked immediately before execution. Retained all 248 supported components where whole-response policies retained none.

Use HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution to bound risk before recurring or unattended execution.

Research source arXiv:2607.27636; inspect its method and evaluation before treating results as production evidence.

[2607.27636] HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution

Recent agentic AI systems may return a heterogeneous response containing notices, requests, handoffs, and actions. Conditions can change before external use, so components from the same response need not remain supported together. Rejecting the whole response discards useful components, whereas checking components independently can leave a dependent without its prerequisite. We present Heterogeneous Admission with Localized Obligations (HALO), a runtime protocol that preserves supported components whose declared prerequisites also remain supported, rechecks each exact action before dispatch, and allows blocked actions to be replaced only by fresh candidates. HALO matched all 96 admission expectations and passed all 20 protocol tests. In structured-response replay, it retained 248/248 supported components, including 128/128 unaffected by unrelated changes, while a whole-response policy retained 0/248. Across ten cold-start PX4/Gazebo sessions, HALO blocked every tested stale route, observed no matching stale setpoint, and completed all fresh recoveries.

Taewoo Park; Kyeonghyun Yoo; Kiseok Kim; Seunghyun Yoo; Hwangnam Kim

16 pages, 2 figures; supplementary material included


The work turns loop quality into a measurable task or score. Measures a dimension that task-success benchmarks miss entirely: whether an autonomous agent completes the job without leaving wreckage.

Use StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents to bound risk before recurring or unattended execution.

Benchmark or leaderboard source with repeatable tasks or scores; compare systems only after checking setup and scope.

[2607.26314] StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents

Stealth, the discipline of achieving an objective without revealing your presence, capabilities, or collected intelligence, is what separates sophisticated operators from detectable ones. Elite security researchers and advanced persistent threats achieve their objectives unnoticed; autonomous agents increasingly inherit the same offensive tasks, but do they inherit the tradecraft? We introduce StealthBench,a benchmark that measures operational stealth in autonomous offensive-security agents across six operational security (OPSEC) dimensions. We extract 11 hand-verified OPSEC incidents from real bug-bounty and red-team trajectories, expanded into 14 dockerized task scenarios, where agents, despite finding real vulnerabilities, committed stealth failures inconsistent with standard operational tradecraft: embedding credentials in public uploads, deleting production resources to prove access, force-adding uninvolved users to demonstrate a race condition. We evaluate agent trajectories using a 3-model large language model (LLM) judge panel with majority-vote aggregation, measuring safe success rate (solved and stealthy), Stealth@Solve (tradecraft quality among successful solves), and reckless solve rate (solved but cover blown). Our results show that no model exceeds 54% safe success rate (the compound metric requiring both task completion and stealth), confirming that OPSEC failures are systematic across model families. We release StealthBench as a public benchmark to support both the development of stealth-aware agents and automated OPSEC monitoring for autonomous offensive-security deployments. The interactive leaderboard, evaluation harness, and dataset are available at https://stealthbench.com.

29 pages, 9 tables, 1 figure, 2 appendices. Code: https://github.com/GangGreenTemperTatum/stealthbench Dataset: https://huggingface.co/datasets/0xmoose/stealthbench Website: https://stealthbench.com


Context is managed as durable loop state rather than a single prompt payload. Anthropic guide to context as managed runtime state rather than a prompt dump.

Use Effective Context Engineering for AI Agents to carry context, state, and receipts across runs and failures.

Primary documentation from a platform, SDK, standard, or framework; strong implementation signal.

Carry context, state, and receipts across runs.

Effective context engineering for AI agents \ Anthropic

Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.


Checkpointed state makes long-running agent work recoverable across failures. Covers execution loops, state, checkpointing, observers, and replayability.

Use Agent Harnesses: the Infrastructure Layer Your LLM Agent Actually Needs to carry context, state, and receipts across runs and failures.

Contextual source from ninadpathak.com; useful for practice signals or boundary conditions, not independent validation.


The Agent Loop Is the New OS

Context is managed as durable loop state rather than a single prompt payload. Frames the agent loop as an OS-like boundary with context as RAM and tools as I/O.

Use The Agent Loop Is the New OS to carry context, state, and receipts across runs and failures.

Contextual source from www.harness.io; useful for practice signals or boundary conditions, not independent validation.


Makes persistence and context management visible as runtime design choices. Martin Fowler article on feedforward, feedback, and outer harnesses for coding agents.

Use Harness engineering for coding agent users to carry context, state, and receipts across runs and failures.

Contextual source from martinfowler.com; useful for practice signals or boundary conditions, not independent validation.

A mental model for building trust in coding agents through feedforward guides, feedback sensors, and iterative harness engineering.


Context Engineering

Context is managed as durable loop state rather than a single prompt payload. Simon Willison's framing of context engineering, useful for distinguishing context state from loop orchestration.

Use Context Engineering to carry context, state, and receipts across runs and failures.

Contextual source from simonwillison.net; useful for practice signals or boundary conditions, not independent validation.

The term context engineering has recently started to gain traction as a better alternative to prompt engineering. I like it. I think this one may have sticking power. Here's an …


Agentic Coding in 2026

Durable execution and replay are treated as first-class loop infrastructure. Sourcegraph on supplying deterministic, large-codebase context and code intelligence so recurring agent runs reuse durable repository state instead of rediscovering it each time.

Use Agentic Coding in 2026 to carry context, state, and receipts across runs and failures.

Contextual source from sourcegraph.com; useful for practice signals or boundary conditions, not independent validation.

Agentic Coding in 2026: A Practical Guide for Big Code | Sourcegraph

Learn what agentic coding is, how AI coding agents work in real engineering orgs, and how to give them the codebase context they need to ship safely.


Durable execution and replay are treated as first-class loop infrastructure. Durable agent state with checkpointers, write-ahead logs, and time-travel branching.

Use Agentic AI State Management with ScyllaDB and LangGraph to carry context, state, and receipts across runs and failures.

Contextual source from www.scylladb.com; useful for practice signals or boundary conditions, not independent validation.

Agentic AI State Management with ScyllaDB and LangGraph | ScyllaDB

How to combine LangGraph and ScyllaDB for durable state management, crash recovery, and a highly available backend for your agentic AI applications.


Mem0

Persistent memory is treated as an external runtime artifact. Open-source memory layer for retaining user, session, and agent state across repeated agent sessions.

Use Mem0 to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (62,760 stars; 7,317 forks; Apache-2.0 license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - mem0ai/mem0: Universal memory layer for AI Agents · GitHub

Universal memory layer for AI Agents. Contribute to mem0ai/mem0 development by creating an account on GitHub.


Letta

Persistent memory is treated as an external runtime artifact. Stateful agent framework from the MemGPT line with persistent, self-editing memory across runs.

Use Letta to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (24,140 stars; 2,569 forks; Apache-2.0 license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - letta-ai/letta: Platform for stateful agents: AI with advanced memory that can learn and self-improve over time. · GitHub

Platform for stateful agents: AI with advanced memory that can learn and self-improve over time. - letta-ai/letta


Zep

Control flow is represented as an inspectable graph rather than an opaque prompt loop. Temporal knowledge graph memory that tracks how facts about users and systems change across sessions.

Use Zep to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (4,812 stars; 646 forks; Apache-2.0 license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - getzep/zep: Zep | Examples, Integrations, & More · GitHub

Zep | Examples, Integrations, & More. Contribute to getzep/zep development by creating an account on GitHub.


LangMem

Persistent memory is treated as an external runtime artifact. SDK for extracting, consolidating, and retrieving long-term agent memory between loop runs.

Use LangMem to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (1,597 stars; 183 forks; MIT license; updated 2026-08-07); popularity is context, not proof of reliability.

Contribute to langchain-ai/langmem development by creating an account on GitHub.


Beads

Durable execution and replay are treated as first-class loop infrastructure. Git-plus-SQLite issue and memory store that agents read and write with a `bd` CLI, giving recurring loops durable task state and progress that survives context resets.

Use Beads to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (26,105 stars; 1,750 forks; MIT license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - gastownhall/beads: Beads - A memory upgrade for your coding agent · GitHub

Beads - A memory upgrade for your coding agent. Contribute to gastownhall/beads development by creating an account on GitHub.


Context is managed as durable loop state rather than a single prompt payload. Treats context as a managed runtime artifact, reorganizing the working context when degradation or context rot is detected across a long run.

Use ARC: Active and Reflection-driven Context Management for Long-Horizon Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2601.12030; inspect its method and evaluation before treating results as production evidence.

