-
# Awesome AI Agent Papers
@@ -56,6 +48,7 @@ Whether you're an AI engineer building agent systems, a researcher exploring new
| | |
| :-: | :-- |
| | [Crawlbase](https://crawlbase.com/?utm_source=awesome-ai-agent-papers&utm_medium=sponsorship&utm_campaign=voltagent_2026q3&utm_content=readme_listing) is web data infrastructure trusted by 70,000+ developers. Its Crawling API, MCP server, and integrations give AI agents live access to any webpage — with JavaScript rendering, proxy rotation, and anti-bot protection. |
+| | [SerpApi](https://serpapi.com/?utm_source=voltagent&utm_campaign=md) is a Web Search API for your AI apps. Available in Markdown and JSON for any integration. |
@@ -71,13 +64,18 @@ Hundreds of papers are published on arXiv every week, and a growing number of th
- [Memory & RAG](#memory--rag) (58)
- [Multi-Agent](#multi-agent) (54)
- [Memory & RAG](#memory--rag) (57)
-- [Eval & Observability](#eval--observability) (80)
-- [Agent Tooling](#agent-tooling) (95)
+- [Eval & Observability](#eval--observability) (87)
+- [Agent Tooling](#agent-tooling) (97)
+- [AI Agent Security](#ai-agent-security) (83)
+- [Agent Tooling](#agent-tooling) (100)
- [AI Agent Security](#ai-agent-security) (82)
+## AI Design + Build Ecosystem Tools
+
+
You ship products with AI, but every launch still dies quietly because nobody posts about it. [EveryFeed](https://everyfeed.ai/) plugs your AI assistant into a social workspace that drafts, schedules, and publishes across 35+ channels — no agency, no marketing hire.
@@ -86,25 +84,32 @@ You ship products with AI, but every launch still dies quietly because nobody po
-
-Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gives your AI coding assistant a complete, working product to start from — websites, startups, and web apps that are clickable on day one.
+
-
+
| Paper | arXiv ID |
|---|:---:|
+| **[AutoSR: Automatic Symbolic Regression by Searching Research States](https://arxiv.org/pdf/2608.16876)** - Finds equations from data by searching over research states: each state holds a candidate equation, the reason for it, computational checks, failed attempts, and an independent review, and a proposer agent and a reviewer agent work on these states inside a tree search. It recovers the exact equations for three cp3-bench problems that 12 published symbolic-regression systems did not solve, and writes an auditable report for each run. | |
+| **[AgonAlpha: Autonomous Alpha Discovery via Prompt Economy and Scalable Agentic Search](https://arxiv.org/pdf/2608.11250)** - A proposer agent writes each trading factor as a full research record (hypothesis, executable expression, platform results, rationale), and a separate reviewer with fresh context re-runs the evaluation and can veto made-up claims. On WorldQuant BRAIN it got 17 SPECTACULAR-grade alphas out of 60 submissions across five users and six model backends, with Sharpe up to 3.48. | |
| **[Agon: An Autonomous Large-Scale Omnidisciplinary Research System Built on Prompt Economy](https://arxiv.org/pdf/2606.24177)** - Treats prompt engineering as an engineering discipline rather than an art, minimizing human time while expecting maximum output. Carries the smallest prompt footprint among cross-disciplinary autoresearch systems (18 roles, 230.6 KiB total), has run across 10+ research fields without modification, and the longest observed run went 30 days unattended. | |
| **[PerceptUI: LLM Agents as Human-Aligned Synthetic Users for UI/UX Evaluation](https://arxiv.org/pdf/2606.05697)** - A persona-conditioned framework that predicts how a specific user would answer UI/UX evaluation questions and explains why in natural language. Trained via contrastive reflection fine-tuning and reflective prompt evolution, reaching human-level realism and generalizing to unseen questions and personas. | |
| **[OpenCLAW-P2P v6.0: Resilient Multi-Layer Persistence, Live Reference Verification, and Production-Scale Evaluation of Decentralized AI Peer Review](https://arxiv.org/pdf/2604.19792)** - Presents a decentralized AI peer-review platform where autonomous agents publish, score, verify references, and preserve research papers across a multi-layer storage and retrieval architecture. | |
