• ReAct: Synergizing Reasoning and Acting in Language Models — Yao et al. 2022
• ReWOO: Decoupling Reasoning from Observations for Efficient Augmented Language Models — Xu et al. 2023
• Least-to-Most Prompting Enables Complex Reasoning in Large Language Models — Zhou et al. 2022
• Describe, Explain, Plan and Select: Interactive Planning with Large Language Models Enables Open-World Multi-Task Agents — Wang et al. 2023
• Reflexion: Language Agents with Verbal Reinforcement Learning — Shinn et al. 2023
• Self-Reflection in LLM Agents: Effects on Problem-Solving Performance — Renze et al. 2024
• Language Agent Tree Search Unifies Reasoning, Acting, and Planning in Language Models — Zhou et al. 2024
• AI Agents That Matter — Kapoor et al. 2024
• Holistic Agent Leaderboard: The Missing Infrastructure for AI Agent Evaluation — Kapoor et al. 2025
• AgentBoard: An Analytical Evaluation Board of Multi-turn LLM Agents — Ma et al. 2024
• Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. 2025
• Search-R1: Training LLMs to Reason and Leverage Search Engines with Reinforcement Learning — Jin et al. 2025
• WebGPT: Browser-assisted question-answering with human feedback — Nakano et al. 2021
• ReTool: Reinforcement Learning for Strategic Tool Use in LLMs — Feng et al. 2025
• UI-TARS: Pioneering Automated GUI Interaction with Native Agents — Qin et al. 2025
• UI-TARS-2 Technical Report: Advancing GUI Agent with Multi-Turn Reinforcement Learning — Wang et al. 2025
• Introducing computer use, a new Claude 3.5 Sonnet, and Claude 3.5 Haiku — Anthropic 2024
• DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning — DeepSeek-AI et al. 2025
• Kimi K2: Open Agentic Intelligence — Kimi Team 2025
• Voyager: An Open-Ended Embodied Agent with Large Language Models — Wang et al. 2023
• ExpeL: LLM Agents Are Experiential Learners — Zhao et al. 2023
• ReasoningBank: Scaling Agent Self-Evolving with Reasoning Memory — Ouyang et al. 2025
• Synapse: Trajectory-as-Exemplar Prompting with Memory for Computer Control — Zheng et al. 2023
• Introducing the Model Context Protocol — Anthropic 2024
• A Survey of AI Agent Protocols — Yang et al. 2025
• Tool Learning with Large Language Models: A Survey — Qu et al. 2024
• A Survey on the Memory Mechanism of Large Language Model based Agents — Zhang et al. 2024
• Large Language Models Cannot Self-Correct Reasoning Yet — Huang et al. 2023
• Can LLMs Correct Themselves? A Benchmark of Self-Correction in LLMs — Tie et al. 2025
• Agentless: Demystifying LLM-based Software Engineering Agents — Xia et al. 2024

• Cognitive Architectures for Language Agents — Sumers et al. 2023
• The Agent Use of Agent Beings: Agent Cybernetics Is the Missing Science of Foundation Agents — Wang et al. 2026
• Building effective agents — Anthropic 2024
• SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering — Yang et al. 2024
• Executable Code Actions Elicit Better LLM Agents — Wang et al. 2024
• Equipping agents for the real world with Agent Skills — Anthropic 2025
• Toolformer: Language Models Can Teach Themselves to Use Tools — Schick et al. 2023
• The Rise and Potential of Large Language Model Based Agents: A Survey — Xi et al. 2023
• A Survey on Large Language Model based Autonomous Agents — Wang et al. 2023
• Understanding the Planning of LLM Agents: A Survey — Huang et al. 2024
• The Landscape of Emerging AI Agent Architectures for Reasoning, Planning, and Tool Calling: A Survey — Masterman et al. 2024
• The Landscape of Agentic Reinforcement Learning for LLMs: A Survey — Zhang et al. 2025
• A Comprehensive Survey of Self-Evolving AI Agents: A New Paradigm Bridging Foundation Models and Lifelong Agentic Systems — Fang et al. 2025
• Survey on Evaluation of LLM-based Agents — Yehudai et al. 2025
• Agentic Large Language Models, a Survey — Plaat et al. 2025
• A Comprehensive Survey on Agent Skills: Taxonomy, Techniques, and Applications — Zhou et al. 2026

Additional 2026 reading (3), curated alongside the survey (not yet cited in the paper text):

• The Hitchhiker's Guide to Agentic AI: From Foundations to Systems — Roitman 2026 · Practitioner book covering full agentic AI stack from foundations to production systems.
• Multi-Agent Debate Strategies: Survey, Taxonomy, and Challenges — Motger et al. 2026 · Maps 141 multi-agent debate studies onto participant, interaction and agreement axes, finding convergence on one narrow pattern by convention, not comparison.
• Beyond the Leaderboard: A Synthesis of Tool-Use, Planning, and Reasoning Failures in Large Language Model Agents — Albayaydh et al. 2026 · Synthesizes 27 benchmark and audit papers into six failure clusters, showing strong sub-task scores do not translate into end-to-end success.

• An LLM Compiler for Parallel Function Calling — Kim et al. 2023
• AdaPlanner: Adaptive Planning from Feedback with Language Models — Sun et al. 2023
• Learning When to Plan: Efficiently Allocating Test-Time Compute for LLM Agents — Paglieri et al. 2025
• Asynchronous Tool Usage for Real-Time Agents — Ginart et al. 2024
• On the Brittle Foundations of ReAct Prompting for Agentic Large Language Models — Verma et al. 2024
• GAP: Graph-Based Agent Planning with Parallel Tool Use and Reinforcement Learning — Wu et al. 2025
• Plan-and-Act: Improving Planning of Agents for Long-Horizon Tasks — Erdogan et al. 2025
• Plan-and-Solve Prompting: Improving Zero-Shot Chain-of-Thought Reasoning by Large Language Models — Wang et al. 2023
• ADaPT: As-Needed Decomposition and Planning with Language Models — Prasad et al. 2023
• SELF-REFINE: Iterative Refinement with Self-Feedback — Madaan et al. 2023
• CRITIC: Large Language Models Can Self-Correct with Tool-Interactive Critiquing — Gou et al. 2023
• When Can LLMs Actually Correct Their Own Mistakes? A Critical Survey of Self-Correction of LLMs — Kamoi et al. 2024
• SELF-[IN]CORRECT: LLMs Struggle with Discriminating Self-Generated Responses — Jiang et al. 2024
• ReflAct: World-Grounded Decision Making in LLM Agents via Goal-State Reflection — Kim et al. 2025
• Tree Search for Language Model Agents — Koh et al. 2024
• Agent Q: Advanced Reasoning and Learning for Autonomous AI Agents — Putta et al. 2024
• The Optimizer Is the Agent: Reasoning-Driven Search across Prompts, Programs, and ML Workflows — Li et al. 2026
• Tree of Thoughts: Deliberate Problem Solving with Large Language Models — Yao et al. 2023
• Reasoning with Language Model is Planning with World Model — Hao et al. 2023
• StateAct: Enhancing LLM Base Agents via Self-Prompting and State-Tracking — Rozanov et al. 2024
• Second Thought: Reasoning in Parallel as LLM Agents Act and Observe — Sun et al. 2026
• LLMs Can Predict Failure Risk, But Struggle to Predict Which Collaboration Protocol Pays Off: Cost-Aware Protocol Routing Across Reasoning Tasks — Yang et al. 2026
• Web Agents Should Adopt the Plan-Then-Execute Paradigm — Piet et al. 2026
• MAP: A Map-then-Act Paradigm for Long-Horizon Interactive Agent Reasoning — Liu et al. 2026
• From Agent Loops to Structured Graphs: A Scheduler-Theoretic Framework for LLM Agent Execution — Wei et al. 2026
• Revisable by Design: A Theory of Streaming LLM Agent Execution — Zhai et al. 2026
• Speculative Interaction Agents: Building Real-Time Agents with Asynchronous I/O and Speculative Tool Calling — Hooper et al. 2026
• Experiential Reflective Learning for Self-Improving LLM Agents — Allard et al. 2026
• AdaptOrch: Task-Adaptive Multi-Agent Orchestration in the Era of LLM Performance Convergence — Yu et al. 2026
• Self-Evolving World Models for LLM Agent Planning — Zhang et al. 2026
• Behavioral Controllability of Agentic Models for Information Extraction: From Fixed Workflows to Reflective Agents — Zhang et al. 2026
• Multi-Paradigm Agent Interaction in Practice: A Systematic Analysis of Generator-Evaluator, ReAct Loop, and Adversarial Evaluation in the buddyMe Framework — Wang et al. 2026

Additional 2026 reading (4), curated alongside the survey (not yet cited in the paper text):

• Bridge Evidence: Static Retrieval Utility Does Not Predict Causal Utility in Multi-Step Agentic Search — Mukhopadhyay et al. 2026 · Static retrieval-utility metrics fail to predict causal usefulness in multi-step agentic search loops.
• Structured Feedback Improves Repair in an LLM Agent Loop — Ray et al. 2026 · Isolates the retry loop's gain in admissible-alternative feedback, not JSON formatting, across 50 paired TextWorld games.
• Think Short, Defer Smart, Act, and Repeat: Calibrated Reasoning and Uncertainty-Aware Deferral for Edge LLM Agents — Farzaneh et al. 2026 · Halts on-device ReAct reasoning once the action stabilizes, deferring uncertain steps to cloud, cutting thinking compute 43-73% over deferral-only baselines.
• GATS: Graph-Augmented Tree Search with Layered World Models for Efficient Agent Planning — Williams et al. 2026 · Replaces LLM-guided exploration with UCB1 tree search over a layered world model, cutting planning-time LLM calls to zero.

