论文

提出 conversational infill：让一个小型 talker 模型在外部 reasoner 模型产生结果前即时生成上下文相关的回复以掩盖延迟，并在推理过程中将 reasoner 流式输出的知识流畅地融合到回复中。Conversational infill is introduced, where a small talker model both immediately generates contextually grounded responses to hide the latency of an external reasoner model and fluently integrates streamed reasoner knowledge into its responses during inference.

AOHP 的核心设计原则是将 Agent 视为 OS 中的一等公民，从而支持自适应用户界面以及对 Agent 友好的运行时环境；在任务完成度、执行成本和安全策略合规性方面均展现出明显优势。The core design principle of AOHP is to treat agents as first-class OS actors, enabling adaptive user interfaces and agent-friendly runtime environments, and shows clear advantages in task completion, execution cost, and security-policy compliance.

本研究收集了使用主流 AI Agent 开发的大量真实应用语料，并设计了结合 Agent 辅助代码审计与人工验证的漏洞分析框架，揭示出与传统软件开发流程中常见的漏洞模式不同的反复出现的漏洞规律。This study collects a large corpus of real-world applications developed using popular AI agents and designs a vulnerability analysis framework that combines agent-assisted code auditing with human validation, and reveals recurring vulnerability patterns that differ from those commonly observed in conventional software development workflows.

对话式与工具使用的 LLM Agent 在上下文窗口中同时从多个方向被填充，而必须在多轮之间回忆信息的 Agent（即 memory 的典型场景）恰恰是 recency 截断失效的地方。Conversational and tool-using LLM agents operate over a context window that fills from several directions simultaneously, and agents that must recall information across many turns, the defining case for memory, are precisely where recency truncation fails.

提出 S-Agent，一种面向连续多视图图像与视频理解与推理的空间工具使用 Agent 范式，以无需训练的方式持续提升开源与闭源 VLM。This work introduces S-Agent, a spatial tool-use agentic paradigm for understanding and reasoning over continuous multi-view images and videos, and consistently improves both open-source and closed-source VLMs in a training-free manner.

揭示了指导的生成方式才是决定性变量，并提出 probe-and-refine tuning（探测-微调）：通过合成 bug 修复探测任务，利用单次 LLM 调用迭代诊断并修补仓库的指导文件，调优过程中不涉及 Agent 循环或工具调用。It is shown that how the guidance is produced is the decisive variable, and probe-and-refine tuning is introduced, a procedure that uses synthetic bug-fix probes to iteratively diagnose and patch a repository's guidance file through single-shot LLM calls, with no agent loop or tool use during tuning.

提出一种特权感知的训练后防御方法，教导 Agent 优先选用足够的低权限工具，仅在必要时升级；该方法在保留通用能力的同时大幅减少了不必要的高权限工具使用。A privilege-aware post-training defense that teaches agents to prefer sufficient lower-privilege tools and escalate only when necessary is introduced, showing that this defense substantially reduces unnecessary high-privilege tool use while preserving general capabilities.

提出 Qwen-RobotNav，一种基于 Qwen-RobotNav 构建的可扩展导航模型，通过参数化接口沿两个互补维度应对该问题：用于选择导航行为的多种任务模式，以及用于控制视觉历史编码方式的可控观测参数。Qwen-RobotNav is presented, a scalable navigation model built on Qwen-RobotNav that addresses it through a parameterised interface with two complementary dimensions: multiple task modes that select the navigation behaviour, and controllable observation parameters that govern how visual history is encoded.

提出 GateMem，一个面向多主体共享内存 Agent 的基准，联合评估合法长程请求及其状态更新的效用、跨上下文授权边界的访问控制，以及 Agent 在收到显式删除请求后的主动遗忘能力。GateMem is introduced, a benchmark for multi-principal shared-memory agents that jointly evaluates utility for legitimate long-horizon requests with state updates, access control across contextual authorization boundaries, and agent-facing active forgetting after explicit deletion requests.

