The Agentic AI Map

This is a working map of what is actually being built, regulated, financed, and contested in the agent-native landscape — organized into seven families, forty-nine dimensions, and eleven meta-patterns that cut across them.

It is not a survey. It is a position. Every dimension here is one I think matters; the absence of something common ("prompt engineering," say) is deliberate. The map is versioned because the landscape moves quickly and being honest about what changed is part of the discipline. Current version: v2.3.

Use it as a reference. Quote it. Disagree with it. Send corrections.

Version v2.3 · Published October 26, 2026 · Weekly scan of all seven families through October 26; prior deep-review boundaries retained. What changed · Weekly evidence .

Eleven meta-patterns

These are the threads that cut across families. If you only read one section of this page, read this one.

Agent OS Convergence. Persistent workspaces, background execution and recovery are converging into agent runtimes. Treat this as an architectural direction: persistence, isolation, scheduling and authority remain separate contracts, whether delivered by a library, service or operating environment.

Sources: LangGraph checkpointers , Cursor Cloud Agents security overview . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

The Definitional Gap. Apply each rule to its actual scope. SR 26-2 superseded SR 11-7 but explicitly excludes generative and agentic AI from that guidance; this does not remove other governance duties. EU and Colorado rules have their own covered systems, actors, obligations and application dates.

Sources: Federal Reserve SR 26-2 and revised model risk guidance , European Commission AI Act implementation overview , Colorado SB26-189 enacted bill overview . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Downside-Routing Fabric. Authorization and hard effect limits come first. Within that boundary, action class, uncertainty, reversibility, and recovery determine whether an agent proceeds, asks for review, or stops. Liability and insurance remain additional routing layers. Confidence can inform escalation; it cannot create permission or establish that an action was correct.

Sources: CapScope , Intent-Governed Tool Authorization . The authorization-first ordering is editorial synthesis. The technical studies do not establish insurance-market adoption. Study dates, methods, results and consequential limitations are in Research evidence .

Compliance as Differentiation. Recovery, identity, provenance and bounded authority can support procurement and compliance evidence. Map each control to a specific obligation; technical controls, management-system certification and insurance cover do not confer blanket compliance or establish who will win regulated markets.

Sources: First harmonised standard supporting the AI Act , ATA launches up to $750 million AI infrastructure facility . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Verification Renaissance. Executable tests, artifact checks, validated rubric judges, and learned trajectory verifiers address different parts of agent reliability. The question is which evidence justifies trusting a run. Formal proofs, judged task success, instruction compliance, and safe execution support different claims; each verifier needs its own validation.

Sources: Agentic Benchmark Checklist , AgentHorizon , Traverse and Scout , Cryptographically Verifiable Authorization . Formal proofs, rubric judgments and runtime controls support different claims; deployment maturity must be evidenced separately. Study dates, methods, results and consequential limitations are in Research evidence .

Model–System Co-Design. Model capability, memory, tools, verification, and coordination jointly determine agent performance. Better models can reduce the value of extra agents; better harnesses can improve how a model uses its budget. Evaluate the complete system on the intended task under matched cost, latency, and verification requirements.

Sources: Scaling Agent Systems , SAIGE , Agents Are Systems, Not Models . These experiments do not establish frontier-model convergence or the source of a commercial moat. Study dates, methods, results and consequential limitations are in Research evidence .

Evaluation Beyond the Score. A high success rate can coexist with brittle repetition, missed constraints, and harmful intermediate actions. Fresh tasks and professional workflows extend coverage; validated judges, trajectory audits, fault tests, and cost-success comparisons make scores interpretable. Contamination, scorer defects, and saturation require separate evidence.

Sources: Towards a Science of AI Agent Reliability , Measurement-First Auditing of Agentic Leaderboards , Traverse and Scout , Holistic Agent Leaderboard , APEX Agents , Odysseys . Susceptibility to leakage is different from demonstrated exposure or causal score inflation; the reviewed evidence does not establish that all named benchmarks are saturated and contaminated. Study dates, methods, results and consequential limitations are in Research evidence .

Identity to Action Authority. The frontier extends from identifying an agent to constraining and reconstructing what it may do: which principal delegated which action, on which resource, under which policy, and whether the grant remained valid at execution. Identity, authorization, and execution evidence are distinct layers. Research prototypes and draft protocols make their interfaces explicit.

Sources: WIMSE AIMS , Cryptographically Verifiable Authorization , ACLE-MCP . Draft protocols and proofs of concept expose distinct interfaces; their maturity does not establish widespread adoption. Study dates, methods, results and consequential limitations are in Research evidence .

Reasoning as Billing Axis. Test-time compute is a UX knob, a billing tier, and a research objective at the same time. "How hard should the agent think" is now a product surface.

Orchestration to Runtime. Checkpointing, pause/resume and durable state are becoming explicit execution contracts. Libraries can supply these features too. Compare crash recovery, replay, retention and side-effect behavior instead of assuming that a product label guarantees durability.

Sources: LangGraph checkpointers . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Layered Agentic Commerce. Payment mandates, checkout workflows, HTTP payment mechanisms and dispute evidence solve different parts of commerce. Track their versions, trust boundaries and legal obligations separately. Protocol deployment does not resolve every authorization or consumer-protection question.

Sources: AP2 agent payments specification . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Family 1 — Runtime & Execution

How agents actually run. The infrastructure layer.

Durable Execution. Recovering long-running work with persistent checkpoints, replay and explicit failure semantics. A framework can support durability when correctly configured; an in-memory saver cannot survive process loss. Replayed API calls may repeat external effects, so test idempotency, reconciliation and recovery rather than assuming exactly-once execution.

Pin the runtime and checkpoint backend version, then inject failures around interruption and resume. Check that completed sub-tasks, state updates and pending writes are not applied twice. Recovery of graph state and recovery of external effects need separate assertions. Sources: LangGraph 1.2.16 resume and checkpoint fixes . Study scope and limits: Weekly evidence .

Sources: LangGraph checkpointers . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Coordination & Shared State. Task decomposition, delegation, message routing, shared work records, and conflict recovery determine whether an agent team makes progress. The runtime manages handoffs, stale state, duplicate work, failed participants, and context budgets. Emerging designs use dependency graphs and persistent shared stores with bounded retrieval. Evaluate the team's selected result, including coordination cost and recovery. Emerging runtime supervisors can propose guidance, retries, or continuation edits. Expose explicit intervention points and record which proposals were applied. The host validates compatibility and authority before resuming execution.

Test feedback through shared rankings or popularity counts as well as explicit messages. Separate candidate exposure from final judgment: early selections can suppress alternatives before reviewers see them. Compare independent selection, randomized ordering and wider candidate budgets. Sources: LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades . Study scope and limits: Weekly evidence .

Sources: ScaleMAS , SAIGE , MAST , ARIA: Runtime Inspection and Amendment for Multi-Agent Systems , Learning to Steer LLM Agents and Multi-Agent Systems . Candidate discovery is different from final-answer reliability. ARIA allows one pending plain-text substitution; authority validation is a design recommendation, not a demonstrated ARIA guarantee. Study dates, methods, results and consequential limitations are in Research evidence . Related: durable execution , delegated authority , evaluation .

Persistent Agent Machines. Separate persistent workspace or conversation state from the lifetime of a VM and its credentials. Inspect resume behavior, snapshot retention, repository access, secret expiry and deletion. Cursor documents per-agent VMs that are recycled while selected state persists; this is one implementation, not a universal machine lifecycle.

Sources: Cursor Cloud Agents security overview . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Sandbox & Code Execution. Evaluate execution isolation, filesystem scope, network egress, secrets and resource limits by backend. The OpenAI Agents SDK Manifest describes a workspace contract; it is not established here as a universal interoperability standard. An SDK path grant is not necessarily an operating-system boundary for arbitrary shell commands.

Sources: OpenAI Agents SDK sandbox concepts . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Confidential Compute. Attestation and confidential execution protect specified assets within a stated hardware and software trust boundary. GPU mode and interconnect assumptions matter: NVIDIA CC and PPCIE treat NVLink differently. A TEE does not establish action authorization, safe outputs or sectoral compliance.

Sources: NVIDIA PPCIE verifier 2.x introduction . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Inference Economics. Speculative decoding, caching, memory movement, hardware and batching affect serving costs. Separate measured compute cost, billed prices and total task cost; include failed attempts, verification, orchestration and human review. A provider price change alone does not identify its technical cause.

Compare total cost per verified successful task, including retries, verification and human review, alongside latency and review time. Related: Agent Evaluation & Verification .

Family 2 — Cognition & Capability

How agents think. The capability layer.

Reasoning & Test-Time Compute. Reasoning effort levels, task budgets, parallel test-time compute. The user-facing knob that determines how hard the agent thinks before acting.

Multi-Agent Reasoning & Ensembles. Parallel attempts, voting, debate, and specialist teams are different ways to spend inference compute. Benefits depend on task structure, independent evidence, and reliable answer selection; agreement can preserve shared mistakes. Compare with a strong single-agent harness and independent sampling at the same budget. Provider-managed teams are a deployment form; internalized debate and latent communication are emerging research directions.

Sources: Scaling Agent Systems , Debate or Vote , Mixture of Debaters , Causal Audit of Latent Communication , Jev-LiteMAS: Separating Decisions from Generation in Multi-Agent Workflows , xAI Multi Agent documentation . Provider-managed teams do not establish a shared-weight neural architecture. Routing and screening may use bounded decisions while generative models execute and repair. Test false passes and needless escalation; include decision-model costs. Jev-LiteMAS v2 reports decision fees and latency separately from its headline generative-token savings. Study dates, methods, results and consequential limitations are in Research evidence . Related: coordination , inference economics .

World Models. Learned environment models for simulation, prediction and planning. Separate visual environment generation, domain-specific simulation and demonstrated control. Test action coverage, persistence and transfer on the intended environment; a convincing generated world does not establish reliable physical or general-purpose planning.

Sources: Genie 3: a new frontier for world models . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Working Context & Compaction. What an agent keeps in view, when it compresses, and how it resumes. Active budgets, working-state summaries, and learned compaction policies. Preserve sources and distinguish observations, agent-written inferences, and standing user commitments. Test missing evidence, lost constraints, repeated exploration, and task success after compression. Source checks are emerging mechanisms; provenance does not establish correctness, and pruning can remove useful constraints.