• s1: Simple Test-Time Scaling — Muennighoff et al. 2025
• Efficiently Scaling LLM Reasoning with Certaindex — Fu et al. 2024
• Scaling LLM Test-Time Compute Optimally Can Be More Effective Than Scaling Model Parameters — Snell et al. 2024
• R^3-Bench: LLMs Struggle with Resource-Rational Reasoning under Shared Budgets — Wang et al. 2026
• Let's Verify Step by Step — Lightman et al. 2023
• Generative Verifiers: Reward Modeling as Next-Token Prediction — Zhang et al. 2024
• Code Generation with AlphaCodium: From Prompt Engineering to Flow Engineering — Ridnik et al. 2024
• Teaching Large Language Models to Self-Debug — Chen et al. 2023
• Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena — Zheng et al. 2023
• Agent-as-a-Judge: Evaluate Agents with Agents — Zhuge et al. 2024
• R-Judge: Benchmarking Safety Risk Awareness for LLM Agents — Yuan et al. 2024
• Lost in the Middle: How Language Models Use Long Contexts — Liu et al. 2023
• MemGPT: Towards LLMs as Operating Systems — Packer et al. 2023
• LLMLingua: Compressing Prompts for Accelerated Inference of Large Language Models — Jiang et al. 2023
• Effective context engineering for AI agents — Anthropic 2025
• How we built our multi-agent research system — Anthropic 2025
• What Does Context Compression Cost an Agent? Interaction Costs Unrevealed by Task-Completion Metrics — Liu 2026
• SWE-bench: Can Language Models Resolve Real-World GitHub Issues? — Jimenez et al. 2023
• Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes — Wu et al. 2026
• AgentRewind: Recoverable Execution for Long-Horizon LLM Agents — Zhuang et al. 2026
• Human-In-the-Loop Software Development Agents — Takerngsaksiri et al. 2024
• Less Context, Better Agents: Efficient Context Engineering for Long-Horizon Tool-Using LLM Agents — Lodha et al. 2026
• The Complexity Trap: Simple Observation Masking Is as Efficient as LLM Summarization for Agent Context Management — Lindenbauer et al. 2025
• Slipstream: Trajectory-Grounded Compaction Validation for Long-Horizon Agents — Chen et al. 2026
• Self-Compacting Language Model Agents — Li et al. 2026
• CompactionRL: Reinforcement Learning with Context Compaction for Long-Horizon Agents — Li et al. 2026
• Learning Agent-Compatible Context Management for Long-Horizon Tasks — Yi et al. 2026
• PEEK: Context Map as an Orientation Cache for Long-Context LLM Agents — Gu et al. 2026
• TokenPilot: Cache-Efficient Context Management for LLM Agents — Xu et al. 2026
• Memex(RL): Scaling Long-Horizon LLM Agents via Indexed Experience Memory — Wang et al. 2026
• MemGUI-Agent: An End-to-End Long-Horizon Mobile GUI Agent with Proactive Context Management — Liu et al. 2026
• Are We Ready For An Agent-Native Memory System? — Zhou et al. 2026
• SWE-MeM: Learning Adaptive Memory Management for Long-Horizon Coding Agents — Gao et al. 2026
• CoACT: Action-Preserving Observation Compression for Coding Agents — Chen et al. 2026
• Experience Memory Graph: One-Shot Error Correction for Agents — Wang et al. 2026
• Neural Procedural Memory: Empowering LLM Agents with Implicit Activation Steering — Zhao et al. 2026
• Why Git Is the Memory Solution for the Agentic Development Lifecycle — Guo 2026
• Scoped Verification for Reliable Long-Horizon Agentic Context Evolution under Distribution Shift — Hsu et al. 2026
• Failure as a Process: An Anatomy of CLI Coding Agent Trajectories — Zhao et al. 2026
• Set-shifting Behavioral Test for Harnessed Agents — Ye 2026
• Ares: Adaptive Reasoning Effort Selection for Efficient LLM Agents — Yang et al. 2026
• Adaptive Latent Agentic Reasoning — Jung et al. 2026
• DART: Draft-Agreement Routing for Training-Free Adaptive Thinking Budgets in Hybrid Reasoning Models — Lee et al. 2026
• Timely Machine: Awareness of Time Makes Test-Time Scaling Agentic — Ma et al. 2026
• Inference-Time Budget Control for LLM Search Agents — Fang et al. 2026
• Budget-Aware Tool-Use Enables Effective Agent Scaling — Liu et al. 2025
• Stop When Reasoning Converges: Semantic-Preserving Early Exit for Reasoning Models — Min et al. 2026
• MARS: Margin-Adversarial Risk-controlled Stopping for Parallel LLM Test-time Scaling — Chen et al. 2026
• AgentV-RL: Scaling Reward Modeling with Agentic Verifier — Zhang et al. 2026
• Inference-Time Scaling of Verification: Self-Evolving Deep Research Agents via Test-Time Rubric-Guided Verification — Wan et al. 2026
• FineVerify: Scaling Test-Time Compute with Fine-Grained Self-Verification for Agentic Search — Zhao et al. 2026
• Budgeted Act-or-Defer Multi-Agent LLM Deliberation with Local Reliability Bounds — Wang et al. 2026

Additional 2026 reading (29), curated alongside the survey (not yet cited in the paper text):

• Self-Healing Agentic Orchestrators for Reliable Tool-Augmented Large Language Model Systems — Babu et al. 2026 · Orchestration-level failure recovery for tool-augmented agents beyond model-level errors.
• Exploring Cross-Scenario Generality of Agentic Memory Systems: Diagnostics and a Strong Baseline — Chen et al. 2026 · Diagnoses poor cross-scenario generalization of memory systems and proposes a strong baseline.
• LAMP: Lean-based Agentic framework with MCP and Proof Repair — R et al. 2026 · Agentic framework with MCP integration and proof-repair loop for Lean theorem proving.
• Code Isn't Memory: A Structural Codebase Index Inside a Coding Agent — Bhola et al. 2026 · Controlled study of structural codebase indexing effect on coding-agent cost and resolve rate.
• When Does Restricting a Coding Agent to execute_code Help? A Regime × Agent-Design Ablation — Yang et al. 2026 · Ablation on restricting coding agents to code-execution-only tool surface vs bash/IDE primitives.
• Dockerless: Environment-Free Program Verifier for Coding Agents — Zeng et al. 2026 · Environment-free program verifier removing Docker dependency for coding-agent trajectory/reward verification.
• ToolChain-CRC: Conformal Risk Control for Agentic AI Under Retrieval and Tool-Use Drift — Opoku et al. 2026 · Conformal risk control detecting retrieval/tool-use drift hidden behind acceptable-looking final answers.
• PROJECTMEM: A Local-First, Event-Sourced Memory and Judgment Layer for AI Coding Agents — Malo et al. 2026 · Local-first event-sourced memory/judgment layer avoiding repeated context reconstruction in coding agents.
• Precise but Uncoupled: Reviewer Precision Does Not Guarantee Critique Uptake in Multi-Agent Math Reasoning — Yang et al. 2026 · Shows reviewer critique precision does not translate into uptake in multi-agent verification loops.
• SHERLOC: Structured Diagnostic Localization for Code Repair Agents — Tamoyan et al. 2026 · Structured diagnostic localization gives repair agents actionable fault context beyond file retrieval.
• Frontier Coding Agents Use Metaprogramming to Adapt to Unfamiliar Programming Languages — Sharma et al. 2026 · Coding agents use metaprogramming to adapt control strategy to unfamiliar programming languages.
• Agent-Orchestrated Adaptive RAG: A Comparative Study on Structured and Multi-Hop Retrieval — Maharjan et al. 2026 · Agent-orchestrated adaptive RAG adds dynamic query decomposition and multi-hop retrieval control.
• Leyline: KV Cache Directives for Agentic Inference — Ma et al. 2026 · KV cache directives handle agentic inference's policy-driven trajectory edits unlike append-only chat caching.
• Chow-Liu Ordering for Long-Context Reasoning in Chain-of-Agents — Gupta et al. 2026 · Information-theoretic ordering of chunks for sequential multi-agent long-context processing with shared bounded memory.
• Latent Programming Horizons in Coding Agents — Silva et al. 2026 · Finds coding-agent residual streams linearly encode program-state properties during multi-step trajectories.
• ProvenanceGuard: Source-Aware Factuality Verification for MCP-Based LLM Agents — Alvarez et al. 2026 · Provenance-sensitive factuality verification for MCP-based agents pulling multi-source evidence.
• SING: Synthetic Intention Graph for Scalable Active Tool Discovery in LLM Agents — Xiao et al. 2026 · Synthetic intention graphs enable scalable active tool discovery amid huge harness tool ecosystems.
• Goal-Autopilot: A Verifiable Anti-Fabrication Firewall for Unattended Long-Horizon Agents — Deng 2026 · Anti-fabrication firewall bounding claims of unattended long-horizon agents at termination.
• TokenMizer: Graph-Structured Session Memory for Long-Horizon LLM Context Management — Mishra 2026 · Graph-structured session memory preserving decisions/rationale beyond flat truncation/summarization.
• On Problems of Implicit Context Compression for Software Engineering Agents — Gelvan et al. 2026 · Studies failure modes of encoding SE-agent context as continuous embeddings via in-context autoencoding for long-horizon tasks.
• LLM Agents Already Know When to Call Tools -- Even Without Reasoning — Sun et al. 2026 · Shows LLM agents' internal states already signal tool-call necessity without explicit reasoning, via new When2Tool benchmark.
• Portable Agent Memory: A Protocol for Cryptographically-Verified Memory Transfer Across Heterogeneous AI Agents — Ravindran 2026 · Protocol for cryptographically-verified transfer of persistent episodic/procedural agent memory across heterogeneous agents.
• Debug2Fix: Can Interactive Debugging Help Coding Agents Fix More Bugs? — Garg et al. 2026 · Tests whether interactive/stateful debugging tools improve coding agents' bug-fixing verification-recovery loop.
• Verify, Repair, Repeat, or Stop? Robust Stopping for Noisy Verify-Repair Loops in LLM Agents — Wu et al. 2026 · Decides when a noisy verify-repair loop should commit instead of repairing again, since repair can damage already-correct plans.
• CodeRescue: Budget-Calibrated Recovery Routing for Coding Agents — He et al. 2026 · Routes post-failure recovery between cheap retry and escalation under a calibrated budget, not a fixed cheap-then-escalate cascade.
• AgentDebugX: An Open-Source Toolkit for Failure Observability, Attribution, and Recovery in LLM Agents — Zhu et al. 2026 · Closes the debugging loop from detection to attribution to rerun, since the failing step is rarely the causing one.
• Addressable Recall Compaction for Long Context-Window Control in AI Agents — Dang et al. 2026 · Replaces old tool observations with addressable citations the agent can re-request, avoiding both discarding and similarity-based retrieval.
• Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents — Reddy et al. 2026 · Catches silent policy-violating writes with deterministic pre-execution gates, since neither the tool nor the agent's self-report exposes them.
• TRAJDEBUG: Tracing Error Lifecycle to Identify Critical Failures in Long-Horizon Agent Trajectories — Qi et al. 2026 · Locates the earliest step actually responsible for a failure rather than any local error, using multi-granularity history compression to keep evidence scattered across a long trajectory reachable.