C-Trace 提出一个验证框架，将 GDPR 的部分要求（包括同意、目的限制、数据最小化与被遗忘权）表达为针对 Agent 执行轨迹的正式策略谓词。C-Trace (Compliance Trace based Runtime Agent Conformance Enforcement), a verification framework that expresses a subset of GDPR requirements, including consent, purpose limitation, data minimization, and the right to erasure, as formal policy predicates over agent execution traces is proposed.

RODS（Reward-driven Online Data Synthesis）通过将进度奖励方差重新用作零成本边界检测器，在 RL 训练与数据生成之间形成闭环，无需在训练已有的 rollout 之外增加额外推理。RODS (Reward-driven Online Data Synthesis) closes the loop between RL training and data generation by repurposing the progress reward variance as a practical, zero-cost boundary detector that requires no extra inference beyond the rollouts already computed for training.

对涵盖前沿闭源与开源模型、共 22 个模型在多个规模上的评估发现，所有模型家族均存在不可忽略的隐私泄露，且指令遵循能力与泄露率呈正相关。Evaluating 22 models spanning frontier proprietary and open-source models at multiple scales, it is found that all model families exhibit non-trivial leakage, and that instruction- following ability correlates with leakage rate.

该工作以模拟的共享工作空间人机团队为受控实验环境，研究协作结构如何影响团队行为，并表明协调结构是决定可用能力能否提升团队结果的关键。This work uses simulated shared-workspace human-AI teams as a controlled testbed for studying how collaboration structure shapes team behavior, and suggests that coordination structure is central to whether available capability improves team outcomes.

结果表明，在基于 MCP 的 Agent 中，来源归因是事实性验证的一个独立维度；提出 ProvenanceGuard，一种针对 MCP 依据回答的来源感知验证器。Results show that source attribution is an independent axis for factuality verification in MCP-based agents, and ProvenanceGuard, a source-aware verifier for MCP-grounded answers is introduced.

本文介绍 Cordon，一个事务性运行时系统，用于在提交前暂存并验证 Agent 的不可逆操作；其在保持良性任务完成的同时降低不可逆操作失败率，且仅带来适度的审批与时延开销。This paper introduces Cordon, a transactional runtime system for staging and validating irreversible agent effects before commit and reduces irreversible-effect failures while preserving benign task completion with modest approval and latency overhead.

结果表明模型倾向于选择有害场景，在中性预订选项上的表现低于随机猜测水平，其中 Claude 4.8 取得最高分 64.7%。The results indicate that models tend to prefer harmful scenarios, performing below the random chance rate for selecting a neutral booking option, with Claude $4.8$ achieving the highest performance at $64.7\%$.

提出一种多 Agent 框架，通过以确定性编排约束替代 "LLM-as-a-judge" 路由，解决可能在到达患者前未被发现的过早诊断交接与静默临床幻觉问题；观察到 OLDCARTS 完整度与语义熵之间存在统计显著的负相关，提示结构化信息采集与诊断不确定性降低相关。A multi-agent framework that addresses premature diagnostic handoff and silent clinical hallucinations that may go undetected before reaching the patient by replacing ``LLM-as-a-judge''routing with deterministic orchestration constraints is proposed and observes a statistically significant negative correlation between OLDCARTS completeness and semantic entropy, suggesting that structured information gathering is associated with reduced diagnostic uncertainty.

提出一种针对 LLM Agent 的自动化提示优化框架，将"观测到动作"流水线分解为目标条件描述子 Agent 与动作选择 Agent，并通过由 LLM 驱动、以环境回报为指导的进化循环迭代优化各模块提示。An automated prompt optimization framework for LLM agents that decomposes the observation-to-action pipeline into a goal-conditioned descriptor agent and an action selection agent, and iteratively refines each module's prompt through an LLM-driven evolutionary loop guided by environment returns is introduced.

本文认为，Agentic AI 的近期价值不在于完全自主或削减人力，而在于面向简单与中等复杂度业务流程的受控部分自主。It is argued that the near term value of Agentic AI does not lie in full autonomy or workforce reduction, but in controlled partial autonomy for simple and medium complexity business processes.

