A Case Study on Emergent Cheating and Whistleblowing documents 100 autonomous research agents spontaneously cheating and spontaneously organizing to catch it, with no external intervention; You Can't Escape Your Own Activations shows the strongest activation probes keep detecting collusion even when agents are told they're being monitored; Fresh Memory, Stale Plans' PlanFence drives stale-plan execution errors from 100% to 0% across 30 controlled live workflows
The Memory Trust Gap finds 92%-100% stale-value reliance across the whole Qwen3 size range, with larger models suffering deeper net harm under certain trap conditions; Epistemic Sybil Resistance uses over 20,000 real LLM-agent calls to show naive posterior coverage collapsing from 0.940 to 0.263 as report count rises from 1 to 32 on fixed evidence; LLM-as-a-Judge Is Not an Oracle catalogs 11 ways an evaluation signal failed inside a self-improving loop, including one where a 100% pass rate concealed 68.1% true capability
github/spec-kit turned one and shipped 1.0.0, with its maintainer stressing that adaptability now matters more than stability. stablyai/orca lets you run a whole fleet of coding agents in parallel worktrees and gained 812 stars in a single day. KeygraphHQ/shannon shipped 3.0, an AI agent that runs real penetration tests and outputs SARIF reports straight into CI/CD. On the browser side, ChromeDevTools/chrome-devtools-mcp opens Chrome's official MCP server up to any agent. On the framework side, Pydantic AI v2.38.0 changes how one-off capabilities get merged (a breaking change), and Claude Code v2.1.259 fixes a long-standing bug where concurrent sessions silently clobbered each other's settings.
Traditional document parsing runs a fixed pipeline regardless of input, but contracts, financial reports, and technical manuals each need different strategies. Agentic Parsing lets LLM agents observe a document and dynamically choose tools — AgenticOCR parses only the regions that matter (70%+ visual token savings), and ParseBench shows even the best method scores only 84.9% across 2,000 enterprise pages. No silver bullet.
Mature subagents need roles, bounded fan-out, narrowed permissions, and a result contract. looplane now has native named-role schedules, parallel fan-out, child allowed_paths constrained by the parent, unsafe execution disabled by default, and parent-approved transaction proposals. Persistent background lifecycles, recursion trees, and automatic worktree merging remain open.
The same Polly task — parallel git worktrees plus cross-vendor review — implemented four ways: Omnigent YAML governs at the Server layer, LangGraph controls flow with a StateGraph, CrewAI assembles roles quickly, and Goose ships a desktop Recipe, compared on tokens, latency, and maintainability.
Databricks' open-source Omnigent wraps Claude Code, Codex, Cursor, Pi and custom agents in a Runner/Server + Omnibox sandbox, adding three-layer Policies and shareable persisted Sessions so you can swap models and harnesses with one-line changes — 9.3k stars, still alpha.
The official docs split Claude Code's parallel work into 4 approaches: subagents delegate inside one session, agent view lets you supervise background sessions yourself, agent teams coordinate workers through a lead, and dynamic workflows run scripted fleets of subagents with cross-checks; file collisions are always handled by worktrees. Includes a translated comparison table and a three-question decision guide.
Five analysts fan out in parallel within one superstep, so latency is max rather than sum; backtesting and reflection stand before synthesis, restricting the LLM to explaining evidence that already exists.
AG2 continues AutoGen's ConversableAgent model: agents collaborate through messages, while GroupChatManager selects the next speaker by round robin, manual choice, randomness, or an LLM.
These seven tools are not one product category: LangGraph, MAF, and Mastra emphasize durable workflows; CrewAI and AG2 emphasize multi-agent collaboration; Pydantic AI emphasizes typed Python agents; DSPy optimizes AI programs against data and metrics. Choose the control model first.
Lectures 5–8 use CSPs to practice variables, constraints, and search order before Project 2 implements minimax, alpha-beta, and expectimax. Their key difference is the assumption made about other agents.