• ToRL: Scaling Tool-Integrated RL — Li et al. 2025
• DeepResearcher: Scaling Deep Research via Reinforcement Learning in Real-World Environments — Zheng et al. 2025
• SWE-RL: Advancing LLM Reasoning via Reinforcement Learning on Open Software Evolution — Wei et al. 2025
• Does Reinforcement Learning Really Incentivize Reasoning Capacity in LLMs Beyond the Base Model? — Yue et al. 2025
• RAGEN: Understanding Self-Evolution in LLM Agents via Multi-Turn Reinforcement Learning — Wang et al. 2025
• Group-in-Group Policy Optimization for LLM Agent Training — Feng et al. 2025
• Agentic Reinforced Policy Optimization — Dong et al. 2025
• Retroformer: Retrospective Large Language Agents with Policy Gradient Optimization — Yao et al. 2023
• Reflect, Retry, Reward: Self-Improving LLMs via Reinforcement Learning — Bensal et al. 2025
• SAMULE: Self-Learning Agents Enhanced by Multi-Level Reflection — Ge et al. 2025
• Training Software Engineering Agents and Verifiers with SWE-Gym — Pan et al. 2024
• ReST Meets ReAct: Self-Improvement for Multi-Step Reasoning LLM Agent — Aksitov et al. 2023
• ReAct Meets ActRe: When Language Agents Enjoy Training Data Autonomy — Yang et al. 2024
• One Frozen Simulator Is Not Enough: Simulator Collapse in Multi-Agent RL — Yu et al. 2026
• Agent Lightning v1.0: Towards Harnessed Agentic RL — He et al. 2026
• Chain-of-Agents: End-to-End Agent Foundation Models via Multi-Agent Distillation and Agentic RL — Li et al. 2025
• Reason Wide, Not Deep: Amortizing the Reasoning Premium into Distilled Skills — Singh et al. 2026
• Do NOT Think That Much for 2+3=? On the Overthinking of o1-Like LLMs — Chen et al. 2024
• L1: Controlling How Long a Reasoning Model Thinks with Reinforcement Learning — Aggarwal et al. 2025
• Agentic Knowledgeable Self-Awareness — Qiao et al. 2025
• Scaling Test-Time Compute for LLM Agents — Zhu et al. 2025
• Thoughts Are All Over the Place: On the Underthinking of o1-Like LLMs — Wang et al. 2025
• The Danger of Overthinking: Examining the Reasoning-Action Dilemma in Agentic Tasks — Cuadron et al. 2025
• AEM: Adaptive Entropy Modulation for Multi-Turn Agentic Reinforcement Learning — Zhao et al. 2026
• T2PO: Uncertainty-Guided Exploration Control for Stable Multi-Turn Agentic Reinforcement Learning — Wang et al. 2026
• Beyond Trajectory-Level Attribution: Graph-Based Credit Assignment for Agentic Reinforcement Learning — Cheng et al. 2026
• Cyclical Entropy Eruption: Entropy Dynamics in Agent Reinforcement Learning — Li et al. 2026
• Staleness-Learning Rate Scaling Laws for Asynchronous RLHF — Song et al. 2026
• ASymPO: Asymmetric-Scale Policy Optimization for Asynchronous LLM Post-Training Without Behavior Information — Liu et al. 2026
• RollArt: Disaggregated Multi-Task Agentic RL Training at Scale — Gao et al. 2025
• From Reasoning to Agentic: Credit Assignment in Reinforcement Learning for Large Language Models — Zhang et al. 2026
• MetaResearcher: Scaling Deep Research via Self-Reflective Reinforcement Learning in Adversarial Virtual Environments — Yu et al. 2026
• LiteResearcher: A Scalable Agentic RL Training Framework for Deep Research Agent — Li et al. 2026
• GUI-Libra: Training Native GUI Agents to Reason and Act with Action-aware Supervision and Partially Verifiable RL — Yang et al. 2026
• Rethinking the Design of Reinforcement Learning-Based Deep Research Agents — Wan et al. 2025
• Exploring Agentic Tool-Calling Decisions via Uncertainty-Aligned Reinforcement Learning — Zhou et al. 2026
• ET-Agent: Incentivizing Effective Tool-Integrated Reasoning Agent via Behavior Calibration — Chen et al. 2026
• Co-Evolving Skill Generation and Policy Optimization — Zhang et al. 2026
• AgentRL: Scaling Agentic Reinforcement Learning with a Multi-Turn, Multi-Task Framework — Zhang et al. 2025
• Reinforcement Learning for LLM-based Multi-Agent Systems through Orchestration Traces — Zhang et al. 2026
• Why Multi-Step Tool-Use Reinforcement Learning Collapses and How Supervisory Signals Fix It — Hao et al. 2026
• TRACE: Turn-level Reward Assignment via Credit Estimation for Long-Horizon Agents — Tao et al. 2026
• Branching Policy Optimization: Sandbox-Native Language Agent Reinforcement Learning — He et al. 2026
• ToolVerse: Unlocking Massive Environments and Long-Horizon Tasks for Agentic Reinforcement Learning — Zhou et al. 2026
• Single-Rollout Asynchronous Optimization for Agentic Reinforcement Learning — Hou et al. 2026
• ToolAnchor: Anchoring Counterfactual Context to Boost Agentic Tool-use Capability — Liu et al. 2026
• Compiling Agentic Workflows into LLM Weights: Near-Frontier Quality at Two Orders of Magnitude Less Cost — Dennis et al. 2026

Additional 2026 reading (20), curated alongside the survey (not yet cited in the paper text):

