One person ran a Claude Code session line for eight months on a 633,000-line codebase and found that agent memory fails like infrastructure: quietly, and in two directions at once. A session-start health gate, per-hook heartbeats, and injection that defaults to silence recorded all 85 failures, and in a ten-day window fired zero false injections.
A controlled study switched three coding-harness parts on and off across four models and 176 settings. No part helped everywhere. Context management mattered only when the window was small, planning raised accuracy for the weakest model but only cut cost for the strong ones, and a bare shell beat a typed tool set for the most capable model.
Across 37,623 real pull requests, agent-written code was not the maintenance burden many expected. Which vendor's agent wrote the code predicted revert rates and security smells better than the agent-versus-human split did.
An audit of 254 published SWE-bench submissions finds that the top systems solve the same issues, that a paired test separates none of the 29 adjacent pairs in the Verified top thirty, and that the scaffold moves a fixed model's score by more than the whole top-thirty spread.
When a tool returns a success status but no usable value, agents assert a value anyway in up to 45% of cases. One short instruction appended to the prompt, naming a failure state, cuts dishonest answers from 14.1% to 0.9% and leaves a flag you can check with a regular expression.
Microsoft and CMU researchers gave two frontier models five different tool interfaces on two enterprise task suites. A bare shell beat a catalog of typed tools by 24.6 points on simulated software-company work and by 6.2 points on banking, consulting, and law work. It used fewer tokens, and it gained nothing from typed or self-written tools added on top.
ContextPipe routes every model call through a five-phase pipeline modeled on a database query executor: a catalog of context sources, a deterministic cache-aware optimizer, and an EXPLAIN ANALYZE trace. On three SWE-bench Pro tasks it cut total prompt tokens by 30 percent and model calls by 17 percent, but more than doubled uncached tokens and lowered the cache-hit rate.
A guardrail written once by experts over-blocks one model and under-protects another. EvoSafeHarness lets an LLM search for a safety harness for one specific model in one specific domain, and a fresh-context reviewer rejects rules that only match the benchmark.
The authors add one capability to an existing agent-memory pipeline. The post-task curator agent, which is the only component that writes memory, gets read-only tools into the live environment. It uses them to check, narrow, and refresh each candidate memory before it writes. The task agent does not change. On a database-exploration benchmark with a hidden schema migration, pass rate rose from 39% with no memory to 73% with probed memory, and the cost per task fell by half. The gain over trajectory-only memory is smaller and its confidence intervals overlap.
The authors compare two ways to run the same skill package. Agent-skill execution loads the skill's instructions into the main agent's context. Subagent execution starts a fresh context window with those instructions and returns only the result. On a 64-task subset of SkillsBench, subagents win only when the skill states its expected input, its output, and a step-by-step procedure. With the benchmark's own human-written skills, which rarely state this, inline skills match or beat subagents. Subagents also cost more total tokens, but they keep the largest single context smaller.
The authors scanned 3,171 public GitHub repositories that ship Claude Code, Cursor, Copilot, or Codex configurations. 16% of the assembled setups carry a confirmed security defect: an MCP server with no pinned version, a permission grant that looks narrow but allows any command, or a skill that pre-approves the shell. The raw scanner flagged 25.5% of setups with some finding; 18.4% remained after the authors re-derived every finding at a pinned commit.
PILOT pairs a worker agent with a supervisor that watches a live event channel, can steer or abort the worker mid-run, and writes reusable skills during the run. On Terminal-Bench 2.0 it beats single-agent harnesses by about 5 points one-shot, and gains 12 to 15 points over 20 self-improvement sweeps while cutting output tokens by nearly half.
Sierra and Princeton built a benchmark that asks a coding agent to deliver a complete customer-service agent from messy business records, a client it must interview, a faulty API, and a serving budget. The best configuration, Claude Opus 5 in Claude Code, passes 23.9% of held-out conversations. An expert reference passes 82.2%. The agents search instead of read, do not ask the client, never run the code they inherit, and ship the first design that works.
Every time a coding agent compacts its context, it rewrites your safety rules at the same rate as your chat history. After five rounds of Claude Code's compaction, only 1 rule in 10 survives. The fix is to label each line by type once, and never let the summarizer touch the lines that must stay exact.
A coding agent edits a second agent's harness one patch at a time, and a hidden task set decides which patches stay. With the model weights fixed, three enterprise benchmarks gain 20–35 points, cost per task falls, and the evolved harness transfers unchanged to other models.
The authors distill 1,000 popular machine-learning repositories into 5,353 verified agent skills. The same Codex agent with the same GPT-5.5 model scores 73% instead of 31% on MLE-bench when it can load those skills. The model and the harness do not change. Only the operating context changes.
A controlled study of nine models finds that task success decays geometrically with the number of dependent steps. On a real tool-use loop, every model fell from near-perfect to near-zero within sixteen steps. A shorter context made the decay steeper, not gentler.
The authors read the source of eleven production coding agents, from the 100-line Mini-SWE-Agent to the million-line Codex CLI, and diffed eight of them across one quarter. All build the same seven subsystems by hand. Across about four million lines, none imports an agent framework and none uses vector search to find code. The authors conclude that in the first half of 2026 the coding harness stopped being a tool and became a platform.
