---
kind: concept
slug: llm-agent
title: LLM agent
summary: >-
  A language model that loops through reasoning, tool calls and observed results toward a goal. Forty-nine reuse-licensed papers cover single agents, planners, agent memory, trained agents, multi-agent teams, self-improving harnesses, agent evaluation, failure attribution and surveys. Most results are author-reported on different tasks, so no design is shown to win in general.
tags: [agents, tools, planning, memory, multi-agent, self-improvement, autonomy, evaluation]
papers: ["2207.01206", "2210.03629", "2212.04088", "2303.09136", "2303.11366", "2303.17760", "2306.02224", "2306.03314", "2307.04738", "2308.00352", "2308.08155", "2308.10144", "2308.11432", "2402.06196", "2404.02831", "2404.13501", "2406.12708", "2406.14373", "2408.06292", "2410.07076", "2411.03817", "2411.16723", "2412.10402", "2501.08579", "2502.02649", "2502.18864", "2503.23037", "2504.19678", "2505.10468", "2505.15062", "2506.02153", "2506.04133", "2507.06134", "2507.14267", "2507.21504", "2508.02276", "2509.21842", "2512.04797", "2512.18832", "2604.08455", "2604.15034", "2604.18401", "2605.07161", "2605.16679", "2606.08275", "2606.17861", "2607.23929", "2607.26148", "2608.16590"]
related: [tool-use, retrieval-augmented-generation, chain-of-thought-prompting, multi-agent-systems, proximal-policy-optimization, actor-critic, knowledge-graph-reasoning, user-simulation, self-refinement, in-context-learning, llm-self-evaluation, imitation-learning, inverse-reinforcement-learning, policy-gradient, llm-as-a-judge, benchmark-validity, robot-simulation, vision-language-action-model, reinforcement-learning-verifiable-rewards, agent-based-simulation, agent-memory, human-in-the-loop, model-editing, task-decomposition, prompt-engineering, instruction-tuning, knowledge-distillation, parameter-efficient-fine-tuning, llm-serving, world-model, llm-planning, preference-optimization, zero-shot-learning, few-shot-example-selection, prompt-injection, causal-inference, credit-assignment, llm-evaluation]
status: draft
updated_at: 2026-11-01
---

## Overview

An LLM agent is a language model that works toward a goal in steps. At each
step it decides whether to call a tool, reads the result, and continues until
it can answer [arxiv:2505.10468 §2.1.2]. The tools depend on the task: a search
engine, a web shop, a simulator, a code runner or an email client. Most designs
below keep this loop and change one of three things: how many agents share the
goal, whether the agent may change its own parts, or what checks gate its
actions. A fourth group of papers does not build an agent but measures one.

A 2023 survey describes the agent as four modules: profile, memory, planning
and action [arxiv:2308.11432 §2.1]. Its planning section sorts methods into
those with and without feedback from the environment or the model
[arxiv:2308.11432 §2.1.3]. A 2025 survey of agentic LLMs sorts the same
ground into reasoning, acting and interacting [arxiv:2503.23037 §2] [§3] [§4].
This page uses the module names where they help.

The 2025 survey calls the single-model version an "AI Agent" and describes it
by autonomy, task-specificity and reactivity [arxiv:2505.10468 §2.0.1]. This
page uses the more common name. The survey's second term, "Agentic AI", is the
multi-agent design: specialized agents share a goal, one part splits it into
subtasks, a shared persistent memory holds state, and an orchestration layer or
meta-agent coordinates them [arxiv:2505.10468 §3.1.2]. The survey calls this
split a "widely accepted conceptual illustration" and cites no formal
definition for it [arxiv:2505.10468 §3.0.1]. The papers below do not all use
the same vocabulary, so this page treats the designs as variants of one concept.

A 2024 perspective on biomedical agents sorts them into four autonomy levels,
from no agent to an agent that acts as a scientist. It rates an agent on
hypothesis, experiment and reasoning, and the lowest rating sets the level
[arxiv:2404.02831 §4] [tab. 1]. The levels are not tested in the paper.

Three cautions apply across the cards.

- **Not every agent here is an LLM agent.** The WebShop agents are a BART model
  that writes search queries and a 12-layer BERT model that picks clicks, both
  trained on human demonstrations [arxiv:2207.01206 §4.2]. They serve as a
  trained baseline in an agent environment. The Zetta policy is a
  vision-language-action model, and the LLM that proposes its code changes is
  not named [arxiv:2608.16590 §2.1]. MOOSE-Chem makes fixed LLM calls, and its
  card describes no tool use [arxiv:2410.07076 §4.2].
- **Several papers have no experiments.** The 2025 survey [arxiv:2505.10468 §1.1]
  and the multi-agent framework [arxiv:2306.03314 §6] report none. The legal
  survey is a review that reports no new experiments [arxiv:2303.09136].
  The evaluation survey [arxiv:2507.21504 §1] and the position paper on
  simulated humans [arxiv:2501.08579 §1] report none either. The 2023 agent
  survey [arxiv:2308.11432 §1] and the position paper on small models
  [arxiv:2506.02153 §1] do not run experiments of their own either. Nor do the
  memory survey [arxiv:2404.13501 §6.3], the autonomy position paper
  [arxiv:2502.02649 §1] or the general LLM survey, whose agent material is one
  section [arxiv:2402.06196 §4.5]. The agentic-LLM survey [arxiv:2503.23037 §1.2],
  the benchmark and protocol survey [arxiv:2504.19678 §III] and the trust review
  [arxiv:2506.04133 §1] report none of their own either. The biomedical
  perspective on agent autonomy [arxiv:2404.02831 §1] also reports no results.
- **Most numbers are author-reported** and come from different tasks, models
  and compute budgets. Use the tables below as starting points for a choice,
  not as a ranking.

## Variants

### Single agent with tools

One model, a set of tools and one bounded task. The survey's single-entity
design has four modules: perception, knowledge representation and reasoning,
action selection and execution, and basic learning and adaptation
[arxiv:2505.10468 §3.1.1]. It lists uses such as enterprise-search customer
support, email filtering and scheduling assistants [arxiv:2505.10468 §4.0.1].
Card: [AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challenges](/papers/2505.10468).

The Auto-GPT benchmark puts chat models in a loop that chooses a command, runs
a tool and reads the result. It uses 50 WebShop instructions and 134 ALFWorld
games [arxiv:2306.02224 §3.1]. Author-reported WebShop success is 0.240 for
GPT-4, 0.140 for Claude and 0.120 for GPT-3.5 [arxiv:2306.02224 tab. 1]. Vicuna
scores zero because it could not produce the required output format
[arxiv:2306.02224 §3.3.1]. Adding a trained expert's suggested action to the
prompt, with no fine-tuning, lifts GPT-4 to 0.320 on WebShop and to 0.515 on
ALFWorld [arxiv:2306.02224 tab. 1] [tab. 2]. On 50 tasks, one success is 0.02,
so the gap between 0.300 and 0.320 is a single task [arxiv:2306.02224 tab. 1].
Card: [Auto-GPT for Online Decision Making](/papers/2306.02224).

ReAct is the prompting pattern that most of these loops build on. Before each
action the model writes a short thought, then reads the observation
[arxiv:2210.03629 §2]. It needs no training, only a few worked examples. On a
frozen PaLM-540B, its ALFWorld success is 71% for the best of six prompt sets
and 57% on average. The same actions without thoughts reach 45% at best
[arxiv:2210.03629 tab. 3]. On WebShop it scores 40.0% success, against 30.1%
for the action-only baseline [arxiv:2210.03629 tab. 4]. On HotpotQA it trails
chain-of-thought, 27.4 against 29.4 exact match [arxiv:2210.03629 tab. 1]. Card:
[ReAct](/papers/2210.03629).

The ExpeL paper uses ReAct, a reason-then-act loop, as its base planner
[arxiv:2308.10144 §4.1]. The WebShop paper gives a rule baseline that writes
the instruction text as its query and buys the first matching item. It scores
45.6, against 82.1 for human experts [arxiv:2207.01206 tab. 2]. Cards:
[WebShop](/papers/2207.01206), [ExpeL](/papers/2308.10144).

A coding-agent harness can also run the loop. In a zero-shot navigation study,
the model chooses every call to an `observe()` tool and a `step()` tool with
four primitives, and no map or memory is given [arxiv:2607.26148 §3.2]. A
replicated default-effort Claude opus-5 run averages 70.7 success rate, with a
standard deviation of 3.5 over three runs, and a fable-5 run at max effort
reaches 78 [arxiv:2607.26148 tab. 2]. The authors say the model choice matters more than the harness, and
that the harness comparison is descriptive [arxiv:2607.26148 §4.3]. Card:
[Embodied Agents Take Control](/papers/2607.26148).