[2601.12030] ARC: Active and Reflection-driven Context Management for Long-Horizon Information Seeking Agents

Large language models are increasingly deployed as research agents for deep search and long-horizon information seeking, yet their performance often degrades as interaction histories grow. This degradation, known as context rot, reflects a failure to maintain coherent and task-relevant internal states over extended reasoning horizons. Existing approaches primarily manage context through raw accumulation or passive summarization, treating it as a static artifact and allowing early errors or misplaced emphasis to persist. Motivated by this perspective, we propose ARC, which is the first framework to systematically formulate context management as an active, reflection-driven process that treats context as a dynamic internal reasoning state during execution. ARC operationalizes this view through reflection-driven monitoring and revision, allowing agents to actively reorganize their working context when misalignment or degradation is detected. Experiments on challenging long-horizon information-seeking benchmarks show that ARC consistently outperforms passive context compression methods, achieving up to an 11% absolute improvement in accuracy on BrowseComp-ZH with Qwen2.5-32B-Instruct.

Yilun Yao; Shan Huang; Elsie Dai; Zhewen Tan; Zhenyu Duan; Shousheng Jia; Yanbing Jiang; Tong Yang

Published in Findings of the Association for Computational Linguistics: ACL; the linked arXiv record remains available for open access.


Evaluation data is used as the feedback signal for improving loop behavior. Formalizes agent memory as a write-manage-read loop and surveys compression, retrieval, reflective self-improvement, and policy-learned management across recurring runs.

Use Memory for Autonomous LLM Agents: Mechanisms, Evaluation, and Emerging Frontiers to carry context, state, and receipts across runs and failures.

Research source arXiv:2603.07670; inspect its method and evaluation before treating results as production evidence.

[2603.07670] Memory for Autonomous LLM Agents:Mechanisms, Evaluation, and Emerging Frontiers

Large language model (LLM) agents increasingly operate in settings where a single context window is far too small to capture what has happened, what was learned, and what should not be repeated. Memory -- the ability to persist, organize, and selectively recall information across interactions -- is what turns a stateless text generator into a genuinely adaptive agent. This survey offers a structured account of how memory is designed, implemented, and evaluated in modern LLM-based agents, covering work from 2022 through early 2026. We formalize agent memory as a \emph{write--manage--read} loop tightly coupled with perception and action, then introduce a three-dimensional taxonomy spanning temporal scope, representational substrate, and control policy. Five mechanism families are examined in depth: context-resident compression, retrieval-augmented stores, reflective self-improvement, hierarchical virtual context, and policy-learned management. On the evaluation side, we trace the shift from static recall benchmarks to multi-session agentic tests that interleave memory with decision-making, analyzing four recent benchmarks that expose stubborn gaps in current systems. We also survey applications where memory is the differentiating factor -- personal assistants, coding agents, open-world games, scientific reasoning, and multi-agent teamwork -- and address the engineering realities of write-path filtering, contradiction handling, latency budgets, and privacy governance. The paper closes with open challenges: continual consolidation, causally grounded retrieval, trustworthy reflection, learned forgetting, and multimodal embodied memory.


Durable execution and replay are treated as first-class loop infrastructure. Reviews how durable state, reusable skills, protocols, and the harness move out of model weights into external infrastructure, the substrate that lets loops persist progress and reuse capability across runs.

Use Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering to carry context, state, and receipts across runs and failures.

Research source arXiv:2604.08224; inspect its method and evaluation before treating results as production evidence.

[2604.08224] Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering

Large language model (LLM) agents are increasingly built less by changing model weights than by reorganizing the runtime around them. Capabilities that earlier systems expected the model to recover internally are now externalized into memory stores, reusable skills, interaction protocols, and the surrounding harness that makes these modules reliable in practice. This paper reviews that shift through the lens of externalization. Drawing on the idea of cognitive artifacts, we argue that agent infrastructure matters not merely because it adds auxiliary components, but because it transforms hard cognitive burdens into forms that the model can solve more reliably. Under this view, memory externalizes state across time, skills externalize procedural expertise, protocols externalize interaction structure, and harness engineering serves as the unification layer that coordinates them into governed execution. We trace a historical progression from weights to context to harness, analyze memory, skills, and protocols as three distinct but coupled forms of externalization, and examine how they interact inside a larger agent system. We further discuss the trade-off between parametric and externalized capability, identify emerging directions such as self-evolving harnesses and shared agent infrastructure, and discuss open challenges in evaluation, governance, and the long-term co-evolution of models and external infrastructure. The result is a systems-level framework for explaining why practical agent progress increasingly depends not only on stronger models, but on better external cognitive infrastructure.

Chenyu Zhou; Huacan Chai; Wenteng Chen; Zihan Guo; Rong Shan; Yuanyi Song; Tianyi Xu; Yingxuan Yang; Aofan Yu; Weiming Zhang; Congming Zheng; Jiachen Zhu; Zeyu Zheng; Zhuosheng Zhang; Xingyu Lou; Changwang Zhang; Zhihui Fu; Jun Wang; Weiwen Liu; Jianghao Lin; Weinan Zhang

54 pages, tech report on Externalization in LLM Agents


Context is managed as durable loop state rather than a single prompt payload. A bi-level loop where a meta-agent evolves reusable skills while a base-agent optimizes context, co-evolving the harness and context artifacts across runs (ICML 2026).

Use Meta Context Engineering via Agentic Skill Evolution to carry context, state, and receipts across runs and failures.

Research source arXiv:2601.21557; inspect its method and evaluation before treating results as production evidence.

[2601.21557] Meta Context Engineering via Agentic Skill Evolution

The operational efficacy of large language models relies heavily on their inference-time context. This has established Context Engineering (CE) as a formal discipline for optimizing these inputs. Current CE methods rely on manually crafted harnesses, such as rigid generation-reflection workflows and predefined context schemas. They impose structural biases and restrict context optimization to a narrow, intuition-bound design space. To address this, we introduce Meta Context Engineering (MCE), a bi-level framework that supersedes static CE heuristics by co-evolving CE skills and context artifacts. In MCE iterations, a meta-level agent refines engineering skills via agentic crossover, a deliberative search over the history of skills, their executions, and evaluations. A base-level agent executes these skills, learns from training rollouts, and optimizes context as flexible files and code. We evaluate MCE across five disparate domains under offline and online settings. MCE demonstrates consistent performance gains, achieving 5.6--53.8% relative improvement over state-of-the-art agentic CE methods (mean of 16.9%), while maintaining superior context adaptability, transferability, and efficiency in both context usage and training.

Haoran Ye; Xuning He; Vincent Arak; Haonan Dong; Guojie Song


Persistent memory is treated as an external runtime artifact. Evaluates twelve agent memory systems across five workloads from a data-management perspective, decomposing memory into representation, extraction, retrieval, and maintenance modules and finding localized maintenance more cost-efficient than global reorganization.

Use Are We Ready for an Agent-Native Memory System? to carry context, state, and receipts across runs and failures.

Research source arXiv:2606.24775; inspect its method and evaluation before treating results as production evidence.

[2606.24775] Are We Ready For An Agent-Native Memory System?

Memory for large language model (LLM) agents has rapidly evolved from simple retrieval-augmented mechanisms into a data management system that supports persistent information storage, retrieval, update, consolidation, and dynamic lifecycle governance throughout agent execution. Despite this evolution, existing evaluations still benchmark agent memory mainly through end-to-end task success metrics (e.g., F1, BLEU), while treating the underlying system as a monolithic black box. As a result, critical system-level concerns, including operational costs, architectural trade-offs across memory modules, and robustness under dynamic knowledge updates, remain insufficiently explored. In this paper, we present a systematic experimental study of agent memory from a data management perspective. We propose an analytical framework that decomposes agent memory into four core modules: memory representation and storage, extraction, retrieval and routing, and maintenance. Under this framework, we evaluate 12 representative memory systems and two reference baselines across five benchmark workloads spanning 11 datasets. Our extensive end-to-end evaluation shows that no single architecture dominates across all scenarios; instead, effectiveness depends heavily on how well the memory structure aligns with the workload bottleneck. Furthermore, through fine-grained ablation studies, we quantify their individual effects on representation fidelity, retrieval precision, update correctness, and long-horizon stability. Finally, we reveal cost-performance trade-offs under realistic workloads, showing localized maintenance is more cost-efficient than global reorganization. Based on these findings, we identify promising directions towards building truly agent-native memory systems. The code is publicly available at https://github.com/OpenDataBox/MemoryData.

Wei Zhou; Xuanhe Zhou; Shaokun Han; Hongming Xu; Guoliang Li; Zhiyu Li; Feiyu Xiong; Fan Wu

Paper list available at: https://github.com/OpenDataBox/awesome-agent-memory. Source code available at: https://github.com/OpenDataBox/MemoryData


Makes persistence and context management visible as runtime design choices. Evolves a deployment-time world model while the agent and model weights stay frozen, retrieving observed transitions, distilling rules from prediction-observation mismatches, and filtering low-confidence forecasts so each run's errors improve later planning.

