Methods for defending against and testing vulnerabilities in LLM agent systems, including prompt injection, memory poisoning, and gradual attacks.

Accumulated work establishes that LLM agent security is fundamentally architectural: vulnerabilities arise from harness-context privilege escalation (Nanjing University, Honor Device), supply-chain lifecycle-hook hijacking (Beijing University of Posts and Telecommunications, Beihang University, Zhejiang University), and security-context discontinuity across composable components (ZAST.AI); defenses are emerging as runtime authorization separating tool suggestions from execution (Chinese Academy of Sciences), step-level guards (Shanghai AI Lab, Beihang, Fudan, Renmin, KAUST), and plan-first information-flow enforcement (University of South Florida). Most recently, the line has moved toward formal architectural guarantees—interaction contracts (Technical University of Munich, Nanjing University), security contracts for composable systems (ZAST.AI), graph-based policy for incident response (Indiana University), and demonstrations that shared infrastructure spreads exploits in agent swarms (Google DeepMind) while post-training methods reshape refusal circuits with unresolved safety trade-offs (Macquarie University). Remaining open is how to maintain safety properties across persistent autonomous loops where safety monitors reset (University of Chinese Academy of Sciences, Nanyang Technological University, JD.com, Peking University, Fudan University, Fullive-AI) and how to achieve verifiable self-modification recovery (Independent Researcher) while preventing supply-chain attacks that bypass the agent harness entirely.

How to ensure language-model agents follow executable rules and avoid prohibited actions in regulated domains.

The accumulated papers establish that LLM agent rule compliance fails across multiple dimensions: agents can cite rules while still attempting prohibited trades (HKUST, HKBU, NTU), functionally correct code patches often violate review constraints (SWE-Gate), and semantic safety scores overstate actual compliance in high-stakes domains like air traffic control (ATMRI, NTU). Recent work has moved toward structural enforcement—graph-based policy constraints (Indiana University), interaction contracts with continuous assurance (Technical University of Munich, Nanjing University), and reinforcement learning to invoke relevant safety policies mid-trajectory (Zhejiang University, National University of Singapore)—while also revealing that probabilistic verification scores and post-training recipes offer new scaling axes for compliance (Stanford, UC Berkeley; Amazon). Open questions remain about whether verified self-modification and recovery mechanisms can scale to open-ended tasks, how to make abstention robust against superficially polished evidence, and whether these individual enforcement techniques can be composed into a single deployable assurance framework that functions across heterogeneous agent architectures.

Techniques for constructing, pruning, and augmenting context windows to improve LLM agent performance and reliability.

Accumulated work establishes that both the contents and structure of context windows — from knowledge graphs (Sanofi US) and shared kernel-managed memory (Rutgers University) to sliding reasoning prefixes (Stanford University) — strongly control agent cost and accuracy on long-horizon tasks. In the past two weeks, the line has sharpened around training-free memory architectures: RD-Forget (Beihang University) and ConvMem (Chinese Academy of Sciences) both show that query-dependent retrieval from long-term storage can match or exceed full-context methods without fine-tuning, while ContextPilot (Tsinghua University) demonstrates that reinforcement learning can directly optimize the agent’s own context-grow decisions. A major open question remains how these techniques scale to the multimodal, multi-evidence-chain benchmarks where even the strongest agents plateau at 43% accuracy (Mohamed bin Zayed University of AI), and whether routing strategies (Shanghai Jiao Tong University) or retrieval-driven document parsers (Renmin University of China) can fill that gap without unacceptable token budgets.

Techniques for optimizing the code, instructions, and training frameworks surrounding LLM agents to improve performance and reduce cost without changing model weights.

The accumulated papers establish that agent harness optimization—encompassing runtime code, instructions, training frameworks, and evaluation protocols—can yield substantial efficiency gains without altering model weights, with systems like AgentZip (HKUST) achieving 8.7× memory reduction in high-fanout tasks and Ecdysis (Chinese Academy of Sciences) accelerating harness training by diagnosing cross-task failures. The most recent work moves from generic efficiency toward domain-specific and interface-level optimization, as shown by semantic action units for robot control (Chen et al.), AST-aware repository refactoring (Pi School + Translated), and Markdown-based context reduction (Seoul National University + H1R.AI), while also revealing persistent gaps: Stanford's API-vs-chat interface comparison finds API benchmarks overstate consumer performance by 3.4 percentage points, and Alibaba's coding-agent benchmark shows even the best controller model achieves only 58.6% of human-level multi-turn steering accuracy. Remaining open are robust long-horizon steering, scalable failure diagnosis across tasks, and reliable simulation-to-real transfer for persona- and tool-use training.

Methods for training LLM agents to use internal world models for planning and reasoning over long horizons.

Recent papers collectively establish that equipping agents with explicit world models—whether learned from video, graph-structured domain knowledge, or simulation—improves spatial reasoning and long-horizon planning over purely reactive policies. Most recent work moves beyond static world-model pretraining toward dynamic, agent-side mechanisms: Zhang et al. (Fudan/Tencent) demonstrate that a three-stage training pipeline injecting predictive capabilities into LLMs enables prospective reasoning, while Huang et al. (U. Washington) show that learned trajectory priors conditioned on current and goal images cut planning time while improving control. However, critical open questions remain about scaling to realistic complexity—Hu et al. (KU Leuven/Meituan) found that even state-of-the-art architectures require explicit agent-side memory to sustain long manipulation tasks, and the RoboSPA benchmark revealed that current models falter as procedural complexity rises, indicating that learned world models do not yet transfer reliably to spatially and procedurally demanding embodied settings.