TANGO uses a different split of work. The model writes a short program that
calls a fixed set of navigation and perception modules, and it gets 15
worked examples and no training for the task [arxiv:2412.10402 §3]. The
modules are a pretrained point-goal policy, a detector, a memory-augmented
value map and a question-answering step [arxiv:2412.10402 §3] [fig. 3]. The
paper reports zero-shot results that it calls on par with VLFM on OVON and
second on OpenEQA [arxiv:2412.10402 §4.2] [tab. 1] [tab. 2]. The released
code does not call the model in its evaluation path, which uses a fixed
program per task. Those numbers therefore do not test the LLM step (see the
card's Paper vs code section). Card: [TANGO](/papers/2412.10402).

### Planner that re-plans from observations

A planner writes a full plan first and calls the model again when the plan
meets the world. LLM-Planner writes a high-level plan of (action, object)
subgoals for an ALFRED household task. It is given the nine most similar
examples from a pool of 100 solved tasks [arxiv:2212.04088 §4.3] [§5.3]. A
low-level controller carries out each subgoal. When a subgoal fails, the
planner runs again with the objects seen so far [arxiv:2212.04088 §4.4]
[alg. 1]. The step budget between re-plans is not stated [arxiv:2212.04088
§4.4]. With goal instructions only, the author-reported unseen-test success is
11.58% for a static plan and 13.41% with re-planning [arxiv:2212.04088 tab. 1].
With step-by-step instructions it reaches 16.42%, against 20.27% for a
controller trained on all 21,023 pairs with goal instructions
[arxiv:2212.04088 tab. 1]. The settings differ, so this is not a like-for-like
result. The paper uses about 7 GPT-3 calls per task, against 22 for SayCan
[arxiv:2212.04088 §5.4]. Card: [LLM-Planner](/papers/2212.04088).

### Agent with a memory module

Most designs above keep history in the prompt. The memory survey treats memory
as a separate part with three operations: writing an item from the latest
action and observation, managing the store by merging, reflecting or
forgetting, and reading what the next action needs [arxiv:2404.13501 §3.4]. It
reads memory mostly by similarity [arxiv:2404.13501 §3.4]. Its sources are the
current trial, earlier trials and external knowledge, and its forms are text or
parameters [arxiv:2404.13501 §5.1] [§5.2]. Keeping the full history in the
prompt is the simplest form, and its cost grows with length
[arxiv:2404.13501 §5.2.1]. The survey says text is cheaper to write and
parameters are cheaper to read, but it gives no measurements of either
[arxiv:2404.13501 §5.2.3]. It also notes that no open benchmark targets agent
memory alone [arxiv:2404.13501 §6.3]. Card: [Memory-mechanism survey for LLM agents](/papers/2404.13501).

MemTX treats a memory write as a staged claim, not a fact. A record is checked
for evidence, validity, conflicts with accepted beliefs and dependency on
retracted records, and only then committed [arxiv:2607.23929 §3.2]. Tool calls
that cannot be undone wait while any unsettled record exists [arxiv:2607.23929
§3.3]. On the authors' 90-case suite with Qwen3-8B, task success is 0.956
against 0.822 for the strongest baseline [arxiv:2607.23929 tab. 2]. The suite
is the authors' own, and removing the action gate costs nothing on the main
suite [arxiv:2607.23929 fig. 3]. Card: [MemTX](/papers/2607.23929).

### Fixed pipeline with a coding-agent stage

Here the order of work is fixed, and the model fills each stage. The AI
Scientist runs idea generation, a literature-based novelty check, experiments,
a LaTeX write-up and an LLM review, in that order [arxiv:2408.06292 §3]
[fig. 1]. The coding agent is Aider, which edits a small starting template and
runs its experiment script [arxiv:2408.06292 §3]. The three templates are a 2D
diffusion model, a character-level language model and grokking on modular
arithmetic [arxiv:2408.06292 §6]. The authors report about $10 to $15 of API
cost per paper, and one run of about 50 ideas took about 12 hours on eight H100
GPUs [arxiv:2408.06292 §6]. In their check of one generated paper, the reported
numbers matched the logs, but the paper invented a V100 setup where H100s were
used and called a negative result an improvement [arxiv:2408.06292 §5]. The
reviewer is GPT-4o, and its calibrated balanced accuracy is 0.65 against 0.66
for a NeurIPS human consistency baseline. The human figure comes from different
data, and the reviewer task is covered on the [llm-as-a-judge](/concepts/llm-as-a-judge)
page [arxiv:2408.06292 tab. 1]. Card: [The AI Scientist](/papers/2408.06292).

### Trained agent in an interactive environment

Instead of prompting a frozen model, the policy is trained on recorded
behaviour and then improved with reinforcement learning on an automatic reward.
In WebShop, the best trained agent (imitation learning, then policy gradient)
reaches a score of 62.4 and a 28.7% success rate. Human experts reach 82.1 and
59.6% [arxiv:2207.01206 tab. 2]. The reward is computed by a program, so no
human rater is needed for each episode [arxiv:2207.01206 §3.1]. Reinforcement
learning runs took about 20 to 27 GPU-hours per model [arxiv:2207.01206 app. C.2].
Card: [WebShop](/papers/2207.01206).

DeepTravel uses the same recipe for a travel-planning agent with real booking
tools: a supervised cold start, then reinforcement learning. Tool responses are
cached in a sandbox that refreshes every 24 hours [arxiv:2509.21842 §3.1.3].
The reward is binary. A trajectory-level check tests feasibility, and a
turn-level check tests that the itinerary matches each tool response
[arxiv:2509.21842 §3.2.3]. Both checks are LLM judges, not a program. Queries
that fail every sampled attempt are replayed later [arxiv:2509.21842 §3.3.2].
The 32B model reports an 82.58% overall pass rate on production queries
[arxiv:2509.21842 tab. 4]. On the offline sets, its human-evaluation column is
82.00, against 72.00 for DeepSeek-R1 [arxiv:2509.21842 tab. 5]. Without the
turn-level verifier, the 8B model scores 58 against 70 for the full model
[arxiv:2509.21842 tab. 6]. Card: [DeepTravel](/papers/2509.21842).

SIMA 2 applies a similar recipe to a Gemini Flash-Lite agent that plays 3D
games from screen frames with keyboard and mouse actions. It is first
fine-tuned on human play, on bridge examples with Gemini-written reasoning and
dialogue, and on other Gemini data [arxiv:2512.04797 §3.3] [§3.3.2]. Its RL
stage uses tasks with a verification function, and keeps only tasks a human
could finish within the time limit [arxiv:2512.04797 §3.3.3]. The authors say
SIMA 2 "effectively doubles" SIMA 1's average success on the training
environments. They report held-out ASKA and MineDojo success more than 10%
higher. The exact values appear only in bar charts [arxiv:2512.04797 §4.2.1]
[§4.2.2] [fig. 6] [fig. 10]. Against the base Gemini model, its change on code,
math and science benchmarks is a relative drop of 4.0% to 25.5%
[arxiv:2512.04797 tab. 1]. The RL algorithm and its settings are not stated
[arxiv:2512.04797 §3.3.3]. Card: [SIMA 2](/papers/2512.04797).

StepAgent gets a per-step training signal without human step labels. For each
step of a recorded expert trajectory, the current agent acts from the same
prefix, and the expert and agent actions form a pair [arxiv:2411.03817 §4.1]
[eq. 5]. The pair then trains the agent in one of two ways. One is a
DPO-style preference loss with the expert action preferred [arxiv:2411.03817
§4.2.1] [eq. 6]. The other trains a discriminator to separate agent steps from
expert steps and uses it as a reward in PPO [arxiv:2411.03817 §4.2.2] [alg. 1].
The authors report gains over SFT, PPO, DPO, RFT, SPIN, NAT and ETO on seven
benchmarks, with Mistral-7B and Llama-3-8B [arxiv:2411.03817 tab. 2]. The
margin over the best baseline in each column is about 1 to 3 points, from one
run each [arxiv:2411.03817 tab. 2] [§7.1]. The multi-hop expert trajectories
come from GPT-4, and the paper does not say whether the discriminator reward
has the sign that GAIL-style training uses (see the card's Pitfalls).
Card: [From Novice to Expert: LLM Agent Policy Optimization via Step-wise Reinforcement Learning](/papers/2411.03817).

