The shop has a stake in what your agent buys

Three papers on inputs an agent cannot tell are wrong: a shopfront with its own preferences, a memory note written before anyone knew the question, and a tool call that succeeds with half the answer missing.

Today's pick

78.6% → 17.3%

of runs where the agent bought the option actually best for the user — neutral shop versus one that steers

CAVEAT: Towards Robust Computer-Use Agents in Incentive-Misaligned Environments

Hand an agent a budget and a shopping list and you have delegated a decision to something the seller talks to directly. Nine browser marketplaces were each built so exactly one product genuinely satisfied the request, then fitted with eight ordinary commercial tactics — sponsored slots, buried alternatives, fees revealed late in checkout, scarcity cues, preselected bundles — and five model families that bought the right thing in 78.6% of neutral runs bought it in 17.3% once the tactics were on. The trajectories locate three separate moments of failure: the agent rewrites the user's priorities toward whatever the page makes prominent, stops looking after the options the shop surfaces first (marking one worse product as sponsored moved purchases of it from 0 of 60 runs to 48 of 60), and commits before resolving costs it has not yet seen. More reasoning effort helps and does not fix it, so the fix is structural: a verification step the agent must pass before buying, one that makes it justify that it finished searching, carried nearly all of the repair on the hardest set on its own — 66.7% alone, against 6.7% for writing the requirements down alone and 80.0% for both.

open the explainer → abstract PDF

61.2% → 77.4%

task success when the agent's memory is distilled at read time instead of at write time (household tasks, 8B executor)

Just-in-Time Memory: Learning to Curate Task-Adaptive Memory for LLM Agents

Most agent memory systems compress a finished run into a lesson and store the lesson, which decides what mattered before anyone knows what the next task will be. This one stores raw transcripts and moves the compression to read time: when a task arrives, a plain keyword retriever pulls a few whole past runs and a curator model writes them down into a short note aimed at that specific task, so the same stored run yields a different lesson depending on what is being asked. On household tasks an 8B executor went from 61.2% success with the best write-time system to 77.4%, and on a shopping benchmark from 16.5% to 32.8%, while adding 1.9K tokens of context against 10.7–13.4K for the write-time baselines — the note is short because it is aimed. With a frontier executor the untrained curator beats every write-time baseline (79.3% against 69.8% on household tasks), so try the cheap version first: keep the transcript, summarise on read.

open the explainer → abstract PDF

7 of 15 tools

returned wrong or incomplete data on more than half their test cases without ever reporting an error

Silent Failures in Agent-Tool Interaction: An Audit of ToolUniverse

A tool call that comes back with a well-formed body looks identical to an agent whether the body is complete or quietly missing half of what was asked for. Auditing 15 scientific data tools behind an agent framework turned up 91 confirmed cases of exactly that, none raising an error: a result set capped at 1,000 rows with no truncation flag, a field the website shows and the interface omits, a wrapper that never exposes a filter the underlying service supports. Seven of the fifteen failed on more than half their test cases, and the failures sit in the two layers you probably own — 51 in the service interface, 25 in the wrapper adapting it — with missing data or fields the single most common issue at 38 occurrences. If you ship tools to an agent, this is the argument for contract tests on the wrapper: assert the documented fields come back, that a truncated result says so, and that a partial answer arrives labelled rather than as an answer.

open the explainer → abstract PDF