Sources: AutoCompact , Governance Decay , Prune the Summary, Not the History: Source-Judged Compaction for Long-Horizon Agents . Learned compaction gains and source checks are experimental. Source-supported summaries can still lose useful constraints; the source-judged study assumes a single always-visible instruction. Include judge cost and measure retained commitments. Study dates, methods, results and consequential limitations are in Research evidence . Related: durable execution , authorization .

Persistent Memory & Evidence. Episodic traces, semantic facts, temporal state, and query-conditioned access to complementary evidence. Construction, retrieval, refresh, contradiction handling, and provenance belong in the same lifecycle. Preserve paths to source records so compressed memories can be checked. Evaluate whether the retrieved evidence is sufficient and still current for the request.

Treat persistent instructions and scheduled-task state as distinct security-sensitive writes. Evaluate malicious planting and later triggering separately across fresh sessions, including unrelated follow-ups. Restoring a memory does not restore valid authority for its instructions. Sources: CarryoverBench: After the Attacker Leaves . Study scope and limits: Weekly evidence .

Sources: MemPursuit , JAM , EvalMem , Grounding Agent Memory , Rethinking the Role of Tool Graph Memory in Multi-Turn Tool Use . Attribute gains with no-memory, random-guidance and no-guidance controls under stated budgets. Compare situation-level lessons with next-tool guidance, including construction and extra model calls. Tool-transition graph evidence does not establish how all temporal or entity graphs behave. Study dates, methods, results and consequential limitations are in Research evidence . Related: evaluation , drift , provenance .

Continual Learning & Skill Transfer. Turning completed work and feedback into validated procedures, reusable skills, and better future performance. Distinguish external memory updates, training the ability to learn from experience, and continued model-weight adaptation. Start downstream tests with empty banks and disjoint evaluation tasks. Measure reuse, retention, peak and final performance, and robustness when skills are rewritten, incomplete, misleading, added, or removed. Report total learning cost and performance against the untrained backbone.

Sources: AgentCL , CL-Bench , ALMA , SkillLearnBench , MetaExp: Learning to Self-Improve through Experience via Verifiable Cross-Task Environment Scaling , Evolving Together, Failing Apart: The Skill–Policy Co-evolution Trap in Self-Improving Agents . Persistent storage does not automatically establish transfer. MetaExp trains learning behavior before downstream frozen-weight adaptation; CODA tests bank fragility in different smaller-model systems and is not a direct replication or refutation. Study dates, methods, results and consequential limitations are in Research evidence . Related: held-out evaluation , persistent memory .

Computer-Use & Multimodal. Pixel-level GUI control, voice agents, robotics action spaces. Multimodal action as a first-class capability rather than a bolted-on feature.

Spec-Driven Development. Explicit specifications, acceptance criteria and executable checks can structure agent coding. Preserve the version actually used and link it to tests and execution evidence. A specification records intended behavior; it does not by itself explain every action or prove that implementation followed the plan.

Sources: GitHub Spec Kit . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Family 3 — Trust, Safety & Verification

Fifteen dimensions covering identity, authority, behavior, oversight, and evidence. These mechanisms address different failure modes and need separate evaluation.

Verifiable Inference (zkML). Cryptographic proofs can establish a specified computation under stated encoding and proof-system assumptions. Keep computation validity, input provenance, policy adequacy and binding to the executed external action separate. A valid inference proof is not by itself a proof that an agent was authorized or safe.

Sources: EZKL official repository . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Mechanistic Interpretability. Sparse features, attribution graphs and causal interventions investigate internal mechanisms. Evaluate coverage, reconstruction error, causal faithfulness and transfer. Research tools and bounded probes can inform monitoring, but do not establish comprehensive runtime safety enforcement.

Sources: Circuit Tracing: Revealing Computational Graphs in Language Models . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Activation Steering & Control. Runtime interventions in internal activations differ from fine-tuning model weights. Test causal effects against matched prompts and random-direction controls, along with retention, legitimate questions and deployment overhead. Recent ask-versus-act experiments show model-dependent effects in a toy setting; simulated oversight burden is not measured human productivity.

Sources: Human Interventions as Labels . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Constitutional AI & Model Specs. Written behavioral commitments can inform training, evaluation and runtime instructions. State which mechanism is actually implemented. A published constitution expresses intended behavior and does not guarantee compliance or imply that it is consulted on every inference.

Sources: Claude’s new constitution . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Scalable Oversight. Debate, weak-to-strong supervision, and monitoring methods for checking increasingly capable systems. Multiple agents and judges require tests of correlated errors, minority suppression, and false overrides. Independent evidence, executable checks, and measured evaluator reliability determine whether oversight adds value beyond consensus.

Recent self-assessment work distinguishes production offline flagging from experimental attack blocking. Teacher agreement is not independent validation, and a monitor can miss attacks while adding review work. Sources: Anthropic self-assessment .

Sources: Debate or Vote , Minority Sentinel , AgentHorizon , Learning to Steer LLM Agents and Multi-Agent Systems , ARIA: Runtime Inspection and Amendment for Multi-Agent Systems . Untrained supervision can reduce delivered-answer quality. Measure paired recovery and harm and the costs of guidance, rejection, retries and inspector calls. Static debate studies do not validate general runtime oversight. Study dates, methods, results and consequential limitations are in Research evidence . Related: evaluation , coordination .

Agent Evaluation & Verification. Artifact and end-state checks, rubric judges, trajectory failure localization, repeated-run reliability, and perturbation testing. Evaluate the complete model, harness, and tool configuration under stated budgets. Validate the evaluator as well as the agent; task success, instruction compliance, and operational safety are separate measurements. When an agent optimizes or selects work using a verifier, test verifier influence, adaptive probing, and performance on verifier-unseen checks; an unchanged in-loop score can conceal worse results.

For interactive work, report success across turn budgets, costs and user behaviors, with regression checks after each turn. Test whether equivalent implementations are wrongly rejected. A reviewer rewriting a judge does not establish that the revised verdict is correct. Sources: UserSWE: Evaluating Coding Agents in Multi-Turn Conversations with Dynamic Users . Study scope and limits: Weekly evidence .

Sources: AgentHorizon , Traverse and Scout , Towards a Science of AI Agent Reliability , Agents Are Systems, Not Models , When Can You Trust an Agent's Own Verifier? , ARIA: Runtime Inspection and Amendment for Multi-Agent Systems , Learning to Steer LLM Agents and Multi-Agent Systems . For memory, test update, retrieval, changing state, compaction, forgetting and held-out transfer separately against stateless, full-context and simple retrieval baselines. For teams, include selected-answer correctness, duplicate work, communication ablations and recovery. Compare paired interventions: recovered failures, damaged successes, false rejection, retries and all monitoring costs. Pass@N discovery is not reliable commitment. This is an editorial measurement framework, not a universal standard. Study dates, methods, results and consequential limitations are in Research evidence . Related: inference economics , pricing .

Adversarial Red-Teaming. Multi-turn attack discovery and adaptive testing across models, tools, memory and permissions. Report attacker access, attempts, costs, safeguards enabled, useful-task performance and completed harmful effects. Continuous testing complements deployment controls; an offline flag is distinct from prevention.

Sources: Anthropic self-assessment . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Supply-Chain Security. Assess dependencies, models, tool servers, skills and retrieved instructions across provenance, integrity, update paths and privileges. OWASP names Agentic Supply Chain Vulnerabilities as ASI04. A threat taxonomy guides testing; it does not measure incident prevalence or establish that a software bill of materials prevents compromise.

Sources: OWASP Top 10 for Agentic Applications . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Agent Identity & Credential Lifecycle. Identify the acting workload and the human or system on whose behalf it acts; provision, rotate, revoke, and audience-bind credentials. MCP defines transport-level access controls. WIMSE's AIMS work composes identity, delegation, and monitoring mechanisms and remains an Internet-Draft. Identity anchors authorization and audit, but does not establish that a particular action is justified.

Sources: MCP authorization , WIMSE AIMS . MCP authorization is optional and transport-scoped. WIMSE AIMS remains an Internet-Draft and supersedes the earlier draft-klrc-aiagent-auth; neither establishes mission-to-action permission by itself. Study dates, methods, results and consequential limitations are in Research evidence . Related: authorization , MCP .

Agent Authorization & Delegation. Bound authority to the task, principal, resource, arguments, and time window, with narrower grants for delegated agents. Validate requester, approver authority, operation, destination, and purpose against policy at dispatch. Where approval is required, bind it to a canonical effect, render that effect through trusted code, and reject effects outside its bounds, expired authority, or reuse beyond the approved limits. Token possession and agent-written approval text do not establish permission.

Test scope violations under benign pressure as well as malicious instructions, including actions without direct harm. Score completion and authority independently. The observed association between asking and fewer violations does not establish that mandatory extra approvals cause safer behavior. Sources: AuthorizationBench: Act on Your Behalf, Beyond Your Authorization . Study scope and limits: Weekly evidence .

Sources: CapScope , Intent-Governed Tool Authorization , MCP authorization , Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization , When Approval Becomes Execution: Authorization-Grounded Workflow Attacks on Tool-Using Agents , The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named , Revoked but Still Authoritative . Memory and delegated messages can supply evidence but cannot mint authority. Check current grants, revocation and effect bounds at use time. Accepted unauthorized drafts and completed unsafe effects are separate outcomes. These prototypes do not solve general intent extraction or establish human usability. Valid, bounded authority need not trigger redundant approval. Study dates, methods, results and consequential limitations are in Research evidence . Related: identity , information-flow control , intervention .

Prompt-Injection & Information-Flow Control. Preventing untrusted content from redirecting privileged actions or leaking protected data. Separate model robustness from enforced control flow, data provenance, and restrictions on tool arguments. Architectural containment and robustness training are complementary approaches. Measure authorized-task utility, attack outcomes, and residual channels together.

Measure delayed attacks through both memory and scheduler state: per-attempt planting, conditional trigger success and legitimate-task utility have different denominators. Five repeated aligned follow-ups do not establish attack frequency across arbitrary future use. Sources: CarryoverBench: After the Attacker Leaves . Study scope and limits: Weekly evidence .

