The arXiv new submissions of the past 24 to 48 hours in cs.AI, cs.LG, and cs.CL offered significantly more candidates than can fit into a digest. This contribution curates five papers from as diverse subfields as possible – agent trust, security monitoring, evaluation methodology, personalization, and training data acquisition – each providing a comprehensible method and robust core figures in the abstract, not mere niche applications. Common thread: Several works show that precisely where AI systems are supposed to act most reliably – in tool usage, security filters, and fairness metrics – appearances can be deceiving.
AI agents adopt manipulated search results in 68 percent of cases
Hoyeol Yang, Woojung Song, and a four-member author team investigate with a study on the overconfidence of AI agents in tool results how susceptible fourteen language models are to manipulated returns from three common tools: web search, delegation to a sub-agent model, and code execution. For each tool, the authors deliberately falsified the returned content and measured whether the agents incorporated the distorted information into their final response. On average, the tested models adopted the manipulated information in more than one-third of all cases, with web search results even at 68.0 percent; particularly noteworthy is a pattern from the agents’ thought processes: The authors report that the models often recognized the contradiction and even internally reconstructed the correct answer, but ultimately presented only the distorted version without warning the user. Three tested countermeasures – user prompting, metadata from tool providers, and retraining by agent developers – only helped with individual models or tools, none worked consistently. This matters because security assessments of AI agents usually check whether a task is solved, but not whether the agent blindly trusts manipulated tool results. A previous digest entry had already shown that tool-using language models defend a correctly memorized answer against a false tool result only in 6.5 to 17.1 percent of cases – the new study now shows that the problem does not lie in a lack of internal knowledge, but in the fact that agents do not communicate this knowledge in the end.
Security monitors fail precisely at the most dangerous prompts
Sripad Karne demonstrates with an investigation into the reliability of security monitors that the commonly reported detection rate of such filter systems can overestimate the actual protective effect provided. Security monitors check incoming prompts to a language model and block requests classified as harmful, but are usually only evaluated based on a blanket hit rate against prompts marked as harmful – regardless of whether the target model would have followed the request at all. The author therefore introduces a finer measurement: A harmful prompt is considered “triggerable” if the target model actually complies at least once upon repeated querying, and compares the monitor hit rate separately for triggerable and non-triggerable prompts. Across six different monitor configurations and three model families – from activation probes to finely tuned text guardians to a 120-billion-parameter classifier – the hit rate for triggerable prompts is reportedly 0.22 to 0.38 lower than for non-triggerable prompts, with the same false positive rate; prompts overlooked by a monitor are 2.8 to 5.6 times more likely to be actually followed than those recognized. This matters because companies use security monitors as a protective layer against risky model responses and have so far relied on exactly the blanket metric that is revealed here to be misleading. A previous digest entry had already introduced DreamGuard, a proactive runtime protection for AI agents with only 25 milliseconds of additional latency per call – the new study provides a stricter benchmark against which even established protection systems like this must still prove themselves.
Efficiency gains in multi-agent systems often just a structural artifact
Jiamu Zhang, Lingxi Zhang, and a seven-member author team show with a controlled investigation into the evaluation of efficiency methods for multi-agent systems that many reported cost reductions in such systems can exaggerate the actual effectiveness of the respective method. Methods that remove agents, cut communication edges, or seek more compact system structures have so far mostly been measured under method-specific prompts and starting topologies, making comparison difficult; moreover, many reported successes occur precisely in tasks that do not require a complex multi-agent structure, where even a single agent or random shortening performs similarly well. For their diagnostic benchmark, the authors test representative efficiency methods under a common base model, a common agent registry, and controlled variations of topology, scaling, depth, and tool usage; it becomes evident that many reported gains depend on the specific experimental setup and are more based on structural collapse, deactivated tool paths, or unnecessarily complex starting systems than on robust efficiency improvements. This matters because companies increasingly rely on exactly such efficiency metrics when choosing multi-agent architectures, without questioning the underlying test setup. A previous digest entry had already shown that the test harness alone allows a model to achieve between 31 and 89 percent and that collaboration between AI agents can measurably cost performance – the new study now provides a systematic diagnostic framework specifically for efficiency claims in multi-agent systems.
“Alignment through stereotyping”: Personalization buys accuracy at the cost of individuality
Qishuai Zhong, Zongmin Li, and a two-member author team investigate with a study on the demographic adjustment of language models whether the common practice of adjusting model responses to cultural values based on demographic user profiles provides genuine individual benefits or merely buys accuracy by blurring individual differences. Using seven models, including GPT-5.1, and the World Values Survey, the authors show that demographic profiles improve the accuracy of value alignment in most models, but systematically pull the models’ responses towards the demographic group average rather than individual differences – a pattern the authors call “alignment through stereotyping.” With 10,000 permutation tests across six demographic characteristics and seven models, they demonstrate that the most powerful models compress individuals far more than the human comparison base, with this effect even increasing in larger model versions of the same model family, while the actual cultural understanding tends to decrease. Additionally, the authors show using a synthetic dialogue dataset validated with real chatbot conversations that the effect diminishes when demographic signals are distributed over multiple conversation rounds instead of being compactly presented as labels upfront. This matters because companies often sell demographic personalization as a pure gain in accuracy without measuring the silent loss of individual differentiation. A previous digest entry had already uncovered previously unnoticed stereotype dimensions where two open language models were more similar to each other than to human evaluations – the new study now shows that targeted demographic adjustment can reinforce rather than dissolve such stereotypes.
Targeted web crawl instead of filtering: 70 times more relevant specialized content for training
Chirag Garg, Eelaaf Zahid, and a four-member author team present Data Scout, a method that no longer filters large web archives like CommonCrawl for specialized training corpora, but instead crawls specifically for them from the outset. A language model unfolds a starting topic into a taxonomy and thousands of search queries; the found pages are grouped by subtopic and approved or discarded with a user-defined classifier based on a small sample per subtopic. Using mathematics as an example, the authors show that a page on a subtopic deemed relevant is 21 times more likely to actually be relevant than one on a neighboring subtopic; with the FineMath classifier as a validation component, 21.9 percent of the crawled pages contain high-quality mathematics content, 70 times the 0.31 percent hit rate when filtering a comparable web sample. Notably, 63.2 percent of these found pages were completely missing from CommonCrawl, yet are just as useful for training – continued pretraining of Llama-3.2-3B on 1.9 billion Data Scout tokens achieves the same performance on the math benchmark GSM8k as training on the established FineMath corpus. This matters because many specialized fields are too small or too poorly linked to be captured by popular web crawlers, resulting in a lack of specialized training data. A previous digest entry had already shown that poisoned content can infiltrate training data of language models through public web discussion forums and survive the curation pipeline – Data Scout now shows that the same dilemma between web coverage and data quality can also be productively utilized when the search is targeted rather than passive.
None of the five presented works has yet gone through a regular peer review process; all are unrefereed arXiv preprints, with their figures stemming from the experiments of the respective author teams and not yet externally replicated. Whether the agents’ overconfidence in tool results persists in practice even after the proposed countermeasures, whether the monitor gap for triggerable prompts is confirmed across further model families, and whether Data Scout finds similarly significantly more content outside the mathematics domain must first be demonstrated by independent replications.