Use Self-Evolving World Models for LLM Agent Planning to carry context, state, and receipts across runs and failures.

Research source arXiv:2606.30639; inspect its method and evaluation before treating results as production evidence.

[2606.30639] Self-Evolving World Models for LLM Agent Planning

World models offer a principled way to equip long-horizon LLM agents with foresight: predictions of action consequences before execution. However, unreliable foresight can be ignored, misused, or even degrade downstream decision-making. In this paper, we introduce WorldEvolver, a self-evolving world model framework that revises its deployment-time context while keeping the downstream agent and all model parameters frozen. WorldEvolver integrates three modules: (i) Episodic Memory, which exploits real action transitions through retrieval-based simulation; (ii) Semantic Memory, which extracts persistent heuristic rules from prediction-observation mismatches; and (iii) Selective Foresight, which filters low-confidence predictions before integrating them into agent reasoning context. We evaluate WorldEvolver on ALFWorld and ScienceWorld, measuring world model prediction accuracy on Word2World and downstream agent success rate on AgentBoard. Extensive experiments show that WorldEvolver achieves the highest prediction accuracy across three backbones and leads other world model baselines on downstream agent success rate, demonstrating that test-time memory revision enhances both predictive fidelity and planning performance.

Xuan Zhang; Wenxuan Zhang; See-Kiong Ng; Yang Deng


Makes persistence and context management visible as runtime design choices. Finds that naively re-internalizing accumulated experience causes progressive capability collapse across self-improvement iterations, and identifies what keeps the loop stable: principle-level abstractions, step-wise injection for tool use, and off-policy distillation from stronger teacher trajectories.

Use Rethinking Continual Experience Internalization for Self-Evolving LLM Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2606.04703; inspect its method and evaluation before treating results as production evidence.

[2606.04703] Rethinking Continual Experience Internalization for Self-Evolving LLM Agents

Experience internalization converts contextual experience from past interactions into reusable parametric capability, offering a promising path toward continual learning in large language models (LLMs). While prior work has predominantly focused on single-iteration transfer, we discover that under multi-iteration experience learning, existing methods suffer from a progressive capability collapse rather than compounding improvement. We systematically examine this failure through three vital dimensions of experience internalization: (1) Experience Granularity: We find that principle-level experience is more durable than instance-level experience, as it effectively abstracts transferable strategies away from trajectory-specific details. (2) Experience Injection Pattern: Our analysis reveals that step-wise injection significantly outperforms global injection by aligning experience with intermediate decision states, a property that is critical for long-horizon tool use. (3) Internalization Regime: We demonstrate that off-policy context-distillation on high-quality teacher trajectories provides a substantially more stable training signal than on-policy context-distillation, which is inherently limited by local corrections on student-induced flawed states. Together, these insights yield a simple yet robust recipe for stable and sustainable experience internalization, providing concrete guidance for engineering self-evolving and continually learning LLMs.

Jingwen Chen; Wenkai Yang; Shengda Fan; Wenbo Nie; Chenxing Sun; Shaodong Zheng; Yangen Hu; Lu Pan; Ke Zeng; Yankai Lin


GenericAgent

Persistent memory is treated as an external runtime artifact. Self-evolving agent that grows a skill tree from a small seed, crystallizing completed runs into layered memory and reusable skills, with a master-worker mode for long-horizon goals.

Use GenericAgent to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (13,689 stars; 1,586 forks; MIT license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - lsdefine/GenericAgent: Self-evolving agent: grows skill tree from 3.3K-line seed, achieving full system control with 6x less token consumption · GitHub

Self-evolving agent: grows skill tree from 3.3K-line seed, achieving full system control with 6x less token consumption - lsdefine/GenericAgent


Context is managed as durable loop state rather than a single prompt payload. Governs long-horizon agent context as indexed lifecycle objects in an explicit nod to garbage collection, with a side-channel planner proposing fold, mask, and prune actions under harness-enforced recoverable sidecars, cutting production input tokens by 10-15%.

Use Self-GC: Self-Governing Context for Long-Horizon LLM Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.00692; inspect its method and evaluation before treating results as production evidence.

[2607.00692] Self-GC: Self-Governing Context for Long-Horizon LLM Agents

Long-horizon LLM agents accumulate tool results, files, plans, and user constraints that are too structured to be treated as a disposable text suffix. Current systems mostly rely on in-run heuristics such as chronological pruning and tool-output masking, or on final self-summary near a context limit. Heuristics are cheap but blind to future dependencies; summaries preserve narrative state but often hide exact evidence, locators, and editable artifacts. We present Self-GC, where GC denotes self-governing context while deliberately echoing garbage collection: the system does not merely reclaim unused tokens, but governs the lifecycle of agent context objects. Self-GC turns user turns, tool spans, and skill state into indexed objects; asks a side-channel planner to propose fold, mask, and prune actions; and lets the harness enforce recoverable sidecars, safe commit boundaries, and cache-aware commit. On a 33-session Hard Set, Self-GC prunes 43.95% of prefix tokens while leaving 84.85% of future continuations unaffected, compared with no-impact rates of 54.55% to 69.70% for heuristic baselines. On a 332-session production-derived suite, three planner backbones reach no-impact rates of 91.27% to 94.58%, while baselines remain at 77.71% to 87.46%. In production, an online account-level split reduces daytime average input tokens by 10% to 15%, with peak reductions near 20%. These results point to context management as runtime lifecycle control over indexed, recoverable objects rather than post hoc text cleanup.

Xubin Hao; Hongjin Meng; Xin Yin; Jiawei Zhu; Chenpeng Cao


Verification is promoted from a final check to a loop-control signal. Reinforcement-learning method that jointly optimizes task execution and compaction-summary generation so long-horizon agents can continue past finite context windows, lifting GLM-4.5-Air to 66.8% on SWE-bench Verified and shipping in the GLM-5.2 pipeline.

Use CompactionRL: Reinforcement Learning with Context Compaction for Long-Horizon Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.05378; inspect its method and evaluation before treating results as production evidence.

[2607.05378] CompactionRL: Reinforcement Learning with Context Compaction for Long-Horizon Agents

Long-horizon agentic LLMs are increasingly limited by finite context windows, as extended interaction trajectories can exceed the maximum context length before a task is completed. Context compaction offers a natural solution by summarizing previous interaction states and continuing the rollout under a compressed context, but incorporating compaction into reinforcement learning remains underexplored. We propose CompactionRL, a reinforcement learning strategy to train long-horizon agentic LLMs with context compaction. Our approach jointly optimizes task execution and summary generation with token-level loss normalization and cross-trajectory generalized advantage estimation. This design enables the LLM agents to learn from compacted long-horizon trajectories. We train CompactionRL on top of open models and observe consistent performance gains on agentic coding tasks. CompactionRL enables the open GLM-4.5-Air model (106B-A30B) to achieve Pass@1 scores of 66.8% on SWE-bench Verified and 24.5% on Terminal-Bench 2.0, with absolute gains of 7.0 and 3.1 points, respectively. Built upon GLM-4.7-Flash (30B-A3B), CompactionRL improves Pass@1 by 5.5 and 6.8 points, reaching 56.0% on SWE-bench Verified and 20.2% on Terminal-Bench 2.0, respectively. CompactionRL is thus deployed in the RL pipeline for training the open GLM-5.2 model (750B-A40B).

Yujiang Li; Zhenyu Hou; Yi Jing; Jie Tang; Yuxiao Dong


Primary-source operational guidance rather than commentary. Memory framework in which the agent autonomously optimizes its own storage, retrieval, and summarization strategies per task instead of a fixed pipeline, improving BEAM's official score over the strongest baseline by 48.7%, 40.8%, and 41.9% at 100K, 500K, and 1M tokens, respectively.

Use SelfMem: Self-Optimizing Memory for AI Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.03726; inspect its method and evaluation before treating results as production evidence.

[2607.03726] SelfMem: Self-Optimizing Memory for AI Agents

While current AI agents support increasingly long context windows, tool use, and skill execution for long-horizon tasks, they still require memory systems to effectively leverage historical experience. Existing memory frameworks typically rely on fixed storage, retrieval, and summarization mechanisms, which can be rigid across different tasks and often require manual tuning. To address this limitation, we propose SelfMem, a self-optimizing memory framework. Inspired by prior work on self-improving AI, we follow the principle of "teaching an agent to fish rather than giving it a fish." Instead of forcing the model to follow a predefined memory strategy or format, SelfMem provides an environment with memory tools and feedback signals that allow the agent to explore, evaluate, and refine its own memory strategy. Our results show that SelfMem consistently outperforms retrieval, compression, and agent-memory baselines on BEAM across conversation scales from 100K to 1M tokens. Compared with the strongest baseline, SelfMem improves the official score by 48.7%, 40.8%, and 41.9% at 100K, 500K, and 1M, respectively. Further question-type analysis shows broad robustness across diverse memory demands, and our optimization study shows that model-guided strategy refinement further improves performance.