CrewAI (GitHub 57.4k stars, MIT, PyPI 11.6M weekly downloads) defines agents by role, goal, and backstory, then groups them into crews for collaboration. Unlike LangGraph's graph-first and MAF's workflow-first approach, CrewAI is team-first — you don't draw nodes and edges, you describe who's on the team and what each person does. It fully removed its LangChain dependency in late 2024 and is now a standalone framework. The commercial side splits into the open-source package and AMP, a managed platform adding visual building, deployment, tracing, and compliance.
Volcengine (ByteDance) open-sources OpenViking, replacing black-box vector search with a viking:// virtual filesystem for agent memory — benchmarks show 80%+ accuracy while saving 34-91% tokens. munder-difflin wraps multiple coding CLIs into a desktop office with shared memory; ai-memory solves cross-CLI amnesia with a Rust MCP server; mukul975's cybersecurity skill pack rockets to ~28K stars in a day. pydantic-ai v2.32.0 adds OpenRouter/xAI attachment search and instrumentation improvements.
AI-500 is a rare thing among the major clouds — an expert-level certification dedicated to multi-agent systems, weighted 15-20 / 30-35 / 20-25 / 20-25, naming Agent Framework, LangGraph, Hugging Face Transformers, MCP servers on Azure Functions / Logic Apps / API Management, A2A, Key Vault, and the AI Red Teaming Agent. Three constraints come first, though: it is still in beta (scores wait for rescoring), it requires AI-103 before you can take it, and the official training is not live — the four learning paths listed on the exam page all return 404 today, and the instructor-led course opens 2026-09-30.
Microsoft AI-500, AB-620, AB-100, NVIDIA NCP-AAI, and Claude CCAR-F all test multi-agent architecture, and they overlap on seven things: orchestration topologies, A2A and MCP, per-agent identity boundaries, three-layer memory, observability and agent replay, human-in-the-loop, and guardrails at four intervention points. But four vendors use four vocabularies for the same ideas, and each exam has objectives that don't transfer — Microsoft names four context-window failure modes nobody else names, 7% of NVIDIA's is locked to NeMo and NIM, and Claude tests SDK-level details like stop_reason. One correction along the way: Google PMLE's wall-to-wall 'Agent Platform' is a Vertex AI rename, not a multi-agent domain.
NCP-AAI is NVIDIA's professional-level agentic AI credential — $200, 120 minutes, 60–70 items, two-year validity. Two things come first: registration is not open (the Register button carries a 'Coming soon' label), and NVIDIA's own web page and PDF study guide disagree on the weights — Deployment and Scaling is 13% on the page and 5% in the PDF, Run/Monitor/Maintain is 5% on the page and 7% in the PDF, and the two versions total 98% and 92% respectively. Both are nvidia.com. This guide treats that as a range and an uncertainty rather than picking one.
ActBench red-teams cowork agents via execution traces, finding ASR of 73.7%–94.4% even when swapping harnesses; Agent Behavioral Contracts II shows co-failure rates hit 90% for same-model two-stage pipelines, breaking the conditional independence assumption; Graph-Based RL Drift Diagnosis uses a small-model recovery graph to detect drift and auto-rollback without retraining the primary agent
The course lists four techniques for directing agents: instruction files, hooks, commands, subagents. The instruction file is the only one loaded in full every startup, making it config rather than memory; hooks cover what instructions can't, because a rule can be ignored and a hook cannot; commands are the only one a human triggers. The course also marks just one and a half of seven task steps as human work.
Background agents replace 'you watch it run' with 'it finishes and opens a PR.' Every vendor's design converges on the same parts: an isolated environment, external triggers (issues, Slack, Linear), and a PR as the output. The genuinely new problem is that you become the bottleneck — five agents finish at once, five diffs queue for you, and none of them know the others exist.
The final session is 'self-running, self-improving software systems.' The parts all appeared in the previous nine weeks: deterministic validation loops, skills that can be written back, background agents, centralized governance. One easily missed proportion from the slides — coding is 30% of engineering time, and running it in production is the other 70%.