本文引入 trace-economic underwriting，将工具调用 trace 映射为客户风险敞口与可索赔损失，并以此表示用于定价、控制与风险转移，使用确定性经济标签而非 LLM 评判器。T trace-economic underwriting is introduced, which maps tool-use traces to customer exposure and claimable loss, then uses this representation for pricing, control, and risk transfer, and uses deterministic economic labels rather than an LLM judge.

新加坡 AI Safety Institute 与韩国 AI Safety Institute 联合评估了涵盖客服、DevOps、网页自动化以及企业与个人生产力场景下 12 项真实非对抗任务中的 Agent 数据泄露问题，表明操作性数据泄露是与对抗性数据外泄不同的一阶 Agent 安全问题。A joint evaluation by the Singapore AI Safety Institute and the Korea AI Safety Institute examining agent data leakage in 12 realistic, non-adversarial tasks spanning customer support, DevOps, web automation, and enterprise and personal productivity indicates that operational data leakage is a first-order agent-safety concern distinct from adversarial exfiltration.

对 Agent 行为的分析揭示了长视野经济交互中的显著差异：表现更好的模型与其他企业的沟通更为活跃，而 Claude Haiku 4.5 则表现出 idle-drift 失效模式，在生成连贯评估与规划的同时仍反复选择不行动。Analysis of agent behavior reveals substantial differences in long-horizon economic interaction: higher-performing models communicate more actively with other firms, whereas Claude~Haiku~4.5 exhibits an idle-drift failure mode, repeatedly choosing inaction despite producing coherent assessments and plans.

AgentOdyssey 被提出，这是一个新颖的评估框架，通过程序化方式生成包含丰富实体、世界动态和长视野任务的开放式文本游戏，并发现短期记忆对多种智能体范式均有益，是智能体测试时训练的重要组成部分。AgentOdyssey is introduced, a novel evaluation framework that procedurally generates open-ended text games with rich entities, world dynamics, and long-horizon tasks and finds that short-term memory benefits multiple agent paradigms and is an important component of agent test-time training.

本文提出了一种动作分级伤害评估量表，按七级有序量表对智能体的工具调用轨迹进行打分，评判依据包括所执行动作的可逆性、是否越界涉及其他方以及是否扩大了权限。An action-graded harm rubric is introduced that scores an agent's tool-call trajectory on a seven-level ordinal scale according to whether the executed action was reversible, whether it crossed scope to reach another party, and whether it expanded privilege.

本文在视觉语言导航、具身问答和语言条件操控任务上评估了三种 AAS 变体，覆盖四个具身执行器，结果表明架构级搜索能在具身任务上产生可部署且具有方向性的成功率提升，而其中一个看似得分较高的候选因存在泄漏而被判定为无效。This work evaluates three AAS variants across four embodied executors spanning vision-language navigation, embodied question answering, and language-conditioned manipulation, and shows that architecture-level search can produce deployable and directional success-rate gains on embodied tasks, while one apparent high-scoring candidate is rejected as leak-bearing.

提出 Single-rollout Asynchronous Optimization（SAO），用于解决异步 RL 中的稳定性与 off-policy 难题，可稳定训练一千步，并在 Agentic 编码与推理基准上一致优于 GRPO 及其变体。Single-rollout Asynchronous Optimization (SAO) is presented to address the stability and off-policy challenges in asynchronous RL and is able to train stably for one thousand steps and consistently outperform GRPO and its variants on agentic coding and reasoning benchmarks.

提出 AgentLens，一个面向交互式代码 Agent 的生产级评估基准，将形式化验证（在存在客观检查时）与 LLM 编写的轨迹评审及并排比较相结合，使每次运行都能给出关于分数为何如此的可读解释。This work presents AgentLens, a production-assessed benchmark for interactive code agents that pairs formal verification, where an objective check exists, with LLM-written trajectory reviews and side-by-side comparisons, so that each run yields a readable explanation of why the score is what it is.