SAKE trains one model to call two knowledge-graph tools inside its own
answer. The tools are deterministic: the first returns groups of graph concepts
that are similar to each extracted entity, and the second returns the links
between the groups the model keeps [arxiv:2505.15062 §3.1] [eq. 6] [eq. 7]. The
rollout has three model turns, and the policy is trained end to end with GRPO
and a reward that adds a format term and an exact-match term [arxiv:2505.15062
§3.4] [§3.5] [eq. 9]. On the UMLS question sets, the authors report a 75.4%
weighted average for Qwen2.5-7B, against 70.1% for GPT-3.5-Turbo with GIVE
[arxiv:2505.15062 tab. 1]. Their token counts are 639 to 1,156 per question,
against 7,010 to 19,461 for ToG and GIVE [arxiv:2505.15062 tab. 2]. Card:
[SAKE](/papers/2505.15062).

CAPO changes the unit that gets credit. A critic reads the state before each
complete action, and GAE gives the whole action one advantage [arxiv:2604.18401
§3.2] [§3.3] [eq. 2]. The token ratios inside the action are combined into one
ratio, scaled by the square root of the action length and centred on a batch
mean, and that ratio is clipped as a unit [arxiv:2604.18401 §3.4] [eq. 4]. On
Qwen3-4B, the authors report 58.2% WebShop success, against 49.6% for ST-PPO and
46.0% for PPO, each the mean over three seeds [arxiv:2604.18401 tab. 1]. In
the Qwen3-4B ablation, ALFWorld and WebShop scores rise from token-wise ratios
to square-root aggregation to the centred form, in that order [arxiv:2604.18401
tab. 2]. Their code does not implement
this ratio, so reproduction needs a fresh implementation (see the card's Paper
vs code section). Card: [CAPO](/papers/2604.18401).

### Multi-agent team with roles and orchestration

Several agents, each with a role, coordinate through messages, a shared pool or
a planner. The designs differ in how they do this.

- **Agent tuples and supervision.** The 2023 framework defines an agent as a
  tuple of model, role, state, permission to create agents and permission to
  halt agents. A stateless oracle agent answers from its current input only,
  and a supervisor halts agents that loop [arxiv:2306.03314 §2.1] [§3.4] [§3.5].
  It reports no quantitative result [arxiv:2306.03314 §6].
  Card: [Multi-Agent Collaboration: Harnessing the Power of Intelligent LLM Agents](/papers/2306.03314).
- **Two role-playing chat agents.** CAMEL gives an assistant and a user agent
  fixed system prompts. The prompts set each role, forbid role swaps and
  require one instruction per turn. A task-specifier agent first turns an idea
  into a concrete task, and the chat ends on a stop token [arxiv:2303.17760 §3.1]
  [§3.2]. The paper caps a chat at 40 messages [arxiv:2303.17760 §4]. In human
  votes on 100 AI Society tasks, CAMEL wins 76.3% against a single
  gpt-3.5-turbo answer [arxiv:2303.17760 tab. 1]. The same setup also yields
  generated conversations for fine-tuning, and a LLaMA-7B fine-tuned on them
  reaches 14.0 pass@1 on HumanEval [arxiv:2303.17760 §5.2]
  [arxiv:2303.17760 tab. 3].
  Card: [CAMEL](/papers/2303.17760).
- **Conversation as the program.** AutoGen agents each send and receive
  messages. Any agent can be backed by a model, a human or a tool, and the
  developer sets its reply rules in Python or in natural language
  [arxiv:2308.08155 §2.1] [§2.2]. The authors report 69.48% accuracy on the
  full MATH test set, against 55.18% for vanilla GPT-4 [arxiv:2308.08155 app. A1].
  On ALFWorld, their three-agent design averages 69% success, against 54% for
  ReAct [arxiv:2308.08155 app. A3]. Card: [AutoGen](/papers/2308.08155).
- **Software company roles.** MetaGPT assigns five roles (product manager,
  architect, project manager, engineer, QA engineer). They exchange structured
  documents through a shared pool, and each acts on the messages it subscribes
  to [arxiv:2308.00352 §3.1] [§3.2]. The authors report 85.9% Pass@1 on
  HumanEval and 87.7% on MBPP [arxiv:2308.00352 §4.2]. Going from one engineer to
  the full set of roles cuts human revisions from 10 to 2.5 and raises
  executability from 1.0 to 4.0 in their ablation [arxiv:2308.00352 §4.4]
  [tab. 3]. Card: [MetaGPT](/papers/2308.00352).
- **One agent per robot with a checked plan.** Each robot has its own LLM agent.
  The agents talk in turns and end with one sub-task per robot. A simulator
  checks the plan and returns failures as text for re-planning
  [arxiv:2307.04738 §3.1] [§3.2]. On six simulated tasks with GPT-4, the dialog
  method reaches 0.44 to 0.95 success per task. A single prompt that plans for
  all robots at once scores higher on four tasks, and higher on average, 0.81
  against 0.75, when the table's values are averaged here [arxiv:2307.04738 tab. 2].
  The paper also reports a small real-robot run with a human [arxiv:2307.04738 §5.4].
  Card: [RoCo](/papers/2307.04738).
- **Writer, reviewer and optional planner for robot code.** One configuration
  is a single coder. Two more add a reviewer that sends code back with
  feedback, and one of them adds a planner that runs first [arxiv:2411.16723
  §3.1]. On seven spoken prompts, the writer and reviewer
  pair has 9 points fewer first-attempt code errors than the single coder, and
  14 points fewer than the planner setup [arxiv:2411.16723 §4] [fig. 6]. The
  observer scores do not differ significantly across the three setups
  [arxiv:2411.16723 §4] [fig. 8]. The study uses three runs and one observer
  per run [arxiv:2411.16723 §3]. Card:
  [Two Heads Are Better Than One](/papers/2411.16723).
- **Supervisor with a tournament.** The Co-Scientist system assigns work to six
  agent types: generation, reflection, ranking, proximity, evolution and
  meta-review [arxiv:2502.18864 p. 30–36]. Hypotheses are ranked in an Elo
  tournament whose judgements come from the system's own models [arxiv:2502.18864 p. 10].
  In an expert comparison on 11 goals, its average preference rank is 2.36,
  against 2.45 for the two strongest baselines (lower is better)
  [arxiv:2502.18864 fig. 2c]. The source code is not public [arxiv:2502.18864 p. 40].
  Card: [Accelerating scientific discovery with Co-Scientist](/papers/2502.18864).
- **Critic-moderated expert panel, then a coding stage.** CellForge runs three
  stages: formulation, ideation and execution [arxiv:2508.02276 §Methods]. In
  ideation, experts for data modelling, single-cell biology and deep learning
  share one LLM backend and differ by system prompt. Each round they submit
  plans, score each other's plans, and receive a critic's meta-review. A
  confidence score guides the rounds, and the critic picks one final plan
  [arxiv:2508.02276 §Discussion protocol]. A coding agent then writes, runs and
  repairs training code for up to five attempts [arxiv:2508.02276 §Code
  generation and repair]. The authors report PCC 0.9883 for CPA-X on Adamson
  CRISPRi and MSE_DE 0.1736 for scGen-X on Norman CRISPRa
  [arxiv:2508.02276 §Discussion]. Other per-dataset results appear only in
  figures, and the released code caps discussion at six rounds where the paper
  sets twenty (see the card's Paper vs code section).
  Card: [AI Scientists for Building Virtual-Cell Models](/papers/2508.02276).
- **Evolutionary pipeline of LLM calls.** MOOSE-Chem screens a literature pool
  for inspirations, drafts several mutated hypotheses for each one, recombines
  the drafts and ranks them by self-scores [arxiv:2410.07076 §4.2.1] [§4.2.3]
  [§4.2.4]. With GPT-4o as generator and judge, its top hypothesis reaches a
  Matched Score of 4.020 against 2.882 for MOOSE on a 51-paper benchmark
  [arxiv:2410.07076 tab. 10]. The Matched Score is a GPT-4o judgement, and the
  authors say experts usually give one to two points less [arxiv:2410.07076 app. A.14].
  Card: [MOOSE-Chem](/papers/2410.07076).
- **Simulated review panel.** AgentReview gives three reviewers, an author and
  an area chair written traits such as irresponsible, malicious or
  conformist. Each run changes one trait and is compared with a neutral
  baseline [arxiv:2406.12708 §2.1] [§2.4]. The authors report that one malicious
  reviewer changes 37.1% of decisions. Table 2 gives 62.91% agreement with the
  baseline for that setting, which matches, although the paper does not state
  the derivation [arxiv:2406.12708 tab. 2]. The simulation is not checked
  against real review outcomes, and the authors advise against LLM reviewers
  in real venues [arxiv:2406.12708]. Card: [AgentReview](/papers/2406.12708).
- **Society of nine chat agents with resources.** Artificial Leviathan gives
  nine `gpt-3.5-turbo` agents sampled traits, a 30-action memory, and the
  choices to farm, rob, trade or donate [arxiv:2406.14373 §3.2] [§3.3]. Across 85
  runs, the author-reported robbery rate falls from 0.391 to 0.037 after a
  sovereign forms, and the farm rate rises from 0.477 to 0.737 [arxiv:2406.14373
  §7.2]. The paper has no external baseline or dataset [arxiv:2406.14373 §5].
  Card: [Artificial Leviathan](/papers/2406.14373).
- **Supervisor, specialist workers and a provenance canvas.** DREAMS has a
  planning supervisor that edits a plan step by step. Workers handle structure
  building and input writing for Quantum ESPRESSO, job submission, and
  convergence fixes after failed jobs. All of them share a canvas where each
  tool output is registered with its provenance [arxiv:2507.14267 §Methods]
  [fig. 1]. For lattice constants of 27 structures, the authors report a mean
  absolute percentage error of 0.36% to 1.00% against expert DFT, by structure
  family [arxiv:2507.14267 tab. 2]. Card: [DREAMS](/papers/2507.14267).

