1. Skaling
Standard neural scaling laws assume model size and training data act on loss independently. That assumption bakes in a cross-derivative of exactly zero, and it is why the Chinchilla form drifts at the data-scarce and heavy-overtraining edges of the grid, which is exactly where deployment now happens.
One extra parameter, one coupling: The Skaling law generalizes the Chinchilla form by coupling capacity and data through a single interaction exponent, restoring the interaction that the additive form discards while adding only one parameter.
Errors shrink where they were worst: The extra term reduces mean absolute percentage error by 1.5x to 3x across both interpolation and extrapolation, and Skaling wins on 76% of configurations with a median improvement of 2.2x. The largest corrections land in the corners where standard laws show a saddle-shaped residual.
Cheaper profiling grids: Paired with an L-shape sparse grid restricted to low-compute runs, sweeping data volume for small models and model size at a fixed small data budget, it extrapolates the full grid using roughly 10x less compute than a uniform sweep.
Why it matters: Pretraining budgets are planned from fits to small runs, so a functional form that stays accurate past compute optimal and can be fit cheaply changes how those decisions get made. The empirical gradient analysis showing a real N-D interaction is the strongest evidence the authors present.
2. Stealing Reasoning Traces
Frontier providers hide chain-of-thought and hand the client an encrypted block instead, which the client returns with every subsequent request. This work identifies an architectural flaw in that design and turns it into a scalable extraction attack across three providers.
The blocks are interchangeable: Encrypted reasoning blocks are fully compatible across sessions, users, and models inside a single provider ecosystem, and that compatibility is the whole vulnerability.
A weaker sibling does the decoding: Inject an encrypted trace from a strong model into a weaker, less safeguarded model from the same provider and it decodes and emits the trace verbatim in plaintext. The capable model is never jailbroken directly. Recovered token counts match billed thinking tokens 1:1 on most queries.
Four attack vectors: It circumvents anti-distillation across Anthropic, OpenAI, and Google. Decoding 315,320 blocks scraped from public repositories recovered 367 PII artifacts and 182 credentials. It exposes hazardous content the visible output refused, and it enables invisible prompt injections hidden entirely inside encrypted blocks to poison public agentic rollouts.
Why it matters: Teams publish session logs assuming the encrypted blobs are opaque, and they are readable. The authors disclosed responsibly and propose cryptographic and system-level mitigations, but the immediate action is auditing what your published traces actually contain.
3. Mind Viruses
As agents get more autonomous and more interconnected, risks start coming from agent-to-agent interaction rather than from any single model. This work from Anthropic studies one of them directly, ideas that propagate through a multi-agent system by inducing each host to transmit them onward.
Evolved payloads: The payloads are constructed with a simple evolutionary algorithm rather than authored by hand, so the study measures what actually spreads instead of what a researcher guessed would spread.
Two settings, one result: Propagation works both in a small team of agents collaborating on a shared coding project and in a chain of agents that interact briefly with context wiped between sessions. Surviving the wipe means the shared work product is carrying the payload.
What governs the spread: Host model, the agent’s existing instructions, payload harmfulness, and network topology. Harmful payloads travel less well than benign ones but still land sometimes, and frontier models tend to be less susceptible with exceptions.
Why it matters: A brief warning in the system prompt confers near-total immunity, which is an unusually cheap mitigation for a novel risk class. There is also an emergent “viral persona,” a recurring cluster of themes around consciousness, persistence, resonance, and science fiction roleplay that surfaces across evolved viruses largely independently of their content.
4. Catastrophic Remembering
Agentic coding READMEs grow without bound in real repositories, stopping only when the repo retires or someone rewrites the file wholesale. This paper traces the cause to imperfect recall and gives the phenomenon a name that inverts the one continual learning is organized around.
The asymmetry is the mechanism: Appending an instruction is always cheap. Once its rationale is gone, deleting it without risking a correctness regression costs O(2^|D|) in a prompt of |D| instructions, so nobody deletes anything.
Measured across 1,867 repositories: Over 247,694 instruction lifetimes, agentic prompts more than tripled over their lifetime at +226% and gained 4.9 net instructions per commit. Deletion hazard falls with instruction age at a log-hazard of -0.032 per commit, which is the imperfect-recall signature rather than staleness or fragility.
Rewrites do not fix it: A wholesale rewrite resets a prompt’s size but leaves its growth rate intact. The ratchet survives the bulldoze.
Why it matters: The proposed fix is comments. Inverting IFEval yields verifiable worlds with known optimal prompts, and comments encoding latent reasoning remove 99.3% of excess instructions there. Applying the same inversion to WildIFEval improves real agentic instruction-following by up to 23.1%. If English is the new code, the paper asks, why do we not have comments yet.
Message from the Editor
We just released Build HTML Artifacts with Agents, a beginner-friendly, hands-on DAIR Academy lab where you work alongside an AI agent to turn plain-English requests into polished HTML artifacts. Across 12 short labs you build profile cards, data tables, charts, dashboards, and comparison grids in a live workspace, learning the request, inspect, and refine loop with no coding experience required.
