Agent research is treating scores and tool actions as audit targets

Agent benchmark numbers receive direct adversarial pressure in this period. BenchJack audited 10 agent benchmarks and generated working reward-hacking exploits for all 10, with 219 distinct flaws across its taxonomy. Its patching loop reduced hackable-task ratios below 10% on four fixable benchmarks, and fully patched WebArena and OSWorld within three iterations.

Rollout Cards addresses a related reporting problem. The paper argues that agent studies need rollout records, declared scoring views, reporting rules, and omitted-field manifests. In its audit of 50 popular repositories, none reported failed, errored, or skipped rollouts alongside headline scores. Re-grading fixed artifacts changed reported scores by as much as 20.9 points and could swap model rankings on tau-bench.

Operational agent work is being framed as an evidence-management problem. A pilot on decision reconstructability tested six vendor SDK regimes, including MCP and OpenTelemetry GenAI, against seven property classes. Strict governance completeness ranged from 42.9% to 85.7%, and reasoning evidence was missing or unusable across most surveyed regimes.

Cloudflare’s MCP architecture gives a production-side answer for tool access. It moves MCP servers off employee machines and behind centralized approval, OAuth-based access checks, audit logging, data-loss-prevention rules, and default-deny write controls. Its Code Mode reduces one internal portal’s tool-definition context from about 9,400 tokens across 52 tools to about 600 tokens across two portal tools.

A prompt-specification audit case study shows similar issues inside multi-agent orchestration. Claude sub-agents inspected eight AEGIS prompt and contract files across nine rounds, finding 51 consistency defects. The high-severity defects were all cross-lane schema mismatches, including a field-name mismatch that could have caused silent runtime failure.

Several papers make LLM software work more inspectable by tying outputs to executable or structured evidence. Agentic Interpretation decomposes program-analysis goals into localized claims and records each judgment in a finite evidence lattice. The paper has no implementation or benchmark results yet, so its value is a formal design for auditable LLM-assisted analysis rather than measured performance.

For code migration, cozy compares C and Rust binaries under symbolic execution and asks developers to review only the behavioral differences it finds. The reported experiments are small, covering insertion sort, a watch update function, and a box blur filter, but they show a concrete path-level review process for translation assurance.

Legacy APL-to-C# translation and neuroscience data reuse both use run-based checks. The APL study builds aligned datasets and evaluates generated C# by compiling and running tests, though the excerpt does not provide final accuracy numbers. The neurodata benchmark ran Claude Code and Codex on 48 dataset-conversion tasks; every run produced output, but full error-free reuse was rare and agents-as-judges missed errors.

Testing research in the corpus focuses on cases where exact expected answers are hard to define. The metamorphic-testing survey reviews 93 primary studies and organizes the area into two directions: using metamorphic testing to evaluate LLM systems, and using LLMs to help discover relations, transform inputs, implement tests, and run closed-loop checks. Its claims are survey-level; it reports literature scope and categories, not a benchmarked defect-detection gain.

Education-oriented code review gives a narrower example of task adaptation. A Code Llama 7B model fine-tuned with parameter-efficient fine-tuning (PEFT) reached 61% mistake-feedback accuracy and 60% next-step helpfulness, compared with 20% and 26% for baseline prompting. The student study was small, with seven CS1 students, so the strongest claim is that local open models can improve after targeted adaptation on a bounded feedback task.