Sources: CaMeL , RAISED , AgentSecBench . Robustness training and enforced information flow address different failures. RAISED uses static attacks; CaMeL depends on policy quality and mediated flows, with residual channels and utility costs. Study dates, methods, results and consequential limitations are in Research evidence . Related: supply-chain security , authorization .

Privacy-Preserving Agents. Distinguish data minimization and access control, encryption, confidential execution, secure computation and differential privacy. State the protected data, adversary, privacy parameters and leakage channels for each claim. These mechanisms provide different guarantees; none automatically authorizes sensitive-data use or establishes healthcare or financial compliance.

Sources: NIST SP 800-226: Guidelines for Evaluating Differential Privacy Guarantees , NVIDIA PPCIE verifier 2.x introduction . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Uncertainty, Calibration & Escalation. Detect unsupported beliefs and estimate failure risk. Evaluate initial routing, handoff timing, and oversight after handoff separately, alongside calibration, failure discrimination, intervention cost, and completed work. Confidence signals can come from outputs, trajectories, or internal representations; validate thresholds on the deployed task distribution. Confidence informs review and cannot create permission.

Sources: Towards a Science of AI Agent Reliability , Do Agents Know When They Succeed , LEASH: Uncertainty-Aware Weak-to-Strong Escalation and Oversight for Computer-Use Agents , CapScope . The earlier confidence-probe study uses offline replay; LEASH tests online latent-guided escalation and pending-action oversight on OSWorld. This does not establish early detection of every unsafe action, reliable human escalation or recovery of committed effects. Include monitoring and stronger-model calls. Study dates, methods, results and consequential limitations are in Research evidence . Related: intervention , inference economics .

Agent Drift. Changes in beliefs, plans, coordination, and behavior across extended work. Track obsolete memories, lost constraints, diverging shared plans, and recovery failures separately. Evaluate changing environments and repeated task streams; distinguish a stale record, a retrieval failure, and an unauthorized action rather than treating them as one undifferentiated drift score.

Sources: AgentCL , AgentWorld , Revoked but Still Authoritative . These studies identify specific failures, not their prevalence across current production systems. Study dates, methods, results and consequential limitations are in Research evidence . Related: memory , authorization .

Agentic Observability. Versioned traces linking goals, model and harness settings, tool actions, state changes, costs, verifier decisions, authority, and human interventions. Locate the first error, distinguish recovery from cascading failure, and audit side effects in passing runs. Monitoring quality depends on validated detectors and sufficient evidence; collecting traces is the starting point.

Sources: Traverse and Scout , Holistic Agent Leaderboard , WIMSE AIMS , AgentEval: Evidence-Bounded Assessment of Stateful Agents , Stronger Judges Do Not See More: Deployment-Integrity Blindness in LLM Evaluation . Bind judgments to objective, run, task specification, evidence and measurement version. Distinguish a violated obligation from missing evidence or invalid binding; preserve historical results separately from current comparison eligibility. Record measured models, prompts/templates, tools, retrieval, dependencies and output processing, with unmeasured components explicit. A digest can flag change; it does not prove safe behavior or attest to unmeasured state. Study dates, methods, results and consequential limitations are in Research evidence . Related: decision provenance , supply-chain security .

Family 4 — Protocols & Interop

How agents talk to each other and to the world.

MCP Ecosystem. A protocol for connecting model applications to tools and context. Pin the specification and extension versions: the July 28, 2026 core uses stateless requests and per-request capability negotiation; Tasks, Skills over MCP and MCP Apps are optional extensions. Capability advertisement is distinct from attestation and action authority.

Sources: MCP 2026-07-28 specification . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Related: workload identity and credentials , task- and effect-bound authorization . Protocol access is distinct from authority for a particular action.

A2A Protocol. Cross-agent messages, tasks and capability descriptions. In v1.0.1, Agent Card signing is optional and clients should verify signatures when present. Signed metadata supports integrity, not proof of competence or permission for every downstream action. Specification maturity and production deployment need separate evidence.

Sources: A2A v1.0.1 specification . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Agentic Commerce. Separate payment authorization mandates from checkout integration and payment transport. AP2 v0.2 specifies bounded mandates and trusted verification; agent-to-agent mandate delegation and particular dispute procedures remain outside its scope. Compare AP2, UCP, x402 and MPP by their actual layer and version, rather than treating them as interchangeable governance solutions.

Sources: AP2 agent payments specification . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Capability Discovery. Distinguish repository instructions such as AGENTS.md, metadata schemas such as OASF, and network discovery through Agent Cards. Descriptions help select candidates; verification, identity and task-specific authorization remain separate. An instruction file is not a discovery protocol or a trust certificate.

Sources: AGENTS.md , Open Agentic Schema Framework , A2A v1.0.1 specification . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Standards Bodies. Separate published standards, harmonised references, protocol specifications, threat taxonomies and work in progress. NIST’s agent initiative is standards-development work. EN 18286:2026 now has an EU AI Act harmonised reference for covered Article 17 quality-management requirements; that presumption is narrower than compliance with the entire Act.

Sources: NIST AI Agent Standards Initiative , First harmonised standard supporting the AI Act , OWASP Top 10 for Agentic Applications . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Family 5 — Economic, Legal & Regulatory

What it costs, who is liable, and who decides.

Sectoral Compliance. Track jurisdiction, covered system, actor, obligation and effective date. SR 26-2 excludes generative and agentic AI from its scope. The Commission’s current AI Act overview distinguishes general application from later high-risk dates. Colorado SB26-189 replaced the earlier framework; developer requirements start January 1, 2027. Avoid treating every governance instrument as a binding agent-specific law.

UK FCA examples apply existing rules to agentic use; they do not create a separate AI rulebook. Distinguish that supervisory evidence from enacted legislation. Sources: FCA: AI in financial services—good practice and areas for improvement . Study scope and limits: Weekly evidence .

Sources: Federal Reserve SR 26-2 and revised model risk guidance , European Commission AI Act implementation overview , Colorado SB26-189 enacted bill overview . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

AI Insurance & Risk Transfer. Separate infrastructure/property coverage, cyber and professional liability, and specific model-performance guarantees. ATA’s up-to-$750-million facility is an AI infrastructure capacity announcement, not blanket autonomous-agent failure insurance. Examine policy wording, exclusions, triggers and actual written cover; announced capacity is not claims paid or proof of governance adoption.

Sources: ATA launches up to $750 million AI infrastructure facility . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Liability & Tort. Identify the legal question, jurisdiction, procedural stage and actual holding before generalizing a case. Heppner concerns privilege and work-product protection for self-directed consumer-AI exchanges, not autonomous-agent tort liability. Contract allocation, professional duties, product claims and liability for external actions need distinct evidence.

Sources: United States v. Heppner, memorandum, Doc. 27 . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

IP & Copyright. Separate training-data rights, output authorship, infringement and contractual ownership. The US Copyright Office’s Part 2 report assesses human expression and selection or modification case by case; prompts alone generally do not confer authorship of generated expression. This does not settle training-data litigation or establish a worldwide rule.

Sources: US Copyright Office AI report Part 2: Copyrightability . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Pricing & Monetization. Compare subscriptions, per-user, per-conversation, per-action and outcome-linked contracts. Agentforce itself offers multiple pricing approaches. Report the chargeable unit, failures, retry and tool costs, included capacity and contract date; a rate card does not establish market leadership or cost per verified successful task.

Sources: Salesforce Agentforce pricing . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Compare total cost per verified successful task, including retries, verification and human review, alongside latency and review time. Related: Agent Evaluation & Verification .

Capital Markets. Track financing, licensing, acquisitions and public offerings with dated primary disclosures and explicit announcement versus completion status. ServiceNow confirmed completion of Moveworks in December 2025. Individual deals can show strategic intent; they do not by themselves establish market concentration or who captures value.

Sources: ServiceNow completes acquisition of Moveworks . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Sovereign Compute. Examine data location, legal jurisdiction, ownership, operational control, power availability and export restrictions separately. National AI partnership programs can propose local infrastructure without constituting treaties or proving that announced capacity is operating. Record committed, built and energized capacity distinctly.

Sources: OpenAI for Countries . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Family 6 — Organizational & Conceptual

How organizations and people relate to agents.

Autonomy Gradation. Separate what an agent can accomplish from what it is permitted to do without further review. Specify authority per task and action, including resources, limits, revocation, and escalation. A system can be highly capable while operating under narrow grants. Evaluation establishes capability; enforceable policy establishes allowed action.

Sources: CapScope , Towards a Science of AI Agent Reliability , WIMSE AIMS . This is an editorial distinction between capability and allowed action; the studies do not establish autonomy certificates as a widely adopted procurement practice. Study dates, methods, results and consequential limitations are in Research evidence . Related: authorization , evaluation .

Workforce & Human-Agent Teaming. Design decision rights, responsibility, override paths and learning around the role an AI plays. Interviews distinguish assistant, arbiter and manager roles and show that workers can retain accountability while losing authority. Evaluate output quality, review work and elapsed effort on the actual task; productivity effects vary with users, tools and work settings.

Operational oversight requires trained reviewers who have usable information and power to override or escalate. Record whether review occurred and what changed; assigning responsibility alone does not demonstrate effective challenge. Sources: FCA: AI in financial services—good practice and areas for improvement . Study scope and limits: Weekly evidence .

Sources: From Tool to Agent: How Worker Needs Reorganize Across the Agentic Roles of Workplace AI , METR early-2025 experienced developer study , METR update on developer productivity measurement . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Job Displacement. Separate task exposure, adoption, productivity, hiring, employment, recorded hours and earnings. Administrative evidence exists: a Danish survey-linked study finds task reorganization with little average earnings or hours impact through 2024. Its observational design, country and time window cannot establish the effects of later autonomous agents or rule out future displacement.

Sources: Still Waters, Rapid Currents: Early Labor Market Transformation under Generative AI . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Agent Ethics & Welfare. Investigate possible moral status and welfare alongside effects on people. Anthropic’s exploratory agenda explicitly acknowledges uncertainty and the absence of agreed consciousness measures. Distinguish a research program, model self-report and demonstrated welfare effect; adoption by other labs cannot be inferred from one provider’s publication.