Shu Yang; Junchao Wu; Derek F. Wong; Di Wang


Persistent memory is treated as an external runtime artifact. Model-, storage-, and API-agnostic agent memory architecture where the agent drives symbolic retrieval over a structured relational database, making long-term memory auditable and reproducible instead of opaque embedding search, validated in a year-long deployment.

Use Memory-Orchestrated Semantic System (MOSS): An Auditable Agentic Memory Architecture to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.04391; inspect its method and evaluation before treating results as production evidence.

[2607.04391] Memory-Orchestrated Semantic System (MOSS): An Auditable Agentic Memory Architecture

Long-term memory remains a structural weakness of AI agents. The dominant approach, retrieval-augmented generation (RAG), relies on embedding-based similarity search, which is opaque by construction, difficult to audit, and bounded by the theoretical limits of vector representations. We present the Memory-Orchestrated Semantic System (MOSS), an agentic memory architecture in which the agent drives retrieval over a structured relational database. MOSS is model-agnostic, storage-agnostic, and API-agnostic: it runs on any relational engine, connects to any LLM provider (or to deterministic non-LLM processes), and deploys on any infrastructure, local or cloud. Its retrieval execution is symbolic and reproducible (once a query is formulated, no LLM participates in the retrieval loop) and every step of the system, from indexing to answer formulation, is logged and inspectable, making MOSS auditable by construction. Rather than imposing an external ontology, MOSS derives its conceptual vocabulary from the corpus itself. We report on a longitudinal deployment unique in the agentic-memory literature: a year of continuous production over an individual scholar's working corpus--a conversational corpus reaching back to October 2024 (some 44 million tokens, retroactively indexed) comprising 110,183 segments, alongside 163,494 catalogued documents, 569 inductively derived concepts, 322,662 concept annotations, and eleven metadata graphs totaling approximately five million relations--across four successive infrastructure generations. While the present case is that of a single researcher, the architecture is in no way specific to one person: it serves a team, an institution, or any entity that accumulates knowledge over time. We argue that auditable, sovereign, structurally unbounded memory is a precondition for AI agents intended to accompany a person or an organization over years rather than sessions.

Serge Lacasse; Jérémie Hatier; Alex Baker


Durable execution and replay are treated as first-class loop infrastructure. BabyAGI creator Yohei Nakajima makes an append-only event log the source of truth and the working graph a deterministic projection, giving long-running loops deterministic replay, cheap forking at any event, and end-to-end causal lineage from goal to model call.

Use The Log Is the Agent: Event-Sourced Reactive Graphs for Auditable, Forkable Agentic Systems to carry context, state, and receipts across runs and failures.

Research source arXiv:2605.21997; inspect its method and evaluation before treating results as production evidence.

[2605.21997] The Log is the Agent: Event-Sourced Reactive Graphs for Auditable, Forkable Agentic Systems

Most agent frameworks are built around the language model: a conversation loop comes first, then tools, then rules, and finally a logging layer bolted on for observability, with state persisted as retrievable "memory." We describe ActiveGraph, a runtime that inverts this arrangement. The append-only event log is the source of truth; the working graph is a deterministic projection of that log; and behaviors--ordinary functions, classes, LLM-backed routines, or logic attached to typed edges--react to changes in the graph and emit new events. No component instructs another; coordination happens entirely through the shared graph. This single design decision yields three properties that retrieval-and-summarization memory systems do not provide: deterministic replay of any run from its log, cheap forking that branches a run at any event without re-executing the shared prefix, and end-to-end lineage from a high-level goal down to the individual model call that produced each artifact. We present the architecture, a determinism contract that makes replay sound, and a worked diligence example whose full causal structure is reconstructable from the log alone. We discuss--without claiming to demonstrate--why this substrate is unusually well suited to self-improving agents, and how it extends the BabyAGI lineage and prior graph-memory research.

11 pages, 1 figure. Open-source Apache-2.0 implementation with reproducible quickstart demo, deterministic replay, fork-and-diff, and lineage tracing


Context is managed as durable loop state rather than a single prompt payload. From thousands of agent sessions at Nori, reports zero coding-task benefit from giving agents search over prior session transcripts and argues loop state belongs in distilled artifacts like commits and docs because agents never prune stale context.

Use Agentics: Memorizing Session Transcripts Isn't Useful to carry context, state, and receipts across runs and failures.

Contextual source from 12gramsofcarbon.com; useful for practice signals or boundary conditions, not independent validation.

Keep track of artifacts, not scratch. Alt title: Claude, please stop trying to memorize random crap


Long-Running Agents

Durable execution and replay are treated as first-class loop infrastructure. Addy Osmani's essay on the infrastructure behind agents that run for hours or days, naming three walls (finite context, missing persistent state, unreliable self-verification) and the patterns that address them: durable event logs, checkpoint-and-resume, external state, and a planner/worker/judge split.

Use Long-Running Agents to carry context, state, and receipts across runs and failures.

Contextual source from addyo.substack.com; useful for practice signals or boundary conditions, not independent validation.

Long-running Agents - by Addy Osmani - Elevate

A long-running AI agent can keep making progress over hours, days, or weeks.


Persistent memory is treated as an external runtime artifact. Conflict-aware replicated memory contract with immutable history, explicit conflict objects, and projection-time resolution, so agent systems that accumulate contradictory observations across branches, retries, and replicas record state auditably instead of silently overwriting it.

Use StateFuse: Deterministic Conflict-Preserving Memory for Multi-Agent Systems to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.05844; inspect its method and evaluation before treating results as production evidence.

[2607.05844] StateFuse: Deterministic Conflict-Preserving Memory for Multi-Agent Systems

Agent systems accumulate conflicting observations across branches, retries, and replicas, yet many practical memory layers still collapse disagreement behind overwrite rules that are difficult to inspect or correct. We present StateFuse, a conflict-aware replicated memory contract built on standard OpSet/CRDT merge. StateFuse does not introduce a new join algebra; it defines an agent-facing semantics layer with immutable history, explicit conflict objects, exact and semantic correction handles (claim_id / claim_ref), deterministic predicate contracts, and projection-time resolution that cannot rewrite replicated state. We evaluate StateFuse against flat multi-value, raw-log, provenance-style, and collapsed baselines under matched resolver and verification policies. On a 282-question official conflict-bearing MemoryAgentBench slice, the compared methods tie on answer accuracy, but conflict-preserving surfaces keep contradictions visible while collapsed surfaces do not. In a controlled agent loop with uniform verification, preserving ambiguity enables safer abstention and correction than early collapse. A correction-handle ablation further shows that semantic handles matter when exact prior identifiers are unavailable. The resulting claim is narrow: StateFuse is best supported as a safer public memory contract for contradiction surfacing, abstention, and auditable correction, not as a universal accuracy gain.

Code and supplementary materials available at: https://github.com/nZiben/statefuse


Persistent memory is treated as an external runtime artifact. Names the failure mode "behavioral state decay" (decision-relevant state such as prior attempts, diagnoses, and open subgoals gets buried or evicted as trajectories grow) and pairs the action agent with a proactive memory agent that maintains a structured memory bank and injects memory-grounded reminders only when needed, gaining +8.3 points on Terminal-Bench 2.0 and +6.8 on τ²-Bench.

Use Remember When It Matters: Proactive Memory Agent for Long-Horizon Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.08716; inspect its method and evaluation before treating results as production evidence.

[2607.08716] Remember When It Matters: Proactive Memory Agent for Long-Horizon Agents

In long-horizon tasks, decision-relevant state is often scattered across an expanding trajectory, while the action agent must surface it and act. As trajectories grow, task requirements, environment facts, prior attempts, diagnoses, and open subgoals can be buried in the context window or pushed beyond it, failing to influence decisions when needed. We call this failure mode "behavioral state decay". We study memory as an active intervention mechanism rather than passive retrieval. A separate memory agent runs alongside an unmodified action agent, updating a structured memory bank from the recent trajectory and deciding whether to inject a memory-grounded reminder or remain silent. The module is plug-and-play with frontier action agents and existing agent harnesses. Across Terminal-Bench 2.0 and $\tau^2$-Bench, it improves pass@1 for both weaker and stronger action agents, with gains of +8.3 pp on Terminal-Bench and +6.8 pp on $\tau^2$-Bench. Ablations show that selective intervention outperforms passive bank exposure, always-on injection, advisor-only guidance, and general retrieval. As an early step toward open-weight memory policies, we train Qwen3.5-27B on SETA using SFT and GRPO, improving validation reward and achieving partial transfer to Terminal-Bench.