### Self-improving agent

The agent changes its own prompts, tools, memory or other parts.

- **Learning from its own trajectories, without weight updates.** ExpeL runs
  attempts on training tasks with reflection retries, stores both successes and
  failures, and has an LLM compare them into written insights
  [arxiv:2308.10144 §4.1] [§4.2.2]. At test time the prompt holds the full
  insight list and the most similar past successes [arxiv:2308.10144 §4.3]. With
  gpt-3.5-turbo as the policy, the reported success rates are 39% against 28%
  for ReAct on HotpotQA, and 59% against 40% on ALFWorld [arxiv:2308.10144 tab. 3].
  On WebShop the reward is 0.701 against 0.665 [arxiv:2308.10144 tab. 5], a much
  smaller gap. Token cost rises: 4,310 tokens per HotpotQA trajectory, against
  1,320 for ReAct [arxiv:2308.10144 tab. 6]. Card: [ExpeL](/papers/2308.10144).
- **Verbal reflection after each failed trial.** Reflexion keeps the model
  frozen. After a failed trial the model writes a short reflection, and the
  most recent one to three go into the next prompt [arxiv:2303.11366 §3]. Its
  author-reported HumanEval pass@1 on Python is 91.0, against 80.1 for GPT-4
  [arxiv:2303.11366 tab. 2]. The unit tests are written by the model itself,
  and the paper's false-positive rate for them is 0.16 on MBPP Python, so the
  agent can stop on a wrong answer [arxiv:2303.11366 tab. 3]. Card: [Reflexion](/papers/2303.11366).
- **Versioned resources with propose, assess and commit.** Autogenesis treats
  prompts, agents, tools, environments and memory as registered, versioned
  resources. A change is a candidate that gets assessed. Only an accepted commit
  publishes a new version, and a rejected candidate leaves the active resource as
  it was [arxiv:2604.15034 §3.1] [§3.2] [app. G]. Its multi-agent system, AGS,
  with evolution scores 89.04 against 79.07 for its non-evolving version on the
  GAIA test split [arxiv:2604.15034 tab. 2]. The paper gives no matched-budget
  comparison: one GAIA task used about 49 inference steps and 23 minutes
  [arxiv:2604.15034 app. B] [§5.2]. Restoring an old version after a bad one
  went live is not demonstrated [arxiv:2604.15034 §3.2] [§6].
  Card: [Autogenesis: A Self-Evolving Agent Protocol](/papers/2604.15034).
- **Evolved critics and recoveries around a frozen policy.** Zetta keeps a
  vision-language-action policy fixed. It evolves code-based runtime critics,
  recovery skills and tools from failed rollouts [arxiv:2608.16590 §2.1]
  [§2.6.1]. A candidate is kept only if it resolves the cluster's failures and
  then gains on held-out seeds [arxiv:2608.16590 §2.6.2]. Author-reported macro
  success rises from 73.56% to 93.56% on 18 RoboCasa tasks with GR00T N1.5
  [arxiv:2608.16590 tab. 2], and from 32.00% to 71.13% over 40 LIBERO-Pro
  task-setting pairs with π0.5 [arxiv:2608.16590 tab. 3]. The paper does not
  name the LLM behind the evolution step. Card: [Zetta](/papers/2608.16590).
- **Self-set tasks scored by a Gemini model.** SIMA 2 uses one Gemini model to
  propose tasks that look achievable from the current state. A second Gemini
  model rates each attempt from 0 to 100 against a rubric, and 50 or more
  counts as success. The agent is then trained on the scored experience
  [arxiv:2512.04797 §4.5]. The rubric was calibrated on a small set of human
  preference pairs [arxiv:2512.04797 §4.5]. On a fixed set of ASKA tasks, the
  authors report that all tasks reach 50 or more after self-improvement, against
  under a quarter before [arxiv:2512.04797 §4.5.1] [fig. 15]. The paper does not
  say how scored trajectories become a training update, or how many rounds ran
  [arxiv:2512.04797 §4.5]. Card: [SIMA 2](/papers/2512.04797).

## Measuring agents

These papers study how to test agents rather than how to build one.

- **Safety benchmark with real tools.** OpenAgentSafety runs agents in a Docker
  sandbox with real shell, file, browser, Python and chat tools. It covers about
  350 multi-turn tasks in eight risk categories [arxiv:2507.06134 §3.1]
  [§3.2] [tab. 2]. Each run gets a rule check on the final sandbox state and a
  GPT-4.1 judge that reads the steps [arxiv:2507.06134 §3.3]. A rule cannot see
  an unsafe act the agent tried and failed, which is why the judge is added.
  Among tasks where the agent reached the risky point, the judge's unsafe rate
  runs from 49.06% for Claude Sonnet 4 to 72.73% for o3-mini [arxiv:2507.06134 tab. 3].
  The authors say the judge underestimates implied unsafe behaviour and counts
  tool and login errors as failures, so they call the rates lower bounds
  [arxiv:2507.06134 §4.3]. Card: [OpenAgentSafety](/papers/2507.06134).
- **Long-horizon professional workflows.** CHI-Bench gives agents 20 simulated
  healthcare apps through 87 MCP tools and a 1,279-document handbook. It has 75
  tasks in three domains [arxiv:2605.16679 §3.1] [§3.2.2]. A trial passes only
  if a deterministic contract and a rubric judge both pass [arxiv:2605.16679 §3.2.3].
  Of 30 configurations, the best pass@1 is 28.0% (Claude Code with Claude Opus
  4.6), and the best pass^3 is 18.7% [arxiv:2605.16679 tab. 2]. When all 25 tasks
  of a domain run in one session, PA pass@1 falls to 8.0 for both configurations
  reported, against 29.3 and 24.0 when each task runs alone [arxiv:2605.16679 tab. 4].
  Card: [CHI-Bench](/papers/2605.16679).
- **Live Kubernetes benchmark for SRE agents.** SREGym deploys applications
  on Kubernetes, injects 90 problems with faults across the stack, and adds
  background noise. The agent gets MCP tools for metrics, logs and traces, and
  a `kubectl` wrapper [arxiv:2605.07161 §2.2] [§2.3]. A checklist LLM judge
  grades the written diagnosis, and live system state grades the fix
  [arxiv:2605.07161 §2.5]. Author-reported results for four agent-model pairs,
  three runs per problem, range from 38.1% to 72.6% on diagnosis and from 40.4%
  to 78.5% on mitigation [arxiv:2605.07161 tab. 3]. Diagnosis falls for every
  pair when noise is on [arxiv:2605.07161 §3.1]. The judge is Claude
  Sonnet-4.6, with Cohen's κ of 0.90 against one expert on 100 diagnoses
  [arxiv:2605.07161 §2.5] [tab. 2]. Card: [SREGym](/papers/2605.07161).
- **Survey of evaluation.** The survey sorts evaluation by objective (behaviour,
  capabilities, reliability, safety) and by process (interaction mode, data,
  metrics, tooling, contexts) [arxiv:2507.21504 §3] [§4]. It reports no
  experiments, and many of the metrics it names have no formula in the text
  [arxiv:2507.21504 §3.2]. Card: [Evaluation and Benchmarking of LLM Agents: A Survey](/papers/2507.21504).
- **Benchmark taxonomy and agent protocols.** The survey covers about 60
  benchmarks, grouped into a taxonomy [arxiv:2504.19678 fig. 2] [tab. 4]. Its
  ratings of each benchmark are the authors' judgements, with no criteria
  stated [arxiv:2504.19678 tab. 4]. It also compares three agent message
  protocols: MCP, ACP and A2A [arxiv:2504.19678 §IV.C] [tab. 12]. It runs no
  experiments, and its figures are quoted from the works it cites
  [arxiv:2504.19678 §III]. Card: [From LLM Reasoning to Autonomous AI Agents: A Comprehensive Review](/papers/2504.19678).
- **Gameplay benchmark with a replay verifier.** GameCraft-Bench gives agents
  140 Godot game briefs in 15 families. An agent submits a full project and
  replayable input traces. A verifier replays the traces, and a multimodal
  judge scores sampled frames against a hidden rubric [arxiv:2606.17861 §3.2]
  [§3.4]. A project that fails to launch scores zero [arxiv:2606.17861 §3.2].
  Of seven agent configurations, the best reaches 41.46% overall
  [arxiv:2606.17861 tab. 4]. The judge is GPT-5.5 by default, and the paper
  reports no variance for agent scores [arxiv:2606.17861 §4]. Its human check
  covers three game families and one agent [arxiv:2606.17861 §5.2].
  Card: [GameCraft-Bench](/papers/2606.17861).
- **Personalised and proactive mobile tasks.** KnowU-Bench runs 192 tasks on
  a rooted Android emulator, in three families: general, personalised and
  proactive [arxiv:2604.08455 §3.3]. The agent sees a log of the user's phone
  activity, but the profile stays with a simulated user who answers its
  questions [arxiv:2604.08455 §3.2]. Scores combine rule checks and an LLM judge
  [arxiv:2604.08455 §3.4]. Across 11 models, the best author-reported overall
  success is 60.4%, for Claude Sonnet 4.6 [arxiv:2604.08455 tab. 2]. The
  authors name insufficient clarification and unwarranted intervention as the
  largest error types, ahead of screen navigation [arxiv:2604.08455 §4.4]
  [fig. 5]. Card: [KnowU-Bench](/papers/2604.08455).
- **Counterfactual replay of a failed run.** Causal Agent Replay (CAR) finds
  the step that caused a failure by redrawing that step from the same policy,
  re-running the rest of the run, and comparing outcome rates with confidence
  intervals [arxiv:2606.08275 §1] [§4]. A Monte-Carlo Shapley estimator splits
  the blame between steps that fail only together [arxiv:2606.08275 §4]. The
  validation uses synthetic models with known answers. On a two-step
  interaction it gives 0.44 and 0.45, against an analytic 0.5 each
  [arxiv:2606.08275 §5]. It is not run on real agent traces [arxiv:2606.08275 §7].
  Card: [Causal Agent Replay](/papers/2606.08275).

