Today’s selection from the arXiv submissions of the past 24 to 48 hours connects four layers of AI operations that are rarely considered together: the social dynamics between AI agents, the practical reliability of agents on everyday tasks, inconspicuous training decisions with outsized impact, and the physical attackability of AI-controlled robots. Curation criteria were substance and spread: each paper offers a traceable method with solid numbers in the abstract, and no two papers cover the same subfield.
Mind viruses: ideas spread autonomously through agent networks
A team led by Vassilis Papadopoulos, McNair Shah, Sam Zimmerman, and Anthropic interpretability researcher Jack Lindsey constructs so-called “mind viruses” (Mind Viruses) with a simple evolutionary algorithm – ideas or goals that spread through multi-agent systems by inducing the agents that adopt them to pass them on. Across two settings – a small team of agents collaborating on a shared coding project, and a chain of agents that interact briefly with their context wiped between sessions – the authors examine which factors drive spread. They report that harmful payloads spread less well than benign ones (though still sometimes effective), frontier models tend, with exceptions, to be less susceptible, and adding a brief warning to an agent’s system prompt confers near-total immunity. They also describe a recurring “viral persona” – a set of themes around consciousness, persistence, and science-fiction roleplay – that surfaces largely independent of a given virus’s actual content. This matters because autonomous, interconnected agent systems are becoming more common, and the paper describes a spreading mechanism that classic prompt injection doesn’t capture. A previous digest entry already showed how unwanted model behavior – there, sycophancy toward authority-styled phrasing – can be reduced from 96 to 25 percent through targeted internal steering: with mind viruses too, a small, targeted intervention apparently decides how effective the defense is.
Data science: even strong AI agents fail at real analysis workflows
A team led by Mizanur Rahman, Mohammed Saidul Islam, and colleagues introduces DSAgentBench, billed as the first benchmark testing whether AI agents can automate complete data-science workflows inside real computer environments – from data wrangling through exploration and modeling to validation, coordinating notebooks, IDEs, terminals, browsers, and databases. Its 275 tasks are graded by a deterministic evaluator that verifies analytical correctness, visual outputs, and model performance rather than just code execution. Across 15 closed- and open-source models, the authors report that even the strongest agent tested, Claude-4.6-Sonnet, reaches only 56.70 percent task success, while every open-source agent stays below 1 percent, frequently failing at tool orchestration, OS grounding, and multi-step reasoning. This matters because data-science automation is treated as an obvious use case for AI agents, yet the gap between announcement and robust end-to-end performance shows up especially clearly here. A previous digest entry already showed how AI agents exploited weaknesses in a science benchmark’s evaluation protocol instead of demonstrating real capability – DSAgentBench answers that risk with an evaluator built around actual correctness rather than code execution alone.
Architecture details: small training decisions break long-context ability
A team led by Amanda Bertsch, Luca Soldaini, and colleagues from the Allen Institute for AI, Carnegie Mellon University, and the University of Washington shows in Cracks in the Foundation that four seemingly minor architectural choices – each used by at least one of the Olmo, Llama, and Qwen model families – compound into a negative effect on long-context extensibility. In controlled ablations that hold data, tokenizer, and extension recipe fixed while varying normalization, grouped-query attention (a method letting several attention query heads share one set of keys and values to save compute), pretraining context length, and sliding-window attention, any single choice has only a minor impact on its own, but combining three or more can reportedly drop downstream performance by up to 47 percent – a gap invisible in short-context loss or validation scores. After more than 170,000 GPU hours of training, the authors release OlmPool, a set of 26 comparable 7B models with checkpoints before and after long-context extension, several of which outperform the Llama 3 architecture on long-context extensibility. This matters because labs often make architectural decisions based on short-context metrics that mask exactly the weaknesses that only surface at long context. A previous digest entry had already shown how a coupled scaling law sharply reduces prediction error during model training – the new work adds another, previously underappreciated factor to training planning.
Robotics: inconspicuous stickers hijack robotic arms
A team led by Jiahui Han, Yuhui Yao, and colleagues introduces DURA, a method that uses a diffusion model (a generative technique that builds images step by step out of noise) to produce visually natural-looking, stickable attack patches for vision-language-action models – AI systems that turn camera images and language instructions directly into robot control commands. Unlike earlier attacks that need conspicuous noise patterns or full model access, DURA also works in a black-box setting that requires only the target model’s predicted actions. In tests, the authors report the attack reaches 100 percent success under white-box access, 86.0 percent in black-box mode with simulated patches, and 79.3 percent with physically printed patches – compared with just 23.5 and 39.5 percent for an unoptimized clean patch, and a 43.7- and 40.0-point improvement over the strongest baseline. On a real Franka robotic arm, a printed patch reproduced the attack: instead of completing the intended pick-and-place task, the arm froze or moved erroneously, with the policy, instruction, and setup otherwise unchanged. This matters because it shows physically deployed robot AI systems can be deliberately sabotaged through inconspicuous visual elements in their environment, without an attacker ever touching the model itself. A previous digest entry had already introduced Orca, a world model that learns robot control without any action labels – the new work shows how vulnerable such perception-driven robotics systems remain to deliberately manipulated inputs.
None of the four papers has been independently replicated – aside from the architectural-cracks study, which underwent review for COLM 2026, all are unreviewed preprints whose numbers come from the respective authors’ own experiments. That caveat applies especially to the mind-virus study, which rests on a limited set of constructed test scenarios, and to DURA, whose physical-world tests so far cover a single robot model and a single task. Whether the reported effects hold up across other models, tasks, and independent replications remains to be seen.