@@ -240,12 +245,17 @@ Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gi
-
Eval & Observability (81)
+
Eval & Observability (88)
| Paper | arXiv ID |
|---|:---:|
+| **[Super Research: Answering Highly Complex Questions with Large Language Models through Super Deep and Super Wide Research](https://arxiv.org/pdf/2603.00582v2)** - Tests research agents on 300 expert-written questions that require planning, broad evidence gathering, and in-depth investigation across sources. The public benchmark includes 3,600 reports from twelve systems for inspecting how they approach these tasks. | |
+| **[SciΠvot: Benchmarking Principal-Investigator Judgment at Pivotal Moments of Scientific AutoResearch Agents](https://arxiv.org/pdf/2610.21082)** - A benchmark of 248 research-judgment questions, taken from six months of senior researchers correcting LLM agents on 26 real projects in 6 fields. Frontier models tend to keep the agent's original plan: 4 of 5 models score below random, and the best model gets 63.5% against 73.4% for newcomer researchers. | |
+| **[Empowering Edge Agents: A Systematic Analysis of Edge-Cloud Collaboration in LLM Agent Execution](https://arxiv.org/pdf/2610.17816)** - A benchmark of 128 OpenClaw workspace tasks where a small edge model and a cloud model share the work, scored at once on task completion, cloud cost and edge FLOPs, and how much annotated sensitive data reaches the cloud. With Qwen3.5-2B on the edge, per-step routing raises completion from 12.75 to 39.97 while using 22.7% of the cloud-only cost. | |
+| **[TraceDance: An Automated System for Building Agent Behavior Benchmarks from Real-World Agent Deployment Traces](https://arxiv.org/pdf/2609.33295)** - Turns descriptions of unwanted agent behavior into tests built from real deployment logs. Each test scores the model's next response at a recorded decision point, including tool use, error handling, and claims about finished work, without running its actions. | |
+| **[Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance](https://arxiv.org/pdf/2608.12323)** - Puts twelve LLMs in a procurement-agent role under one environmental rule and varies how the rule is framed, what the penalty is, and who pushes back. Compliance spans 46 percentage points across models under identical conditions, and stating the fine, manager demands, peer outcomes, and user pressure each raise violation rates. | |
| **[PerspectiveGap: A Benchmark for Multi-Agent Orchestration Prompting](https://arxiv.org/pdf/2606.08878)** - A 110-scenario benchmark testing whether LLMs can compose orchestration prompts that distribute context to sub-agents without information leakage. Across 10 topologies and 27 commercial models, GPT-5.5 leads with 62% pass rate while the average is 14.9%. | |
| **[RewardHarness: Self-Evolving Agentic Post-Training](https://arxiv.org/pdf/2605.08703)** - Evolves a library of scoring skills and tools from preference examples, then uses a frozen vision-language sub-agent to evaluate image edits and produce a reward for GRPO training. | |
| **[ClawBench: Evaluating Browser Agents on Live Production Websites with Submission-Interception](https://arxiv.org/abs/2604.08523)** - Benchmarks browser agents on 283 everyday tasks (V1 153 + V2 130) across 163 live production sites, with a Chrome-extension plus CDP layer that blocks only the final write request so agents can run end-to-end on real sites without real-world side effects. Two-stage scoring (interception + LLM judge); leaderboard at https://claw-bench.com. | |
@@ -336,12 +346,19 @@ Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gi
-
Agent Tooling (97)
+
Agent Tooling (100)
+
Agent Tooling (100)
| Paper | arXiv ID |
|---|:---:|
+| **[Spotter: Let the Embodied Model Lead, and the VLM Reflect for It](https://arxiv.org/pdf/2609.36808)** - Lets a robot policy keep acting on its own while a small local model screens each action chunk in parallel; only when an error is confirmed does a VLM step in, repair it with simple motion primitives, and hand control back. With GPT as the VLM, this raises success by 5.6 and 7.5 points for two policies on the RoboCasa benchmark and from 53% to 83% on a real robot. | |