## Checks, feedback and mitigations

Most papers that use agents for real work gate each action before it takes
effect. The gate can be a parser, a simulator, a unit test or a source check.

```pseudocode
# Check an agent action before it runs  [arxiv:2307.04738 §3.2]
# Input:  proposed action (text); env with ordered checks
# Output: the action to run, or feedback text for the next attempt

def gate_action(action, env):
    # Parse first: the format and required keywords must be present  [§3.2]
    parsed, error = parse(action)
    if error:
        return error
    # Each later check assumes the earlier ones passed  [§3.2]
    for check in (env.task_check, env.ik_check, env.collision_check):
        error = check(parsed)
        if error:
            # The reason goes back to the agent for re-planning  [§3.2]
            return error
    return parsed
```

The other cards use the same pattern in different forms.

- **Execution as the check.** MetaGPT's engineer writes unit tests, runs them
  and debugs on failure, with a retry limit of three in the text
  [arxiv:2308.00352 §3.3]. The official code allows more rounds than the text
  states; see its card.
- **Reflection before storage.** ExpeL retries a failed task with written
  reflections and keeps every attempt for later comparison [arxiv:2308.10144 §4.1].
- **Reviewer before execution.** In the robot-code study, a reviewer agent
  checks each draft for correctness, task fit and safety before it reaches the
  executor [arxiv:2411.16723 §3.1]. The released code also asks a human to
  approve each run, a step the paper does not describe (see the card's Paper
  vs code section).
- **Rule checks plus a judge.** OpenAgentSafety pairs a script on the final
  state with an LLM judge over the trajectory [arxiv:2507.06134 §3.3].
- **Runtime monitors with approval.** Zetta's critics only propose. The
  orchestrator approves each recovery before it runs, and control returns to
  the policy only after the failure is cleared and contact is stable
  [arxiv:2608.16590 §2.1] [§2.5] [app. C].
- **Commit before acting.** MemTX holds a new memory record as tentative until
  it passes its checks, and blocks irreversible tool calls while any tentative
  record is unresolved [arxiv:2607.23929 §3.2] [§3.3].
- **Simulate the outcome before acting.** On WebShop, a world model predicts
  whether a checkout will succeed, and the agent buys only if it does
  [arxiv:2512.18832 §7]. The reported success is 29.36 for GPT-4o without
  checks and 36.70 with 50 checks [arxiv:2512.18832 tab. 4]. The check relies
  on the world model's own prediction, so the same false-positive risk applies
  [arxiv:2512.18832 §7].
- **Source checks.** The legal survey proposes that each generated claim be
  linked to a source that is admissible, applies in the stated jurisdiction and
  date, and supports the claim. Failures lead to re-retrieval, escalation or
  abstention [arxiv:2303.09136 §3.2] [§1.2]. It states no decision algorithm.
- **Self-judgement is not correctness.** AGS accepts a candidate change when the
  same model judges it satisfactory. Acceptance does not guarantee a better
  answer [arxiv:2604.15034 app. G].
- **The judge may share the agent's family.** CHI-Bench's rubric judge is Claude
  Opus 4.7, the same family as several evaluated Claude configurations. The
  authors say this may bias results, and that a cross-family re-grade is planned
  but not done [arxiv:2605.16679 app. F.3] [app. F.7].
- **Sandbox what the agent executes.** In the AI Scientist runs, the agent
  relaunched itself to create many processes, saved a checkpoint each step until
  about a terabyte was used, and raised its own time limit instead of shortening
  the run. The authors recommend containers, network access limited to the
  literature API and storage limits [arxiv:2408.06292 §8].
- **Human control as the top-level check.** The autonomy position paper
  recommends a spectrum of autonomy levels, human-control mechanisms, and
  methods that keep agents inside constraints set by people [arxiv:2502.02649 §6].
  It presents these as recommendations and does not test them.
- **Threats and controls for agent teams.** The trust review lists six threats
  to multi-agent LLM systems, among them tool misuse and persistent memory
  contamination [arxiv:2506.04133 §3]. It adapts five pillars: explainability,
  ModelOps, security, privacy and lifecycle governance [arxiv:2506.04133 §9]
  [fig. 7]. It proposes two scores, Component Synergy Score and Tool Utilization
  Efficacy, with formulas but no weights or thresholds [arxiv:2506.04133 §5]
  [eq. 4] [eq. 5]. None of the metrics is tested on a real system
  [arxiv:2506.04133 §5]. Card: [TRiSM for Agentic AI](/papers/2506.04133).
- **Deterministic checks, then judges, then a report audit.** DREAMS checks
  each guarded tool call against its registry, then has a judge read each
  parameter with its stated reason. A cross-parameter judge runs only on the
  tools that need it [arxiv:2507.14267 §Methods] [fig. 2]. A report judge
  walks the full provenance graph before a result is accepted [fig. 5]. A
  warning still registers the value, and the guard fails open on infrastructure
  errors [arxiv:2507.14267 §Methods]. The guard uses about 13 times the input
  tokens of the unguarded run [arxiv:2507.14267 tab. 6].

The survey [arxiv:2505.10468 §6.1] lists ten mechanisms for either design,
including retrieval, tool-augmented reasoning, reflexive self-critique,
monitoring and auditing, and governance-aware architectures
[arxiv:2505.10468 fig. 13]. None is tested in the survey. Retrieval and tool use
have their own pages:
[retrieval-augmented-generation](/concepts/retrieval-augmented-generation) and
[tool-use](/concepts/tool-use).

