Attack poisons persistent agent memory with delayed-activation payloads

Research highlights a new attack where adversaries poison persistent LLM agent memory with delayed-activation payloads, while a study of reasoning model internals reveals they follow qualitatively different hidden-state trajectories rather than simply computing longer. Vercel Labs released Zero, a systems programming language designed for AI agents to read, repair, and ship code autonomously.

Security #

Hidden in Memory: Sleeper Memory Poisoning in LLM Agents #

arXiv

Persistent memory in LLM assistants – designed for personalization and continuity across sessions – introduces a new attack surface: adversaries can manipulate external context (documents, emails, web pages) to inject delayed-activation payloads into agent memory. The poisoned memories lay dormant until a trigger condition activates them in a future session, influencing the agent’s behavior without the user’s knowledge. This is distinct from prompt injection (which targets the current session) and represents a supply-chain-style attack on the agent’s accumulated state, with implications for any system that stores and retrieves cross-session context.

Who Owns This Agent? Tracing AI Agents Back to Their Owners #

arXiv

As autonomous agents act in the world – browsing, purchasing, communicating – there is no reliable mechanism to trace a harmful agent back to the account that deployed it. The paper frames this as an accountability gap that affects both ends of the intent spectrum: benign operators deploying misconfigured agents and malicious operators weaponizing them deliberately. The proposed tracing framework addresses a governance prerequisite that regulation will eventually require but that current agent infrastructure does not provide.

Verifiable Agentic Infrastructure: Proof-Derived Authorization for Sovereign AI Systems #

arXiv

Identity-centric authorization – the assumption that valid credentials imply safe execution – breaks down for autonomous agents that can generate syntactically valid but semantically unsafe actions. This paper proposes proof-derived authorization where agents must produce machine-verifiable justifications for each action, replacing standing privileges with per-action proofs. The framework is particularly relevant for sovereign AI systems where autonomous agents interact with critical infrastructure and standing permissions represent unacceptable operational risk.

Research & Papers #

Reasoning Models Don’t Just Think Longer, They Move Differently #

arXiv

Reasoning-trained models generate longer chains of thought on harder problems, but this paper shows the additional tokens are not merely “more of the same” – the models follow qualitatively different hidden-state trajectories. Using trajectory analysis across competitive programming, mathematics, and Boolean satisfiability, the authors find that after normalizing for generation length, reasoning models exhibit distinct geometric properties in their hidden states compared to standard models. This suggests that reasoning training instills a structurally different computation pattern, not just a longer one, which has implications for how we evaluate and scale inference-time reasoning.

SDOF: Taming the Alignment Tax in Multi-Agent Orchestration with State-Constrained Dispatch #

arXiv

Multi-agent frameworks like LangChain and CrewAI route tasks through graph-based pipelines but do not enforce the stage constraints that govern real business processes. SDOF treats multi-agent execution as a constrained state machine, using an Online-RLHF Specialized Intent Router to dispatch tasks while respecting business-process invariants. For teams deploying multi-agent systems in regulated or process-heavy environments, this addresses the gap between the flexibility of graph-based orchestration and the rigidity that compliance requires.

Runtime-Structured Task Decomposition for Agentic Coding Systems #

arXiv

Many agentic coding systems encode task logic, execution flow, and output generation inside monolithic prompts, creating brittle behavior, limited debuggability, and high retry costs when failures require rerunning entire workflows. This paper introduces runtime-structured decomposition that breaks agentic coding into discrete, independently debuggable execution units with explicit interfaces between them. The approach directly addresses the engineering reality that monolithic agent prompts are the agentic equivalent of spaghetti code, and structured decomposition yields the same maintainability benefits in agent systems as in traditional software.

Quantization Undoes Alignment: Bias Emergence in Compressed LLMs #

arXiv

Post-training quantization is routine for reducing inference costs, but this study shows it systematically re-introduces biases that alignment training removed. Unlike prior work that compared only full-precision vs. a single quantized variant, this paper evaluates multiple model families across multiple precision levels, revealing that bias re-emergence is gradual, model-family-dependent, and not captured by aggregate metrics. Teams deploying quantized models in production should treat alignment properties as potentially degraded after compression, not preserved.

Context Pruning for Coding Agents via Multi-Rubric Latent Reasoning #

arXiv

LLM-powered coding agents spend most of their token budget reading repository files, yet much of the retrieved code is irrelevant. Existing pruners use a single-objective sequence labeler that collapses all facets of code relevance into one score. This paper introduces a multi-rubric approach that scores code along multiple independent relevance dimensions, reducing token consumption while preserving the heterogeneous signals – API relevance, type compatibility, control-flow proximity – that a single score flattens.

Reducing the Safety Tax in LLM Safety Alignment with On-Policy Self-Distillation #

arXiv

Safety alignment frequently improves robustness to harmful queries at the cost of reasoning ability – the “safety tax.” This paper identifies off-policy training mismatch as a key source: when models train on safety demonstrations produced by other models or humans rather than their own policy’s distribution, the mismatch degrades general capabilities. On-policy self-distillation – where the model generates and trains on its own safety-compliant trajectories – reduces this tax, preserving reasoning ability while maintaining safety properties.