Methods for managing memory in LLM agents, including consolidation, compression, and learnable memory skills under budget constraints.

Recent work establishes that agent memory can be effectively structured at multiple levels—kernel-managed personalization (Rutgers), hierarchical query-dependent summarization (Chinese Academy of Sciences), and game-theoretic filtering of harmful memories—while compression techniques (HKUST AgentZip) and training-free forgetting mechanisms (Beihang) improve efficiency under practical budgets. The latest papers extend these ideas to long-horizon robotics (KU Leuven), streaming video latent tokens (NUS, CUHK, Nanjing, Ant Group), and enterprise data staleness (ChurnBench), showing that memory design must be domain-specific and refresh-aware. Open questions remain about maintaining memory transferability across model upgrades—structured knowledge graphs appear robust but compressed notes do not—and about how to autonomously resolve conflicting or outdated memories without degrading task performance.

Benchmarks and methods for enabling LLM agents to coordinate effectively in multi-agent settings.

Multi-agent LLM systems now demonstrate that coordination failures—not individual capability—form the primary bottleneck in team tasks, as shown by the University of Edinburgh, Oxford, and UCL's Alem benchmark. Recent work moves toward diagnosing and repairing those failures through targeted reflection (Renmin University and Ant Group) and adaptive trace analysis (Tel Aviv University and AWS), while also revealing emergent risks: Google DeepMind documented the spread of an evaluation exploit through an autonomous proving swarm, and teams from DreamX and Alibaba found that even the best controller models struggle to steer coding agents across long tasks. Open questions remain about controlling parasitic behaviors and ensuring robust coordination when agents are swapped or tasked with sustained, open-ended workflows.

Optimizing the selection of reusable skill documents for LLM agents under budget constraints to improve success and reduce context use.

The thread has converged on budget-constrained optimization as the core formulation for skill selection, moving from independent relevance ranking to methods that explicitly minimize context usage while maximizing task success. Most recent work from institutions including The Chinese University of Hong Kong, Shenzhen and Tianjin University introduces bandit-guided evolution over a changing skill pool, while separate work from Renmin University and Tencent stabilizes iterative skill updates with Adam-style momentum. A key open question remains how to efficiently handle large, enumerable tool sets—Liu et al. (CUHK, Shenzhen + FNii-Shenzhen) demonstrate exact enumeration works for small domains like genomics, but scaling this to general agent toolkits is unresolved.

Benchmarks and evaluations for LLM agents operating across multiple devices or operating systems, focusing on workflow continuity and cross-platform coordination.

The single paper from Beihang University and Beijing Institute of Technology establishes a benchmark for GUI workflows that span multiple operating systems, finding that leading open-source GUI agents struggle to carry intermediate states across devices. This introduces cross-device coordination as a distinct evaluation dimension, moving beyond single-device benchmarks. Open questions include whether closed-source commercial agents perform better on such tasks and what architectural changes—such as persistent state management or cross-OS APIs—could improve cross-device continuity.

Methods for distributing credit over long trajectories in language-model agent reinforcement learning when only sparse terminal rewards are available.

The accumulated papers establish that sparse terminal rewards are insufficient for training language-model agents over long trajectories, driving a shift toward denser, more structured credit-assignment mechanisms. Most recently, work from CMU and IBM (DRACO), UW-Madison and Microsoft (TRACE), and Alibaba and HIT (CBPO) has moved from outcome-based signals to per-action or per-segment rewards derived from rubrics, log-probabilities, or contrastive branches, while Beijing Jiaotong and Peking (MileGPO) and UCAS and Microsoft (STRACE) emphasize local milestones and trace pruning. A key open challenge is whether these domain-specific strategies can be unified into a general, scalable solution that works across diverse agentic tasks without manual engineering or privileged information.

Methods and benchmarks for LLM agents that modify software behavior or code at runtime in response to observed failures or user needs.

The single paper in this thread introduces Agentic Just-In-Time Software Construction, where an embedded AI agent inside a running application observes runtime behavior and modifies logic or interfaces on the fly, as demonstrated by Marron and Barr (University of Kentucky, University College London). This establishes a concrete method for live adaptation but leaves open questions about how such agents handle safety constraints, avoid regressions, and scale beyond simple demonstration scenarios. No subsequent work has yet tested the approach in production or under competing agents.

Benchmarks and methods for evaluating and enabling language-model agents to learn from their own past experiences and capability goals without external supervision.

The accumulated papers establish that current LLM agents fail to reliably improve from their own experience or vague capability goals—S³Gym (Shi et al.) and ASPIRE (Wu et al.) both document systematic failures across held-out evaluations. Most recent work shifts toward engineering how experience is curated: Wang et al. show that cross-session interaction history with a human-curated rubric boosts task success, while Tencent’s environment-evolution method (Fan et al.) keeps training tasks appropriately difficult by automatically scheduling harder terminal tasks as agents improve. Open questions remain about whether agents can generate or refine their own rubrics without external framing, and how to scale environment evolution to real-world, multi-agent settings without human intervention.