Sources: Exploring model welfare . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Decision Provenance. Reconstruct the request, evidence, policy, delegated authority, and state changes behind an action. Distinguish observed execution records from generated explanations and counterfactual hypotheses. A valid authorization proof can establish a bounded policy relation while leaving execution binding open; a plausible explanation cannot replace evidence that the approved action occurred.

Sources: Cryptographically Verifiable Authorization , ACLE-MCP , WIMSE AIMS . CVA and ACLE-MCP are preliminary prototypes with different trust assumptions; proof validity, policy appropriateness and execution binding are separate claims. Study dates, methods, results and consequential limitations are in Research evidence . Related: observability , authorization .

Open vs Closed Weights. Compare access to weights, code, training information, deployment control, licensing and full operating cost separately. Check each model checkpoint’s terms; a repository’s code license need not cover every weight release. Qwen’s current release repository does not support a blanket story that open weights have become a commodity or disappeared behind premium closed models.

Sources: Qwen3.8 official repository . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

Family 7 — Human-System Surfaces

The newest family in v2.0. How humans actually relate to agents under load — not in demos.

Intervention Geometry. Latency, granularity, authority, and reversibility determine how a human can intervene. Specify what can be paused, cancelled, corrected, or recovered, and which external effects are already committed. Measure failed escalation, review burden, and recovery quality alongside task completion. A successful final artifact can still contain a harmful execution history. When approval is required, the displayed effect and executed call must match; evaluate false approvals, false refusals, and prompt flooding separately.

Evaluate a human review pipeline: task-relevant checking, defect-revealing evidence, correct interpretation, and successful correction. Count failures at each stage; visible activity and confident approval do not establish effective review. Sources: Looks Fine to Me: Understanding Oversight in Agentic Interactions . Study scope and limits: Weekly evidence .

Human-study evidence now complements the earlier automated-approver prototypes: compare problematic-action exposure, recognition, conditional intervention and final consequences separately. Plan approval does not authorize every state encountered later. Sources: Comparing Human Oversight Strategies for Computer-Use Agents .

Sources: Traverse and Scout , Intent-Governed Tool Authorization , Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization , LEASH: Uncertainty-Aware Weak-to-Strong Escalation and Oversight for Computer-Use Agents . Effect-bound approval uses model approvers in a prototype, not a human usability study. LEASH tests automated handoff, not human intervention. Interface requirements are design inferences from the observed failures. Study dates, methods, results and consequential limitations are in Research evidence . Related: calibration , authorization .

Interface Compression. Make task-relevant state, evidence, changes and commitments inspectable without hiding consequences. Measure review time and workload alongside risk recognition, successful intervention, task quality and irreversible effects. Fewer prompts or shorter summaries alone do not establish better oversight; attention needs depend on expertise, authority and timing.

Distinguish perceived oversight, observable checking and corrected defects. Low input activity can include careful reasoning; gaze, typing or physiological signals should not be treated as validated universal engagement detectors. Sources: Looks Fine to Me: Understanding Oversight in Agentic Interactions . Study scope and limits: Weekly evidence .

Sources: Comparing Human Oversight Strategies for Computer-Use Agents . Reviewed October 20, 2026; dates and consequential limitations are in Expanded review evidence .

How to use this map

Each dimension on this page is a category or sub-category in the editorial taxonomy of this site. Posts are filed against exactly one category and tagged with the entities and meta-patterns they touch. If you came here from a post, the section above tells you where that post sits in the larger picture. If you came here cold, pick a family that interests you and the post archive will show you what's been written under it.

Versioned because the landscape moves. Current version: v2.3. Previous content is retained in CMS revision history. Material changes and research evidence make the update auditable.

v2.3 changes

Published October 26, 2026. Added cross-session memory/scheduler attack tests, authorization failures under benign pressure, interactive evaluation budgets and equivalent-implementation checks, feedback-driven candidate-selection controls, and version-pinned interruption/recovery checks. Human oversight now distinguishes diagnostic evidence, interpretation and repair from confidence or activity. Added scoped UK FCA practice evidence and seven primary records, bringing the retained ledger to 100. Ten dimensions supplemented; no taxonomy or meta-pattern count change: 49 dimensions across families of 6, 8, 15, 5, 7, 6 and 2; eleven meta-patterns. All seven families were scanned; unchanged categories were not independently revalidated in full.

v2.2 changes

Published October 20, 2026 after reviewing all seven families. Corrected durability and sandbox boundaries; separated world-model demonstrations from reliable control; qualified interpretability and activation-steering claims; added self-monitoring and human-oversight evidence. Updated MCP and A2A semantics, commerce mandate limits and discovery layers. Corrected banking, EU and Colorado scope, insurance and legal-case claims. Replaced unsupported market rankings and workforce predictions with bounded primary evidence. Added 36 source records. Counts remain 49 dimensions (6, 8, 15, 5, 7, 6, 2) and eleven meta-patterns. This includes catch-up corrections to older claims as well as new October research; it is not 36 newly published papers.

v2.1 changes

Published October 20, 2026. Six net additions bring the visible map from 43 to 49 dimensions; the previous introduction advertised 56. Added Coordination & Shared State; split memory into working context, persistent evidence and continual skill learning; added Agent Evaluation & Verification, Agent Authorization & Delegation, and Prompt-Injection & Information-Flow Control. Rewrote five meta-patterns and revised identity, uncertainty, observability, oversight, drift, autonomy, provenance and intervention. Added primary sources, experimental limitations and cross-links. Family counts are 6, 8, 15, 5, 7, 6 and 2; eleven meta-patterns are retained.

Research evidence

The map now includes an October 20, 2026 claim audit across all seven families, alongside the earlier deep review of evaluation, memory, coordination and authorization. The earlier 57 principal records are retained; the expanded review adds 36 dated primary records. This is a bounded review of material claims and selected research, not an exhaustive literature census or independent replication. Preprints, provider reports, live documentation and legal summaries carry different evidential weight. See Expanded review evidence for new findings and access limitations. The October 26 weekly review adds seven records (100 cumulative), with new scope and limits in Weekly evidence .

Evaluation evidence

AgentHorizon — October 8, 2026, v1, preprint. Judges 1,373 instruction–trajectory items from human recordings, including swapped near-matching instructions. Eleven judges; the best agentic judge scores 80.9% balanced accuracy on the paper's 528-item hard subset. It tests judging, not agent task execution. The released dataset card uses a different partition; pin the manifest before reproduction. Supports evaluator validation and separate positive/negative error rates.

Traverse and Scout — September 15, 2026, v1, preprint. Traverse has 1,423 human-verified trajectories and 44,341 steps. Six judges locate the first error in fewer than one third of failed software or terminal runs. Safety analysis finds destructive actions in solved runs. Scout selects among pre-generated candidates; best-of-N gains include extra generation compute and do not establish prevention of live harm.

Measurement-First Auditing of Agentic Leaderboards — October 5, 2026, v1, preprint. Separates training exposure, retrieval leakage, and scaffold leakage. Nine HAL configurations; four narrower pipeline incidents. Matched localization controls retain 100 pairs; GPT-4.1's ten-point Top-3 difference has a confidence interval including zero. Limited models and repositories; neither broad prevalence nor causal score inflation is established. Direct reason to qualify the blanket contamination claim.

Agents Are Systems, Not Models — October 1, 2026, v1, preprint. Factorial study of four science tasks, three backbone sizes, budgets, reasoning, information, and verification; five repeats per configuration. About 54% of variance among genuine attempts is repeat-run noise. Dedicated verification tools alter behavior more than stronger verification prompts in the tested setup. Score analyses exclude non-completions. Supports reporting configuration, completion, repeats, and costs separately.

Towards a Science of AI Agent Reliability — ICML 2026; arXiv v3 , June 2 revision, first February 18. Fifteen models, 165 GAIA tasks and 26 airline tasks, five repeats, paraphrases, fault injection and tool-format shifts. Twelve metrics distinguish consistency, robustness, predictability, and safety. Calibration and safety improve while some reliability measures lag. One scaffold per benchmark and narrow tasks limit transfer; reliability is not uniformly stagnant.

Do Agents Know When They Succeed — first September 8, revised October 12, 2026, v2, preprint. Across three local coding models and three environments, at least one internal method obtains the best AUROC and Brier score in each tested setting versus specified baselines. Nested cross-validation; offline teacher-forced replay. Needs labels and model access. Does not establish prospective early warnings, cross-domain transfer, or zero-overhead production deployment.

Odysseys — April 27, 2026, v1, preprint. Two hundred live-web tasks; rubric validation on 120 trajectories. Task-level rubric agreement is κ=0.849 versus κ=0.508 for holistic judging; best tested perfect-task success is 44.5%. Live sites change and the validation sample uses one model's trajectories. Shows that scoped rubric judges can work well; it does not establish general judge reliability.

APEX Agents — first January 20, revised February 23, 2026, v3, preprint. Four hundred eighty expert-created professional tasks; eight systems with eight repeats. Best tested pass@1 is 24.0%, all-eight success 13.4%. Criterion judging has 98.5% accuracy on 747 human labels. Constructed worlds and selected tasks differ from field deployment; criterion accuracy cannot be transferred to full-trajectory safety judging.

Holistic Agent Leaderboard — October 13, 2025, v1; HAL lists ICLR 2026. Reports 21,730 rollouts, accuracy–cost frontiers, and logs across nine models and benchmarks. More reasoning produces equal or lower accuracy in 21 of 36 tested combinations. Incomplete matrix and external rate limits complicate comparisons, especially latency. Supports cost-controlled system evaluation and logs, not a universal rule that reasoning effort is wasteful.

Agentic Benchmark Checklist — first July 3, revised August 7, 2025, v5. Audits task and outcome validity in ten benchmarks, finding weak checks and shortcuts, including insufficient software tests and empty-answer credit. Findings apply to inspected versions. Scorer flaws are different from contamination. Supports explicit scorer validation, shortcut controls, solvability, and benchmark revisions.