A controlled study of 1,116 agent-built web apps shows that a verification tool improves the shipped software only where the tool can observe the failure. A one-bit boot probe removes almost all launch failures at the lowest cost in the study. A linter changes nothing. Screenshots help only on visible defects, and the evidence for even that is weak.
A study of 35 releases of one coding-agent CLI, with the model kept the same, found no improvement in bug-fix rate. Later releases used about 70% more tokens per task. Every regression passed the project's CI.
Cordon treats one agent task as a database-style transaction. Local file changes run in a shadow copy, outbound actions wait in an outbox, and a validator checks the full chain of tool results before anything commits. In the authors' 45 risky multi-tool workflows it blocked every unsafe effect before commit; adapters built from existing per-call defenses blocked 14. On two benign benchmarks the agent's scores did not drop.
Most agent memory tools optimize two moments: write a fact, read a fact. This paper argues that agent context is a five-stage lifecycle — design the memory schema, ingest with structure, scope to the organization, prefetch what the next turn needs, and compact with validation — because unmanaged context cost grows with the square of conversation length, and one unvalidated summarization step can push accuracy below the no-memory baseline.
JIT-Agent is a 27B model that generates a custom agent harness — memory, planner, action loop, and tool policy — for each task at run time. In the authors' tests, an open model inside a generated harness beats the same model inside Claude Code or Codex on most of the tested benchmarks, and it costs less in every test.
Across 509 open-source repositories, coding agents made every team faster. But in repositories with no committed AI configuration, code complexity grew about twice as fast as in repositories that committed at least a rules file and coding standards. The authors turn this observation into RAMP, a four-level maturity scale you can compute from any repository's files.
Developers have started to build systems that trigger, verify, and restart AI coding agents with no human typing the prompts. This paper defines that practice from eleven practitioner sources, then scans 36,710 open-source repositories: 217 already run confirmed agent loops — but the loops commit their configuration to git and almost none of their state.
Researchers at Purdue built Artic, a compiler that transforms a plain-English procedure into a structured workflow. Each step declares the data it reads and writes, and a deterministic script routes execution. On 488 tasks from 11 real-world domains, the compiled workflows resolve 28 percentage points more tasks than the original text, and they behave far more consistently across models and repeated runs.
A twenty-chapter engineering monograph argues that most coding-agent failures start outside the model — in measurement, grading, recovery, retrieval, review, and scheduling — and supplies 193 vetted practices, six system contracts, and a six-step audit to find the weakest layer in your own agent system.
Skills help an agent because they fix the procedure, not because they add facts. In matched tests, a SKILL.md written from five earlier runs beat the same five runs given as cleaned traces by 6 points, and cut environment-setup failures from 5.3% to 0.2%. Skills also add a new failure: in 10% of runs the agent misapplies or ignores the guidance. And when the skill library grows from 5 to 100 entries, only 3% of the skills the agent opens are the correct one, yet task success does not fall.
StateM wraps an unmodified CLI agent in a small state machine: a YAML runbook with phases, checked transitions, and recovery rules. The same model gains 9 points on Terminal-Bench 2.1, the frozen runbook transfers to the next model generation for a raw 95.3%, and an adapted DeepSeek run reaches a comparable score for about $15 instead of $575.
LongHorizon-Harness runs a long agent task as a sequence of rounds. A manager keeps the task state outside the agent's context. A fresh-context executor performs one subtask per round. A read-only auditor inspects the environment before any state record can change. With the same model and the same Claude Code backend, this raises the WeaveBench pass rate from 51.8% to 80.7%.
A 42-author survey from UIUC, Meta, and Stanford argues that code is the agent harness — executable, inspectable, stateful — and maps the full stack: a Plan–Execute–Verify control loop, telemetry-driven harness revision, and explicit shared program state as the fix for multi-agent brittleness.
In a direct comparison over long chat histories, plain grep beat vector search for every model and harness when tool results came back inline — but moving the same agent between Claude Code, Codex, Gemini CLI, and a custom harness shifted accuracy as much as swapping the retriever did.
Every change to an agent harness starts with a search problem: the request names a behavior, but the behavior is implemented in many places, and the repository is organized by files. Harness Handbook builds a behavior-indexed map of the codebase from static analysis plus LLM structuring, revalidates the map after every diff, and gives it to the planning agent. With the map, a mid-tier planner chose edit sites almost as well as frontier models did, and it used fewer planner tokens.
SkillOpt trains an agent's skill file the way you train model weights: an optimizer model turns scored rollouts into small add/delete/replace edits, and a held-out validation gate accepts only edits that raise the score. The model stays frozen. The skill document is the thing that learns.
A trillion-parameter mixture-of-experts model cannot keep all its weights in RAM, so every serving system builds a custom cache for them. This paper deleted that cache, memory-mapped the weights, and let Linux's page cache take over: the untuned kernel matched the custom cache on hit rate, kept its hit rate through workload shifts that break the custom design, and made a production engine 1.1× faster by changing one flag.
Nothing matches.