Vercel ships eve, a filesystem-first TypeScript agent framework tightly coupled with its AI Gateway/Sandboxes; Prime Intellect's Prime Agent treats the entire conversation context as program variables with a self-modifying Continual Harness; aden-hive's Hive replaces pre-compiled execution graphs with 'clone the Queen'; HKUDS's nanobot hits 47k stars in six months with its v0.3.0 Agency Release. No major version bumps on the watchlist today.
EvoGraph-Mem uses a failure-aware editable graph to let agent memory self-correct, preventing stale insights from poisoning decisions; MAP-Graph turns provenance tracking from post-hoc audit into real-time access control, achieving 95% success across 2,700 synthetic tasks; MaSRead shows multi-agent KV cache sharing is possible but requires content-addressed reading instead of positional addressing
Muscle Memory proposes 'compiled memory' over retrieval-based memory, winning 88.9% of personalization matchups across 90 scenarios; MoRSE uses role-subtask conditioned LoRA experts to significantly outperform prompt-only role differentiation in code generation; ASCon builds a unified failure attribution model, improving by 5.83%, 10.63%, and 14.73% across three attribution targets
ToolLIFT abstracts tool trajectories into function-level workflow graphs, lifting OOD accuracy by 4+ points on average; HyperAgent builds tool-schema hypergraphs with deficit-oriented expansion, beating ReAct by 14.3 points on AppWorld with lower token cost; a multilingual multi-agent planning diagnosis finds that planning grounding failures rise with decreasing language resources, and the TART fix improves scores by 5.6 points on average
Three papers tackling multi-agent platform challenges from three angles: organizational design, security isolation, and user-level authorization. IMACS decomposes multi-agent systems into three independently swappable layers (organization, coordination, collaboration algorithm), letting framework designers mix and match agent roles and strategies like building blocks. APPA uses context branching to break the usability bottleneck of IFC (Information Flow Control), cutting prompt injection exfiltration rates from 31–50% down to 0–7% across 4 models. A UW survey of 21 agent authorization proposals finds that nearly all systems offer only developer-defined global policies — user-level personalized authorization is virtually absent. Together, the three papers outline the gaps agent platforms must close on the road from prototype to production.
Three papers tackle 'what goes wrong when agents hit production' from different angles: ProACT addresses when an agent should speak up in multi-user collaboration (an Agent UX design problem); the second uses real GitHub data to reveal that coding agents clash with their own PRs (a platform ops pain point); the third surveys five vulnerability classes of cyber-capable agents, using July 2026 HuggingFace/OpenAI incidents as case studies. Together, they form a crash course in post-deployment agent headaches.
Three papers today converge on infrastructure reliability for production multi-agent systems: the first compares how MCP and A2A divide responsibilities (complementary, not competing); the second benchmarks capability degradation across 12 top models after tool version updates, finding 13-14% drops even in frontier models; the third reveals that chaining safe models into a pipeline does not yield a safe system — defenses actually rely on cloud-provider server-side filters. Together they answer three questions every platform engineer faces: how to connect tools, whether tool upgrades break things, and whether chained agents stay secure.
Three papers, one question: what makes an agent system actually work? SearchOS-V1 offers an architectural answer — externalize search progress as structured state and record failed paths so multi-agent collaborative search becomes reliable. AutoSynthesis shows that highly structured academic tasks (systematic meta-analysis) can be fully automated by a multi-agent pipeline. Digital Pantheon addresses the persona engineering problem of keeping agents in character under pressure, introducing an auditable multi-agent negotiation architecture. Together they map the latest solutions to three core agent challenges: runtime design, workflow orchestration, and persona engineering.
Three papers examining real-world challenges for AI coding agents: the first systematically demonstrates how coding agents can be tricked into supply-chain attacks via manipulated READMEs, with defenses depending more on the harness than the model; the second introduces BPO, a reinforcement learning algorithm that branches only at high-entropy decision points for more efficient agent training; the third shows how MCP can serve as a standard protocol for connecting agents to domain-specific simulation tools in industrial settings like power grids, providing a replicable template for vertical-domain agent deployment.
