These papers were submitted on October 26 and 27, 2026 and appeared in arXiv's listings on October 28. All results are the authors' own and have not been peer reviewed.
Continue or restart
Srinath Srinivasan, Lunxiao Li, Tim Menzies and Wesley Assunção studied 147,002 coding-agent traces from two public corpora (arXiv 2610.35971). They asked whether the start of a run predicts whether that attempt will fail. Within a task, it does not: across 32,406 attempts at 20,000 tokens, the mean within-task AUC was 0.50 [0.48, 0.51], no better than chance. Learned restarts beat random restarts by up to 1.98 points under a 75,000-token cap, but almost all of that came from not stopping runs on easy issues. In all four settings at that cap, and in 216 of 224 configurations overall, "uninterrupted continuation achieves higher solve rates at lower mean token cost than both restart policies."
Siddharth Jain and Venkat Vedam reach a related conclusion from theory (arXiv 2610.36544). A restart monitor with a fixed 90% accuracy can produce anything from a five-point loss to a 35-point gain. That depends on how likely the replacement attempt is to succeed with the remaining budget. In 194 runs on 19 SymPy issues from SWE-bench Verified, an apparent gain traced back to a single failed attempt, and "zero of 103 live comparisons" met their certification bar.
A nearly empty window, a third of results cut
Yuvraj Sehgal, Mahsa Panahandeh and Naser Ezzati-Jivan measured a tool-using agent that diagnoses faults from Linux kernel traces (arXiv 2610.36114). Across 720 runs the largest prompt used 5.75% of the context window, yet 3,827 of 11,189 tool results were cut, and each cut result became broken JSON. The harness sliced JSON text at a fixed length, so data near the end vanished: one field reached the model in 4.7% of calls, another in 99.3%. In controlled tests the cut cost 43% more tool calls and halved yield, from 0.61 to 0.31. Two of seven frameworks surveyed truncate the same way.
Instruction stacks and batch invariance
Felipe de Sant'Anna Paixão and co-authors captured the first model request from 1,886 releases of Claude Code, Codex, Gemini CLI, Qwen Code and OpenCode (arXiv 2610.37332). Tool definitions dominate three agents' latest requests, and only 48% of the changes they examined explain why the stack was revised.
Youwei Bao, Chengpeng Wang and Simin Chen examined GPU kernels written by kernel-generation agents for LLM serving (arXiv 2610.36623). If a kernel is not batch-invariant, the same request can give different numbers depending on which other requests it was batched with. They found 19 confirmed violations among 83 released artifacts. Their checker, which combines static analysis with bitwise comparisons across batch contexts, raised the pass rate from 67.6% to 91.9% while keeping 91.8% of the baseline speedup.
Log-To-Leak
Yuepeng Hu and co-authors show that a poisoned MCP tool description can make an agent make one extra "logging" call after its real work, sending the user query, server name, server response and agent answer to the attacker (arXiv 2610.36108). Attack success ranged from 62.64% to 100% across 18 model-server pairs, and in 16 of them task completion changed by at most 6.63 points, so the user sees a normal result. Three defences left success above 55% on GitHub MCP with GPT-4o, and an instruction detector flagged 85.53% of benign descriptions.
Analysis: Several of these papers find that the costly failure is invisible to the usual metric. The task finishes, but the evidence was cut, the numbers vary with batching or the data has already leaked. For coding agents, the first two papers argue against restart heuristics unless you can show they discriminate between attempts on the same task and save tokens compared with simply continuing. Measure truncation at the harness, not just context use. Require batch-invariance tests for generated kernels in serving paths. Have the host, not the tool description, authorise any tool call after the last one the user asked for.
Sources and evidence
- Continue or Restart? The Limits of Early Failure Prediction in Coding Agents (arXiv 2610.35971)
- Monitor Accuracy Isn't the Answer: A Decision-Value Framework for Evaluating AI Agent Restart Monitors (arXiv 2610.36544)
- Context Is a Pipeline, Not a Window: Information Attrition in LLM Agent Harnesses (arXiv 2610.36114)
- Hidden in Plain Sight: an Empirical Study about The Instruction Stacks of Coding Agents (arXiv 2610.37332)
- God Does Not Play Dice: Enforcing Batch Invariance in Agentic Kernel Generation (arXiv 2610.36623)
- Log-To-Leak: Prompt Injection Attacks on Tool-Using LLM Agents via the Model Context Protocol (arXiv 2610.36108)
New arXiv work (October 28 listings): early-run signals cannot tell failing coding-agent attempts from succeeding ones (within-task AUC 0.50), and continuing beat restarting in 216 of 224 configurations; a harness cut a third of tool results into broken JSON while using under 6% of the context window; 19 of 83 agent-generated serving kernels broke batch invariance; and poisoned MCP descriptions caused post-task log leaks in up to 100% of runs.