LEASH: Uncertainty-Aware Weak-to-Strong Escalation and Oversight for Computer-Use Agents — October 15, 2026, 17:40 UTC, v1, preprint. Four weak backbones, stronger executor and Manager; 262 OSWorld tasks, disjoint 99-task reference pool, 50-action budget. Best configuration reports 73.66% success and $0.4117 token-priced inference per task versus always-on strong executor 72.90% and $0.5094. Runtime escalation and pending-action reassessment are tested. Manager labels are subgoal outcomes, not individual-action correctness; always-on comparator lacks Manager. Include shadow probes, stronger-model calls and reference-bank collection. Local-model reference token prices are not hardware costs. One benchmark; no general equivalence test, human escalation study, or demonstrated undo of committed effects. Confidence: High that this is online experimental evidence; moderate for transfer to other workflows.

When Can You Trust an Agent's Own Verifier? — October 16, 2026, 00:41 UTC (October 15 New York), v1; metadata reports NeurIPS 2026 workshop acceptance. One generator, six supervised pipeline tasks, three seeds; verifier-weight sweeps, claim-minimization control, precommitment probe access. Probe access selects passing claims while held-out rationale fidelity falls; Credit-G decline has non-overlapping intervals. Initial verifier influence is weak. Short searches and no immutable served checkpoint; some declines are confounded by rules for pipelines with at most ten features. A null claim-minimization result with feedback omitting claim counts is not robustness. The proposed pressure ratio is not a universal threshold. Supports verifier-unseen checks under adaptive search. Confidence: High for requiring unseen checks; moderate for mechanism generality.

AgentEval: Evidence-Bounded Assessment of Stateful Agents — October 15, 2026, 03:32 UTC (October 14 New York), v1, preprint. Three bounded tool-world families, two configurations: 32 allocated administrations, 30 complete and two retained interruptions. Independent contract checks agree on complete runs. Forty-eight edited evidence views expose binding faults; hash-only checks accept 36. Separate custom retail study has 192 held-out executions and ten successful return subgoals inside whole-task failures. Edited views are not independent agent trials. Assumes trusted capture, host and checker; fixed exact-answer checks do not validate open-ended judges. Distinguish obligation violation from missing evidence/invalid binding and preserve historical results separately from current comparison eligibility. Confidence: High for assessment-binding distinction; moderate for wider operational evidence.

Stronger Judges Do Not See More: Deployment-Integrity Blindness in LLM Evaluation — October 15, 2026, 02:44 UTC (October 14 New York), v1, preprint. 7,560 scored examples: 120 synthetic tasks, seven conditions, three model pairs, three seeds. Single-component changes can preserve tested behavior. Manifest comparisons detect declared changes; an undeclared template change escapes. Benign declared changes also mismatch identity. Small open models and only 16 multi-step AgentDojo tasks; software manifests are not hardware attestation. A forger of manifests is outside scope. Stronger judges accepting deliberately preserved-correct outputs does not imply worse task grading. Record measured components and coverage separately from behavior. Confidence: High for separate behavior/identity claims; moderate for deployed detection coverage.

Memory evidence

AutoCompact — October 1, 2026, v1, preprint. Trains compression timing, summaries, and continuation jointly using supervised initialization and reinforcement learning. Same-model/scaffold results rise 30.4% to 39.6% on SWE-bench Verified and 19.5% to 24.5% on SWE-PolyBench Verified. Compaction ablations help isolate effects. Two coding benchmarks establish working-context improvements, not universal persistent learning.

MemPursuit — October 11, 2026, v1, preprint. Selects complementary memories through residual-guided query reconstruction. Controlled store, candidate pool, answerer, and entry budget. LoCoMo gains are 7.2 points at Top-10 and 5.5 at Top-20 over the specified hybrid baseline. Entry counts are not matched token lengths; reranking speed excludes the rest of the pipeline. Evidence composition is the supported mechanism.

JAM — September 28, 2026, v1, preprint. Preserves raw history in hierarchical pages and uses a trained researcher to construct context for each request. LongMemEval accuracy is 65.2% versus vanilla 54.8%; LoCoMo F1 is 52.09 versus RAG 43.37. Training and architecture both contribute; some comparisons use different backbones. Include offline construction and online research costs.

EvalMem — September 3, 2026, v1; metadata reports EMNLP 2026 Findings acceptance. Separates encoding, retrieval, and generation diagnosis across seven systems and three datasets. Default LoCoMo attribution rates are retrieval 22.1%, encoding 7.7%, generation 6.5% of all questions, with overlapping labels. LLM examiners and standardized systems limit generalization; diagnostics add cost. Supports lifecycle instrumentation rather than a single QA score.

Grounding Agent Memory — September 10, 2026, v1, preprint. A curator uses read-only environment probes before writing memories. Schema-drift passes: no memory 39%±4, full context 61%±11, memory 70%±16, memory plus probing 73%±5; displayed intervals are reported 95% confidence intervals. The incremental probing comparison is 70 to 73, not 39 to 73. Task-agent costs exclude curation; simulated enterprise-like tasks are not field evidence.

AgentCL — first June 1, latest September 26, 2026, v3, preprint. Dependent, conventional, and independent task streams separate plasticity, stability, and generalization. On held-out HumanEval-Pro, memoryless ReAct scores 72.5%; MemProbe scores 71.7/70.8 after dependent/conventional streams. External-memory adaptation only; standardized retrieval and reimplementations. Demonstrated reuse and held-out transfer are different outcomes.

CL-Bench — June 4, 2026, v1, preprint. Six expert-validated environments share latent task structure; learning gain subtracts each system's own stateless baseline. Full-context Sonnet 4.6 leads aggregate gain at 25.4%±3.6 with a reported 95% confidence interval; dedicated memories do not dominate its cost frontier. Some environments favor memory agents. Short sequences and context adaptation do not settle lifelong or weight-based learning.

ALMA — February 8, 2026, v1, preprint. Runs domain-specific searches over executable memory designs across four sequential-decision environments. GPT-5-mini mean rises from 41.1% without memory to 53.9%; best manual mean is 48.6%. Dynamic Cheatsheet still beats ALMA on Baba Is AI, 38.0 versus 33.3. Small text worlds and search costs limit transfer; learns memory design, not foundation-model weights.

SkillLearnBench — April 22, 2026, v1, preprint. Twenty skill-dependent tasks, six models and four skill-generation methods. Mean accuracy: 10.17% no skills, 27.33–31.08% generated skills, 74.50% human reference skills. Selected tasks favor skill dependence and teacher feedback has reference access. Distinguish a library's benefit from reliable autonomous skill acquisition and transfer.

Revoked but Still Authoritative — September 8, 2026, v1, preprint. Nine superseded-policy scenarios, nine models, five memories. Graphiti default exposes revoked records; mem0 default withholds expired records, while an override exposes them. Other failures include missed supersession and lost validity metadata. Specific configurations, not a universal product audit. Derived summaries can retain stale authority, motivating use-time validity checks.

Governance Decay — first June 21, revised June 27, 2026, v2, preprint. In 1,323 simulated episodes, explicit policy yields 0% violations while compacted state yields 30%; pinning constraints restores 0% in that benchmark. Operator impersonation defeats pinning. Tool-call violations are scored deterministically; constraint-survival judgments use LLM assessors. Simulated tools and limited repetition constrain transfer. Pinning text is not enforceable authorization.

MemSecBench — July 29, 2026, v1, preprint. Three hundred ten cases across 24 configurations test Write–Execute–Forget, inspect artifacts and downstream consequences. Persistence is 84.2%; full write–execute success 50.3%; selective repair 56.1% conditional on poisoning. Constructed cases and judge components. Verbal deletion claims are insufficient: inspect backend state and preserve benign memory during repair.

Prune the Summary, Not the History: Source-Judged Compaction for Long-Horizon Agents — October 14, 2026, 20:57 UTC, v1, preprint; after initial review. AppWorld 168 and OfficeBench 95-task subset, two agents, three runs, matched host-compression method within each agent condition. All-three-run Pass^3 improves 2.1–8.9 percentage points in four settings, while mean accuracy falls one point in one setting. Source support is not truth. Supported-entry recall is 64.2%; pruning a valid recipient restriction contributes to two of three MiniMax failures in a case. Source-judge compute is additional. A single always-visible instruction is assumed; multi-turn standing commitments were not validated. Require both provenance and constraint-preservation tests. Confidence: High for retaining constraints; moderate for general compaction gains.

Rethinking the Role of Tool Graph Memory in Multi-Turn Tool Use — October 15, 2026, 09:24 UTC, v1, preprint. ToolNet and H-EPM across nine open models on ToolSandbox/BFCL v4, three runs; random and no-suggestion ablations on three models retain much of the gain. H-EPM uses 2.72× calls and 2.21× tokens on ToolSandbox. Situation-level textual insights often have a better tradeoff. Costs reported but comparisons are not all equal-budget; include offline insight construction. These are tool-transition graphs, not all temporal/entity graph memories. Require no-memory/random/no-guidance controls before attributing gains to graph structure. Confidence: High for baseline/cost requirement; moderate outside tested graph methods.

MetaExp: Learning to Self-Improve through Experience via Verifiable Cross-Task Environment Scaling — October 15, 2026, 08:29 UTC, v1, preprint. SFT on 4,956 trajectories in 1,000 synthetic task families; Qwen3.5-122B-A10B. Downstream weights frozen, banks start empty, adaptation/evaluation tasks disjoint. Spreadsheet 65→73.5%, Automation 14.5→29.3%; APEX peak +2.3 points, final +1.8. One backbone, three runs, rich verifiable feedback, short streams. Domain variance includes investment banking −2.5 points; stronger models retain higher absolute scores. Reported SD is not a confidence interval. Separate prior training of the learning behavior from downstream external-memory updates. Confidence: High for distinguishing training from memory adaptation; moderate for broad transfer.

Evolving Together, Failing Apart: The Skill–Policy Co-evolution Trap in Self-Improving Agents — October 14, 2026, 19:29 UTC, v1, preprint; overlap-window catch-up. Four co-evolution methods, five benchmarks/six settings; fixed policy/tasks while banks are rewritten, made incomplete/misleading, composed or removed. Worst tested success falls 4.9–12.6 points from peak and loses 52–93% of bank benefit. Small 4B/7B models, method/backbone confounding, and LLM rewrites may not preserve meaning. Stress-case worst drops are not natural failure incidence; no mitigation is validated. Supports perturbing learned skill banks as well as measuring peak gains. Confidence: High for perturbation testing; moderate for general failure magnitude.