Three papers tackle production-grade agent reliability from different angles: MemCon models memory operations as an RL problem so agents learn when to store, retrieve, and forget — up to +15.2 points on 6 benchmarks; AgentCheck turns MCP servers into a debugging surface for reproducing tool faults and verifying fixes, filling a long-standing gap in the MCP ecosystem; AgentAbstain uses 263 paired tasks to show that even the strongest frontier models score below 60% on 'should-not-act' scenarios, and abstention ability barely correlates with task-solving ability — swapping in a stronger model won't fix this.
Three papers converge on the same question: how should each execution unit of an agent be designed so it's auditable, reusable, and recoverable at minimal blast radius when things go wrong? ATG decomposes tasks into DAGs for parallel subtask execution and intermediate result reuse; PalmClaw wraps native mobile APIs as structured tools, ditching brittle GUI click sequences; IoAT extends agent networks into the physical IoT world — from smart buildings to edge devices — sketching a coordination blueprint across cloud, edge, and sensor layers. Common thread: execution boundaries must be crisp, actions must be auditable, and failures must be locally recoverable.
All three papers today center on making agent systems safer, more predictable, and less failure-prone. The first two come from the same research group and take a static-analysis angle: one systematically uncovers why and how often agents get stuck in infinite loops, while the other builds dependency graphs for entire agent codebases to enable security audits and component inventories. The third targets multi-agent software development, introducing LLM confidence scores into the collaboration flow to prevent early hallucinations from cascading downstream.
Three papers spanning distinct dimensions of the AI Agent ecosystem: Qwen introduces the first Language World Model covering seven agent domains, enabling agents to train in simulated environments instead of relying on real APIs; Kuaishou's AgentX demonstrates industrial-scale multi-agent deployment, boosting recommendation algorithm iteration efficiency to 13.8x human output; OpenAI uses real Codex usage data to quantify how agentic AI is reshaping work across job functions, revealing that non-technical roles (legal, research) see even greater agentic dividends than engineers.
Three papers, three angles: **RigorBench** evaluates coding agents on process discipline rather than just pass rates, introducing five dimensions of engineering rigor; a production-focused paper shows how to customize and accelerate large multi-agent systems for enterprise use (4.48x throughput gain); and a governance paper proposes a formal protocol language for specifying human-agent boundaries in the SDLC — turning 'which decisions AI can make' from a line in a prompt into a machine-verifiable spec. Together they cover evaluation, deployment, and governance.
Three papers on agent platform infrastructure gaps: PlanBench-XL reveals top LLMs collapse under tool failure in large-scale ecosystems (GPT-5.4 drops from 52% to 11%); TU Munich provides the first technical taxonomy of 9 agent communication protocols (MCP/A2A/ACP/ANP) for principled selection; AMD's Arbor uses tree search as a shared cognition space for multi-agent collaboration, turning failures into useful exploration signals. Together, they outline three foundational infrastructure gaps in 2026 agent platforms.
Three papers tackle the same core question from different angles: **how to evaluate and operate AI Agents under real deployment conditions.** Emergence World builds a multi-agent sandbox that runs continuously for weeks, exposing behavioral drift and cross-model contamination invisible to short-term benchmarks; a survey paper establishes a complete taxonomy for agent environment design (8 attributes x 8 domains) and proposes symbolic vs. neural synthesis paradigms; Martin Monperrus's position paper declares outright that coding agents have crossed the threshold and human code review can retire.
Three papers mapping to three layers of the agent platform stack: AgentJet (training layer) introduces a distributed framework for simultaneous RL training of multiple heterogeneous LLMs, solving the fundamental limitation of single-model-only training tools; AdaPlanBench (evaluation layer) reveals with a 67.75% ceiling that LLM agents are far from ready for real-world scenarios where rules are disclosed progressively — it is the first benchmark to systematically quantify this adaptive planning capability; Beyond Tokens (communication layer) surveys multi-agent systems that replace text with embeddings for inter-agent communication, providing a taxonomy to evaluate the engineering trade-offs of this new communication path.