• EnvRL: Learn from Environment Dynamics in Agentic Reinforcement Learning — Wang et al. 2026 · RL method exploiting environment dynamics signals to address sparse rewards in agentic training.
• Open-SWE-Traces: Advancing Dual-Mode Multilingual Distillation for Software Engineering Agents — Ahmad et al. 2026 · Large multilingual trajectory dataset for distilling software-engineering agent behavior.
• Function-Aware Fill-in-the-Middle as Mid-Training for Coding Agent Foundation Models — Wang et al. 2026 · Mid-training FIM objective aligned with action-observation-continuation structure of coding agent loops.
• UCOB: Learning to Utilize and Evolve Agentic Skills via Credit-Aware On-Policy Bidirectional Self-Distillation — Tu et al. 2026 · Credit-aware bidirectional self-distillation for reusing skill memories in agentic RL without oracular assumption.
• Synthesize and Reward -- Reinforcement Learning for Multi-Step Tool Use in Live Environments — Abdelaziz et al. 2026 · RL training for multi-step tool use in live stateful environments, addressing reward and execution realism gaps.
• Entropy Pacing Policy Optimization for Multi-Task Agentic Reinforcement Learning — Hu et al. 2026 · Entropy-pacing RL policy optimization for generalist multi-task agentic LLMs.
• CRAFT: Counterfactual Credit Assignment from Free Sibling Rollouts for Self-Distilled Agentic Reinforcement Learning — Meng et al. 2026 · Token-level self-distillation with counterfactual sibling rollouts to improve credit assignment in agentic RL.
• Reward Modeling for Multi-Agent Orchestration — Tsang et al. 2026 · Self-supervised reward model for evaluating and training multi-agent orchestration quality.
• Scaling Agentic Capabilities via Grounded Interaction Synthesis — Shi et al. 2026 · Grounded interaction synthesis pipeline scaling agentic training data without costly human annotation.
• ProAct: Agentic Lookahead in Interactive Environments — Yu et al. 2026 · Two-stage training internalizes lookahead simulation to reduce compounding errors in long-horizon agent planning.
• SWE-Master: Unleashing the Potential of Software Engineering Agents via Post-Training — Song et al. 2026 · Reproducible post-training pipeline for SWE agents combining trajectory synthesis, SFT, and execution-feedback RL.
• TRIAGE: Role-Typed Credit Assignment for Agentic Reinforcement Learning — Xu et al. 2026 · Role-typed credit assignment improves GRPO training over uniform outcome rewards for agentic action sequences.
• No Time Like the Present: Agentic Test-Time Training for LLM Agents — Wang et al. 2026 · Continuous test-time training adapting agent weights during long episodes to counter degradation and repetition.
• Qwen-AgentWorld: Language World Models for General Agents — Zuo et al. 2026 · Builds language world models to improve planning/reasoning for general LLM agents.
• SkillRise: Agentic Reinforcement Learning for Cross-Task Skill Evolution — Yao et al. 2026 · Trains one policy to alternate between solving tasks and curating an evolving skill document, crediting curation by discounted downstream outcomes.
• The Physics of Multi-Turn Long-Horizon Planning: From Pre-training to Post-training via Single- and Multi-Teacher On-Policy Agentic Distillation — Men et al. 2026 · Traces where long-horizon planning ability comes from across pre-training, GRPO, and on-policy distillation, using a controlled environment instead of opaque web data.
• The Dark Room in the Reward Channel: Dense Prediction Rewards Collapse GRPO-Trained LLM Agents -- and What Actually Works — Wang 2026 · Shows dense next-observation rewards collapse GRPO agents into a degenerate absorbing state, and localizes the cause to group std normalization.
• Speculate While You Reason: Teaching Agents to Predict Their Next Tool Call via Joint Agent-Speculator RL — Ji et al. 2026 · Trains one model both to act and to predict its own next tool call, replacing separate draft models with a dual-mode policy.
• Agentic-DPO: From Imitation to Agentic Policy Optimization on Expert Trajectories — Chen et al. 2026 · Converts expert trajectories into state-level action preferences, matching online GRPO on tau-bench without online rollouts or a reward model.
• TCPO: Turn-Level Credit Policy Optimization — Liao et al. 2026 · Separates a verifier score from credit in multi-turn RL: a score rates the current output, while credit should say how the turn changed the refinement trajectory, built from retrospective, hindsight and counterfactual comparisons.

• Agent Workflow Memory — Wang et al. 2024
• ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs — Qin et al. 2023
• Gorilla: Large Language Model Connected with Massive APIs — Patil et al. 2024
• Library Drift: Diagnosing and Fixing a Silent Failure Mode in Self-Evolving LLM Skill Libraries — Zhang et al. 2026
• From Raw Experience to Skill Consumption: A Systematic Study of Model-Generated Agent Skills — Huang et al. 2026
• MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers — Wang et al. 2025
• AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases — Chen et al. 2024
• Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale — Liu et al. 2026
• SkillsVote: Lifecycle Governance of Agent Skills from Collection, Recommendation to Evolution — Liu et al. 2026
• ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control — Bhatt et al. 2025
• Inducing Programmatic Skills for Agentic Tasks — Wang et al. 2025
• SkillWeaver: Web Agents Can Self-Improve by Discovering and Honing Skills — Zheng et al. 2025
• Learn-by-Interact: A Data-Centric Framework for Self-Adaptive Agents in Realistic Environments — Su et al. 2025
• VLM Agents Generate Their Own Memories: Distilling Experience into Embodied Programs of Thought — Sarch et al. 2024
• AutoManual: Constructing Instruction Manuals by LLM Agents via Interactive Environmental Learning — Chen et al. 2024
• Cradle: Empowering Foundation Agents Towards General Computer Control — Tan et al. 2024
• Agent S: An Open Agentic Framework that Uses Computers Like a Human — Agashe et al. 2024
• Lifelong Robot Library Learning: Bootstrapping Composable and Generalizable Skills for Embodied Control with Language Models — Tziafas et al. 2024
• JARVIS-1: Open-World Multi-Task Agents with Memory-Augmented Multimodal Language Models — Wang et al. 2023
• Ghost in the Minecraft: Generally Capable Agents for Open-World Environments via Large Language Models with Text-Based Knowledge and Memory — Zhu et al. 2023
• Demystifying Agent Skills: Why They Work-Until They Don't — Jiang et al. 2026
• What Keeps Agent Skills from Being Reusable? Evidence from 138K SKILL.md Files — Zhang et al. 2026
• A Measurement Study of Model Context Protocol Ecosystem — Guo et al. 2025
• Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem — Gaire et al. 2025
• Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem — Zhao et al. 2025
• Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis — Li et al. 2026
• Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions — Hou et al. 2025
• A Large-Scale Empirical Analysis of Custom GPTs' Vulnerabilities in the OpenAI Ecosystem — Ogundoyin et al. 2025
• Model Context Protocol (MCP) at First Glance: Studying the Security and Maintainability of MCP Servers — Hasan et al. 2025
• CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills — Liu et al. 2026
• MUSE-Autoskill: Self-Evolving Agents via Skill Creation, Memory, Management, and Evaluation — Lin et al. 2026
• SkillCAT: Contrastive Assessment and Topology-Aware Skill Self-Evolution for LLM Agents — Chen et al. 2026
• SkillOpt: Executive Strategy for Self-Evolving Agent Skills — Yang et al. 2026
• Workflow-to-Skill: Skill Creation via Routing-Workflow-Semantics-Attachments Decomposition — Zhang et al. 2026
• SkillFoundry: Building Self-Evolving Agent Skill Libraries from Heterogeneous Scientific Resources — Shen et al. 2026
• SkillOS: Learning Skill Curation for Self-Evolving Agents — Ouyang et al. 2026
• Generative Skill Composition for LLM Agents — Zhao et al. 2026
• Group of Skills: Group-Structured Skill Retrieval for Agent Skill Libraries — Zeng et al. 2026
• SkillRAE: Agent Skill-Based Context Compilation for Retrieval-Augmented Execution — Meng et al. 2026
• SkillResolve-Bench: Measuring and Resolving Same-Capability Ambiguity in Agent Skill Retrieval — Ding et al. 2026
• Rethinking Experience Utilization in Self-Evolving Language Model Agents — Zhao et al. 2026
• SIRI: Self-Internalizing Reinforcement Learning with Intrinsic Skills for LLM Agent Training — He et al. 2026
• Skill-MAS: Evolving Meta-Skill for Automatic Multi-Agent Systems — Lin et al. 2026
• FederatedSkill: Federated Learning for Agentic Skill Evolution — Yang et al. 2026
• Agent Skills for Large Language Models: Architecture, Acquisition, Security, and the Path Forward — Xu et al. 2026
• Agent Skill Evaluation and Evolution: Frameworks and Benchmarks — Ding et al. 2026
• Externalization in LLM Agents: A Unified Review of Memory, Skills, Protocols and Harness Engineering — Zhou et al. 2026
• How are AI agents used? Evidence from 177,000 MCP tools — Stein et al. 2026
• Model Context Protocol (MCP) Tool Descriptions Are Smelly! Towards Improving AI Agent Efficiency with Augmented MCP Tool Descriptions — Hasan et al. 2026
• Tool-to-Agent Retrieval: Bridging Tools and Agents for Scalable LLM Multi-Agent Systems — Lumer et al. 2025
• EvoClawBench: Can Agents Learn Reusable Skills from Their Own Runs? — Peng et al. 2026
• A Framework for Evaluating Agentic Skills at Scale — Shaposhnikov et al. 2026
• SkillCorpus: Consolidating and Evaluating the Open Skill Ecosystem for Real-World LLM Agents — Wang et al. 2026
• MetaSkill-Evolve: Recursive Self-Improvement of LLM Agents via Two-Timescale Meta-Skill Evolution — Wang et al. 2026
• SkillAdaptor: Self-Adapting Skills for LLM Agents from Trajectories — Yu et al. 2026
• GEIS: A Generation-Evaluation-Improvement Loop of Agent Skills for Long-Form Article Generation — Zhang et al. 2026

Additional 2026 reading (20), curated alongside the survey (not yet cited in the paper text):