Developer Tools #

Zero: A systems programming language for AI agents #

Vercel Labs

Vercel Labs released Zero, an open-source (Apache 2.0) systems programming language designed so AI agents can read, repair, and ship native programs without human interpretation of compiler errors. The language prioritizes machine-parseable error messages, deterministic build semantics, and structured compiler output – properties that benefit human developers but were specifically optimized for agentic workflows. This is a notable bet that programming languages themselves should be redesigned for the agent era rather than forcing agents to work around languages designed for humans.

Semble: Code search for agents that uses 98% fewer tokens than grep #

GitHub / Hacker News

Semble is an open-source code search tool for LLM coding agents working on large codebases, addressing the fallback to grep, full-file reads, or subagents when direct search fails. The tool indexes on demand without API keys and claims 98% token reduction compared to grep-based approaches. For teams building or deploying coding agents, this targets a concrete efficiency bottleneck – the token cost of repository navigation – that accounts for a large fraction of agent inference budgets.

GenCAD: Generating Parametric CAD Programs from Images #

Hacker News (335 points)

GenCAD uses transformer-based contrastive learning and diffusion models to generate complete parametric CAD programs – not just 3D meshes, but the sequence of design commands needed to recreate and edit a shape. This preserves the accuracy and editability of true CAD models while enabling generation from images, a significant step toward AI-assisted mechanical design. The 335-point HN discussion reflects strong interest from engineering-adjacent communities in AI that produces structured, editable outputs rather than opaque representations.

Regulatory & Policy #

Mistral CEO warns European military should not rely on US AI models #

Mistral / multiple outlets

Mistral CEO Arthur Mensch cautioned that European military systems should avoid depending on US AI models for sensitive codebase analysis, citing cybersecurity dependency risks. Mensch advocated for treating AI infrastructure as critical national infrastructure, analogous to energy or telecommunications. The statement reflects growing European concern that reliance on American AI providers creates a strategic vulnerability – and positions Mistral explicitly as a sovereign alternative for defense applications.

Musk-OpenAI trial: trust and transparency dominate closing arguments #

TechCrunch

Closing arguments centered on whether CEO Sam Altman is trustworthy, with Musk’s attorneys challenging Altman’s congressional testimony about his equity stake in the company. The trial surfaced a broader structural concern: all major AI labs are privately held with limited transparency into their governance, safety practices, and financial arrangements. Regardless of the verdict, the trial has produced a public record of internal communications and decision-making processes at OpenAI that will inform regulatory debates about AI lab governance.

Model Releases #

Apple planning major Siri overhaul with Google Gemini and privacy focus #

Bloomberg / TechCrunch

Bloomberg’s Mark Gurman reports that Apple will unveil a standalone Siri app powered by Google Gemini at WWDC in June, featuring a ChatGPT-like interface with auto-deleting conversations and stronger data protection measures. The privacy-first framing – auto-deletion defaults, on-device processing emphasis – positions Apple’s AI assistant as a direct counterpoint to competitors that retain conversation data. If Apple ships Gemini integration across its install base, this could become the largest single deployment of a non-OpenAI frontier model to consumers.

Funding & Business #

OpenAI launches the Deployment Company #

OpenAI / multiple outlets

OpenAI officially launched a dedicated Deployment Company that embeds OpenAI engineers directly into enterprise organizations to help build internal AI workflows and systems. This moves OpenAI beyond API sales toward becoming an operational partner – a services business model that Anthropic has also pursued with its PwC deployment (which reduced insurance underwriting timelines from 10 weeks to 10 days). The shift signals that frontier labs are discovering enterprise AI adoption requires hands-on integration work that self-serve APIs alone cannot provide.

Infrastructure #

Confusion Grows With More Interconnect Options And Tradeoffs #

Semiconductor Engineering

Chip architects are now choosing multiple interconnect standards for single designs as each standard serves a specific use case, creating complexity that grows with every new protocol addition. The proliferation of options – CXL, UCIe, NVLink, and emerging alternatives – means that AI accelerator and HBM designs require more sophisticated interconnect strategies than simply picking a standard. For AI infrastructure teams, interconnect choice is becoming a first-order architectural decision that affects memory bandwidth, multi-chip scaling, and total cost of ownership.

Threads to Watch #

Agent memory is becoming a first-class attack surface. Hidden in Memory (sleeper poisoning), Who Owns This Agent? (accountability tracing), and Verifiable Agentic Infrastructure (proof-derived authorization) each address a different facet of the same problem: as agents gain persistent state and autonomous authority, security must evolve from per-request guardrails to persistent-state integrity and provenance. Combined with this week’s MemLineage (lineage-guided memory enforcement), AgentTrap (trust failures in third-party skills), and Invisible Orchestrators (suppressed protective behavior), a comprehensive threat model for agent security is emerging that is substantially larger than prompt injection alone.

Agentic coding is being decomposed into structured engineering concerns. Runtime-Structured Task Decomposition breaks monolithic agent prompts into debuggable execution units. Context Pruning treats repository navigation as a multi-rubric optimization. Semble provides indexed code search at 98% fewer tokens. Together with this week’s Zerostack (Unix-philosophy coding agent) and Vercel Zero (language designed for agent readability), the tooling layer for agentic coding is maturing from “give the model a shell” to engineered systems with clear abstraction boundaries and measurable efficiency properties.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

• Stanford HAI – scrape: content_truncated