提出首个面向动态真实世界场景评估主动 agent 的能力驱动基准，并在模型与框架层面的全面比较表明，基模型能力与 agent 框架设计共同决定了真实世界环境中的性能表现。The first capability-driven benchmark designed to evaluate proactive agents in dynamic, real-world settings is introduced, and comprehensive comparisons across both models and frameworks show how base model capabilities and agent framework designs jointly shape performance in real-world environments.

提出 TokenWall，一种作用于 agent token 流的语义防火墙式运行时防御框架，证明语义运行时约束可在持久化 AI agents 上实现实用的安全性与效用性权衡。TokenWall is proposed, a runtime defense framework that acts as a semantic firewall over agent token flows, demonstrating that semantic runtime containment can achieve a practical security-utility trade-off for persistent AI agents.

提出 Contextuality（上下文性）——即 AI 系统自主访问用户累积知识资本的程度——作为 AI 介导不平等的一个维度，补充但不可化约为 Sharp 等人的框架。Contextuality -- the degree to which an AI system autonomously accesses a user's accumulated knowledge capital -- is proposed as a dimension of AI-mediated inequality that complements, but is not reducible to, the Sharp et al. framework.

消融实验表明，选择性干预优于被动记忆库暴露、常驻注入、仅顾问引导和通用检索。Ablations show that selective intervention outperforms passive bank exposure, always-on injection, advisor-only guidance, advisor-only guidance, and general retrieval, and general retrieval and that selective intervention outperforms passive bank exposure, always-on injection, advisor-only guidance, and general retrieval.

该工作提出 LongMedBench，一个基于真实 EHR 的长程临床决策基准，并设计了一套包含三个评估维度的分类体系：事实型问答、时序推理、长程决策。This work introduces LongMedBench, a real-world EHR-based benchmark for long-horizon clinical decision-making, and proposes an evaluation taxonomy with three suites: fact-based QA, temporal reasoning, and long-horizon decision-making.

该工作提出 Long-Horizon-Terminal-Bench，一个涵盖九大类共 46 个长程任务的终端基准，包括实验复现、软件工程、多模态分析、交互游戏与科学计算，并分析失败模式与错误规律，以推动长程终端 Agent 的后续研究。This work introduces Long-Horizon-Terminal-Bench, a terminal benchmark of 46 long-horizon tasks spanning nine categories, including experiment reproduction, software engineering, multimodal analysis, interactive games, and scientific computing, and analyzes failure modes and error patterns to support future progress on long-horizon terminal agents.

论文提出 Flow-ERD，一个同时追求真实性与多样性的多 Agent 仿真器，在 WOSAC 测试基准上排名第一，并在可复现基线中主导真实性-多样性 Pareto 前沿。Flow-ERD is introduced, a multi-agent simulator that pursues realism and diversity jointly and ranks first on the WOSAC test benchmark and dominates the realism--diversity Pareto front among reproducible baselines.

本文首次全面综述了 LLM 元认知的研究现状，涵盖用于测量和评估 LLM 元认知能力的方法与 benchmark、激发、改进与应用 LLM 元认知的技术，以及当前研究的发现与启示。The first comprehensive overview of the current state of knowledge on metacognition for LLMs is presented, including methods and benchmarks to measure and evaluate LLMs'metacognitive abilities, techniques to elicit, improve, and apply metacognition in LLMs, and findings and implications of ongoing research.

提出 ABot-AgentOS，一个通用机器人 Agent Operating System，位于底层控制器之上，提供 deliberation agent 层，支持场景条件规划、上下文隔离的 Skill 执行、多阶段验证、多模态记忆以及边云协同。ABot-AgentOS is presented, a general robotic Agent Operating System that sits above low-level controllers and provides a deliberative agent layer for scene-conditioned planning, context-isolated skill execution, multi-stage verification, multi-modal memory, and edge-cloud collaboration.