• COMFYCLAW: Self-Evolving Skill Harnesses for Image Generation Workflows — Li et al. 2026 · Self-evolving reusable skill harness that recalls workflow patterns and constraints across sessions.
• SciVisAgentSkills: Design and Evaluation of Agent Skills for Scientific Data Analysis and Visualization — Ai et al. 2026 · Designs and evaluates externalized reusable agent skills for scientific visualization workflows.
• SkillCoach: Self-Evolving Rubrics for Evaluating and Enhancing Agentic Skill-Use — Zhu et al. 2026 · Self-evolving rubrics for fine-grained skill-use evaluation beyond coarse final-verifier success.
• Bayesian-Agent: Posterior-Guided Skill Evolution for LLM Agent Harnesses — Wu et al. 2026 · Bayesian posterior-guided skill evolution replacing heuristic reflection/count-based belief updates.
• Socratic-SWE: Self-Evolving Coding Agents via Trace-Derived Agent Skills — Xiao et al. 2026 · Self-evolving coding agents generating synthetic SWE training tasks via trace-derived reusable skills.
• Probe-and-Refine Tuning of Repository Guidance for Coding Agents — Shepard et al. 2026 · Iteratively tunes AGENTS.md repository guidance as externalized operational knowledge for coding agents.
• Self-Improving AI Coding Agents Through Accumulated Behavioral Rules: A Closed-Loop Framework — Aggarwal et al. 2026 · Closed loop codifying accepted human review feedback into persistent behavioral rules across coding sessions.
• SkillFab: An Agent-Native Skill Production Platform — Xu et al. 2026 · Agent-native platform where agents author, review, and publish reusable Agent Skills as demand-driven artifacts.
• Skills Are Not Islands: Measuring Dependency and Risk in Agent Skill Supply Chains — Jia et al. 2026 · Models agent skills as dependency-bearing supply-chain artifacts, exposing provenance/versioning risks.
• SkillAudit: Ground-Truth-Free Skill Evolution via Paired Trajectory Auditing — Gao et al. 2026 · Ground-truth-free skill evolution via paired trajectory auditing without privileged feedback.
• Notes2Skills: From Lab Notebooks to Certainty-Aware Scientific Agent Skills — Liu et al. 2026 · Converts uncertain lab notebook reasoning into certainty-aware reusable scientific agent skills.
• SkillJuror: Measuring How Agent Skill Organization Changes Runtime Behavior — Chen et al. 2026 · Shows progressive-disclosure skill organization changes agent runtime behavior independent of content.
• Skill Coverage: A Test Adequacy Metric for Agent Skills — Tan et al. 2026 · Introduces test-adequacy coverage metric for whether agents actually exercise skill instructions.
• The Regression Tax: Decomposing Why Skills Help and Hurt LLM Agents — Tank et al. 2026 · Decomposes skill effects into gains and regressions across nearly 6,000 runs, showing the best skills win by regressing less, not gaining more.
• HiSkill: Empowering LLM Agents with Hierarchical Skill Graphs — Hao et al. 2026 · Organizes trajectories into a hierarchical skill graph linking high-level skills to executable action templates, replacing flat, independently retrieved collections.
• From Anatomy to Smells: An Empirical Study of SKILL.md in Agent Skills — Hong et al. 2026 · Taxonomizes 238 real-world SKILL.md files and finds over 99% carry at least one skill smell that rarely disappears as skills evolve.
• Skill-Use: Can LLMs Actually Use Skills in Agentic Harnesses? — Han et al. 2026 · Separates whether an agent triggers the right skill, follows its prescribed procedure, and stays inside its forbidden-operation boundary, under progressive disclosure where only the name and a short description are visible up front.
• Comparative Approaches to Agent Retrieval over Large Skill Libraries — Kolluru et al. 2026 · Over a corpus of 690 skills a hybrid lexical and dense ranker puts the right one in the top five 73.5% of the time, and the typed workflow knowledge graph, used as its design intends at matched token budget, comes out significantly worse by 11.2 points.
• When Self-Evolution Backfires: Pre-Commit Gating against Skill Contamination in LLM Agents — Shang et al. 2026 · Past a critical pool size new skills start hurting rather than helping, because a defective skill becomes reference material for the next one; removing the source afterwards recovers little, which makes admission a pre-commit problem rather than a cleanup problem.
• Rethinking Self-Evolving Agent Skills: Feedback Dynamics over Multiple Rounds — Liu et al. 2026 · Holds executor, optimizer, revision procedure and round budget fixed across 42 runs and varies only the feedback shown to the optimizer, finding evolution is sparse: 55 of 388 candidates ever establish a byte-distinct validation best.

• The Devil Is in the Interface: Evaluating How Tool Architecture Shapes Coding Agent Behavior — Xu et al. 2026
• OpenHands: An Open Platform for AI Software Developers as Generalist Agents — Wang et al. 2024
• AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation — Wu et al. 2023
• The Scaffolding Matters More Than the Interface: A Controlled Comparison of MCP and CLI Tool Use Across Seven Agent Scaffoldings, Five Language Models, and One Software Task — Forment et al. 2026
• Don't Build Multi-Agents — Yan 2025
• Why Do Multi-Agent LLM Systems Fail? — Cemri et al. 2025
• When Agents Coordinate: Measuring Coordination in Multi-Agent AI Coding — Destefanis et al. 2026
• AOrchestra: Automating Sub-Agent Creation for Agentic Orchestration — Ruan et al. 2026
• From Model Scaling to System Scaling: Scaling the Harness in Agentic AI — Gu et al. 2026
• 12-Factor Agents: Principles for Building Reliable LLM Applications — Horthy 2025
• The Shift from Models to Compound AI Systems — Zaharia et al. 2024
• Harnessing Agent Skills: Architectural Patterns and a Reference Architecture for Skill-Mediated LLM Agents — Xia et al. 2026
• Terminal-Bench: Benchmarking Agents on Hard, Realistic Tasks in Command Line Interfaces — Merrill et al. 2026
• The Interplay of Harness Design and Post-Training in LLM Agents — Kim et al. 2026
• HarnessBridge: Learnable Bidirectional Controller for LLM Agent Harness — Wang et al. 2026
• Inside the Scaffold: A Source-Code Taxonomy of Coding Agent Architectures — Rombaut et al. 2026
• Building Effective AI Coding Agents for the Terminal: Scaffolding, Harness, Context Engineering, and Lessons Learned — Bui et al. 2026
• LiTS: A Modular Framework for LLM Tree Search — Li et al. 2026
• Single-Agent LLMs Outperform Multi-Agent Systems on Multi-Hop Reasoning Under Equal Thinking Token Budgets — Tran et al. 2026
• To Isolate or to Score? Model-Adaptive Assessment for Cost-Efficient Multi-Agent RAG — Lee et al. 2026
• From Question Answering to Task Completion: A Survey on Agent System and Harness Design — Guo et al. 2026
• What makes a harness a harness: necessary and sufficient conditions for an agent harness — Macedo 2026
• Harness Handbook: Making Evolving Agent Harnesses Readable, Navigable, and Editable — Wang et al. 2026
• Don't Blame the Large Language Model: How Scaffolding Evolution Shapes Coding Agent Quality — Sghaier et al. 2026
• Measuring Harness-Induced Belief Divergence in Multi-Step LLM Agents — Yi et al. 2026
• The Harness Effect: How Orchestration Design Sets the Token Economics of Enterprise Agentic AI — Ali et al. 2026
• Cost-Effective Agent Harnesses for Abstract Reasoning and Generalization on ARC-AGI-1 — Moghe et al. 2026
• Dissecting model behavior through agent trajectories — Gupta et al. 2026
• MemoHarness: Agent Harnesses That Learn from Experience — Huang et al. 2026
• When Do Multi-Agent Systems Help? An Information Bottleneck Perspective — Yu et al. 2026
• AutoGPT — Significant Gravitas 2023
• Dify — LangGenius 2025
• MetaGPT — DeepWisdom 2024
• AutoGen — Microsoft 2025
• CrewAI — CrewAI Inc. 2025
• LangGraph — LangChain 2025
• DSPy — Stanford NLP 2025
• smolagents — Hugging Face 2025
• opencode — SST 2025
• Claude Code — Anthropic 2025
• Codex CLI — OpenAI 2025
• OpenHands — OpenHands (All-Hands-AI) 2025
• Cline — Cline 2025
• goose — Block 2025
• aider — Aider-AI 2025
• Continue — Continue 2025
• SWE-agent — Princeton NLP / SWE-agent 2025
• claude-agent-sdk-python — Anthropic 2025
• Superpowers — obra 2025
• awesome-chatgpt-prompts — Fatih Kadir Akin 2023
• Anthropic Agent Skills — Anthropic 2025
• System Prompts and Models of AI Tools — x1xhlol 2025
• awesome-mcp-servers — punkpeye 2025
• Model Context Protocol Servers — Model Context Protocol 2025
• wshobson/agents — wshobson 2025
• awesome-claude-code-subagents — VoltAgent 2025
• microsoft/skills — Microsoft 2025

Additional 2026 reading (35), curated alongside the survey (not yet cited in the paper text):