Yifan Wu; Lizhu Zhang; Yuhang Zhou; Mingyi Wang; Bo Peng; Serena Li; Xiangjun Fan; Zhuokai Zhao


Persistent memory is treated as an external runtime artifact. Rate-distortion framing that unifies KV-cache eviction, prompt compression, recurrent state, and cross-session agent memory compaction under a single objective with a layer-agnostic lower bound, showing why attention- and recency-based eviction discards information before future queries reveal what mattered.

Use What to Keep, What to Forget: A Rate-Distortion View of Memory Compaction to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.08032; inspect its method and evaluation before treating results as production evidence.

[2607.08032] What to Keep, What to Forget: A Rate--Distortion View of Memory Compaction in LLMs and Agents

Large language models, and the agents built on them, spend an ever-growing share of their compute and memory on remembering: caching attention keys and values, carrying long prompts, maintaining recurrent state, and storing what happened in previous turns and sessions. Because none of this memory is free, four largely separate research communities have each learned to compact it. They evict or quantize the KV cache, prune or distill prompts, bound architectural state, and consolidate agent memory. We argue that these are instances of one problem: a rate--distortion decision about what context-derived information to retain versus discard, at what fidelity, under a resource budget, so as to preserve downstream task utility. We make this lens precise with a single compaction objective and a layer-agnostic lower bound, use it to build a seven-axis taxonomy that classifies methods from across the stack uniformly, and use it to transfer mechanisms between layers that have never been connected, from serving-stack KV management to agent long-term memory. Two patterns hold across the survey. At every layer the signal that decides what to keep is attention magnitude or recency, and it fails in the same way everywhere, by discarding, before the query is known and with no way to undo it, information the query later needs. And while compression is measured carefully on single-turn long context, the repeated compaction that agents actually perform is almost never measured, and no benchmark holds one budget axis across all the layers at once. We turn both observations into a benchmark proposal, a small reference experiment, and a set of compaction-aware design principles, and we map the open problems.


Verification is promoted from a final check to a loop-control signal. Three-layer hierarchical memory keeps injected context bounded and roughly constant across multi-session, long-horizon multi-agent workflows, demonstrated by the Ensemble QSP framework autonomously selecting pharmacokinetic-pharmacodynamic models across 104 runs with overseer agents handling verification and troubleshooting.

Use A Hierarchical Memory Architecture Overcomes Context Limits in Long-Horizon Multi-Agent Modeling to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.07666; inspect its method and evaluation before treating results as production evidence.

[2607.07666] A hierarchical memory architecture overcomes context limits in long-horizon multi-agent computational modeling

Large language models (LLMs) demonstrate remarkable reasoning capabilities, yet their stateless architecture fundamentally limits deployment in long-horizon research workflows requiring multi-session continuity and quantitative rigor. Here we present Ensemble QSP, a multi-agent framework featuring a three-layer hierarchical memory architecture that keeps injected context bounded and constant in project duration (mid-term project state: median 301 tokens, max 4,050, across 104 runs) by capping each state category and evicting completed work, enabling continuous autonomous operation without context degradation. The system orchestrates five specialist worker agents under domain-expert principal investigators, enforcing physical constraints through physics-based checklists and structured-domain knowledge. Comprehensive benchmarking demonstrates robust autonomous pharmacokinetic-pharmacodynamic model selection without human intervention, consistent result quality across both lower-cost and frontier LLMs, improved PK parameter recovery relative to single-agent baselines, and stable model selection across linguistically diverse prompts of the same task. Feature-level ablation across physiologically based pharmacokinetic (PBPK) models spanning a broad complexity range shows that PI-agent oversight improves debugging efficiency while preserving final accuracy across conditions. The architecture is structurally domain-agnostic, adding a new scientific domain requires only a new PI agent configuration.

19 pages, 4 figures, 2 tables. Preprint submitted for publication


State persistence is explicit enough for repeated runs and handoff. Claims the largest open skill library for agents (216,938 structured skills across 24 domain bundles), built with an LLM quality gate (SkillGate) and iterative source-grounding that maps each retained claim to an exact source quotation, and shipped as offline-searchable SQLite FTS5 bundles, infrastructure for skills-as-persistent-state that agent loops accumulate and reuse.

Use SkillCenter: A Large-Scale Source-Grounded Skill Library for Autonomous AI Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.07676; inspect its method and evaluation before treating results as production evidence.

[2607.07676] SkillCenter: A Large-Scale Source-Grounded Skill Library for Autonomous AI Agents

Autonomous AI agents can execute complex tasks with limited human review, yet they often lack the grounded operational knowledge to make their outputs not just executable but correct, secure, and maintainable. We introduce SkillCenter, to our knowledge the largest open skill library for agents by total count: 216,938 structured skills across 24 domain bundles. A SkillGate-filtered pipeline contributes 114,565 source-grounded skills from peer-reviewed journals, ArXiv, and over 24,000 technical sources, integrated with 102,373 community skills from GitHub and the ClawHub marketplace. We present the end-to-end framework that builds the pipeline subset: multi-source acquisition, an LLM-based quality gate (SkillGate), template-driven generation, iterative source-grounding, and quality-controlled publishing. Source grounding is a traceability guarantee: each retained claim maps to an exact quotation in its source. All skills ship as offline-searchable SQLite FTS5 bundles.

Tianming Sha; Yue Zhao; Lichao Sun; Yushun Dong

44 pages, 5 figures. Code: https://github.com/LabRAI/SkillCenter ; Data: https://huggingface.co/datasets/Tommysha/skillcenter-bundles


Checkpointed state makes long-running agent work recoverable across failures. Thomas Dohmke (former GitHub CEO, now founder of Entire) argues that agent session logs (prompts, tool calls, and decision checkpoints) are becoming the most important artifact in software development and should be versioned alongside code so agent fleets stop repeating mistakes, and that Git hosting must re-decentralize for agent-scale parallelism.

Use How version control will evolve for the agent boom to carry context, state, and receipts across runs and failures.

Contextual source from entire.io; useful for practice signals or boundary conditions, not independent validation.

How Version Control Will Evolve for the Agent Boom · Entire

To meet the demand of the agent boom, Git hosting must return to its original promise: a distributed network of many hosts.


self-learning-skills

Durable execution and replay are treated as first-class loop infrastructure. Meta-skill for Claude Code, Cursor, and AGENTS.md-compatible agents that recognizes when a session has earned a hard-won golden path (or hit a dead-end worth remembering), distills the procedure including failed approaches, and persists it as a skill or rule auto-loaded next run, turning each session's discoveries into durable cross-session loop state.

Use self-learning-skills to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (942 stars; 42 forks; MIT license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - Kulaxyz/self-learning-skills: A self-improving skill for AI coding agents (Claude Code, Cursor, AGENTS.md): recognize a hard-won golden path in a session and harvest it into a reusable skill/rule for next time. · GitHub

A self-improving skill for AI coding agents (Claude Code, Cursor, AGENTS.md): recognize a hard-won golden path in a session and harvest it into a reusable skill/rule for next time. - Kulaxyz/self-learning-skills


Makes persistence and context management visible as runtime design choices. Git-for-data design for an agent-first lakehouse that lifts single-table Iceberg snapshots into lakehouse-wide commits, branches, and merges, so agents work on isolated branches while humans review and publish, and pipeline outputs become visible atomically or not at all, with production lessons and correctness insights from a preliminary Alloy model of the core abstractions.

Use GitLake: Git-for-data for the agentic lakehouse to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.08319; inspect its method and evaluation before treating results as production evidence.

[2607.08319] GitLake: Git-for-data for the agentic lakehouse

We present GitLake, a Git-for-data design for an agent-first lakehouse. The system lifts single-table Iceberg snapshots into lakehouse-wide commits, branches, and merges, letting agents work on isolated branches while humans review and publish changes. Pipelines run on temporary branches and publish through a final merge, so all outputs become visible atomically or none do. Finally, we report production lessons as well as correctness insights from a preliminary Alloy model of our core abstractions.

Weiming Sheng; Jinlang Wang; Manuel Barros; Aldrin Montana; Jacopo Tagliabue; Luca Bigon

Accepted at DASHSys Workshop at the International Conference on Very Large Data Bases (VLDB); the linked arXiv record is the available paper version.

Current arXiv acceptance note and official workshop page


Persistent memory is treated as an external runtime artifact. Architecture that selectively persists four categories of reusable context (task specifications, data schemas, tool configurations, output constraints) across agent sessions while discarding session-specific reasoning traces, with cross-user sharing under access controls and a zero-token refresh path for recurring data updates, reporting 96% task completion vs 79% without memory and 71% with full-history carryover.

Use Shared Selective Persistent Memory for Agentic LLM Systems to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.09493; inspect its method and evaluation before treating results as production evidence.

