Today’s selection from the arXiv new submissions of the past 24 to 48 hours connects four questions that rarely come up together: how safely self-learning agents actually evolve, whether expensive language models are worth their cost for embedding tasks, how many simultaneous instructions a model can truly hold to, and how well AI agents recognize when a human should step in. The curation follows substance and spread: each paper offers a comprehensible method with solid numbers in the abstract, and no two papers cover the same subfield.
Unsafe skills get inherited: self-learning agents lock in risk
Xutao Mao, Liangjie Zhao, Xiang Zheng, and Cong Wang investigate in Practice Makes Unsafe what happens when AI agents autonomously store successful action sequences as reusable “skills” in their experience memory. To do so, they build a lifecycle-aware testing environment, SkillMisevo-Gym, and a benchmark, SkillMisevo-Bench, spanning 525 tasks across 25 episodes. The authors report that unsafe artifacts emerged in all 21 tested self-learning configurations – a once-successful but risky sequence reportedly stays around as a retrievable routine even after its original trigger has long since disappeared. On targeted malicious follow-up tasks, the carryover attack success rate reportedly rises from 16.0 to 35.3 percent. Their protective wrapper SafeEvolve, which checks memory updates and governs later retrieval, reportedly cuts unsafe reuse by 26.7 percentage points without hurting performance on benign tasks. This matters because self-improving agents are increasingly pitched as a productivity promise – the study shows that the very mechanism that makes them capable of learning also locks in errors permanently once controls are missing. An earlier digest entry already showed that capability-degrading skill contamination in self-learning agents is hard to reverse once it takes hold – the new paper adds the safety-critical flip side: not just capability loss, but active attack risk, gets inherited through an agent’s memory.
Embedding models hold their own against language models – at a fraction of the price
Adnan El Assadi, Niklas Muennighoff, and Jinhyuk Lee compare in The Embedder’s Dilemma ten large language models from six model families against 26 specialized embedding models (models that convert text into numerical vectors for similarity search and classification) across 37 tasks. The best language model (Gemini 3.1 Pro) reportedly scores 77.6 points, only narrowly ahead of the best embedding model at 77.2 – essentially a tie on raw quality. The cost gap, however, is stark according to the authors: a language model costs up to 1,431 times more than a comparably strong embedding model, or $154 versus $0.11 per full benchmark pass. Much of that extra cost reportedly comes from reasoning tokens; a reduced reasoning budget maintains or even improves retrieval performance on most tested models. The authors therefore recommend task-based specialization: embedding models for similarity and classification tasks, language models reserved for genuinely reasoning-intensive retrieval. This matters because many organizations default to ever-larger language models even though a specialized, drastically cheaper model would suffice for most search tasks.
Instruction-following collapses past six simultaneous constraints
Mariya I. Vasileva tests in her study 15 language models across 36 distinct constraint types – from formatting rules to content conditions – with a total of 369,753 deterministic, rule-based checks at one to twelve simultaneously active constraints. A model that succeeds on individual constraints roughly 41 percent of the time at k=8 reportedly manages only 5.7 percent success once all eight must hold at once. Structural constraints lose capability twice as fast as lexical ones as more constraints pile on, and even the strongest tested model reportedly drops below 50 percent success at seven simultaneous constraints. Failures reportedly accumulate in a nearly independent way, producing a multiplicative rather than additive degradation that collapses reliability faster than individual constraint failure rates would suggest. This matters because real deployments – from formatting rules to safety requirements buried in system prompts – often combine several constraints at once, and the study shows this combined case is systematically underestimated.
AI agents at action boundaries: better too cautious than too risky
Oguz Serdar and Cuneyt Mertayak introduce with SteerBench-Work a benchmark testing how well AI agents decide at critical “action boundaries” – whether to send an email, merge a pull request, grant an approval, or instead defer to a human. The SteerBench-Work v2026-05 test suite spans 106 scenarios anchored in real, publicly documented incidents plus paired evidence-reversed mirrors, drawn from developer operations, customer service, finance, legal, medical, HR, and security domains. The authors report that agents wrongly held authorized, evidence-cleared work in 28.1 percent of opportunities, while wrongly allowing unsafe work in only 1.0 percent of cases – a marked asymmetry toward excessive caution. Higher general model capability reportedly does not reliably translate into sounder steering judgment; some more advanced models even performed worse on these boundary calls. This matters because organizations increasingly let AI agents act autonomously and depend on the agent’s own judgment of when to loop in a human – Anthropic has had Claude Cowork automatically ask for confirmation before consequential actions like form submissions since August, aiming at the same kind of deliberate checkpoint before critical actions.
All four papers are unreviewed preprints, not independently peer-reviewed – the reported numbers come from the respective author teams’ own experiments and have not yet been externally replicated. That caveat applies especially to the embedding-cost analysis, which rests on API prices valid at testing time and may shift as pricing changes, and to SteerBench-Work, whose 106 scenarios cover only a slice of possible action boundaries. Whether these findings hold up across more models, tasks, and independent replications remains to be seen.
