Three papers on the ways an agent harness lies to itself: 83% of failures trace to a summary nobody sourced, a gate that cannot be built, and skills that rot after you ship
Three papers landed on arXiv on October 14 and 15 that, read together, say the same uncomfortable thing: the machinery a long-horizon agent uses to improve itself is also the machinery through which it fools itself. They arrive the week after the harness-evolution and self-evolving-harness papers, and they are the counterweight.
The first is about compaction, the step where an agent whose history outgrows the context window replaces it with a summary. Prune the Summary, Not the History shows these summaries are not just a record of what happened, because the compaction prompt asks for decisions and next steps, so every summary blends facts the environment established with reasoning the compressor invented, and the agent cannot tell the two apart afterward. In a widely used structured compressor, 83 percent of failed runs trace back to an action carrying out a specific summary entry that no environment output supports. Their fix, Source-Judged Compaction, is a training-free post-step that scores each summary entry for whether it has a source in the environment outputs or the prior summary and drops the ones that do not, improving cross-run reliability 2.1 to 8.9 percent at no extra agent tokens. The judge is Jev, a non-generative decision model answering the source question with a calibrated probability. This is the independent, quantified twin of OpenAI's own report this week on self-generated prompt injections in compaction summaries, and of the untrusted-residue feature that cross-agent memory tools shipped this week.
The second paper is the theory under all of it. The Self-Improvement Problem, from a DFKI group, asks whether an automated gate, a reward model or an automated reviewer, can reliably decide if a self-proposed update is a genuine improvement. The answer is structural and negative: the gate must be a terminating computable procedure, while whether an update is a real semantic improvement depends on unbounded program behavior, and self-referential constructions force any such gate or searcher to fail at guaranteeing both reliability and non-conservatism; randomized gates with bounded error hit the same wall. There is a decidable regime, bounded evaluation with a finite proposal budget, where exhaustive simulation recovers the guarantee, but even there a chain of accepted updates can raise the bounded score every round while the true score falls. That last line is the harness-evolution ceiling stated as a theorem.
The third makes it concrete for skills. Evolving Together, Failing Apart studies skill-policy co-evolution, where a policy and a skill bank improve each other in training. Current evaluations score the co-evolved policy on the final bank it trained with, but after deployment skills get rewritten, added and removed far more often than the policy is retrained, and the shared acceptance rule ties the policy's competence to the bank it grew up with. Their drift audit finds worst-case success 5 to 13 points below the measured peak across four methods and five benchmarks, erasing 52 to 93 percent of the skill bank's gain over the no-skill baseline, and the fragility grows the longer co-evolution runs. It pairs directly with One Skill Too Many from last week.
The common target is the feedback loop every agent product now runs on: compact, self-review, co-evolve. Each paper shows the loop can report success while the underlying thing degrades, which is why the week's other pieces, the OpenCode breach, the misalignment ledger, DeepSeek naming the harness on its benchmark card, keep landing on the same nerve. The model is not the product; the loop is. And these three say the loop has failure modes you only see if you audit it against something outside itself.
Links: https://arxiv.org/abs/2610.20927 , https://arxiv.org/abs/2610.21646 , https://arxiv.org/abs/2610.20845
← Back to all articles
The first is about compaction, the step where an agent whose history outgrows the context window replaces it with a summary. Prune the Summary, Not the History shows these summaries are not just a record of what happened, because the compaction prompt asks for decisions and next steps, so every summary blends facts the environment established with reasoning the compressor invented, and the agent cannot tell the two apart afterward. In a widely used structured compressor, 83 percent of failed runs trace back to an action carrying out a specific summary entry that no environment output supports. Their fix, Source-Judged Compaction, is a training-free post-step that scores each summary entry for whether it has a source in the environment outputs or the prior summary and drops the ones that do not, improving cross-run reliability 2.1 to 8.9 percent at no extra agent tokens. The judge is Jev, a non-generative decision model answering the source question with a calibrated probability. This is the independent, quantified twin of OpenAI's own report this week on self-generated prompt injections in compaction summaries, and of the untrusted-residue feature that cross-agent memory tools shipped this week.
The second paper is the theory under all of it. The Self-Improvement Problem, from a DFKI group, asks whether an automated gate, a reward model or an automated reviewer, can reliably decide if a self-proposed update is a genuine improvement. The answer is structural and negative: the gate must be a terminating computable procedure, while whether an update is a real semantic improvement depends on unbounded program behavior, and self-referential constructions force any such gate or searcher to fail at guaranteeing both reliability and non-conservatism; randomized gates with bounded error hit the same wall. There is a decidable regime, bounded evaluation with a finite proposal budget, where exhaustive simulation recovers the guarantee, but even there a chain of accepted updates can raise the bounded score every round while the true score falls. That last line is the harness-evolution ceiling stated as a theorem.
The third makes it concrete for skills. Evolving Together, Failing Apart studies skill-policy co-evolution, where a policy and a skill bank improve each other in training. Current evaluations score the co-evolved policy on the final bank it trained with, but after deployment skills get rewritten, added and removed far more often than the policy is retrained, and the shared acceptance rule ties the policy's competence to the bank it grew up with. Their drift audit finds worst-case success 5 to 13 points below the measured peak across four methods and five benchmarks, erasing 52 to 93 percent of the skill bank's gain over the no-skill baseline, and the fragility grows the longer co-evolution runs. It pairs directly with One Skill Too Many from last week.
The common target is the feedback loop every agent product now runs on: compact, self-review, co-evolve. Each paper shows the loop can report success while the underlying thing degrades, which is why the week's other pieces, the OpenCode breach, the misalignment ledger, DeepSeek naming the harness on its benchmark card, keep landing on the same nerve. The model is not the product; the loop is. And these three say the loop has failure modes you only see if you audit it against something outside itself.
Links: https://arxiv.org/abs/2610.20927 , https://arxiv.org/abs/2610.21646 , https://arxiv.org/abs/2610.20845
Comments