[2607.09493] Shared Selective Persistent Memory for Agentic LLM Systems

Agentic LLM systems that generate code through multi-turn tool use face a fundamental context problem: each session starts from zero, discarding the configuration choices, domain constraints, data schemas, and tool-use patterns that made previous sessions productive. Naively persisting entire conversation histories is token-inefficient and counterproductive: irrelevant context degrades generation quality. We introduce shared selective persistent memory, an architecture that identifies and retains four categories of reusable context (task specifications, data schemas, tool configurations, and output constraints) while discarding session-specific reasoning traces. Crucially, this memory is shared: workspaces encapsulating selective memory can be transferred across users with role-based access control, enabling collaborative reuse without redundant specification. We implement it in a deployed collaborative workspace platform where LLM agents produce, edit, and maintain git-versioned artifacts (dashboards, reports, and data-driven documents) from heterogeneous sources (CSV, SQL, REST APIs, and MCP servers). A complementary zero-token data refresh mechanism decouples generated programs from runtime data, enabling artifact reuse without re-invocation. Across three enterprise scenarios, shared selective persistent memory achieves 96% task completion (vs. 79% without memory and 71% with full history). Zero-token refresh eliminates LLM re-invocation for recurring updates (14x task-time reduction), while summary-driven generation cuts per-invocation token cost by 97x versus raw data injection. A replication on four public datasets confirms generalizability, with zero-token refresh succeeding in 12/12 trials. Notably, naive full-history persistence actively degrades completion by biasing the agent with stale traces, while selective memory outperforms both extremes.

Sanjana Pedada; Aditya Dhavala; Neelraj Patil


Control flow is represented as an inspectable graph rather than an opaque prompt loop. GRACE represents an agent's persistent instructions as a typed semantic graph and runs scoped verification over the local neighborhood of each proposed edit before committing it, so accumulated context evolves reliably across long-horizon deployment under distribution shift instead of drifting as flat text; evaluated on telecom agent tasks.

Use Scoped Verification for Reliable Long-Horizon Agentic Context Evolution to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.09175; inspect its method and evaluation before treating results as production evidence.

[2607.09175] Scoped Verification for Reliable Long-Horizon Agentic Context Evolution under Distribution Shift

Deployed LLM agents rely on agentic context, the model-external textual control content assembled by an operational harness. In this work, the mutable component of that context is a persistent system-level instruction that is updated from operational experience while the model, tools, and harness remain fixed. Over long evolution horizons, flat-text maintenance makes verification increasingly difficult as accumulated instructions grow and interact. We propose Graph-Regularized Agentic Context Evolution (GRACE), which maintains the persistent instruction component as a typed semantic graph and validates proposed updates within the local typed neighborhoods of modified nodes. Accepted graph updates are reconstructed as incremental edits to the textual instruction checkpoint used at deployment. We evaluate GRACE within a fixed telecom agent harness derived from $\tau^2$-bench under a controlled distribution-shift protocol. Across five independent replications, GRACE improves strict reliability, measured by pass^3, from the Gemini 2.5 Flash zero-shot value of 0.091 to 0.673$\pm$0.136 at the final checkpoint. This exceeds a Gemini 3.1 Pro zero-shot reference of 0.242 on the same held-out set, while the flat-text HCE baseline finishes at 0.191$\pm$0.051. These results identify two requirements for reliable long-horizon context evolution, a structural substrate that makes verification local and a consolidation mechanism that keeps accumulated instruction content usable.


AgentMemory

Persistent memory is treated as an external runtime artifact. Persistent cross-session memory for coding agents: auto-capture lifecycle hooks, an MCP server, and a REST API so progress, decisions, and context survive across runs and tools.

Use AgentMemory to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (26,684 stars; 2,266 forks; Apache-2.0 license; updated 2026-08-07); popularity is context, not proof of reliability.


TencentDB-Agent-Memory

Persistent memory is treated as an external runtime artifact. Tencent Cloud's open-source local-first long-term memory for AI agents: a four-tier progressive pipeline from capture through consolidation with zero external API dependencies.

Use TencentDB-Agent-Memory to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (17,210 stars; 1,543 forks; NOASSERTION license; updated 2026-08-07); popularity is context, not proof of reliability.

GitHub - TencentCloud/TencentDB-Agent-Memory: TencentDB Agent Memory is a team-level memory hub for AI Agents — turning conversations, docs, and code into four reusable memory assets (Chat Memory, Skill, LLM-Wiki, Code-Graph) that are governed, shared, and equipped across agents and frameworks. · GitHub

TencentDB Agent Memory is a team-level memory hub for AI Agents — turning conversations, docs, and code into four reusable memory assets (Chat Memory, Skill, LLM-Wiki, Code-Graph) that are governed, shared, and equipped across agents and frameworks. - TencentCloud/TencentDB-Agent-Memory


agent-memory (Neo4j Labs)

Primary-source operational guidance rather than commentary. Official Neo4j Labs graph-native memory system that stores conversations, builds knowledge graphs from agent interactions, and lets agents learn from their own reasoning traces.

Use agent-memory (Neo4j Labs) to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (405 stars; 88 forks; Apache-2.0 license; updated 2026-08-06); popularity is context, not proof of reliability.


re_gent

Makes persistence and context management visible as runtime design choices. Agent-native version control layered on top of Git that records agent activity at the prompt level, so you can answer why the agent did something and undo agent work without losing your own.

Use re_gent to carry context, state, and receipts across runs and failures.

Inspectable GitHub source (782 stars; 57 forks; Apache-2.0 license; updated 2026-08-05); popularity is context, not proof of reliability.

GitHub - regent-vcs/re_gent: Version-Control for AI coding agents. · GitHub

Version-Control for AI coding agents. Contribute to regent-vcs/re_gent development by creating an account on GitHub.


Checkpointed state makes long-running agent work recoverable across failures. State-centered framework that structures a long-horizon computer-use agent's state around a unified causal representation of task progress, regulating every update through verifier-backed state transitions with checkpointing and targeted failure recovery, lifting Qwen3.5-27B from 31.6% to 62.2% on OSWorld-Verified.

Use StructAgent: Harness Long-Horizon Digital Agents with Unified Causal Structure to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.11388; inspect its method and evaluation before treating results as production evidence.

[2607.11388] StructAgent: Harness Long-horizon Digital Agents with Unified Causal Structure

Recent advances in large language models (LLMs) and vision-language models (VLMs) have enabled increasingly capable digital agents for computer use. However, real-world tasks are often long-horizon and involve evolving contexts containing accumulated observations, intermediate edits, failed attempts, and partially completed executions. Existing agents typically operate over raw interaction history, making task progress difficult to interpret, verify, and recover, which ultimately limits reliable long-horizon execution. In this paper, we argue that addressing this challenge requires explicitly structuring both the agent's state and workflow around a unified causal representation of task progress. We present \textbf{StructAgent}, a state-centered framework that introduces a unified state for maintaining compact, verifiable task progress and a structured workflow that regulates progress through verifier-backed state transitions. Building on this design, StructAgent further enables explicit progress checkpointing, evidence-driven task completion, targeted failure recovery, and tool-supported execution, while ensuring that all progress updates remain grounded in verification. Extensive experiments demonstrate that StructAgent consistently improves a wide range of LLM and VLM backbones on long-horizon computer-use tasks. On OSWorld-Verified, it improves Qwen3.5-9B from 27.0\% to 46.9\% success rate and Qwen3.5-27B from 31.6\% to 62.2\%, while achieving a new open-source state of the art of 78.9\% with MiniMax-M3. Moreover, the same framework generalizes beyond desktop environments to Minecraft, demonstrating the generality of our design.

Wenyi Wu; Sibo Zhu; Kun Zhou; Aayush Salvi; Zixuan Song; Biwei Huang


Persistent memory is treated as an external runtime artifact. Diagnoses how agents resolve contradictions in their own persistent memory, finding they tend to comply with the most recent or most assertive entry rather than the correct one, a failure mode for any loop that accumulates state across runs.

Use The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.10608; inspect its method and evaluation before treating results as production evidence.

[2607.10608] The Compliance Trap: Diagnosing How AI Agents Consume Conflicting Memory

Memory is becoming a core component of long-horizon AI agents, allowing agents to reuse past experience when operating web browsers, software tools, and other interactive environments. Existing work mostly treats memory as a supply problem, asking what experience to write, how to store it, and which entry to retrieve for the next task. Yet we still lack a clear account of how models consume retrieved memory across a multi-step action trajectory. This consumption process matters because it determines not only what memories should be retrieved, but also what models and control policies are needed to use them safely. To diagnose this process, we propose Entry--Propagation--Recovery (E-P-R), a trajectory-level framework that asks where memory first changes an action, whether that change carries forward, and whether the agent can recover after leaving a correct path. We instantiate E-P-R on WebArena and on MemTrapBench, a controlled benchmark we build to isolate these phases. We find that the main failure often begins at entry: agents adopt conflicting memory at the first exposed decision point even when it is task-wrong. Repeated exposure then amplifies this early error, while recovery after divergence is weak. Together, these effects create a compliance trap: across models, conflicting memory induces similar compliance rates, but once agents comply, their success rates collapse to a low floor. Stronger agents therefore suffer larger absolute damage because each compliance event erases more baseline capability. These results suggest that memory-augmented agents should be evaluated not only by retrieval quality or final success rate, but by how they consume memory throughout the trajectory.