+| **[TabAgent: Distilling LLM Agent Components into Cheap Classifiers](https://arxiv.org/pdf/2602.16429)** - Trains a small classifier on an agent's own successful runs to make its repeated fixed-choice decisions, like which tools to shortlist or which model to route to, instead of calling an LLM each time. On AppWorld tool shortlisting it recovers almost all the tools the GPT-5.4 shortlister picked, at about 1,000x lower latency and 100,000x lower cost per decision. | |
+| **[Jev in the Wild: A Data-Driven Analysis of the Jev Model's Functionality, Applications and Ecosystem](https://arxiv.org/pdf/2609.30216)** - Surveys 2,170 public GitHub Jev projects to show which application domains use typed decisions and how those uses spread during the model's early growth. | |
+| **[Steer, Don't Solve: Training Small Critic Models for Large Code Agents](https://arxiv.org/pdf/2606.21811)** - Trains 4B and 8B critic models with SFT and DPO to identify errors in a coding agent's trajectory and give high-level guidance every few steps at inference time, without producing actions. The critics improve SWE-bench Verified resolve rates of six larger agents, by up to 16 points, and lower inference cost for some agents by finishing tasks in fewer steps. | |
+| **[Training Agents to Evolve with Their Harness: TaoLive Digital Avatar Agent Technical Report](https://arxiv.org/pdf/2608.15763v3)** - Trains a compact agent while varying its Skills, tool schemas, prompts, and Hooks, so it can handle later harness changes without retraining for each edit. Tests developer-reviewed updates with frozen model weights and reports a live-commerce deployment. | |
+| **[Graph of States: Solving Abductive Tasks with Large Language Models](https://arxiv.org/pdf/2603.21250)** - Organizes multi-agent reasoning around a shared causal graph of hypotheses, evidence, confidence scores, and causal links, while a state machine controls when agents investigate, refine, backtrack, or stop. Evaluated on medical and distributed-system diagnosis tasks. | |
| **[SCATE: Learning to Supervise Coding Agents for Cost-Effective Test Generation](https://arxiv.org/pdf/2607.08983)** - Replaces the human who keeps prodding a coding agent to write more tests with a contextual bandit that picks the next testing action from current coverage and class testability signals. Driving GEMINI-CLI, it reaches 32.3% higher line coverage and 30.9% higher branch coverage than the agent on its own, and it learns a different policy when the same setup drives CLAUDE CODE. | |
| **[Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution](https://arxiv.org/pdf/2608.08311)** - Documents a coding-agent harness that can update its tools, prompts, context assembly, and core code through reviewed commits, with a 161-day live deployment. Reports frozen-snapshot results of 86.74% on Terminal-Bench 2.1 and 90.69% on OSWorld-Verified. | |
| **[On Effectiveness and Efficiency of Agentic Tool-calling and RL Training](https://arxiv.org/pdf/2606.00135)** - Find that current agentic tool-calling benchmarks like BFCL are quite brittle: system prompt, multi-turn template or even pure random seeds could have huge influence on the final performance. | |
@@ -440,18 +457,20 @@ Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gi
| **[CaveAgent: Transforming LLMs into Stateful Runtime Operators](https://arxiv.org/pdf/2601.01569v3)** - Proposes a dual-stream architecture that elevates the persistent Python runtime as the central locus of agent state, with stateful runtime management and skill injection for long-horizon tasks. | |
| **[Actively Obtaining Environmental Feedback for Autonomous Action Evaluation Without Predefined Measurements](https://arxiv.org/pdf/2601.04235v1)** - Proposes an active feedback model where AI agents proactively interact with the environment to discover and verify feedback without relying on predefined measurements. | |
| **[Warp-Cortex: An Asynchronous, Memory-Efficient Architecture for Million-Agent Cognitive Scaling on Consumer Hardware](https://arxiv.org/pdf/2601.01298v1)** - Proposes an asynchronous architecture for million-agent scaling that reduces memory complexity via singleton weight sharing and topological synapse-inspired KV-cache sparsification. | |