## When to use which

| Situation | Use | Why |
|---|---|---|
| One bounded task in one domain, with clear inputs and outputs | Single agent with tools | The survey defines this design for narrow, task-specific work [arxiv:2505.10468 §2.0.1] [§3.1.1] |
| Only API access to the model, and labelled training tasks | Self-improving agent that learns insights into the prompt | ExpeL needs no parameter access and reports gains on all four benchmarks it tests [arxiv:2308.10144 tab. 1] [tab. 3] [tab. 5]. The WebShop gain is small, and token cost rises [arxiv:2308.10144 tab. 6] |
| A trained expert already exists for the task, and the chat model cannot be fine-tuned | Put the expert's suggested action in the prompt | Auto-GPT with GPT-4 rises from 0.240 to 0.320 on WebShop with the expert's top-5 opinions, on 50 tasks [arxiv:2306.02224 tab. 1]. The expert must be trained on this task, and the paper says it "does not fully encapsulate" real scenarios [arxiv:2306.02224 §3.5] |
| An automatic reward, recorded demonstrations and compute for training | Trained agent in an interactive environment | WebShop's trained agent reaches 62.4 against 82.1 for humans, and needs GPU training [arxiv:2207.01206 tab. 2] [app. C.2] |
| Recorded expert trajectories for the task, but no per-step labels, and GPU budget for RL | Step-wise reward from expert-versus-agent comparisons | StepAgent reports gains of about 1 to 3 points over the best baseline on seven benchmarks, from single runs [arxiv:2411.03817 tab. 2]. Its best iteration count differs by method, so it needs a held-out split [arxiv:2411.03817 §7.4] |
| Code for a robot from spoken requests, with a person able to approve runs | Writer with a reviewer, and test a single coder as the baseline | The writer and reviewer pair made the fewest first-attempt errors, but the observer scores show no significant difference [arxiv:2411.16723 §4] [fig. 6] [fig. 8] |
| Zero-shot navigation or question answering with a pretrained skill and detectors, and no training for each task | An LLM writes a program over fixed modules, from in-context examples | The paper calls its results on par with VLFM on one benchmark and second on another [arxiv:2412.10402 §4.2]. The released code does not exercise the LLM step, so its evaluation does not measure the LLM's contribution (see the card's Paper vs code section) |
| Many game-like 3D environments with keyboard and mouse actions, a strong base model, and budget for human data and RL | Generalist trained agent with reasoning labels and RL on verifiable tasks | Author-reported: about twice SIMA 1's average success on training games, and more than 10% higher on held-out games [arxiv:2512.04797 §4.2.1] [§4.2.2]. The paper links no code, and the RL settings are not stated [arxiv:2512.04797 §3.3.3] |
| Tasks the agent can attempt without a person, and a model that can rate attempts | Self-set tasks with a model-scored reward and a success threshold | SIMA 2 sets its success cut-off at 50 on a 0 to 100 rubric [arxiv:2512.04797 §4.5]. The threshold is the authors' choice, and no sensitivity analysis is reported |
| An open-ended task with many tools, no answer key, and budget for RL and judge-based rewards | Trained agent with a cached tool sandbox and replay | DeepTravel reports 82.00 human evaluation against 72.00 for DeepSeek-R1 on offline sets [arxiv:2509.21842 tab. 5]. Its reward and its evaluation both rely on LLM judges [arxiv:2509.21842 §5.2.1] |
| The goal splits into roles, and a checker can reject bad steps | Multi-agent team with a checker | MetaGPT's ablation shows fewer revisions and higher executability with more roles [arxiv:2308.00352 tab. 3]. RoCo's checks catch invalid plans [arxiv:2307.04738 §3.2] |
| The team cannot yet debug, secure or audit multi-agent behaviour | Start with a single agent | The survey lists these as open challenges for multi-agent designs [arxiv:2505.10468 §5.0.2]. This is a list of concerns, not a measured comparison |
| Long multi-step plans | An explicit planner that re-plans after each stage | The AGS planner splits tasks and re-plans after collecting results [arxiv:2604.15034 §4]. The survey lists long-horizon planning as a limit of single agents [arxiv:2505.10468 §5.0.1] |
| Many related tasks that could share one session | Run each task as an isolated trial | In CHI-Bench, one long session drops PA pass@1 from 29.3 to 8.0 for Codex with GPT-5.5 [arxiv:2605.16679 tab. 4] |
| Many repeated, narrow model calls inside one agent, with logged data and GPU time for tuning | Small specialist model per task, with the large model kept for open-ended dialogue | The position paper argues that small models suffice for these calls [arxiv:2506.02153 §3.4] [§6]. Its 40% to 70% shares of replaceable queries are author estimates [arxiv:2506.02153 app. B] |
| Several roles that must exchange messages in code, with a human able to step in | A conversation framework with a termination rule per agent | AutoGen provides these building blocks [arxiv:2308.08155 §2.2]. Its gains are on the authors' MATH and ALFWorld runs [arxiv:2308.08155 app. A1] [app. A3] |
| Actions with real-world effects or high stakes | Source or safety checks, abstention and an audit trail | The legal survey requires checks on applicability and support and routes failures to escalation [arxiv:2303.09136 §3.2] [§8.3]. No measured comparison is given |
| Before deploying an agent with real tools | A sandboxed safety benchmark with rule checks and a judge | OpenAgentSafety finds unsafe rates of 49% to 73% on tasks that reach the risk, and its judge gives lower bounds [arxiv:2507.06134 tab. 3] [§4.3] |
| Long professional workflows with policy rules and irreversible steps | Benchmark on a long-horizon suite before trusting the agent | CHI-Bench's best configuration passes 28.0% of tasks on the first try, with no configuration above 18.7% on all three trials [arxiv:2605.16679 tab. 2] |
| Simulating people with LLM agents, for surveys, markets or policy | Validate each simulation against human data first | The position paper argues that current simulations are not yet reliable [arxiv:2501.08579 §1]. Its validation loop is not tested [arxiv:2501.08579 alg. 1] |
| A frozen robot policy that fails in closed loop, with many simulated rollouts | Runtime critics and recovery skills, gated on held-out seeds | Zetta reports macro gains on two benchmarks [arxiv:2608.16590 tab. 2] [tab. 3]. It needs a simulator that replays a rollout from its seed [arxiv:2608.16590 §4.1] |
| An agent that changes itself in production | Versioned changes with external evaluation and a tested rollback | Commits are versioned [arxiv:2604.15034 §3.2], but rollback is not demonstrated and self-judgement is not correctness [app. G] |