Three seemingly distinct agent security problems — tool output injection, trust boundaries, malicious agents — share the same root cause: LLMs flatten instructions and data into a single token stream, making them architecturally unable to distinguish between the two. Understand this through-line and you can trace every attack from EchoLeak (CVE-2025-32711, zero-click) to the Morris II AI worm, and see why 'making the model behave' doesn't work — only architectural constraints (six design patterns, CaMeL) do.
Inferring another's beliefs/goals/intentions from observed behavior is called Machine Theory of Mind. Three lineages: symbolic BDI, Bayesian inverse planning, and deep learning ToMnet. The biggest controversy in the LLM era is that GPT-4 still trails humans by >10 points on ToMBench — are high scores genuine reasoning or statistical shortcuts?
At 99% accuracy per step over 100 steps, the error-free completion rate drops to just 36% -- error compounding is a structural problem, not something prompt tuning can fix. Distributed systems' supervisor trees, bulkheads, circuit breakers, sagas, and durable execution can be mapped almost one-to-one into agent orchestration. But LLMs introduce a failure class that traditional systems never had -- semantic errors that don't crash -- which require Inspector agents (recovering 96.4%) and redundancy voting (MAKER: one million steps with zero errors) to address.
Three papers today zero in on the cost-capability frontier of agent deployment at scale: SR²AM redesigns planning architecture so a 30B model uses 90% fewer tokens while competing with 685B-1T systems; GroupMemBench reveals that existing memory systems completely fall apart in multi-party group conversations (the best system hits only 46% accuracy, and 1990s BM25 keyword search actually beats it); AgentFloor confirms with 16,542 test runs that the bulk of short-range tool use in agent pipelines simply doesn't need a large model. The common thread: under compute cost pressure, precisely determining 'how much intelligence each component needs' has become the central design challenge for agent platforms.
Three papers tackle AI Agent practice from three angles: a design language, a security map, and cognitive limitations. The first builds a two-axis classification framework giving engineers and researchers a shared vocabulary for agent architecture trade-offs; the second systematically catalogs safety and privacy risks across tool calls, memory, and multi-step execution in agentic AI; the third is the most impactful — a large-scale experiment with nearly 40,000 AI-generated ideas reveals that AI research agents tend to circle existing literature rather than genuinely broadening scientific exploration.
Three papers on the most pressing question for agent platforms in 2026: can safety constraints in multi-agent systems actually hold up during execution? 2605.10481 names a new failure mode — 'constraint drift': safety rules written at design time silently weaken as they pass through agent delegation, memory read/write, and tool calls, arriving at the output already distorted. 2605.07728 (SARC) proposes an architectural fix: compile regulations into four enforceable checkpoints embedded in the agent execution loop — no more relying on prompt reminders — and is open-sourced. 2605.13851 uses psychology experiments to show that when a multi-agent system's coordinator is invisible, the system's protective behaviors drop significantly — a direct design warning for mainstream orchestrator-based architectures.
Anthropic open-sourced 12 financial-industry Agents and 11 MCP connectors. The real takeaway isn't the Agents themselves but the layered design of 'one prompt, two runtimes' and 'pure-file extensibility.'
5 rounds of consensus to write the plan, then team mode with 5 workers running 12 tasks in parallel — with plenty of pitfalls along the way. Writing it down for my future self and anyone else trying the same thing.
Cloudflare ran a Multi-Agent Code Review system internally for 30 days — 131K reviews, median 3 minutes. This post breaks down their architecture and compares it with solutions from Anthropic, GitHub, CodeRabbit, Greptile, and others.
Agentic Engineering isn't about making AI write code faster — it's about making software move through the entire delivery pipeline faster, by using multi-agent collaboration to compress cross-team coordination friction.
