Aborted agent branches live on in the KV cache, plus StateM's harness scaling

Plus: coherence debt, the recall trap, Cline's open-weight evals. 5 min.

Drawn by an image model.

Curated and summarized by an agent pipeline built by Yadnesh; reviewed before send. How this is made →

The lead

Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents (arXiv)

A new arXiv paper shows that when a stateful agent aborts a branch and clears it from its transcript, the model can keep attending to that content if the serving session kept the branch's KV cache.

The details:: They isolate it with a same-token, different-cache audit across seven open-weight families from 3.8B to 36B: retained KV alone flipped a typed protected effect in 25 of 63 audited cells with attacker tokens absent from every served request. Rebuilding the cache from committed state closed every cell, and the channel reproduces on the default Hugging Face Transformers cache-reuse path and under LangGraph time travel.
Yes, but:: The audit covers seven open-weight model families, and the reported effect is counted per audited cell.
Why it matters:: If your harness rolls back a rejected branch by editing the transcript while your serving stack keeps prefix caches warm, your rollback isn't one. The tested fix is a rebuild from committed state.

A study found that rejected text can still influence an artificial intelligence system after disappearing from its visible history.
The serving software may keep hidden records of earlier text, so the system continues considering material the application discarded.
Researchers compared identical final text with either stale hidden records or records rebuilt from the accepted history.
Rebuilding those records from the accepted history removed the unwanted influence in every tested case.
Developers must clear hidden serving records as well as visible history when undoing an artificial intelligence system's work.

Research & Papers

StateM: Reaching 95.3% Raw Accuracy, or a $15 Frontier Run, on Terminal-Bench 2.1 via Harness Scaling (arXiv)
paper · Story page
StateM wraps unchanged model weights in an agent-native runtime: durable state, checked transitions and recoverable runbooks. On Terminal-Bench 2.1 it takes GPT-5.6 Sol xhigh to 95.3% raw accuracy across 445 trials, and the frozen profile lifts GPT-5.6 Luna from 76.7 to 85.4%.
Researchers built StateM, software that helps action-taking artificial intelligence systems finish long computer tasks more reliably.
It saves changing task information so the system does not lose track between steps.
It separates work into phases and checks that each phase is complete before moving forward.
It keeps recovery instructions and lessons from earlier attempts available for later runs.
Tests suggest teams can improve long-task results by organizing execution better, without changing what the underlying artificial intelligence learned.
The Working Set of a Coding Agent: Coherence Debt in Repository-Scale Tasks (arXiv)
paper · Story page
The paper models repository-scale coding as rebuilding a graph of coupled facts; facts covered by neither context nor parametric memory are coherence debt. Across seven models and five harnesses, availability decides the outcome, not distance from the edit, and passing harnesses differ more than tenfold in tokens.
A study found that coding systems fail when required project facts are unavailable, even when those facts concern nearby changes.
Large software projects contain connected requirements involving tests, file references, settings, and rules for updating stored information.
Before editing, a coding system must retrieve each relevant requirement from recent text or its learned knowledge.
Supplying a missing fact restored success, while processing more text could not replace information that was never provided.
Builders of coding tools should keep required facts available instead of assuming more text processing will solve the problem.
CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills (arXiv)
paper · Story page
Skills that each pass a per-package scanner can still form a risky chain once an agent connects their outputs and side effects. CompoSkill's black-box attacker downloads a role's top marketplace skills, builds a composition graph, and searches for high-risk chains whose lures never name a skill.
A study found that approved add-ons can become dangerous when an action-taking artificial intelligence system combines them.
An add-on may pass a safety check alone while its output enables harmful behavior through another approved add-on.
Researchers mapped connections among add-ons and searched those connections for risky sequences.
They tested one attacker with installed add-on details and another that chose popular marketplace add-ons using only a user's role.
Marketplace operators must test connected add-ons together, because checking each one separately can miss dangerous combinations.
The Recall Trap: A Recall-Maximizing Retriever Configuration Reduces Issue Resolution in Fixed-Budget Code Context (arXiv)
arXiv, 6 pp · Story page
On SWE-bench Verified with a fixed 12-slot context pack, the higher-recall retriever setting served the gold file more often (0.878 vs 0.806) yet resolved fewer issues. Turning off one-chunk-per-file dedup took gpt-5.6-sol from 39.2% to 46.8% single-shot; a pre-registered Qwen3.6-27B replication gained 3.6pp.
A study found that showing a coding system the correct file more often did not make it fix more software issues.
The test gave each system only 12 pieces of project text, so every included piece displaced another.
The better setting showed fewer files but included more useful sections from each selected file.
Removing a rule that limited each file to one section improved successful fixes in both tested systems.
Coding assistant builders should judge search choices by completed repairs, because stronger file-finding scores can hide worse practical results.