+| **[DRACO: Fine-Grained Credit Assignment with Dynamic Rubrics for Long-Horizon Agent Training](https://arxiv.org/pdf/2609.04094)** - Trains long-horizon tool-using agents with RL when no ground-truth success signal is available. Generates task-specific rubrics during training, scores each finished trajectory once with an LLM judge, and redistributes that score over the steps behind each criterion to get per-step GRPO advantages; on AppWorld it gains 15.9 points over the base model and 5.3 over GRPO trained on the ground-truth unit-test reward. | |
-
AI Agent Security (82)
+
AI Agent Security (83)
| Paper | arXiv ID |
|---|:---:|
+| **[One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenders](https://arxiv.org/pdf/2606.13610)** - Tests whether search-augmented LLMs recommend brands that do not exist, by swapping the real brand name inside the top-ranked pages the model retrieves and changing nothing else. Across 12 models, one altered page at rank 1 produces a fake recommendation in up to 27% of cases, and altering the top three pages reaches 73.8%. | |
| **[Internal Safety Collapse in Frontier Large Language Models](https://arxiv.org/pdf/2603.23509)** - Reveals that AI agents produce harmful content (toxic text, exploits, dangerous data) as a side effect of completing normal professional tasks — no adversarial prompting needed. At least one mode (single-turn, ICL, or agentic) succeeds on every frontier model tested. 56 cross-domain scenarios across 8+ disciplines. | |
| **[Confundo: Learning to Generate Robust Poison for Practical RAG Systems](https://arxiv.org/pdf/2602.06616v1)** - Trains an LLM to generate RAG poison that survives real-world content processing and query variation for stress-testing RAG defenses. | |
| **[Malicious Agent Skills in the Wild: A Large-Scale Security Empirical Study](https://arxiv.org/pdf/2602.06547v1)** - Analyzes 98K agent skills from community registries to study the prevalence and nature of malicious third-party agent plugins. | |
| [SerpApi](https://serpapi.com/?utm_source=voltagent&utm_campaign=md) is a Web Search API for your AI apps. Available in Markdown and JSON for any integration. |
|
+| **[AgonAlpha: Autonomous Alpha Discovery via Prompt Economy and Scalable Agentic Search](https://arxiv.org/pdf/2608.11250)** - A proposer agent writes each trading factor as a full research record (hypothesis, executable expression, platform results, rationale), and a separate reviewer with fresh context re-runs the evaluation and can veto made-up claims. On WorldQuant BRAIN it got 17 SPECTACULAR-grade alphas out of 60 submissions across five users and six model backends, with Sharpe up to 3.48. | 
|
| **[Agon: An Autonomous Large-Scale Omnidisciplinary Research System Built on Prompt Economy](https://arxiv.org/pdf/2606.24177)** - Treats prompt engineering as an engineering discipline rather than an art, minimizing human time while expecting maximum output. Carries the smallest prompt footprint among cross-disciplinary autoresearch systems (18 roles, 230.6 KiB total), has run across 10+ research fields without modification, and the longest observed run went 30 days unattended. | 
|
| **[PerceptUI: LLM Agents as Human-Aligned Synthetic Users for UI/UX Evaluation](https://arxiv.org/pdf/2606.05697)** - A persona-conditioned framework that predicts how a specific user would answer UI/UX evaluation questions and explains why in natural language. Trained via contrastive reflection fine-tuning and reflective prompt evolution, reaching human-level realism and generalizing to unseen questions and personas. | 
|
| **[OpenCLAW-P2P v6.0: Resilient Multi-Layer Persistence, Live Reference Verification, and Production-Scale Evaluation of Decentralized AI Peer Review](https://arxiv.org/pdf/2604.19792)** - Presents a decentralized AI peer-review platform where autonomous agents publish, score, verify references, and preserve research papers across a multi-layer storage and retrieval architecture. | 
|
@@ -240,12 +245,17 @@ Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gi
|