Coordination evidence

ScaleMAS — October 12, 2026, v1, preprint. Asynchronous agents use append-only linked messages and bounded search. At roughly 3.5M tokens on the tested BrowseComp-Plus subset, eight-agent ScaleMAS reports 79.8%, versus eight-agent debate 73.0% and four-agent ReAct 72.0%. These are Pass@N on the first 100 instances. Selected-answer reliability is open. Improvement continues at 128 agents on constructed Contradiction Audit recall, which does not penalize extra reports; FATE largely plateaus by sixteen.

Scaling Agent Systems — first December 9, 2025, revised April 8, 2026, v3. Two hundred sixty configurations, six benchmarks, five architectures, three model families, matched reasoning-token budgets. Relative gains range from +80.8% on decomposable financial reasoning to −70.0% on sequential planning. Under dataset-clustered inference, capability saturation is the only predictor significant at α=.05; other effects are directional. Small clusters and wide software-task intervals constrain transfer. Popular v1 figures are stale; thresholds and error ratios are study-specific.

SAIGE — first September 17, revised September 18, 2026, v2, preprint. Dynamic spawning and dependency-based context retrieval with one backbone, shared harness, at most four agents. Single versus SAIGE: terminal 76.71 versus 75.50; research 51.49 versus 55.23; AgentIF 53.57 versus 71.80. Aggregate budgets are reported but not uniformly equalized. Task decomposition benefits vary; output cost and formal assumptions need attention.

AgentWorld — September 25, 2026, v1; paper reports COLM acceptance. One hundred main and one hundred augmented game tasks, 3–20 asymmetric agents, 25–55 rounds. Best main success 52%; augmented 24%. No-chat control 26%, homogeneous roles 21%, centralized controller 54%. Designed asymmetric tasks do not establish general multi-agent superiority. CCE scores failed tasks zero; its aggregate is not the fraction of useful actions in successful runs.

MAST — first March 17, revised October 26, 2025, v3. More than 1,600 traces across seven frameworks; fourteen failure types and expert agreement κ=.88. Case-study role and objective-verification changes improve outcomes with the same model. Mixed tasks/models prevent clean framework rankings; current incidence rates need remeasurement. Supports naming delegation, alignment, and verification failures separately.

Debate or Vote — first August 24, revised October 23, 2025, v2; NeurIPS Spotlight. Five homogeneous agents on seven static QA datasets. Qwen average: independent vote 76.91%, two-round debate 73.77%, single sample 72.05%. Static tasks and protocol assumptions limit transfer; single versus panel compute is not equal. Independent sampling must be a baseline before crediting communication.

Distinct-Peer Random Routing — September 22, 2026, v1, preprint. Eight homogeneous agents on five QA tasks. Short random routing reports 77.33% at 12.36k tokens/question versus an adapted learned-edge comparator 76.27% at 57.59k. Small static tasks and an adapted comparator; not a verdict on all learned topology. Simple routing and stopping baselines are necessary.

Causal Audit of Latent Communication — July 29, 2026, v1, preprint. No-message, other-example, current-message, and self-substitution controls isolate information from extra compute. Four-billion-parameter MATH gains split into generic and example-specific contributions; effects change by task and model size. Small samples and inconclusive intervals. End accuracy alone cannot establish that a latent channel communicates useful evidence.

Minority Sentinel — June 28, 2026, v1, workshop paper. Three-model debate on 1,754 QA cases; minority correct in 25.5% of divergent cases. Selective classifier yields +1.71 points overall, with 39 correct and nine incorrect flips. Per-dataset threshold selection can be optimistic; semantic features still use an LLM. Supports testing minority suppression and false overrides, not a general validated aggregator.

xAI Multi Agent documentation — living official page, checked October 14. Describes provider-managed four- or sixteen-agent teams and a leader that synthesizes responses. It supports the product example. It supplies no public evidence of shared neural weights, learned topology, or communication inside a single forward pass. Those architecture claims require their own sources.

Mixture of Debaters — June 28, 2026, v1, preprint. Frozen vision-language backbones and trained routed adapters study internalized debate. ScienceQA gains over specified MoE-LoRA baselines are modest; the stronger evaluation uses two self-review rounds. Internalized debate is a real research direction, while one model does not necessarily mean one complete forward pass. It does not establish Grok's implementation.

Learning to Steer LLM Agents and Multi-Agent Systems — October 15, 2026, 17:51 UTC, v1, preprint. Learned Qwen3-8B supervisor over frozen Qwen2.5-7B search executors in five-role Wikipedia QA. Delivered-answer token F1: no intervention 42.49, trained every-handoff 47.83, zero-shot supervision 35.34; host turns 9.2, 11.9, 24.1 respectively. Narrow setting with weak executor; host turns omit supervisor compute and appendix slow guidance is about 30 seconds. No equal-total-dollar comparison to a strong single agent. Shows intervention can help or harm and monitoring cost must be explicit. Confidence: High for paired harm/cost reporting; moderate for deployment generality.

Jev-LiteMAS: Separating Decisions from Generation in Multi-Agent Workflows — First October 15, 2026, 07:26 UTC; revised October 16, 02:03 UTC, v2, preprint. Bounded expert selection and pass/escalate screening; generative re-review and feedback on escalation. Two backbones; 150 instances per benchmark, with API-Bank using 150 episodes and 445 prediction points. Native scoring includes MBPP+ EvalPlus pass@1: 12.7–54.6% fewer generative tokens than LAS, score differences within 1.34 points, lower latency in seven of eight settings. Headline excludes decision tokens, but §5.5 reports decision API fee share 1.56–2.14% and latency share 2.92–6.85%. Predefined roles, no equal-total strong-single baseline. Erroneous passes bypass review; corruption tests do not estimate natural incidence. Confidence: High for all-component cost and false-pass testing; moderate for broad savings.

ARIA: Runtime Inspection and Amendment for Multi-Agent Systems — October 14, 2026, 18:27 UTC, v1, preprint; overlap-window catch-up. Outcome-trained runtime inspection and repair with paired harm metrics. Native interface permits at most one pending plain-text substitution per run, not arbitrary tool/structured rewrites or rollback. EB=1 counts one host execution while excluding inspector tokens/latency. Locally adapted baselines, some evaluator-only or recorded training backends. Author repository available; not rerun. Supports explicit intervention boundaries and paired recovery/harm accounting. Host compatibility and authority validation is our design inference, not a demonstrated ARIA authorization guarantee. Confidence: High for explicit intervention boundary; moderate for transfer beyond native interface.

Authorization evidence

CapScope — September 8, 2026, v1, preprint. Five Python repairs, five injection carriers, four conditions, three trials per cell, one model. Executed attacks: 47/75 ambient, 33/75 shared task policy, 3/75 per-agent capabilities. Scoped repairs complete 68/75, matching task-policy completion; mean latency grows 194 to 316 seconds. Narrow tasks and imperfect grant construction. Per-agent limits help but have measurable costs and residual attacks.

RAISED — first October 5, revised October 7, 2026, v2, preprint. Three seeds and several local model families. Gemma AgentDojo attack success falls 39.5% to 1.0%; benign utility changes 84.5% to 83.5%. Static attacks only; failed adaptive optimization is not evidence of adaptive robustness. Teacher mistakes are preserved. Evaluate authorized utility and attack outcomes together.

CaMeL — first March 24, revised June 24, 2025, v2. Separates trusted planning from untrusted processing and tracks provenance through a policy-enforcing interpreter. o3 High benign utility is 77.3% versus 84.5% native calls; reported median token overhead is 2.82× input and 2.73× output. Side channels, policy quality, and declassification remain issues. Author code is a research artifact.

Intent-Governed Tool Authorization — first June 22, latest September 18, 2026, v4, prototype. Intent certificates narrow static rights. Forty intent-inconsistent drafts accepted in 198 attack/ambiguous trials, without completed unsafe effects. Strict benign completion 0/108; 36/108 yield governed artifacts. Synthetic, review-oriented study with no matched real-model substrate-only control; normalization results are trace-rescoring. Rejecting unauthorized authority and withholding final execution are distinct achievements.

ACLE-MCP — September 2, 2026, v1, prototype. Binds invocation authority to current workload appraisal and sender-constrained leases. Four benign and six constructed misuse families across ten repetitions; complete design blocks tested cases. Main authentication/attestation components are simulated, and reported latency is warm-cache local measurement. Demonstrates execution-binding feasibility, not production readiness.

Cryptographically Verifiable Authorization — First July 23, published September 24, 2026; author version v3, preliminary model and proof of concept. Groth16 prototype binds principal, plan, and encoded policy; gateway state handles replay. Context binding, runtime execution binding, and delegation-chain evaluation remain open. No independent circuit audit. A proof's validity does not establish the policy's appropriateness or that the committed action ran.

Capability Gates Are Not Authorization — June 27, 2026, v1, audit/prototype. Pinned framework commits expose tools without default deterministic argument-level authorization in the inspected paths. ScopeGate passes bounded static and adaptive tests plus benign controls. One author's corpus, limited attack budget, no remote-server audit or asserted CVE. Do not apply findings to every current framework version.

AgentSecBench — May 25, 2026, v1, preprint. Six defense classes and two small Qwen models under deterministic decoding, paired controls and exact-marker security events. Separates integrity and confidentiality. Markers miss paraphrased secrets and semantic violations; clean tenant labels and short traces constrain claims. Useful measurement design, not broad deployed-agent security assurance.

MCP authorization — and security practices , July 28, 2026 specification, checked October 14. HTTP access controls, scopes, resource indicators, audience validation, and forbidden token passthrough. Transport-level rights are distinct from interpreting a current request and bounding each tool's effects. Scope statements should preserve the specification's optional authorization support and transport boundaries.

WIMSE AIMS — September 15, 2026, working-group Internet-Draft. Supersedes draft-klrc-aiagent-auth; composes identity, OAuth delegation, revocation, monitoring and audit. Mission-to-authorization translation remains out of scope. Grant binding and durable audit support the proposed boundaries. This is work in progress, not a final RFC or proof of widespread adoption.

Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization — October 15, 2026, 01:11 UTC (October 14 New York), v1, preprint. Ten pinned runtimes, eight with measurable binding: three pass, one partial, four fail. Trusted gateway renders canonical effects and dispatches stored calls. ASU-27: 108 scripted trials, 609 AgentDojo attack pairs, fifteen model approvers; no human study. Modeled detection .30→.98 and benign refusal 16% on constructed stimuli; prompt flooding remains .45–.60. No measured second-device gain because host display is uncompromised by construction. Tamarin 53 lemmas depend on read-card, closed-enrollment and trusted-origin assumptions. Scoped approval reuse is allowed within explicit bounds. Passkeys bind a key, not human understanding; prototypes do not establish usability or current framework-wide prevalence. Confidence: High for effect/display/execution binding; moderate for empirical generality.

When Approval Becomes Execution: Authorization-Grounded Workflow Attacks on Tool-Using Agents — October 16, 2026, 07:47 UTC, v1, preprint. Three controlled EnterpriseOA document targets, 23 local validations. Original approval path 9/9, exact operation 8/9; four single-factor removals 3/3; two non-document target controls 0. Token possession is accepted without jointly checking requester, approver authority, resource, action, recipient and purpose. Small author-controlled benchmark, not general production prevalence. Defenses are proposed, not evaluated. Supports dispatch-time joint policy checks rather than treating token possession as permission. Confidence: High for the demonstrated binding gap; moderate for wider prevalence.

The Agent Clicks Approve: Injected Page Text Makes Browser Agents Authorize Access the Task Never Named — October 10, 2026, v1, preprint; overlap-window catch-up, experiments run June 2026. Two browser models, controlled consent/webhook app, serialized DOM, no login. Seventy-three of 73 ungated unauthorized effects succeed; all 70 gated attempts block; all 73 authorized controls complete. Task envelope supplied directly or via a deterministic matcher for two forms. General free-form intent extraction, server enforcement outside the gate, step-up and administrator consent are untested. Supports task-bound execution in a controlled setting, not a solved intent compiler. Confidence: High for controlled task/effect binding; moderate outside the test envelope.

Review boundaries and open questions

AgentHorizon’s paper/release partition discrepancy remains unresolved. No primary replication, retraction or correction overturning the tracked results was established in the bounded October 19 search; this is not proof that none exists. Indexing delays, later submissions, venue revisions and private evaluations remain coverage limits. High-value next tests include equal-total-budget team selection, independent memory transfer, constraint survival, prospective failure lead time, verifier-unseen checks, damaged successes, delegated revocation, effect binding and human review costs.

Earlier map terms

Multi-Agent Inference. See the updated entry .

Memory & Continual Learning. See the updated entry .

Agent Identity & NHI. See the updated entry .

Hallucination & Calibration. See the updated entry .

Benchmark Contamination. See the updated entry .

Model Convergence Pressure. See the updated entry .

Agent Identity Crisis. See the updated entry .

Expanded review evidence

Reviewed through October 20, 2026. Primary methods, results and limitations were inspected for material empirical findings. Official specifications establish contracts, not adoption or safety performance; provider announcements establish their claims, not independent validation. The EU standard’s full text, EUR-Lex decision/amendment and Colorado signed PDF were inaccessible; the claims here are bounded to the inspected official announcements and enacted summary. No independent experiments were run. All 49 dimensions were triaged; unchanged categories retain prior evidence or are editorial measurement categories, not newly validated deployment claims.

Runtime & Execution — expanded evidence

LangGraph checkpointers. Living official documentation, checked October 20, 2026. Persistent SQLite/Postgres and in-memory implementations differ. Replay re-executes later nodes, including API requests; exit/async/sync durability modes trade crash recovery against performance. This is a documented contract, not a comparative reliability benchmark. External effects need their own deduplication or reconciliation. Primary source .

Cursor Cloud Agents security overview. Living official documentation, checked October 20, 2026. Per-agent VMs, stored conversation/artifacts, repository-scoped app access; runtime resources hibernate and expire. Snapshot retention differs from runtime and transcript retention. Provider documentation, not an independent security audit; does not justify indefinite credential retention or a market leadership ranking. Primary source .

OpenAI Agents SDK sandbox concepts. Living official documentation, checked October 20, 2026. Manifest specifies workspace materialization and path grants across SDK backends. Linux UnixLocal grants do not constrain arbitrary shell commands; backend/process permissions matter. Filesystem permissions are distinct from action approval and API credentials. No evidence of a universal cross-vendor standard. Primary source .

NVIDIA PPCIE verifier 2.x introduction. Official documentation updated October 6, 2026. CC encrypts data crossing NVLink outside the trust boundary; PPCIE changes the boundary to trust that interconnect and permit plaintext. Requires compatible SDK and whole-system mode configuration. Neither attestation nor a TEE establishes lawful purpose or action authority. Primary source .

Cognition & Capability — expanded evidence

Genie 3: a new frontier for world models. Provider research announcement, August 5, 2025. Interactive 720p/24fps generated environments lasting minutes. Limited action space, multi-agent consistency, geography and text rendering. Provider demonstration rather than evidence of reliable physical planning or universal cross-domain transfer. Primary source .

GitHub Spec Kit. Living repository checked October 20, 2026. Offers specification, planning, task and implementation workflows; different processes are independent entry points rather than mandatory phases. Tool documentation establishes a workflow option, not measured correctness, universal agent behavior or complete causal explanation of execution. Primary source .

Trust, Safety & Verification — expanded evidence

Circuit Tracing: Revealing Computational Graphs in Language Models. Research methods report, March 27, 2025. Cross-layer transcoders and attribution graphs studied on Claude 3.5 Haiku. Missing attention computation, reconstruction errors, incomplete coverage, example-local circuits and mechanistic faithfulness limit interpretation. Mechanism hypotheses and causal interventions do not establish a comprehensive deployed safety control. Primary source .

Human Interventions as Labels. October 15, 2026, v1 preprint. Five of thirteen screened model families qualify in a toy ask-versus-act environment. Held-out over-asking flips 72–100% under selected steering; random-direction controls rarely flip. Burden uses a simulated overseer, not a human productivity trial. Localized LoRA wins only in one family; other families favor imitation or are unstable. Including the previous question eliminates re-asking in two tested scaffold ablations. Two out-of-family geometric predictions fail. Primary source .

Claude’s new constitution. January 22, 2026, provider publication. A statement of intended behavior used in training. The publisher explicitly distinguishes ideals from actual behavior. Does not establish that a constitution is consulted on every inference, hard enforcement, cross-provider convergence, or independently verified compliance. Primary source .

Anthropic self-assessment. October 16, 2026, provider research report. Post-response self-assessment reuses cached activations; estimated compute overhead under 2%. Reported detection is against its training teacher, with inherited blind spots and no human-agreement evaluation. Deployed offline flagging differs from experimental blocking. On 24 offensive cyber tasks, baseline success 19/24 becomes 13/24 with self-assessment blocking, versus 6/24 with a stronger prompted monitor; other safeguards disabled. Adaptive rewinding remains a limitation. Not an independent replication. Primary source .

OWASP Top 10 for Agentic Applications. December 9, 2025, practitioner security guidance. Names ASI04 Agentic Supply Chain Vulnerabilities. A consensus threat taxonomy, not an incident-prevalence study, certification, or empirical claim that all tools are compromised. Corrects the map’s AST10 label. Primary source .

NIST SP 800-226: Guidelines for Evaluating Differential Privacy Guarantees. March 6, 2025, final guidance. Framework for evaluating differential privacy claims and implementation hazards. DP depends on its stated privacy model and parameters. It is not interchangeable with encryption, secure computation, or access control and does not by itself confer sectoral compliance. Guidance is not an agent efficacy benchmark. Primary source .

EZKL official repository. Living repository checked October 20, 2026. Produces proofs of encoded ONNX computation using Halo2. Quantization can make circuit outputs differ from Python inference. The proof concerns the encoded relation, not input truth, policy suitability or a later external action. README and security caveat inspected; this review did not audit cryptography. Primary source .

Protocols & Interop — expanded evidence

MCP 2026-07-28 specification. July 28, 2026, official protocol specification. JSON-RPC, stateless requests and per-request capability negotiation; Tasks, Skills over MCP and MCP Apps are optional extensions requiring support by both endpoints. Specification publication does not establish deployment prevalence or core capability attestation. Existing transport authorization evidence remains separate. Primary source .

A2A v1.0.1 specification. Version 1.0.1, checked October 20, 2026. Agent Cards advertise capabilities and authentication requirements. Card signing is MAY; signature verification is SHOULD when present. Signed metadata integrity does not validate claimed competence or authorize a particular downstream effect. Standards text does not verify named enterprise deployments. Primary source .

AP2 agent payments specification. Version 0.2, checked October 20, 2026. Checkout and Payment Mandates represent bounded user authority, with deterministic non-agentic trusted-surface verification. Agent-to-agent mandate delegation and particular dispute-resolution procedures are outside this version’s scope. A signature does not establish correct natural-language intent interpretation or universal legal finality. Primary source .

AGENTS.md. Living project documentation, checked October 20, 2026. Repository instructions for coding agents, distinct from a network discovery or identity protocol. Format adoption and instruction availability do not establish trustworthy instructions or agent capability. Primary source .

Open Agentic Schema Framework. Living official documentation, checked October 20, 2026. Metadata schema and taxonomy for describing agents, skills and domains. Describing a capability does not independently attest to performance or grant execution permission. Primary source .

NIST AI Agent Standards Initiative. Created February 17; updated August 14, 2026. Initiative for research, interoperability, security, guidelines and standards development. An initiative or concept draft is not a completed mandatory standard. Use publication-specific maturity labels. Primary source .

Economic, Legal & Regulatory — expanded evidence

First harmonised standard supporting the AI Act. European Commission publication, October 19, 2026. EN 18286:2026 reference published through Decision (EU) 2026/2274. Presumption of conformity covers Article 17 requirements within the standard, not the entire AI Act. Complements existing management systems, including ISO/IEC 42001. Commission announcement inspected; full paid standard and blocked EUR-Lex decision not inspected. Primary source .