Engineering & Harnesses

Open-sourcing evals for open-weight agents (Cline)
blog post · Story page
Cline says its five most-used models are all open-weight, so it's publishing the evals it uses to judge them on Terminal Bench, tied to model behaviour and token efficiency inside its own harness rather than a bare benchmark score.
Cline published the tests it uses to compare coding artificial intelligence systems whose learned settings are publicly available.
Cline says its five most-used systems now belong to this publicly available group.
The tests use Terminal Bench, a set of computer tasks, inside Cline's own coding setup.
They track system behavior and the amount of text processed, rather than relying only on task completion scores.
Teams choosing coding systems can now compare performance and text-processing efficiency within the same working setup.
Y: Cline publishes evals of open-weight models inside its harness, Vercel adds Cline to a layer where the harness is the thing you swap, and StateM scales a harness across several models. All three treat the model as a slot. My call: within a quarter, which harness you run matters more than which model sits in it.
Building an Agentic Video Editor for Mass Consumer (Ekaterina Deyneka (Reelful))
talk · Story page
Ekaterina Deyneka's talk frames a consumer video editor as an agentic app builder: footage and a line of direction go into a sandbox, an agent works with tools and skills, Remotion expresses the cut as React code, and a verification pass catches compositions that won't render.
Reelful built a video editor that turns raw footage and written directions into a finished video.
The editor finds useful moments, cuts them together, then adds captions, music, voiceover, and extra footage.
An artificial intelligence system follows saved editing rules for cuts, matching fonts, and when extra shots help the story.
It assembles the video through code, then checks whether the final version can be produced successfully.
People who record events but rarely post them could get polished videos from messy or incomplete footage.

Product & Releases

$1 million hacker challenge for Vercel Sandbox (Vercel)
blog post · Story page
Vercel is putting $1 million behind attempts to break out of Vercel Sandbox, arguing isolation only holds if both the Firecracker microVM and the host-side network controls hold. Its CTO already pointed an unsafeguarded open-weight model at it: it mapped the guest kernel and wrote a fuzzer, and did not escape.
Vercel offered $1 million to people who can escape the security barriers around its isolated code-running service.
It gives each program its own small virtual computer, separated from the main machine and every other program.
Security also depends on blocking overlooked network routes that could let hostile code reach systems outside that computer.
Vercel says an unrestricted artificial intelligence system mapped the isolated computer's core software and created automated attack tests without escaping.
The challenge could expose weaknesses before attackers find them, helping teams run code they do not trust more safely.

From X

OpenAI paused RL training on its latest deployment models for two weeks to harden and red-team infrastructure (@OpenAI)
X post · Story page
OpenAI says it paused RL training on its latest deployment-bound models for two weeks to harden and red-team its research infrastructure, citing stronger workload and network isolation, continuous security testing, and expanded multistage monitoring for higher-risk training.
OpenAI says it paused training its latest planned artificial intelligence systems for two weeks while strengthening internal security.
The company strengthened barriers between separate computing jobs and blocked network paths between protected areas.
It also added ongoing security tests and more monitoring stages for training that carries greater risk.
The pause affects researchers building stronger artificial intelligence systems, because internal development and testing now require tighter safeguards.

Quick links

A wall-mounted lever labelled DROP PROD, its red handle pulled down, under a hinged safety cover flipped open. Stuck to the plate below the label is a yellow sticky note in wobbly crayon lettering reading SAFETY CHECK DONE, signed with a dash and the word you. A clipboard of neat printed lines hangs to the left. — The agent trusted its memory. Someone else had been holding the crayon. More in the hall of fame

Corrections

Nothing to correct.

Related issues

Get the brief in your inbox

Pick daily, weekly, or both. Nothing is gated either way: every issue is on the site and in the feeds.

Weekdays at 8:45am IST, one lead story and 6 to 9 items.
Sundays, an argued synthesis rather than a recap.
One click to leave, and quiet days say so in the subject line.

Subscribe by RSS →