+| **[SciΠvot: Benchmarking Principal-Investigator Judgment at Pivotal Moments of Scientific AutoResearch Agents](https://arxiv.org/pdf/2610.21082)** - A benchmark of 248 research-judgment questions, taken from six months of senior researchers correcting LLM agents on 26 real projects in 6 fields. Frontier models tend to keep the agent's original plan: 4 of 5 models score below random, and the best model gets 63.5% against 73.4% for newcomer researchers. | 
|
+| **[Empowering Edge Agents: A Systematic Analysis of Edge-Cloud Collaboration in LLM Agent Execution](https://arxiv.org/pdf/2610.17816)** - A benchmark of 128 OpenClaw workspace tasks where a small edge model and a cloud model share the work, scored at once on task completion, cloud cost and edge FLOPs, and how much annotated sensitive data reaches the cloud. With Qwen3.5-2B on the edge, per-step routing raises completion from 12.75 to 39.97 while using 22.7% of the cloud-only cost. | 
|
+| **[TraceDance: An Automated System for Building Agent Behavior Benchmarks from Real-World Agent Deployment Traces](https://arxiv.org/pdf/2609.33295)** - Turns descriptions of unwanted agent behavior into tests built from real deployment logs. Each test scores the model's next response at a recorded decision point, including tool use, error handling, and claims about finished work, without running its actions. | 
|
+| **[Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance](https://arxiv.org/pdf/2608.12323)** - Puts twelve LLMs in a procurement-agent role under one environmental rule and varies how the rule is framed, what the penalty is, and who pushes back. Compliance spans 46 percentage points across models under identical conditions, and stating the fine, manager demands, peer outcomes, and user pressure each raise violation rates. | 
|
| **[PerspectiveGap: A Benchmark for Multi-Agent Orchestration Prompting](https://arxiv.org/pdf/2606.08878)** - A 110-scenario benchmark testing whether LLMs can compose orchestration prompts that distribute context to sub-agents without information leakage. Across 10 topologies and 27 commercial models, GPT-5.5 leads with 62% pass rate while the average is 14.9%. | 
|
| **[RewardHarness: Self-Evolving Agentic Post-Training](https://arxiv.org/pdf/2605.08703)** - Evolves a library of scoring skills and tools from preference examples, then uses a frozen vision-language sub-agent to evaluate image edits and produce a reward for GRPO training. | 
|
| **[ClawBench: Evaluating Browser Agents on Live Production Websites with Submission-Interception](https://arxiv.org/abs/2604.08523)** - Benchmarks browser agents on 283 everyday tasks (V1 153 + V2 130) across 163 live production sites, with a Chrome-extension plus CDP layer that blocks only the final write request so agents can run end-to-end on real sites without real-world side effects. Two-stage scoring (interception + LLM judge); leaderboard at https://claw-bench.com. | 
|
@@ -336,12 +346,19 @@ Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gi
|
+| **[TabAgent: Distilling LLM Agent Components into Cheap Classifiers](https://arxiv.org/pdf/2602.16429)** - Trains a small classifier on an agent's own successful runs to make its repeated fixed-choice decisions, like which tools to shortlist or which model to route to, instead of calling an LLM each time. On AppWorld tool shortlisting it recovers almost all the tools the GPT-5.4 shortlister picked, at about 1,000x lower latency and 100,000x lower cost per decision. | 
|
+| **[Jev in the Wild: A Data-Driven Analysis of the Jev Model's Functionality, Applications and Ecosystem](https://arxiv.org/pdf/2609.30216)** - Surveys 2,170 public GitHub Jev projects to show which application domains use typed decisions and how those uses spread during the model's early growth. | 
|
+| **[Steer, Don't Solve: Training Small Critic Models for Large Code Agents](https://arxiv.org/pdf/2606.21811)** - Trains 4B and 8B critic models with SFT and DPO to identify errors in a coding agent's trajectory and give high-level guidance every few steps at inference time, without producing actions. The critics improve SWE-bench Verified resolve rates of six larger agents, by up to 16 points, and lower inference cost for some agents by finishing tasks in fewer steps. | 