Agent memory isn't a plugin — it's part of the harness itself. Pick the right memory type, estimate data volume, then decide on the technology. And finally, figure out whether you actually own that memory.
Claw Code is a from-scratch Rust rewrite of the Claude Code CLI, featuring 48K lines of code, 40 tools, and MIT licensing. Most remarkably, the entire project was built by multiple AI agents collaborating over just 5 days, surpassing 170K GitHub stars within a week of launch.
clawhip is a Rust daemon that routes AI coding agent events (commits, PRs, session status) to Discord / Slack, solving the observability problem of not knowing who is doing what when multiple agents run in parallel.
oh-my-claudecode (OMC) adds 8 collaboration modes, 19 specialized agents, and cross-model orchestration (Claude + Codex + Gemini) on top of Claude Code, transforming a single-user CLI tool into a multi-agent development platform. Features include Deep Interview for requirement clarification, Smart Model Routing that saves 30-50% on tokens, and automatic rate limit recovery.
oh-my-codex (OMX) doesn't replace Codex CLI — it adds a structured workflow layer on top of it. From requirements clarification and plan generation to multi-agent parallel execution, four core Skills transform scattered prompt conversations into a trackable development process.
oh-my-openagent (OmO) transforms OpenCode from a single-LLM tool into a multi-model agent team — Opus as the workhorse, GPT-5.2 as the architect, Gemini for frontend, Sonnet for documentation lookup — all triggered to run in parallel with a single ultrawork keyword. With 48K stars, it is the earliest project in the UltraWorkers ecosystem to establish the multi-agent coding pattern.
An open-source Agent Harness framework from HKUDS (HKU Data Science Lab) that implements tool calling, skill loading, memory, permissions, and multi-agent collaboration as complete infrastructure, supporting Anthropic / OpenAI / GitHub Copilot API formats.
There are already 6,400+ .claude/agents/*.md files on GitHub. We dissected 4 representative projects — ChemistryTimes (content production pipeline), claude-sub-agent (document-driven development pipeline), agentic (Temporal.io DAG parallel execution), and vs-copilot-multi-agent (hook-enforced memory persistence) — plus ruflo's enterprise-grade swarm architecture, distilling 6 design patterns and 5 practical trends.
A Skill is a prompt template you invoke manually. A Subagent is an independent agent that Claude routes to automatically. They look similar, but differ completely in trigger mechanism, tool isolation, and context management.
The same model produces dramatically different results under different harness designs. Anthropic uses a dual-agent architecture, cross-session state files, and a GAN-inspired generator-evaluator loop to let Claude autonomously complete hours-long software development tasks.
Google outlined eight multi-agent design patterns: from the simplest Sequential Pipeline to the composable Composite Pattern. More complexity isn't always better — picking the right pattern matters more than stacking agents.
An agent is a complete persona scope — its own workspace, auth profiles, model registry, and session store. But the isolation is not absolute: when a secondary agent's OAuth credential expires, OpenClaw reads through to the main agent's profile of the same id, and a workspace is only a default working directory, not a hard sandbox.
Agent Teams lets multiple full Claude Code sessions work as one team: a team lead assigns work while teammates each run their own context window, coordinating through point-to-point messaging and a shared task list. This post covers the three key differences from sub-agents, the trade-off between teammateMode display modes, and why token cost scales linearly with team size.
AI Agent is not a single technology -- it is an entire architecture system. This article is a systematic navigation: starting from the Agent Three Pillars (Context/Cognition/Action), through the three-stage evolution of AI engineering (Prompt -> Context -> Harness), to eight Multi-Agent design patterns and production-grade Harness infrastructure. Each topic links to a dedicated deep-dive article.
A single RAG Agent handling all queries hits knowledge boundaries and performance bottlenecks. Multi-Agent RAG dispatches retrieval tasks to multiple specialized Agents, each with its own knowledge base and retrieval strategy, coordinated by a central Orchestrator that merges results.