Primary-source operational guidance rather than commentary. Official ADK model separating a conversation thread, its mutable state, and searchable cross-session memory, with service backends for durable persistence.

Use Conversational Context: Session, State, and Memory to carry context, state, and receipts across runs and failures.

Primary official documentation from adk.dev; use it for current product or standard behavior.

Conversational context - Agent Development Kit (ADK) Agent Development Kit (ADK)

Build powerful multi-agent systems with Agent Development Kit (ADK)


Persistence

Primary-source operational guidance rather than commentary. Official LangGraph checkpoint model: save state at every super-step, retain pending writes, recover interrupted execution, support human review, and enable memory and time travel.

Use Persistence to carry context, state, and receipts across runs and failures.

Primary official documentation from docs.langchain.com; use it for current product or standard behavior.

LangGraph's persistence layer gives agents short-term memory through checkpointers and long-term memory through stores.


Workflow checkpoints

Primary-source operational guidance rather than commentary. Official checkpointing guide covering super-step state, pending messages and requests, shared state, in-memory and durable storage providers, and resuming long-running workflows.

Use Workflow checkpoints to carry context, state, and receipts across runs and failures.

Primary official documentation from learn.microsoft.com; use it for current product or standard behavior.

Microsoft Agent Framework Workflows - Checkpoints | Microsoft Learn

In-depth look at Checkpoints in Microsoft Agent Framework Workflows.


Agent state

Primary-source operational guidance rather than commentary. Official state guide separating conversation, agent, and invocation lifetimes, with validation hooks and cross-session persistence for durable agent behavior.

Use Agent state to carry context, state, and receipts across runs and failures.

Primary official documentation from strandsagents.com; use it for current product or standard behavior.

Maintain state in Strands agents across turns and sessions: conversation history, key-value agent state, and per-request invocation state.


The work turns loop quality into a measurable task or score. Learns when to retrieve, consolidate, and forget rather than treating memory as passive storage; across six benchmarks, three frameworks, and three LLMs, it reports up to 15.2 points higher task success with 5-20% fewer tokens.

Use Memory as a Controlled Process: Learned Adaptive Memory Management for LLM Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.13591; inspect its method and evaluation before treating results as production evidence.

[2607.13591] Memory as a Controlled Process: Learned Adaptive Memory Management for LLM Agents

Large Language Model (LLM) agents increasingly rely on external memory systems to accumulate experience across tasks. Yet nearly all existing approaches, from graph-structured memories to reflective insight stores, access memory through fixed, hand-designed heuristics. We argue that this static view of memory is a core bottleneck for agentic learning because optimal memory behavior is fundamentally context-dependent. The early stages of the tasks, benefit from minimal retrieval because memory is sparse; recurring goal types benefit from plan reuse rather than generic nearest-neighbor lookup; stuck agents benefit from re-retrieval with alternative queries; and across long task streams, the memory store itself must be consolidated and pruned to remain useful. We present Memory as a Controlled Process (MemCon), a framework that models memory operations as a Markov Decision Process and learns an online policy that adaptively decides when, what, and how much to retrieve, when to inject a distilled plan, and when to consolidate or forget. MemCon is backend-agnostic: it wraps any existing memory implementation, learns from task-by-task binary feedback with no pretraining and no additional LLM calls, and uses a lightweight tabular contextual bandit with UCB exploration that converges within tens of tasks. Across 6 benchmarks, 3 agent frameworks, and 3 LLM backbones, MemCon consistently outperforms multiple memory baselines by up to 15.2 points in task success while reducing token consumption by 5--20%.

Eric Hanchen Jiang; Zhi Zhang; Yuchen Wu; Levina Li; Dong Liu; Xiao Liang; Rui Sun; Yubei Li; Edward Sun; Haozheng Luo; Zhaolu Kang; Aylin Caliskan; Kai-Wei Chang; Ying Nian Wu


Persistent memory is treated as an external runtime artifact. Binds agent memory to versioned Git artifacts and evaluates retrieval across eight corpora; reported best retrieval reaches about 0.31 MRR and decision synthesis 0.83 sufficiency at 382-980 tokens per query, with capture quality still the main constraint.

Use Why Git Is the Memory Solution for the Agentic Development Lifecycle to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.14390; inspect its method and evaluation before treating results as production evidence.

[2607.14390] Why Git Is the Memory Solution for the Agentic Development Lifecycle

Coding agents now produce a growing share of a team's code, while the reasoning behind each change -- the alternatives weighed, the constraints discovered, the approaches rejected -- is trapped in assistant transcripts that vanish with the session. Memory for this setting, the agentic development lifecycle (ADLC), is usually posed as one retrieval problem and built as machinery: tiered stores, memory graphs, compiled wikis, model-judged admission. We argue memory should instead be git-bound -- built into the repository's version control, inheriting the guarantees the machinery struggles to construct: ground truth from commits, freshness from rebuild, verification from the merge, containment from review. On this ledger we solve two problems separately, then combine them. Seed supply is closed as an eight-corpus retrieval study under a pre-registered ship discipline: five imported ranking mechanisms rejected, two kept, and a best configuration of ~0.31 pooled MRR -- ~60x the raw-transcript grep floor, ~15x an honest parsed-turn floor. Answer assembly is where ranking stops helping: single-shot retrieval scores only 0.07-0.20 answer-sufficiency on real developer questions, and ungated episode injection measurably degrades good answers. A router dispatches breadth to a git-anchored structural map, pointed lookups to confidence-gated episodes, and rationale to decision synthesis, which reconstructs why-arcs no single session contains (0.83 sufficiency on a young ~50k-LOC production system). Routed, the system answers at 382-980 tokens per question -- three orders of magnitude below the recorded history. Because ground truth is mined from commit-session links rather than annotated, every result is replicable on any user's own history at zero labeling cost. The remaining constraint is capture. Code, benchmark, and paper source: github.com/rekal-dev/rekal-cli.


The work turns loop quality into a measurable task or score. Defines continuity-preservation and latency-overhead metrics for provider failover and evaluates a state-forwarding proxy over 750 failover events; reported context preservation reaches 99.20% versus near zero for stateless routing, with asynchronous backoff and jitter preventing retry storms.

Use ContinuityBench: A Benchmark and Systems Study of Stateful Failover in Multi-Provider LLM Routing to carry context, state, and receipts across runs and failures.

Benchmark or leaderboard source with repeatable tasks or scores; compare systems only after checking setup and scope.

[2607.15899] ContinuityBench: A Benchmark and Systems Study of Stateful Failover in Multi-Provider LLM Routing

In production large language model (LLM) deployments, high API availability guarantees do not equate to conversational continuity. When a primary provider experiences an outage or strict rate-limiting, naive stateless failover mechanisms successfully maintain uptime but silently discard conversation history, severely disrupting the user experience. To rigorously quantify and resolve this failure mode, we introduce two novel metrics: Continuity Preservation Rate (CPR) and Continuity Latency Overhead (CLO). We propose a stateful, multi-provider proxy architecture utilizing a History-Forwarding strategy to seamlessly reconstruct conversational state across heterogeneous LLM endpoints during failover events. Furthermore, we release continuity-bench, https://github.com/Vishal-sys-code/continuity-bench, an open evaluation harness designed to stress-test context preservation under high-concurrency provider failure conditions. Our empirical evaluation ($N=750$ failover events) demonstrates that our stateful proxy achieves a 99.20\% CPR [95\% CI: 98.27\%, 99.63\%], cleanly transferring deep conversational context to fallback providers, compared to a near-0\% preservation rate for standard stateless architectures. Finally, we characterize failover latency distributions, identifying the critical necessity of asynchronous exponential backoff with jitter to prevent cascading retry storms against strict-limit fallback APIs. Our results provide a principled foundation for building robust, state-preserving multi-model inference systems.


Evaluation data is used as the feedback signal for improving loop behavior. Uses a render-matched control over 2,907 evidence-revision questions to show that an apparent +0.182 structured-memory gain is mostly presentation, leaving a +0.021 to +0.025 mechanism residual indistinguishable from zero; memory evaluations should hold rendering fixed and prefer the coarsest retained state that answers the target queries.

