Software-agent research is tightening the interface, the metric, and the security check

Code-agent work is getting more concrete about what the model is allowed to touch. CodeStruct replaces line-range reads and string edits with abstract syntax tree (AST) entities such as functions and methods. On SWE-Bench Verified, that lifts Pass@1 by 1.2 to 5.0 points for frontier models, and GPT-5-nano jumps from 19.6 to 40.4 while empty-patch failures fall from 46.6% to 7.2%. PRepair pushes the same idea into training: score repairs by correctness and edit size together. On HumanEvalFix, Qwen2.5-Coder-7B rises from 47.44 to 81.62 on fix_1@1 with only a small pass@1 gain, which means the model is fixing bugs with far less needless rewrite. Fault-localization work in the same window also argues for tighter context over broader dumps, which fits the same pattern: better boundaries, cleaner edits, fewer accidental failures.

Security evidence is strong and often uncomfortable. Broken by Default finds vulnerabilities in 55.8% of 3,500 generated programs, with 1,055 findings proven exploitable by SMT solving. The category rates are severe in integer arithmetic at 87% and memory allocation at 67%. A separate AutoPT benchmark study reaches a similar conclusion at the system level: many penetration-testing agents still hallucinate, simple single-agent baselines stay competitive, and only 16.67% of chained-vulnerability samples complete the full exploit chain. The outside-industry signal is even sharper: Anthropic is restricting Mythos Preview after internal testing that reports first-try exploit reproduction in 83.1% of cases and successful Linux kernel exploit chains. The net picture is simple. Security capability is rising, but the public evidence still shows frequent unsafe code and unreliable autonomous attack pipelines.

This day also puts pressure on simple pass-rate reporting. SWE-Shield shows that issue-resolution agents can post 70.25% to 75.95% pass rate on the verified split while design satisfaction stays at 32.64% to 50.20%. The paper reports little statistical relation between functional correctness and design compliance in most settings. Gym-Anything makes the same point for computer-use agents at a larger scale. It builds CUA-World with more than 10,000 tasks across 200 applications, and on the long-horizon split the best frontier model reaches only 27.5% pass rate. Tasks often run past 500 GUI steps. Together these results say current headline metrics still miss large parts of real work quality: patch acceptability in repositories, and sustained task completion in real software.

There is also a smaller but clear thread around explicit control layers for complex systems. Qualixar OS packages orchestration into a deterministic 12-step runtime with budget checks, security checks, judging, redesign loops, and cross-provider routing. Its evidence is mostly system-test scale and a custom 20-task suite, so the benchmark weight is lighter than the stronger papers here. In formal methods, PROMISE gives a firmer result: retrieval based on proof-state transitions raises proof automation on seL4 by up to 26 points over prior LLM methods under the same query budget. Symetra adds a human-in-the-loop view for symbolic execution tuning, with experts reported to beat automated tuning on coverage and efficiency, though the excerpt does not give exact deltas. The common emphasis is visible control over search, evaluation, and failure handling.