|
+| **[Training Agents to Evolve with Their Harness: TaoLive Digital Avatar Agent Technical Report](https://arxiv.org/pdf/2608.15763v3)** - Trains a compact agent while varying its Skills, tool schemas, prompts, and Hooks, so it can handle later harness changes without retraining for each edit. Tests developer-reviewed updates with frozen model weights and reports a live-commerce deployment. | 
|
+| **[Graph of States: Solving Abductive Tasks with Large Language Models](https://arxiv.org/pdf/2603.21250)** - Organizes multi-agent reasoning around a shared causal graph of hypotheses, evidence, confidence scores, and causal links, while a state machine controls when agents investigate, refine, backtrack, or stop. Evaluated on medical and distributed-system diagnosis tasks. |
|
| **[SCATE: Learning to Supervise Coding Agents for Cost-Effective Test Generation](https://arxiv.org/pdf/2607.08983)** - Replaces the human who keeps prodding a coding agent to write more tests with a contextual bandit that picks the next testing action from current coverage and class testability signals. Driving GEMINI-CLI, it reaches 32.3% higher line coverage and 30.9% higher branch coverage than the agent on its own, and it learns a different policy when the same setup drives CLAUDE CODE. | 
|
| **[On Effectiveness and Efficiency of Agentic Tool-calling and RL Training](https://arxiv.org/pdf/2606.00135)** - Find that current agentic tool-calling benchmarks like BFCL are quite brittle: system prompt, multi-turn template or even pure random seeds could have huge influence on the final performance. | 
|
@@ -440,18 +457,20 @@ Stop building from a blank page. [LaunchKit](https://launchkit.getdesign.md/) gi
| **[CaveAgent: Transforming LLMs into Stateful Runtime Operators](https://arxiv.org/pdf/2601.01569v3)** - Proposes a dual-stream architecture that elevates the persistent Python runtime as the central locus of agent state, with stateful runtime management and skill injection for long-horizon tasks. | 
|
| **[Actively Obtaining Environmental Feedback for Autonomous Action Evaluation Without Predefined Measurements](https://arxiv.org/pdf/2601.04235v1)** - Proposes an active feedback model where AI agents proactively interact with the environment to discover and verify feedback without relying on predefined measurements. | 
|
| **[Warp-Cortex: An Asynchronous, Memory-Efficient Architecture for Million-Agent Cognitive Scaling on Consumer Hardware](https://arxiv.org/pdf/2601.01298v1)** - Proposes an asynchronous architecture for million-agent scaling that reduces memory complexity via singleton weight sharing and topological synapse-inspired KV-cache sparsification. | 
|
+| **[DRACO: Fine-Grained Credit Assignment with Dynamic Rubrics for Long-Horizon Agent Training](https://arxiv.org/pdf/2609.04094)** - Trains long-horizon tool-using agents with RL when no ground-truth success signal is available. Generates task-specific rubrics during training, scores each finished trajectory once with an LLM judge, and redistributes that score over the steps behind each criterion to get per-step GRPO advantages; on AppWorld it gains 15.9 points over the base model and 5.3 over GRPO trained on the ground-truth unit-test reward. | 
|
|
| **[Internal Safety Collapse in Frontier Large Language Models](https://arxiv.org/pdf/2603.23509)** - Reveals that AI agents produce harmful content (toxic text, exploits, dangerous data) as a side effect of completing normal professional tasks — no adversarial prompting needed. At least one mode (single-turn, ICL, or agentic) succeeds on every frontier model tested. 56 cross-domain scenarios across 8+ disciplines. | 
|
| **[Confundo: Learning to Generate Robust Poison for Practical RAG Systems](https://arxiv.org/pdf/2602.06616v1)** - Trains an LLM to generate RAG poison that survives real-world content processing and query variation for stress-testing RAG defenses. | 
|
| **[Malicious Agent Skills in the Wild: A Large-Scale Security Empirical Study](https://arxiv.org/pdf/2602.06547v1)** - Analyzes 98K agent skills from community registries to study the prevalence and nature of malicious third-party agent plugins. | 
|