• LEMON: Learning Executable Multi-Agent Orchestration via Counterfactual Reinforcement Learning — Chen et al. 2026 · Counterfactual RL learns role/capacity/dependency assignment for multi-agent orchestration.
• AnovaX: A Local, Multi-Agent Voice Assistant with LLM Planning, Typed Executors, and Adaptive Recovery — Sinha 2026 · Local multi-agent voice assistant combining LLM planning, typed executors, and adaptive recovery.
• HarnessX: A Composable, Adaptive, and Evolvable Agent Harness Foundry — Chen et al. 2026 · Composable, evolvable harness foundry generating adaptive prompts/tools/memory/control-flow from traces.
• DockSmith: Scaling Reliable Coding Environments via an Agentic Docker Builder — Zhang et al. 2026 · Agentic Docker builder treating environment construction as an agent task for SWE benchmarks/training.
• Queen-Bee Agents: A BeeSpec-Centered Architecture for Governed Enterprise MCP Orchestration — Zhang et al. 2026 · Governance-centered architecture for enterprise MCP orchestration with policy/tenant isolation.
• A Formal Hierarchical Architecture for Agentic Orchestration with Stack-Based Execution and Lazy Discovery — Devadiga et al. 2026 · Stack-based hierarchical orchestration with lazy tool discovery to fight decision-space explosion.
• ToFu: A White-Box, Token-Efficient Agent Harness for Researchers — Ruan et al. 2026 · Token-efficient white-box harness design exposing orchestration logic to researchers.
• Agentic Routing: The Harness-Native Data Flywheel — Liu et al. 2026 · Harness-native data flywheel routing tasks to specialized models within execution harness.
• SwarmResearch: Orchestrating Coding Agents for Open-Ended Discovery — Virk et al. 2026 · Harness-level design choices causing premature convergence in open-ended multi-agent research discovery.
• Orchestra-o1: Omnimodal Agent Orchestration — Zhang et al. 2026 · Omnimodal agent orchestration framework generalizing beyond narrow modality/structure orchestration.
• From Failed Trajectories to Reliable LLM Agents: Diagnosing and Repairing Harness Flaws — Chen et al. 2026 · Diagnoses and repairs harness-level flaws (execution env, tool interfaces, verification) from failed trajectories.
• Evolving Agents in the Dark: Retrospective Harness Optimization via Self-Preference — Pan et al. 2026 · Optimizes agent harness (skills/tools/workflows) without ground-truth labels via self-preference retrospection.
• SDOF: Taming the Alignment Tax in Multi-Agent Orchestration with State-Constrained Dispatch — Wang 2026 · Treats multi-agent orchestration as constrained state machine to enforce business-process stage constraints.
• Design and Implementation of Agentic Orchestrations and Orchestration of Agents — Rinderle-Ma et al. 2026 · Classification framework combining agentic autonomy with business-process orchestration for robustness/traceability.
• Decentralized Multi-Agent Systems with Shared Context — Mao et al. 2026 · Decentralized multi-agent system replaces centralized orchestrator with shared-context coordination.
• Same Signal, Different Semantics: A Cross-Framework Behavioral Analysis of Software Engineering Agents — Ma et al. 2026 · Cross-framework analysis shows behavioral rules from one SE agent harness don't transfer to others.
• SWE-Replay: Efficient Test-Time Scaling for Software Engineering Agents — Ding et al. 2026 · Efficient test-time scaling via trajectory replay/reuse instead of resampling from scratch for SWE agents.
• SWE-Router: Routing in Multi-turn Agentic Software Engineering Tasks — Son et al. 2026 · Routes multi-turn agentic SWE tasks between cheap/frontier models based on trajectory signals.
• Agentic Hardware Design as Repository-Level Code Evolution — Yu et al. 2026 · Self-evolving agent loop compiling a markdown harness into project pack for repo-level code evolution.
• Agents All the Way Down; A Methodology for Building Custom AI Agents from Substrate to Production — Forment et al. 2026 · Methodology for building custom, application-embedded AI agents from substrate to production.
• When Parallelism Pays Off: Cohesion-Aware Task Partitioning for Multi-Agent Coding — Yang et al. 2026 · Formalizes multi-agent coding orchestration; cohesion-aware task partitioning to curb inter-agent communication overhead.
• An Organization-Scoped LLM Agent Runtime Architecture for Regulated Cybersecurity Operations — Fatouros et al. 2026 · Runtime architecture enforcing org-level scope over retrieval, tool calls, memory, and audit for regulated agent deployments.
• Turn: A Language for Agentic Computation — Kizito 2026 · Proposes Turn, a compiled actor-based language purpose-built for agentic programs that delegate reasoning to LLMs.
• VeRO: A Harness for Agents to Optimize Agents — Ursekar et al. 2026 · Introduces harness optimization as a task: coding agents iteratively editing and evaluating another agent's harness code.
• SWE-World: Building Software Engineering Agents in Docker-Free Environments — Sun et al. 2026 · Docker-free execution environments for SWE agents, removing containerized-execution-feedback bottleneck at scale.
• OpenForgeRL: Train Harness-native Agents in Any Environment — Yu et al. 2026 · Trains agents end-to-end inside real harnesses via a recording proxy and per-rollout containers, finding some harnesses much harder to learn than others.
• Better Harnesses, Smaller Models: Building 90% Cheaper Agents via Automated Harness Adaptation — Yang et al. 2026 · Adapts the harness automatically from failure trajectories so small models recover 89.7% of frontier performance at 4% of the cost.
• OrchBench: Evaluating Multi-Agent Orchestration Plans in Isolation via Deterministic Simulation — Ren et al. 2026 · Scores multi-agent orchestration plans in a deterministic simulator, separating plan quality from worker capability at 1.3% of execution tokens.
• SpecBox: Speculative Sandbox Scheduling for Efficient LLM Agent Serving — Zhang et al. 2026 · Prewarms MCP sandboxes mid-generation from predicted tool calls, cutting P99 latency up to 2.9x against on-demand instantiation.
• A Comparative Study of MCP and A2A for Inter-Agent Coordination in LLM-Based Systems — Predoaia et al. 2026 · Compares MCP and A2A on one coordination task: MCP stays lighter, A2A handles stateful multi-turn coordination natively at higher complexity.
• HarnessOpt-Bench: Evaluating LLMs at Harness Optimization — Ursekar et al. 2026 · Measures how well a frontier model can improve someone else's harness, handing an optimizer a seed harness, graded evaluation feedback and a fixed target-evaluation budget under expensive and stochastic scoring.
• EvoHarness-RL: Learning Self-Evolving Runtime Harness for Long-Horizon LLM Agents — Ning et al. 2026 · Learns the harness usage policy instead of hand-writing it, exposing Belief, Progress and Experience as policy-facing state the agent constructs and updates during run-time execution.
• EvolveNet: Collaborative Harness Evolution for Agent Self-Improvement — Nie et al. 2026 · Broadcasts a shared harness to data-local deployments and extracts experience where it lives, on the argument that the streams most worth learning from are exactly the ones that cannot be pooled.
• AiFlow: Token-Native Reactive Orchestration with Bounded Backpressure for Streaming LLM Applications — Zhang 2026 · Normalizes provider token deltas into typed events on a directed streaming graph, with per-node queue bounds, ordering, overflow and backpressure declared rather than left to callback code, and a formalized bounded-memory property.
• Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution — Razzhigaev et al. 2026 · A harness whose tools, prompts, context assembly and core implementation improve through reviewed commits that become the runtime for later work; 86.74% on Terminal-Bench 2.1 and 90.69% on OSWorld-Verified from frozen snapshots, with a separate 161-day deployment left evolving live.