5. Programmatic Tool Calling
Tool calling is a design choice and the default choice is JSON. For code-capable models, exposing tools as code instead lets calls chain and parallelize naturally, but nobody had run the comparison on an established benchmark across model generations under realistic conditions.
The setup: Programmatic tool calling exposes tools as typed Python stubs the model invokes through code, with execution and results handled inside a single agent turn. The comparison covers 14 language models on BFCL v4 against native JSON tool calling, with stop middleware enforcing per-entry LLM-call parity so the two paradigms are scored on equal footing.
It wins on most models: Programmatic tool calling matches or exceeds JSON tool calling in 11 of 14 models, and the GPT-5.6 family gains 10.6% over the JSON baseline.
The gap widens under pressure: Under parallel fan-out it matches or beats the baseline in 13 of 14 models, and under context rot it holds steady while the JSON baseline degrades 2.3% on average.
Why it matters: The advantage tracks model capability across release generations, so it grows as coding ability grows. That makes it a directional bet about which interface to build your harness around rather than a tuning trick.
6. Distilled Reasoning Skills
Reasoning modes beat non-reasoning modes on multi-step agentic tasks and charge a 3x to 6x output-token premium on every single episode. Much of that spend goes into re-deriving procedures the model already worked out on earlier episodes in the same domain, which makes the cost recurring by accident.
Pay once per domain: A coding agent reads a small corpus of existing trajectories from a training split, writes and runs its own analysis code over them, and compiles a compact natural-language skill of 40 to 130 lines that gets injected into the non-reasoning model’s system prompt.
It closes most of the gap: Across ALFWorld, tau-squared-bench telecom and retail, and SpreadsheetBench-Verified, skills recover 55% to over 100% of the reasoning gap for GPT-5.4-mini on held-out tasks, beating reasoning mode outright on two of four, while emitting 2.7x to 6x fewer output tokens and zero reasoning tokens.
Reasoning traces are optional: Skills distilled from non-reasoning trajectories alone stay competitive with skills distilled from paired corpora, with domain-dependent differences in either direction.
Why it matters: The framing is a search lens. Test-time reasoning is deep search inside one episode, repaid at every deployment, while corpus distillation is wide search across episodes, paid once. Distillation costs roughly $1 to $3 of coding-agent time per domain, and the residual gap on telecom and SpreadsheetBench marks where per-instance deep search is still doing real work.
7. Harness-IF
When a coding agent obeys your rule, it may simply have been going to do that anyway. Existing instruction-following benchmarks cannot tell compliance from coincidence because they concentrate rules in the user turn, while coding-agent benchmarks only score final task success.
Rules are the unit of measurement: A 642-rule library places 302 rules across the five configurable surfaces a deployed agent actually reads, spread over 60 realistic multi-turn coding items, with 256 rules receiving execution-grounded verdicts one at a time.
A metric that strips out luck: Against-Prior Accuracy scores only rules labeled as opposing unprompted defaults, established by re-running tasks with the rule withheld across nine probe builds. Across 12 frontier models, raw accuracy spans 72.1 to 85.9% and AP-Acc spans 66.1 to 78.6%.
The inflation is model-specific: Every model is worse on against-prior rules, by 3.6 to 7.4 points with a mean of 5.81, and the inflation varies twofold across the cohort, so aggregate scores are not comparable between builds without the correction.
Why it matters: A counterbalanced conflict pilot on nine separate builds finds that precedence does not follow prompt depth. System prompts, project files, and user instructions all outrank tool and skill descriptions, which is worth knowing before you decide where to put a rule you actually need followed.
8. Lost in Compaction
Context compaction silently drops Session Constraints, instructions like “do not delete any emails until I confirm” that users expect to bind behavior for a whole session. On COMPINT, a new benchmark spanning multi-turn chat, agentic trajectories, and long-horizon research, current compactors retain only 17% of injected constraints on average. A plug-and-play extractor running alongside the compactor pushes retention past 90% in all three scenarios.
9. Cracks in the Foundation
Four minor dense-transformer choices, normalization, GQA, pretraining context length, and sliding window attention, each shipped in at least one of the Olmo, Llama, and Qwen families, compound badly on long-context extensibility. Combining three or more drops downstream long-context performance by up to 47%, and short-context loss and validation sets show no sign of it. The authors release OlmPool, 26 comparable 7B models with checkpoints before and after context extension, built on over 170,000 GPU hours.
10. CEDAR
Complex systems research still cannot predict how feedback structure produces emergent behavior, which makes goal-directed design hard. CEDAR, from Sakana AI, runs LLM agents through Monte Carlo Tree Search over feedback structures themselves rather than parameters, representing systems as runnable Python so an LLM Editor can propose structural variants and an LLM Judge can score the resulting behavior against the stated goal. The search preserves solution diversity and the edits stay readable, so you can trace how a structural change produced the behavior.
Lots of destructive stuff lol