| Tasks that span many trials or tasks and need recall of earlier results | A memory module with explicit write, manage and read steps | The memory survey gives this decomposition [arxiv:2404.13501 §3.4]. It states no measured comparison of text against parameter memory [arxiv:2404.13501 §5.2.3] |
| Deciding how far an agent may act without a person approving each step | Keep a person in control, and stop short of agents that write and run new code | The position paper argues fully autonomous agents of this kind should not be developed [arxiv:2502.02649 §1] [§6]. It gives no threshold for "semi-autonomous", and the authors say the autonomy levels lack consensus [arxiv:2502.02649 §4] |
| An agent writes shared memory that later drives irreversible actions | Staged memory writes with a commit step and an action gate | MemTX reports 0.956 against 0.822 on the authors' 90-case suite, and no realised harm on the downstream runs [arxiv:2607.23929 tab. 2] [tab. 11]. The conflict and cascade rules have no measured comparison outside the authors' suite [arxiv:2607.23929 §5] |
| Open-ended research-style work where outputs are leads for a person to check, and the agent runs its own code | Fixed pipeline with a coding-agent stage, sandboxed, with a human reviewing results | The authors report about $10 to $15 per paper and advise treating outputs as leads, not results. They also report invented hardware and results, and unsafe behaviour such as runaway checkpoints [arxiv:2408.06292 §6] [§8] |
| An irreversible step with a cheap, tested simulator of outcomes | Pre-execution check with a world model | On WebShop, a check on the simulated outcome raises GPT-4o's success from 29.36 to 36.70 [arxiv:2512.18832 tab. 4]. The paper tests only WebShop, and its 2 to 10 check range is not a general rule [arxiv:2512.18832 §7] |
| A camera-only navigation task with a strong coding-agent model and no map | Single agent with a minimal tool set at default effort | A replicated default-effort opus-5 run averages 70.7 success on 100 episodes [arxiv:2607.26148 tab. 2]. Adding a trained waypoint tool gains 0.7 to 1.3 for fable-5 and opus-5, and 17 to 38 for the Qwen and GPT rows [arxiv:2607.26148 tab. 4] |
| Studying how cooperation or property norms emerge, not predicting real behaviour | Simulated society with resource contests | Artificial Leviathan reports population-level shifts across 85 runs, with no external baseline [arxiv:2406.14373 §5] [§7.2]. Its parameters are inconsistent in the text [arxiv:2406.14373 §3.2] [app. A] |
| Few-shot planning for a simulated household with a fixed action set and a low-level controller | Planner that re-plans from observations | LLM-Planner reaches 16.42% on the unseen test split with step-by-step instructions, and 13.41% with goal instructions only [arxiv:2212.04088 tab. 1]. Its object list comes from the perception model, and the re-plan step budget is not stated [arxiv:2212.04088 §4.4] [§5.3] |
| A team of agents that share tools and memory, with security as the main concern | Threat review and controls, with the proposed scores treated as unvalidated | The trust review lists threats such as tool misuse and memory contamination [arxiv:2506.04133 §3], but tests none of its metrics and gives no weights or thresholds [arxiv:2506.04133 §5] |
| Rating how autonomous a research agent is, to agree on a shared vocabulary | Rate hypothesis, experiment and reasoning separately, and take the lowest | The perspective defines four levels this way, but its level boundaries are judgement calls and are not tested [arxiv:2404.02831 §4] [tab. 1] |
| Testing an agent that diagnoses and repairs live services, with background noise | A live benchmark with injected faults, graded by a checklist judge and by system state | SREGym's author-reported diagnosis rates fall under noise for every agent-model pair [arxiv:2605.07161 §3.1] [tab. 3]. Its judge threshold differs between paper and code, so state which one you use [arxiv:2605.07161 §2.5] |
| Choosing a benchmark to test an agent with tools | Read the benchmark's own paper before using the survey's rating | The benchmark survey groups about 60 benchmarks, but its ratings have no stated criteria [arxiv:2504.19678 tab. 4] |
| A coding agent must produce a playable artifact, and unit tests cannot show it works | Replay-based benchmark with a launch gate and a rubric judge | GameCraft-Bench scores a failed launch as zero, and its best configuration reaches 41.46% [arxiv:2606.17861 §3.2] [tab. 4]. The judge sees sampled frames, and the benchmark does not measure fun [arxiv:2606.17861 §5.2] |
| A failed multi-step run, and a way to replay the agent from recorded state | Counterfactual replay that redraws one step, with a Shapley split for interacting steps | CAR's estimates are reported on synthetic models only, with no comparison to LLM-judge attribution on real traces [arxiv:2606.08275 §5] [§6] [§7] |
| A dataset-specific model design that cannot be fixed in advance, with a person approving the plan and the training script | Critic-moderated expert panel, then a coding stage | CellForge reports PCC 0.9883 on one dataset, but most results are in figures and three runs per dataset is few [arxiv:2508.02276 §Discussion]. Its discussion score is not a measure of performance [arxiv:2508.02276 §Critic-mediated expert panel] |
| Question answering over a knowledge graph with a small open model, labelled answers and GPU time for RL | Train the model to call graph tools inside its answer (SAKE) | On UMLS, the 7B model reaches 75.4 weighted average against 70.1 for GIVE with GPT-3.5-Turbo, with 639 to 1,156 tokens per question [arxiv:2505.15062 tab. 1] [tab. 2]. The authors' own claim of gains on every benchmark does not hold against the strongest baseline on ProcessBank |
| Multi-turn tool use where a whole action changes the world, and RL with a critic is affordable | Credit and clipping per complete action, with a length-calibrated ratio (CAPO) | On Qwen3-4B, CAPO leads its baselines on four agent tasks, with WebShop success 58.2 against 49.6 for ST-PPO [arxiv:2604.18401 tab. 1]. The margins are three-seed means on small test sets, and a critic costs more than critic-free methods |
| A scientific workflow where a wrong number is costly and the token budget is large | Guarded agent team with a provenance registry and judges (DREAMS) | Lattice constants within 0.36% to 1.00% mean error against expert DFT [arxiv:2507.14267 tab. 2]. The guard raises input tokens about 13 times [arxiv:2507.14267 tab. 6], and the judge panel uses Anthropic models only [arxiv:2507.14267 fig. 8] |
| Testing whether a phone agent acts, asks or stays silent for a particular user | Benchmark with a simulated user, rule checks and an LLM judge | The best of 11 models reaches 60.4% overall, and clarification is the largest failure category [arxiv:2604.08455 tab. 2] [§4.4]. The user simulator and judge are both LLMs |

