Agent systems need inspectable execution before they can carry more responsibility

DuST treats generated code samples as a source of pairwise supervision. The base model samples 64 candidate programs per problem, a sandbox labels each candidate as passing or failing, and mixed groups train the same model to rank correct programs above incorrect ones using Group Relative Policy Optimization (GRPO). The reward only scores ranking quality, yet generation improves.

On LiveCodeBench v6, Qwen3-30B-Thinking rises from 65.4% to 68.5% pass@1. Its judgment score rises from 70.1 to 76.3 NDCG, and Best-of-4 accuracy rises from 68.7% to 72.6%. The result gives a concrete recipe for reusing test-time scaling data after inference.

Shepherd makes an agent execution a typed object that another agent can inspect, fork, replay, and modify. Every model call, tool call, file write, and environment action becomes an event in a Git-like trace. Forking uses copy-on-write isolation for the process and filesystem, so alternative continuations can start from the same past state.

The reported systems numbers are practical enough to matter for agent search. On Terminal-Bench 2.0 images up to 5.8 GB, Shepherd forks in 134–143 ms. Full filesystem copy reaches 53,462 ms on the largest image. Replay also reaches about a 95% prompt-cache hit rate on Claude Haiku 4.5 across eight tasks.

ComplexMCP tests agents through the Model Context Protocol (MCP) with more than 300 tools and seven stateful sandboxes. The best reported model, Gemini-3-Flash, reaches 55.31% success across 47 tasks. Human users reach 93.61% through the same interface. The failures include tool retrieval saturation, skipped environment checks, and poor recovery after errors.

BenchCAD applies a similar pressure to multimodal design work. It contains 17,900 execution-verified CadQuery programs across 106 industrial part families. The benchmark separates image-to-code generation, visual question answering, code question answering, and edit tasks. Models read CAD code better than they infer the same details from renders: top Code QA is about 0.838, while Vision QA peaks at 0.587.

JAW shows that agent workflows can be hijacked when attacker-controlled content enters prompts connected to tokens, tools, or secrets. It combines workflow path analysis, prompt-provenance tracing, capability checks, and payload evolution. The paper reports 4,174 hijackable GitHub workflows and eight hijackable n8n templates, with impacts including credential leakage and command execution.

The context problem also appears inside coding agents. An In-Context Autoencoder (ICAE) compresses observations into continuous memory tokens and lets agents run longer trajectories, but detail loss hurts real issue resolution. On SWE-bench Verified, the compressed system solves 7 of 500 issues, below the uncompressed Qwen3-8B baseline at 19 and far below the supervised fine-tuned model at 86.