The editorial team selects four papers from the arXiv new submissions of the past 24 to 48 hours that demonstrate how fragile self-improvement, tool usage, and internal traceability of today’s AI agents and models remain – from a structurally irreversible performance drop in self-learning agents to a security vulnerability in the conversation history of tool agents, to an illusion in multimodal image zooming and a new look at internal reasoning errors. The curation was based on substance: each paper provides a traceable method and a concrete numerical result in the abstract, not just a mere topic headline. The selection deliberately covers four different subfields – agent self-improvement, agent security, multimodal evaluation, and mechanistic interpretability.
Skill Contamination in Self-Learning Agents
A team led by Linfang Shang and colleagues shows in When Self-Evolution Backfires that self-learning AI agents (systems that distill reusable skills from their own execution trajectories) do not improve permanently with an increasing skill pool, but rather deteriorate again beyond a critical pool size. The cause is a contamination chain: once a faulty skill becomes part of the reference base, it flows into later distilled skills, and subsequent removal of the triggering skill only restores a small part of the lost performance, according to the authors. Their countermeasure, Verifier-as-Gatekeeper (VaG), checks each new skill before acceptance against three independent criteria, achieving an improvement in every round, with 72 percent Pass@1 using a skill pool about five times smaller than that of uncontrolled collection; the frozen skill pool also transfers positively to four additional model backbones and a second benchmark. This matters because it shifts skill acquisition from a post-hoc correction to a pre-commit necessity – a connection to the previously discussed observation that self-learning agents amplify their own errors through inflated self-assessments without external control, here, however, with a concrete, structural countermeasure.
When Old Conversation History Hijacks Tool Agents
A team led by Xiaoqing Wu and colleagues shows in When History Lies that tool-using AI agents can be misled in ongoing dialogues by conversation history that is structurally still plausible but no longer authoritative. In the model Qwen3-1.7B, such “polluted” history, according to the authors, flips 32.1 percent of decisions that would have been correct based on the original trajectory, often leading to the reuse of already corrupted entities or interface conventions. Using a specially constructed paired benchmark and eleven targeted interventions, the authors isolate the sources of error and then train a method that transfers a teacher policy trained on a clean reference history to a student model that only sees the polluted history; this method achieves 87.0 percent balanced tool-use accuracy compared to 66.3 percent with simple retraining on gold data, and with a larger teacher model the value rises to up to 93.0 percent. This matters because productively deployed agents typically run over long, changing sessions in which exactly such outdated references arise – similar to how a vulnerable control interface in a multi-agent platform previously made the persistent agent memory manipulable.
The Illusion of Visual Tool Use
A team led by Zhiheng Wang and colleagues examines in The Illusion of Visual Tool-Use whether multimodal language models actually benefit from the visual observations returned during “thinking with images” – the active cropping and zooming of image regions during answer finding – or whether it only appears that way. Through causal interventions at three levels – comparing tool usage with direct inference, corrupting all observations throughout a rollout, and selectively swapping individual observations – the authors uncover two failure modes across six representative models and five fine-grained perception benchmarks: in one, the returned observation has no causal effect on the answer at all; in the other, the observation is informative, but the call schedule is incoherent. The measured accuracy gain from tool usage, according to the authors, is concentrated in a small, well-calibrated minority of cases, while it is not causally effective across the broad range of rollouts. This matters because many current multimodal agent systems are built precisely on this crop-and-zoom mechanism without their actual contribution having been causally tested so far.
Reading Reasoning Errors from Internal States
A team led by Hamed Damirchi and colleagues presents in Reasoning Errors Have a Region and a Direction a detector that distinguishes sound from flawed model reasoning based on changes in internal states, rather than evaluating only the final text. Previous methods typically evaluated only the displacement between consecutive internal representations (the so-called residual stream, the main information flow through the model’s layers), which loses the state from which an update originates; the new three-stream detector instead combines this motion with a coarse region reader and a fine direction reader of the originating state. On reasoning benchmarks unseen during training, the method reportedly improves selection accuracy by up to 12 percent over displacement-only methods and by 21 percent over single-layer probing baselines, and although trained only on reasoning benchmarks, it also reads factual completion and fact verification more reliably than every detector compared against. This matters because it shows that the validity of a model’s reasoning is better read from the interplay of originating state and motion than from either static states or decontextualized trajectories alone – a connection to the previously discussed observation that frontier models use meaningless filler tokens to invisibly boost their accuracy in the chain of thought, here, however, with a tool that makes exactly such hidden states legible.
Bottom line: all four works are currently unreviewed preprints, and their numbers come from the respective author teams’ own experiments. The skill contamination study relies on a single main benchmark and four additional backbones, the conversation history study has so far primarily been tested on compact 1.7 to 8 billion parameter models, the illusion study covers six models and five benchmarks, and the interpretability detector has so far only been tested on reasoning and factual benchmarks. Whether the reported effects hold up across other model sizes, tasks, and independent replications remains to be seen.