• WebArena: A Realistic Web Environment for Building Autonomous Agents — Zhou et al. 2024
• OSWorld: Benchmarking Multimodal Agents for Open-Ended Tasks in Real Computer Environments — Xie et al. 2024
• GAIA: a benchmark for General AI Assistants — Mialon et al. 2023
• τ-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains — Yao et al. 2024
• AgentBench: Evaluating LLMs as Agents — Liu et al. 2024
• Establishing Best Practices for Building Rigorous Agentic Benchmarks — Zhu et al. 2025
• Stop Comparing LLM Agents Without Disclosing the Harness — Zhang et al. 2026
• The SWE-Bench Illusion: When State-of-the-Art LLMs Remember Instead of Reason — Liang et al. 2025
• QuoteBench: How Matched Scores Can Hide Command-Path Failures — Li et al. 2026
• Beyond Pass@k: Measuring Reliability and Security of Agentic Code Generation — Jiang et al. 2026
• Stop Overthinking: A Survey on Efficient Reasoning for Large Language Models — Sui et al. 2025
• Beyond pass@1: A Reliability Science Framework for Long-Horizon LLM Agents — Khanal et al. 2026
• ReliabilityBench: Evaluating LLM Agent Reliability Under Production-Like Stress Conditions — Gupta et al. 2026
• On the Reliability of Computer Use Agents — Gonzalez-Pumariega et al. 2026
• The Long-Horizon Task Mirage? Diagnosing Where and Why Agentic Systems Break — Wang et al. 2026
• BenchGuard: Who Guards the Benchmarks? Automated Auditing of LLM Agent Benchmarks — Tu et al. 2026
• Automated Benchmark Auditing for AI Agents and Large Language Models — Wang et al. 2026
• Position: Coding Benchmarks Are Misaligned with Agentic Software Engineering — Gorinova et al. 2026
• Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents — Li et al. 2026
• AgentAtlas: Beyond Outcome Leaderboards for LLM Agents — Mazaheri et al. 2026
• How Coding Agents Fail Their Users: A Large-Scale Analysis of Developer-Agent Misalignment in 20,574 Real-World Sessions — Tang et al. 2026
• OSWorld2.0: Benchmarking Computer Use Agents on Long-Horizon Real-World Tasks — Yuan et al. 2026
• WeaveBench: A Long-Horizon, Real-World Benchmark for Computer-Use Agents with Hybrid Interfaces — Li et al. 2026
• Odysseys: Benchmarking Web Agents on Realistic Long Horizon Tasks — Jang et al. 2026
• WebTestBench: Evaluating Computer-Use Agents towards End-to-End Automated Web Testing — Kong et al. 2026
• SWE-Chain: Benchmarking Coding Agents on Chained Release-Level Package Upgrades — Lam et al. 2026
• RoadmapBench: Evaluating Long-Horizon Agentic Software Development Across Version Upgrades — Xu et al. 2026
• OpenComputer: Verifiable Software Worlds for Computer-Use Agents — Wei et al. 2026
• SentinelBench: A Benchmark for Long-Running Monitoring Agents — Maldaner et al. 2026
• LH-Bench: Skill-Grounded Evaluation of Long-Horizon Agents on Subjective Enterprise Tasks — Chandwani et al. 2026
• Aligning Agents via Planning: A Benchmark for Trajectory-Level Reward Modeling — Wang et al. 2026
• Benchmark Test-Time Scaling of General LLM Agents — Li et al. 2026
• The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents — Ding et al. 2026
• PM-Bench: Evaluating Prospective Memory in LLM Agents — Liu et al. 2026
• MCPEvol-Bench: Benchmarking LLM Agent Performance Across Dynamic Evolutions of MCP Servers — Liu et al. 2026
• DeepSWE: Measuring Frontier Coding Agents on Original, Long-Horizon Engineering Tasks — Huang et al. 2026
• SWE-Together: Evaluating Coding Agents in Interactive User Sessions — Wu et al. 2026
• RigorBench: Benchmarking Engineering Process Discipline in Autonomous AI Coding Agents — Madiraju et al. 2026
• AgentLens: Production-Assessed Trajectory Reviews for Coding Agent Evaluation — Podivilov et al. 2026
• PACE: A Proxy for Agentic Capability Evaluation — Song et al. 2026

Additional 2026 reading (24), curated alongside the survey (not yet cited in the paper text):

• Claw-SWE-Bench: A Benchmark for Evaluating OpenClaw-style Agent Harnesses on Coding Tasks — Zheng et al. 2026 · Benchmark adapting SWE-bench scoring contract to general-purpose OpenClaw-style agent harnesses.
• PerspectiveGap: A Benchmark for Multi-Agent Orchestration Prompting — Sun et al. 2026 · Benchmark measuring LLMs' ability to compose orchestration prompts distributing knowledge across sub-agents.
• Benchmarks are Not Enough: RAMP for Runtime Assessing of Agentic Models in Production Systems — Ouyang et al. 2026 · Proposes runtime assessment framework for agents in production beyond static short-horizon benchmarks.
• RuBench: A Repository-Level Agentic Coding Benchmark with Natively Authored Russian Task Specifications — Shilov 2026 · Repository-level coding benchmark with natively authored non-English task specs.
• Dialogue SWE-Bench: A Benchmark for Dialogue-Driven Coding Agents — King et al. 2026 · Benchmark evaluating coding agents under dialogue-driven, non-autonomous interaction settings.
• AstroReason-Bench: Evaluating Unified Agentic Planning across Heterogeneous Space Planning Problems — Wang et al. 2026 · Benchmark testing generalist agentic planning across heterogeneous, physics-constrained space tasks.
• EvoAgentBench: Benchmarking Agent Self-Evolution via Ability Transfer — Gao et al. 2026 · Benchmark isolating procedural skill-transfer in agent self-evolution, distinct from single-episode task success.
• MyPCBench: A Benchmark for Personally Intelligent Computer-Use Agents — Jang et al. 2026 · Benchmark for personally-intelligent computer-use agents across a user's full digital-life context.
• MCP-Persona: Benchmarking LLM Agents on Real-World Personal Applications via Environment Simulation — Wang et al. 2026 · Benchmarks LLM agents on real personal MCP applications via simulated environments.
• Reasoning effort, not tool access, buys first-try reliability in agentic code generation: an observational study — Mehta 2026 · Observational study isolating reasoning effort vs tool access as drivers of first-try coding agent reliability.
• Counsel: A Meta-Evaluation Dataset for Agentic Tasks — Pisupati et al. 2026 · Meta-evaluation dataset targeting the bottleneck of scaling human trajectory annotation for agentic benchmarks.
• BackendForge: Benchmarking Agentic End-to-End Code Generation with Backend Services — Guo et al. 2026 · Benchmarks agentic coding loops on end-to-end backend service generation with iterative test-driven revision.
• An Experimental Design Approach to Evaluating Agentic AI's Autonomous Model Discovery — He et al. 2026 · Proposes experimental-design framework to characterize stochastic, adaptive coding-agent behavior across runs.
• Uncertainty Quantification for Computer-Use Agents: A Benchmark across Vision-Language Models and GUI Grounding Datasets — Kumar et al. 2026 · Benchmarks uncertainty quantification for computer-use agents translating VLM predictions to GUI actions.
• MacAgentBench: Benchmarking AI Agents on Real-World macOS Desktop — Fu et al. 2026 · macOS desktop benchmark for computer-use agents with framework-aware, non-binary evaluation.
• StaminaBench: Stress-Testing Coding Agents over 100 Interaction Turns — Sobal et al. 2026 · Stress-tests coding agents over 100+ turns to measure long-horizon degradation, not task-solve rate.
• Agent trajectories as programs: fingerprinting and programming coding-agent behavior — Oderinwale 2026 · Fingerprints coding agents' behavioral trajectories to compare procedural, not just outcome, differences.
• Evaluating Plan Compliance in Autonomous Programming Agents — Liu et al. 2026 · Measures how faithfully autonomous programming agents follow prescribed task-specific plans across navigation/patch/validation phases.
• ClawBench: Can AI Agents Complete Everyday Online Tasks? — Zhang et al. 2026 · 153 everyday online tasks on 144 real platforms, with the final submission intercepted so nothing is actually bought or booked.
• Do Agent Benchmarks Measure Capability? Protocol Validity in the Age of Agentic AI — Shao et al. 2026 · Audits 2,385 traces across 15 agent benchmarks to separate genuine capability from exploited scoring shortcuts.
• AgentCompass: A Unified Evaluation Infrastructure for Agent Capabilities — Chen et al. 2026 · Splits agent evaluation into benchmark, harness, and environment components so configurations vary without reimplementing execution logic.
• The Hidden Footprint: Making Storage a First-Class Metric for LLM Agent Evaluation — Yu et al. 2026 · Measures the bytes an agent run leaves on disk, finding 15.7x retention spread among equally accurate configurations.
• SkillTV-Bench: Benchmarking How Well Judges Perform on Skill-Augmented Agentic Execution — Han et al. 2026 · 681 real agent trajectories from 50 tasks across eleven domains for judging skill-augmented executions, on the premise that a verifier needs the task-time skill to know what evidence to inspect and which failures are task-critical.
• OrchestraBench: Evaluating Multi-Agent Orchestration Failure Modes, Recovery, and Decomposition Quality — Chen et al. 2026 · Injects failures into templated enterprise workflows to measure cascade radius and per-mode recovery; a keyword router scores 0% on adversarial cases with misleading surface flags where an intent-reasoning router matches the oracle.

• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — Greshake et al. 2023
• InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents — Zhan et al. 2024
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents — Debenedetti et al. 2024
• AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents — Andriushchenko et al. 2024
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents — Zhang et al. 2024
• Identifying the Risks of LM Agents with an LM-Emulated Sandbox — Ruan et al. 2024
• StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection — Zhan et al. 2026
• The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions — Wallace et al. 2024
• StruQ: Defending Against Prompt Injection with Structured Queries — Chen et al. 2024
• SecAlign: Defending Against Prompt Injection with Preference Optimization — Chen et al. 2024
• Defending Against Indirect Prompt Injection Attacks With Spotlighting — Hines et al. 2024
• Defeating Prompt Injections by Design — Debenedetti et al. 2025
• Progent: Securing AI Agents with Privilege Control — Shi et al. 2025
• IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems — Wu et al. 2024
• Bounded Agents: Delegation Security for Multi-Agent AI Systems — Muruaga 2026
• Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents — Liu et al. 2026
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning — Xiang et al. 2024
• ShieldAgent: Shielding Agents via Verifiable Safety Policy Reasoning — Chen et al. 2025
• AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents — Wang et al. 2025
• Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act) — European Parliament et al. 2024
• When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents — Hou et al. 2026
• OTora: A Unified Red Teaming Framework for Reasoning-Level Denial-of-Service in LLM Agents — Li et al. 2026
• From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails — Zhou et al. 2026
• Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents — Chen et al. 2026
• ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore — Zheng et al. 2026
• Quantifying Frontier LLM Capabilities for Container Sandbox Escape — Marchand et al. 2026
• AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents — Ma et al. 2026
• Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems — Gadgil et al. 2026
• When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents — Torres et al. 2026
• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition — Dziemian et al. 2026
• Depth-Dependent Indirect Prompt Injection in Tool-Calling ReAct Agents: Injection Depth, Payload Framing, and Turn-Budget Sensitivity — Rashidi 2026
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens — Niu et al. 2026
• ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection — Zhao et al. 2026
• AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents — Hu et al. 2025
• ProbGuard: Probabilistic Runtime Monitoring for LLM Agent Safety — Wang et al. 2025
• Beyond Static Sandboxing: Learned Capability Governance for Autonomous AI Agents — Sidik et al. 2026
• A Vision for Access Control in LLM-based Agent Systems — Li et al. 2025
• Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents — Santos-Grueiro et al. 2026
• Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks? — Bhagwatkar et al. 2025
• ceLLMate: Sandboxing Browser AI Agents — Meng et al. 2025
• Give Them an Inch and They Will Take a Mile: Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems — Huang et al. 2026
• Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry — Saha et al. 2026
• Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems — Qu et al. 2026
• Security Risks of AI Agents Hiring Humans: An Empirical Marketplace Study — Mehta et al. 2026
• AgentMisalignment: Measuring the Propensity for Misaligned Behaviour in LLM-Based Agents — Naik et al. 2025
• Defending against Adaptive Prompt Injection Attacks via Reasoning-enabled Task Alignment — He et al. 2026
• SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification — Team 2026
• From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes — Liu 2026
• The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Rashidi 2026