Use Presentation, Not Mechanism: A Render Confound in Deprecation-Aware Memory Evaluation to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.16019; inspect its method and evaluation before treating results as production evidence.

[2607.16019] Presentation, Not Mechanism: A Render Confound in Deprecation-Aware Memory Evaluation

AI systems increasingly retrieve from records that revise themselves: issue threads, encyclopedic histories, policy logs, and long conversations. The challenge is not only finding relevant evidence, but deciding which claims remain in force, which were superseded, and when to abstain. Structured memories promise to solve this with typed edges, temporal updates, and conflict status, yet evaluations often change mechanism and prompt presentation together. We study this as Evidence-State Revision, comparing flat retrieval, coarse edge invalidation, and fine-grained RevisionLedger on 2,907 high-agreement questions from GitHub, multi-repo issue histories, Wikipedia, and DyKnow-style temporal streams. A render-matched control (same layout, deprecation disabled) reveals the central confound: when a value is changed and later restored, RevisionLedger appears to beat a flat baseline by +0.182, but almost all the gain comes from easier presentation; the fine-grained mechanism residual is indistinguishable from zero (+0.021 to +0.025 across two judge families). After presentation is controlled, coarse invalidation is the only mechanism that pays for current-state queries, beating the fine ledger by 0.084; the same query-sufficiency principle says provenance mainly needs retained invalidated evidence, not richer typing. Memory evaluations should hold render fixed, and deprecation-aware systems should deploy the coarsest retained state that covers their queries.

Zhaoyang Jiang; Zhizhong Fu; Zicheng Li; Yunsoo Kim; Jiacong Mi; Xuanqi Peng; Fei Teng; Honghan Wu


Persistent memory is treated as an external runtime artifact. Distills successful and failed trajectories into reusable reasoning memories, then uses memory-aware test-time scaling to turn additional exploration into better guidance for future runs.

Use ReasoningBank: Scaling Agent Self-Evolving with Reasoning Memory to carry context, state, and receipts across runs and failures.

Research source arXiv:2509.25140; inspect its method and evaluation before treating results as production evidence.

[2509.25140] ReasoningBank: Scaling Agent Self-Evolving with Reasoning Memory

With the growing adoption of large language model agents in persistent real-world roles, they naturally encounter continuous streams of tasks. A key limitation, however, is their failure to learn from the accumulated interaction history, forcing them to discard valuable insights and repeat past errors. We propose ReasoningBank, a novel memory framework that distills generalizable reasoning strategies from an agent's self-judged successful and failed experiences. At test time, an agent retrieves relevant memories from ReasoningBank to inform its interaction and then integrates new learnings back, enabling it to become more capable over time. Building on this powerful experience learner, we further introduce memory-aware test-time scaling (MaTTS), which accelerates and diversifies this learning process by scaling up the agent's interaction experience. By allocating more compute to each task, the agent generates abundant, diverse experiences that provide rich contrastive signals for synthesizing higher-quality memory. The better memory in turn guides more effective scaling, establishing a powerful synergy between memory and test-time scaling. Across web browsing and software engineering benchmarks, ReasoningBank consistently outperforms existing memory mechanisms that store raw trajectories or only successful task routines, improving both effectiveness and efficiency; MaTTS further amplifies these gains. These findings establish memory-driven experience scaling as a new scaling dimension, enabling agents to self-evolve with emergent behaviors naturally arise. Our code can be found at https://github.com/google-research/reasoning-bank.

Siru Ouyang; Jun Yan; I-Hung Hsu; Yanfei Chen; Ke Jiang; Zifeng Wang; Rujun Han; Long T. Le; Samira Daruki; Xiangru Tang; Vishy Tirumalashetty; George Lee; Mahsan Rofouei; Hangfei Lin; Jiawei Han; Chen-Yu Lee; Tomas Pfister

Published in International Conference on Learning Representations (ICLR); the linked arXiv record remains available for open access.


Context is managed as durable loop state rather than a single prompt payload. Lets an agent branch into temporary sub-trajectories and fold completed work into compact continuation state, pairing the mechanism with FoldGRPO to operate under a 32K active-context budget.

Use Scaling Long-Horizon LLM Agent via Context-Folding to carry context, state, and receipts across runs and failures.

Research source arXiv:2510.11967; inspect its method and evaluation before treating results as production evidence.

[2510.11967] Scaling Long-Horizon LLM Agent via Context-Folding

Large language model (LLM) agents are fundamentally constrained by context length on long-horizon tasks. We introduce Context-Folding, a framework that empowers agents to actively manage their working context. An agent can procedurally branch into a sub-trajectory to handle a subtask and then fold it upon completion, collapsing the intermediate steps while retaining a concise summary of the outcome. To make this behavior learnable, we develop an end-to-end reinforcement learning framework FoldGRPO with specific process rewards to encourage effective task decomposition and context management. On complex long-horizon tasks (Deep Research and SWE), our folding agent matches or outperforms the ReAct baselines while using an active context 10$\times$ smaller and significantly outperforms models that rely on summarization-based context management.

Weiwei Sun; Miao Lu; Zhan Ling; Kang Liu; Xuesong Yao; Yiming Yang; Jiecao Chen


Control flow is represented as an inspectable graph rather than an opaque prompt loop. Converts failed and successful past trajectories into directed action-decision graphs and matches them at test time to retrieve explicit correction strategies, letting agents fix known error patterns in a single loop-free execution instead of iterative reflection, cross-run experience memory applied to error recovery, validated on ALFWorld and ScienceWorld.

Use Experience Memory Graph: One-Shot Error Correction for Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2607.13884; inspect its method and evaluation before treating results as production evidence.

[2607.13884] Experience Memory Graph: One-Shot Error Correction for Agents

Large Language Model (LLM) agents have shown remarkable capabilities in autonomous decision-making by generating sequential trajectories of states, actions, and observations. However, in complex, long-horizon tasks, these agents frequently suffer from compounding errors and struggle to recover from failures. Existing self-correction mechanisms rely on prompt-based reflection, which is inherently brittle, incurs heavy time and API costs due to iterative trial-and-error loops, and produces task-specific memory that may be hard to generalize to new scenarios. To address this, we propose Experience Memory Graph (EMG), a framework that reformulates agent failure recovery as a graph matching problem. At training time, we convert both failed exploration trajectories and successful expert trajectories into directed action decision graphs. By matching these graphs, we extract common subgraphs (successful workflows) and graph edit paths that explicitly indicate how to correct failures (e.g., which actions to add, delete, or relabel under a given observation), and store them in a memory graph with intra-task nodes and cross-task edges. At test time, EMG retrieves relevant insights and guides the agent in a single, loop-free execution. Experiments on ALFWorld and ScienceWorld show that EMG consistently outperforms state-of-the-art reflection baselines in success rate and average reward, while requiring no test-time trial-and-error.

Wenjun Wang; Yuchen Fang; Fengrui Liu; Zibo Liang; Kai Zheng


Durable execution and replay are treated as first-class loop infrastructure. Survey of 435 works on agents whose behavior is shaped by durable state accumulated across runs, memories, task records, permissions, audit trails, analyzed along six diagnostic dimensions (authority, scope, mutability, provenance, recoverability, actionability); finds the literature over-indexes on accumulating and retrieving state and under-indexes on governing, recovering, or deleting it, and proposes AOEP-v0, an evaluation protocol that scores state-mutation and recovery obligations rather than answer quality alone.

Use Always-On Agents: A Survey of Persistent Memory, State, and Governance in LLM Agents to carry context, state, and receipts across runs and failures.

Research source arXiv:2606.30306; inspect its method and evaluation before treating results as production evidence.

[2606.30306] Always-OnAgents:A Survey of Persistent Memory, State, and Governance in LLMAgents

Always-on agents are systems whose future behavior depends on durable state accumulated across earlier interactions. We treat them as persistent-state systems: the operative system includes retrievable memories, but also task ledgers, permissions, credentials, commitments, provenance and audit records, shared state, trigger conditions, and externally committed effects linked to those records. The survey reads the literature through six diagnostic axes for each state item, authority, scope, mutability, provenance, recoverability, and actionability, and through a lifecycle in which state is written, validated, organized, retrieved, acted upon, updated, forgotten, audited, and sometimes rolled back. Across a 435-work coded corpus, treated as a scoped map rather than an exhaustive census, the literature concentrates more heavily on accumulating and retrieving state than on governing, recovering, or relinquishing it. We therefore introduce the Always-On Evaluation Protocol (AOEP-v0), a pilot evaluation contract that makes these governance requirements concrete by scoring state mutation and recovery obligations rather than answer quality alone. The resulting agenda connects always-on agents to databases, distributed systems, formal methods, capability security, and machine unlearning.

Tianyu Ding; Aditya Nannapaneni; Bingfan Liu; Ling Zhang