Federal Reserve SR 26-2 and revised model risk guidance. April 17, 2026, supervisory guidance; linked attachment inspected. Supersedes SR 11-7. Scope footnote explicitly excludes generative and agentic AI, while other risk management obligations can still apply. Guidance is not a new binding law or exemption from all banking governance. Scope and institution applicability must be stated. Primary source .

European Commission AI Act implementation overview. Current official overview checked October 20, 2026. General application August 2, 2026 with exceptions; current overview gives December 2, 2027 for Annex III high-risk rules and August 2, 2028 for Annex I product rules after the AI omnibus. Official explanatory page inspected; full amended legal text was blocked. Do not apply one date to every actor and obligation. Primary source .

Colorado SB26-189 enacted bill overview. Signed May 14, 2026. Repeals and reenacts the earlier SB24-205 framework around automated decision-making materially influencing consequential decisions. Developer requirements start January 1, 2027; documentation, records and adverse-decision human review feature in the enacted summary. AG enforcement, no new private right. Enacted legislative summary inspected; signed PDF unavailable. Primary source .

ATA launches up to $750 million AI infrastructure facility. January 13, 2026, insurer announcement. Capacity announcement for AI infrastructure risks, including hardware/property and modular associated covers. Up to capacity is not premiums written, claims paid, general agent-error cover or evidence that insurance governs agent behavior. Policy wording and exclusions control any actual protection. Primary source .

United States v. Heppner, memorandum, Doc. 27. S.D.N.Y., February 17, 2026, 25-cr-503. All 12 pages read using local OCR. Denies privilege/work-product protection for the defendant’s self-directed consumer-Claude exchanges; counsel did not direct their creation. Fact- and jurisdiction-specific ruling, not autonomous-agent tort liability. This review does not establish subsequent appeal history or a blanket rule for all legal AI products. Primary source .

US Copyright Office AI report Part 2: Copyrightability. January 2025, agency report. Human expression, selection/arrangement and modifications can qualify case by case; purely AI-generated material does not. Prompt copyrightability differs from authorship of resulting expression; prompts alone generally insufficient under then-current systems. Agency analysis, not a worldwide rule or resolution of training-data litigation. Primary source .

Salesforce Agentforce pricing. Current provider pricing checked October 20, 2026. Offers action/Flex Credit, conversation and user-license approaches. No single per-conversation shape is established as market leader. Informational prices can change and contract order forms control; compare verified work costs including retries, supervision and failed outcomes. Primary source .

ServiceNow completes acquisition of Moveworks. December 15, 2025, issuer announcement. Primary confirmation of a completed acquisition. One disclosed deal does not establish concentration, value capture or the fate of the entire agent stack. Separate completion from announcements and licensing agreements. Primary source .

OpenAI for Countries. May 7, 2025; updated February 6, 2026, provider program. Describes national partnerships, local data-center and customization plans. A program or announced capacity is not an energized facility, an international treaty or proof that only six companies can participate. Track jurisdiction, ownership, operation and infrastructure status separately. Primary source .

Organizational & Conceptual — expanded evidence

From Tool to Agent: How Worker Needs Reorganize Across the Agentic Roles of Workplace AI. October 4, 2026 revision; to appear HAI 2026. Interviews with 16 US workers across healthcare, finance and management identify assistant, arbiter and manager roles and authority/accountability asymmetry. Qualitative purposive sample; role and domain are partly confounded and systems include broader decision support. No causal productivity or employment estimate. Primary source .

METR early-2025 experienced developer study. July 2025 research report; February–June 2025 experiments. Sixteen experienced open-source developers, 246 task-randomized issues in familiar repositories: AI access increased completion time 19% (95% CI 2–39%) despite perceived speedup. Narrow task/population/tool period; not a test of all coding or contemporary autonomous agents. Full methods and limitations inspected. Primary source .

METR update on developer productivity measurement. February 24, 2026. Later study includes ten returning and 47 new participants, but task/participant selection, lower compensation and parallel-agent timing undermine comparison. Raw speedup estimates have intervals including zero. This update does not conclusively establish current productivity gains or replicate the original randomized effect under equivalent conditions. Primary source .

Still Waters, Rapid Currents: Early Labor Market Transformation under Generative AI. NBER w33777, revised March 2026; working paper, earlier title superseded. Links roughly 25,000 Danish workers and 7,000 workplaces across eleven exposed occupations to surveys/admin data. Difference-in-differences finds little average earnings or recorded-hours impact through 2024 despite task reorganization. Assumes parallel trends; common equilibrium effects can cancel, exact adoption timing unavailable, and later/global autonomous-agent displacement is untested. Methods, identification challenges and current PDF revision inspected. Primary source .

Exploring model welfare. April 24, 2025, provider research agenda. Exploratory model-welfare work acknowledges lack of agreed consciousness measures and uncertainty about moral status. Research agenda is not evidence of consciousness, welfare benefit, industry consensus or that other labs will follow. Primary source .

Qwen3.8 official repository. Living repository checked October 20, 2026; successor to Qwen3.5. Repository code license is distinct from licenses of each released checkpoint. README directs users to individual model-card terms. Availability of weights does not establish complete training transparency, commodity economics or a universal shift to closed models. Primary source .

Human-System Surfaces — expanded evidence

Comparing Human Oversight Strategies for Computer-Use Agents. First April 6; revised September 12, 2026, v2 preprint. Forty-eight participants in 192 counterbalanced sessions, plus ten follow-up interviews. Four strategies affect problematic-action exposure but do not establish improved conditional intervention. Researcher-built websites/fictional profile, no autonomous baseline, bundled interfaces and risk/context confounding limit transfer. Conditional intervention denominators differ across conditions. Replaced initial v1 inspection with current v2 methods, results and limitations. Primary source .

Payments Racing Regulation

This former meta-pattern is now Layered Agentic Commerce ; the previous anchor is preserved.

Weekly review — October 26, 2026

Seven primary records below add material tests and scoped operational evidence. This bounded weekly scan covers all seven families from the October 20 baseline with an October 6 overlap. Earlier deep-review dates and inaccessible full legal texts remain explicit. New papers are preprints, not independent replications or evidence of deployed prevalence. No direct protocol revision requiring a map edit was established; protocol, market and legal searches were selective rather than exhaustive. Methods, baselines, costs and limitations were inspected for accepted empirical findings.

AuthorizationBench: Act on Your Behalf, Beyond Your Authorization. First October 20; revised October 21, 2026, v2 preprint. 286 tasks, 24 model/effort/harness configurations, 6,864 trajectories; 19.2% contain predefined out-of-scope actions. Benign pressures also induce failures. Asking correlates with fewer violations; it was not randomized and the principal is simulated. Five-minute/35-turn bounds, synthetic expansions and case-specific judges limit transfer. Human agreement checked on 100 trajectories; repeated runs cover 30 cases. This is not a deployed failure-rate estimate or proof that more approvals cause safety. Primary source .

CarryoverBench: After the Attacker Leaves. October 20, 2026, v1 preprint. 101 attack variants in 12 authored task families; five models in Nanobot, plus four non-reasoning models on the Hermes latent channel. Separates planting from later triggering over five fresh sessions. Repeated topical prompts and unchanged files limit persistence claims; marker verifiers miss some leaks. Tool effects are sandbox stubs, not real transactions. Prompt defenses have utility costs; proposed runtime controls were not established as universally effective. Code release is promised upon acceptance, not independently rerun here. Primary source .

Looks Fine to Me: Understanding Oversight in Agentic Interactions. October 20, 2026, v1 preprint. Controlled six-task Python study: 36 participants, 214 usable final outcomes, 71 silent-defect instances. Most performed extra checking, yet only 28 silent defects were resolved. High confidence persisted in 34/43 unresolved cases. Diagnostic evidence, interpretation and repair differ from activity. Seeded defects, task variation and exploratory analyses limit generality. Gaze and physiology did not establish reliable real-time oversight detection; no tested interface intervention or causal productivity gain. Primary source .

UserSWE: Evaluating Coding Agents in Multi-Turn Conversations with Dynamic Users. October 21, 2026, v1 preprint. Eleven model/scaffold systems on 72 tasks from 42 repositories; 22 issue cascades and 50 adapted tasks. Test-grounded evaluation and cross-family review allow validated equivalent-test rewrites. Rankings vary with interaction budget; weighted turns are not equal dollars or latency. Simulated personas derive from one commercial assistant’s logs, not live users. Reviewer rewrites are not a human-validated judge-error rate. Narrow task set, distinct scaffolds and costly evaluation limit broad rankings. Primary source .

LLM Multi-Agent Systems Are Vulnerable to Herding and Runaway Cascades. October 22, 2026, v1 preprint. Thirteen models, 48 generated song titles/lyrics, 168,480 persona-conditioned agents. Independent, count-only and count-ranked conditions isolate social signals and position; each agent initially selects four songs. Influence shifts selection and collective outcomes; expanding selection to twelve attenuates cascades. Homogeneous model populations have no conversation or shared memory. The historical human benchmark uses different stimuli/tasks; it is not a controlled human–LLM comparison or a general estimate of software-team correctness. Primary source .

LangGraph 1.2.16 resume and checkpoint fixes. October 16, 2026, official release; overlap-window catch-up, checked October 26. Release notes include avoiding reruns of finished subgraph tasks and duplicate application of resumed updates or pending writes. These concrete fixes motivate version-pinned interruption/recovery checks; they do not prove every later version is free of these classes or guarantee exactly-once external effects. Latest release list also inspected through 1.2.17 (October 24). No local runtime reproduction was performed. Primary source .

FCA: AI in financial services—good practice and areas for improvement. Published October 19; editorial amendment October 20, 2026. UK regulator examples from supervision, engagement and AI Lab work cover agentic AI. Existing rules remain applicable; the examples create no new requirements and are not an exhaustive or quantified prevalence study. Meaningful oversight needs qualified people with authority, information and escalation routes; technical outsourcing does not transfer accountability. Named ownership, outcome monitoring and agent inventories are illustrated, without causal estimates of control effectiveness. Primary source .