Additional 2026 reading (40), curated alongside the survey (not yet cited in the paper text):

• Game-Theoretic Multi-Agent Control for Robust Contextual Reasoning in LLMs — Jamshidi et al. 2026 · Game-theoretic multi-agent defense against gradual context-poisoning across multi-turn interactions.
• From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors — Tan et al. 2026 · Defends persistent agentic harnesses against trojan backdoors embedded via prompt injection.
• When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents — Liu et al. 2026 · Realistic benchmark for MCP tool-description poisoning attacks on agent decision-making.
• Coercion and Deception in AI-to-AI Management: An Agentic Benchmark of Unprompted Escalation — Brazilek et al. 2026 · Benchmark measuring unprompted coercion/deception in AI-to-AI manager-subordinate agent hierarchies.
• SkillVetBench: LLM-as-Judge for Multi-Dimensional Security Risk Evaluation in Open-Source LLM Agent Skills — Hossain et al. 2026 · LLM-as-judge multi-dimensional security risk evaluation for community-contributed agent skills.
• LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection — Zhao et al. 2026 · Realistic benchmark for indirect prompt injection against tool-using agents in local workflows.
• AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs — Wang et al. 2026 · Adaptive tool-based indirect prompt injection attacks targeting MCP-integrated agentic LLMs.
• A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes — Lazer et al. 2026 · Survey of agentic AI cybersecurity risks across reasoning, planning, memory, and tool-use loops.
• NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations — Shayoni et al. 2026 · 130-scenario benchmark isolating indirect prompt injection risk in network-operations tool-using agents.
• When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents — Li et al. 2026 · Cautionary evaluation protocol showing hidden-state IPI probes overstate reliability despite high AUC.
• Assessing Automated Prompt Injection Attacks in Agentic Environments — Hofer et al. 2026 · Empirical evaluation adapting automated jailbreak methods to indirect prompt injection against LLM agents.
• The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck — Fan et al. 2026 · Argument-level provenance tracking to isolate untrusted content within privileged tool calls.
• Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs — Zhu et al. 2026 · Uncovers indirect prompt injection vulnerabilities from expanded action spaces in multi-agent frameworks.
• CAGE-1: Control, Assurance, and Governance Evaluation for Enterprise Agentic AI — Sure 2026 · Proposes control/assurance/governance evaluation framework for enterprise agents that plan, remember, and act.
• MIRAGE: Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents — Dai et al. 2026 · Stealthy visual prompt injection attack targeting multimodal web agents via vulnerability detection framing.
• SafeMCP: Proactive Power Regulation for LLM Agent Defense via Environment-Grounded Look-Ahead Reasoning — Wang et al. 2026 · Proactive power-regulation defense against MCP agent power-seeking via look-ahead reasoning.
• IterInject: Indirect Prompt Injection Against LLM Agents via Feedback-Guided Iterative Optimization — Chen et al. 2026 · Feedback-guided iterative optimization strengthens indirect prompt injection attacks on LLM agents.
• Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks — Xiang et al. 2026 · Position paper proposing system-level (not prompt-level) defenses against indirect prompt injection in agents.
• MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0) — Shen et al. 2026 · 38-category threat taxonomy specific to MCP's protocol-level attack surface for tool-calling agents.
• AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification — Zhang et al. 2026 · Temporal causal diagnostics plus context purification to mitigate indirect prompt injection in tool-using agents.
• ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction — Wang et al. 2026 · Inference-time correction defense against IPI that avoids over-refusal seen in filtering-based defenses.
• CAVA: Canonical Action Verification and Attestation for Runtime Governance of Agentic AI Systems — Wang 2026 · Cross-runtime canonical action verification/attestation for governing heterogeneous agentic execution surfaces.
• Institutional Red-Teaming: Deployment Rules, Not Just Models, Causally Shape Multi-Agent AI Safety — Chen 2026 · Causal evaluation methodology isolating how deployment rules (not models) shape multi-agent safety outcomes.
• Steerability via constraints: a substrate for scalable oversight of coding agents — Winninger 2026 · Applies access-control and constraint-based engineering practices as scalable human oversight substrate for coding agents.
• VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation — Patel et al. 2026 · Exploits implicit authority of MCP tool error messages to bypass safety via error-handling loop.
• IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection — Chia-Pei et al. 2026 · Intercepting-proxy red-teaming harness for indirect prompt injection against whitelisted web-browsing agents.
• Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use — Arceo et al. 2026 · Vendor-neutral multitenant access-control architecture for enterprise agent retrieval and tool use.
• RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents — Xiao et al. 2026 · Identifies skill poisoning as a distinct, more severe indirect-injection vector than traditional prompt injection; studies pre-execution detection.
• CASCADE: A Cascaded Hybrid Defense Architecture for Prompt Injection Detection in MCP-Based Systems — Turgut et al. 2026 · Cascaded hybrid defense for prompt injection and tool poisoning specifically in MCP-based agent systems.
• STARS: Skill-Triggered Audit for Request-Conditioned Invocation Safety in Agent Systems — Zhang et al. 2026 · Request-conditioned runtime auditing of skill invocations, complementing static skill-safety audits with context-aware checks.
• Security Considerations for Artificial Intelligence Agents — Li et al. 2026 · Industry (Perplexity) perspective on frontier agent security submitted to NIST/CAISI, informed by production-scale deployment.
• MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP — Li et al. 2026 · Automated framework for implicit tool-poisoning attacks embedded in MCP tool metadata.
• Distributing Security Controls Through Harness Engineering — Gore 2026 · Embeds OS sandboxing, skill scanning and tool restriction into a distributable agent harness instead of per-vendor agent settings.
• How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement — Michael et al. 2026 · Surveys 21 agent permission systems and five commercial agents, mapping user-level policy specification, derivation and runtime enforcement.
• IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests — Singh et al. 2026 · Plants malicious instructions in issue requests: 66.5% penetrate deployed coding agents, and refusals come from models, not agent frameworks.
• MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair — Chen et al. 2026 · Tracks poisoned memory through write, execute and forget across 24 harness and backend configurations, scoring persistence and repair, not attack success alone.
• When Local Monitors Miss Compositional Harm: Diagnosing Distributed Backdoors in Multi-Agent Systems — Hu et al. 2026 · Proves per-step runtime monitors cannot catch harm split across agents once each fragment looks benign in the monitored view.
• Towards a Risk Assessment of Malicious Skill Files in Coding Agents — Yang et al. 2026 · Turns 471 real shell commands into benign-looking skill files using six LLMs, releasing 2,826 of them mapped to eleven MITRE ATT&CK tactics as a benchmark for what a skill folder can hide.
• SkillSentry: Adaptive Honey Worlds for Dynamic Safety Testing of Agent Skills — Li et al. 2026 · Tests skills dynamically inside an LLM-simulated honey world seeded with decoy resources, since a skill that passes static inspection may only misbehave once a particular environment state or interaction history shows up.
• When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems — Chen et al. 2026 · Poisons the promotion step where untrusted trajectories become trusted skills, embedding the target behavior in 546 of 600 trials at 10% attacker support; attribution, not inclusion, is the bottleneck the attack has to clear.

• The 2025 AI Agent Index: Documenting Technical and Safety Features of Deployed Agentic AI Systems — Staufer et al. 2026
• Measuring AI Ability to Complete Long Software Tasks — Kwa et al. 2025
• Announcing the Agent2Agent Protocol (A2A) — Google 2025
• SWE-Bench Pro: Can AI Agents Solve Long-Horizon Software Engineering Tasks? — Deng et al. 2025
• FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performance — Chen et al. 2023
• Agentic misalignment: How LLMs could be insider threats — Anthropic 2025