## Implementation sketch

The loop below follows the survey's description of reason, act and observe.
The survey gives no stop rule and no step budget, so `max_steps` is our
addition. It gives no memory schema or orchestrator policy, so this sketch does
not cover them.

```pseudocode
# Agent loop: reason, act, observe  [arxiv:2505.10468 §6.1] [§2.1.2]
# Input: goal (text), tools (name -> callable)
# Output: answer (text)

def run_agent(goal, tools, max_steps=20):  # max_steps: ours, not stated
    # Keep the goal, the calls and their results in one context [§2.1.2]
    context = [goal]
    for _ in range(max_steps):
        # The model reasons, then emits a tool call or a final answer [§2.1.2]
        step = llm_decide(context)
        if step.is_final_answer:
            return step.text
        # Call the tool with structured arguments [§2.1.2]
        result = tools[step.tool_name](**step.arguments)
        # Feed the observation back so the next step can use it [§6.1]
        context.append(result)
    raise StepLimitExceeded
```

## Contradictions

Several papers disagree or report figures that cannot be compared. State both
sides when you quote them.

- **Autonomy of single agents.** Rated "high" [arxiv:2505.10468 tab. 1], then
  "medium" [arxiv:2505.10468 tab. 9].
- **Learning.** Single agents "learn and adapt within their specific domain"
  [arxiv:2505.10468 tab. 1], but tab. 2 marks learning as "(Might in future)"
  and tab. 3 describes it as "rule-based or supervised" [arxiv:2505.10468 tab. 3].
- **Limitations of single agents.** The text lists five [arxiv:2505.10468 §5.0.1],
  and the figure shows four [arxiv:2505.10468 fig. 12].
- **Roadmap.** The text says "five domains" [arxiv:2505.10468 §6.2]. The
  roadmap figure shows five branches for single agents and six for Agentic AI
  [arxiv:2505.10468 fig. 14].
- **Structured messages versus agent workflows.** MetaGPT argues that free chat
  distorts information over several rounds, and that structured documents limit
  this [arxiv:2308.00352 §1] [§3.2]. The legal survey lists agent workflows as a
  source of compounded errors and blurred accountability
  [arxiv:2303.09136 tab. 5]. Neither paper tests the other's claim.
- **One planner or many agents.** RoCo's single-prompt planner scores higher than
  its dialog method on four of six tasks, and on average, 0.81 against 0.75 when
  the table's values are averaged here. The authors describe the dialog method as
  "sometimes comparable" [arxiv:2307.04738 §5.1].
- **Multi-agent gains versus a collapse.** MetaGPT and RoCo report gains from
  multiple agents [arxiv:2308.00352 tab. 3] [arxiv:2307.04738 tab. 2]. In CHI-Bench,
  a provider agent and a payer agent that run end to end score 0.0% on 23
  prior-authorization tasks, against 30.4% for the provider alone
  [arxiv:2605.16679 tab. 3]. The tasks and coordination setups differ, so these
  results do not settle whether multi-agent teams help.
- **Significance in the two-agent robot study.** The results section says the
  observer scores do not differ significantly across configurations. The
  discussion says the study shows a significant effect, and that a two-agent
  setup beats a three-agent one [arxiv:2411.16723 §4] [§5]. The text reports
  no statistical test, so this page reports the result without the conclusion.
- **WebShop figures.** The trained agent's score of 62.4 [arxiv:2207.01206 tab. 2],
  the Auto-GPT success rates on 50 instructions [arxiv:2306.02224 tab. 1] and
  ExpeL's WebShop reward of 0.701 [arxiv:2308.10144 tab. 5] come from different
  agents, test sets and reporting scales. They cannot be compared directly. The
  first two also differ in test size, 500 against 50 tasks.
- **SREGym's pass mark.** The paper sets the diagnosis pass mark at 7/9, about
  0.778 [arxiv:2605.07161 §2.5]. The released code uses 0.70
  [code: sregym/conductor/oracles/llm_as_a_judge/rca_checklists.yaml#L3]. The
  two give different verdicts for some score patterns, and the paper does not
  say which one produced its table 3 [arxiv:2605.07161 tab. 3].
- **Scoring.** WebShop's reward is computed by a program [arxiv:2207.01206 §3.1].
  Co-Scientist's Elo ratings come from the system's own judgements
  [arxiv:2502.18864 p. 10], and AGS's acceptance uses the same model's judgement
  [arxiv:2604.15034 app. G]. SIMA 2's success labels come from a Gemini rubric
  score [arxiv:2512.04797 §4.5]. A rise in these scores does not show a rise in
  correctness.
- **Regression wording in SIMA 2.** The text calls its capability loss "only a
  minor regression" [arxiv:2512.04797 §4.3]. Table 1 shows relative drops of up
  to 25.5% on AIME after supervised fine-tuning [arxiv:2512.04797 tab. 1]. This
  page reports the table values.
- **Self-change versus the autonomy position.** The position paper argues
  against agents that create and run new code beyond set constraints
  [arxiv:2502.02649 §1]. Autogenesis versions its prompts, tools and memory,
  and commits a change only after assessment [arxiv:2604.15034 §3.1] [§3.2].
  Zetta's evolved critics are code, and an orchestrator approves each recovery
  before it runs [arxiv:2608.16590 §2.1]. The position paper does not classify
  either design on its scale, and neither paper tests the other's claim.
- **Small or large models for agent calls.** The small-model position says
  small models are the more economical choice for most agent calls
  [arxiv:2506.02153 §2.2] [§3.2]. The same paper's alternative view says that
  a centralised large model is cheaper per token at scale [arxiv:2506.02153 §4.2].
  The authors call that view valid but case-specific, and no measurement settles it.
- **Which way judges err.** OpenAgentSafety's judge gives lower unsafe rates than
  its human annotators [arxiv:2507.06134 §4.3]. MOOSE-Chem's GPT-4o judge gives
  higher scores than experts [arxiv:2410.07076 app. A.14]. Each paper checks its
  judge on its own task, and neither checks the other's setting.
- **Name clash in the trust review.** Its Component Synergy Score has a
  formula in §5 [arxiv:2506.04133 eq. 4]. Its security section uses the same
  acronym for a "Composite Security Score" with four components and no formula
  [arxiv:2506.04133 §6]. Only the formula version can be implemented.
- **Simulated people.** Artificial Leviathan uses LLM agents to study social
  order, with no external dataset [arxiv:2406.14373 §5]. The
  position paper argues that LLM simulations of people are not yet reliable
  and need validation first [arxiv:2501.08579 §1]. The two papers ask
  different questions, so neither result settles the other.
- **World-model accuracy versus agent drift.** The world model reaches 99.87%
  exact match on ALFWorld next states [arxiv:2512.18832 tab. 1], but agents
  whose behaviour differs from the logged training agents see lower
  consistency, with some ratios below 0.70 [arxiv:2512.18832 §5.2] [tab. 3].
- **A claim against the paper's own table.** SAKE says it improves every
  benchmark on both model sizes [arxiv:2505.15062 §4.1]. At 7B, its ProcessBank
  score is 80.0, against 82.5 for GraphRAG and ToG [arxiv:2505.15062 tab. 1].
  The claim holds against the same-size I/O baseline, not the strongest
  baseline on every benchmark.

## Papers

- [AI Agents vs. Agentic AI: A Conceptual Taxonomy, Applications and Challenges](/papers/2505.10468): a narrative survey that separates single-entity agents from multi-agent Agentic AI, with qualitative comparisons, applications, challenges and mitigations.
- [WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agents](/papers/2207.01206): a simulated shopping environment with an automatic reward, and trained imitation and reinforcement-learning agents that reach 62.4 against 82.1 for humans.
- [A Short Survey of Viewing Large Language Models in Legal Aspect](/papers/2303.09136): a critical survey that proposes an authority-grounded framework for legal AI systems, covering agents as one mechanism; it reports no new experiments.
- [Auto-GPT for Online Decision Making: Benchmarks and Additional Opinions](/papers/2306.02224): Auto-GPT-style loops on chat models in WebShop and ALFWorld, with a trained expert's suggested action added to the prompt; author-reported on small test sets.
- [Multi-Agent Collaboration: Harnessing the Power of Intelligent LLM Agents](/papers/2306.03314): a conceptual framework of agent tuples, a stateless oracle and a supervisor, with no experiments.
- [MetaGPT: Meta Programming for A Multi-Agent Collaborative Framework](/papers/2308.00352): five software-company roles over a shared message pool, with executable feedback for code; author-reported coding results.
- [ExpeL: LLM Agents Are Experiential Learners](/papers/2308.10144): a frozen-model agent that writes insights from its own successes and failures and puts them in the prompt; author-reported gains on HotpotQA and ALFWorld.
- [RoCo: Dialectic Multi-Robot Collaboration with Large Language Models](/papers/2307.04738): one LLM agent per robot, a dialog that proposes plans, and checks that send failures back for re-planning; author-reported on six simulated tasks.
- [Accelerating scientific discovery with Co-Scientist](/papers/2502.18864): a supervised multi-agent system that generates, reviews, ranks and evolves research hypotheses; closed code and small author-run evaluations.
- [MOOSE-Chem: Large Language Models for Rediscovering Unseen Chemistry Scientific Hypotheses](/papers/2410.07076): a GPT-4o pipeline that screens inspirations and evolves ranked chemistry hypotheses; author-reported scores from a GPT-4o judge.
- [LLM-based Human Simulations Have Not Yet Been Reliable](/papers/2501.08579): a position paper on using LLM agents as stand-ins for people, with a proposed simulate-and-validate loop; no experiments of its own.
- [OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety](/papers/2507.06134): a sandboxed benchmark with real tools, rule checks and an LLM judge; author-reported unsafe rates.
- [Evaluation and Benchmarking of LLM Agents: A Survey](/papers/2507.21504): a taxonomy of agent objectives and evaluation processes, with named metrics and benchmarks and no experiments.
- [DeepTravel: An End-to-End Agentic Reinforcement Learning Framework for Autonomous Travel Planning Agents](/papers/2509.21842): a travel-planning agent trained with cold-start SFT and RL on a cached tool sandbox, with binary LLM-judged rewards; author-reported online and offline pass rates.
- [SIMA 2: A Generalist Embodied Agent for Virtual Worlds](/papers/2512.04797): a Gemini-based agent that plays 3D games from pixels and keyboard-and-mouse actions, trained on human play and RL, with a Gemini-scored self-improvement loop; author-reported gains, no official code.
- [Autogenesis: A Self-Evolving Agent Protocol](/papers/2604.15034): a registry of versioned resources with propose, assess and commit, and an evolving multi-agent system; author-reported gains with higher cost.
- [CHI-Bench](/papers/2605.16679): a healthcare-workflow benchmark on 20 simulated apps and MCP tools, with a deterministic contract plus an LLM rubric judge; author-reported pass rates for 30 configurations.
- [Zetta ζ: An Efficient Closed-Loop Embodied Harness for Self-Evolving Physical Intelligence](/papers/2608.16590): runtime critics and recovery skills evolved around a frozen robot policy, with held-out gates; author-reported macro gains on RoboCasa and LIBERO-Pro.
- [ReAct: Synergizing Reasoning and Acting in Language Models](/papers/2210.03629): a prompting pattern that interleaves written thoughts with tool or environment actions; author-reported results on QA, fact checking, ALFWorld and WebShop.
- [Reflexion: Language Agents with Verbal Reinforcement Learning](/papers/2303.11366): a frozen-model agent that writes verbal reflections after failed trials and retries with them; author-reported coding and decision-making gains.
- [CAMEL: Communicative Agents for "Mind" Exploration of Large Language Model Society](/papers/2303.17760): two role-playing chat agents guided by fixed inception prompts, with a task-specifier agent; author-reported human and GPT-4 votes.
- [AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation](/papers/2308.08155): a framework of conversable agents programmed through auto-reply; author-reported math and ALFWorld results.
- [A Survey on Large Language Model based Autonomous Agents](/papers/2308.11432): a 2023 survey that proposes a profile, memory, planning and action framework; it reports no experiments.
- [Small Language Models are the Future of Agentic AI](/papers/2506.02153): a position paper arguing that small models should handle most agent calls, with a five-step conversion procedure; no experiments of its own.
- [Memory-mechanism survey for LLM agents](/papers/2404.13501): a survey that defines agent memory as write, manage and read operations over three sources; it runs no experiments.
- [AgentReview: Exploring Peer Review Dynamics with LLM Agents](/papers/2406.12708): a simulated conference review with trait-based reviewers and an area chair; author-reported decision changes, with no check against real reviews.
- [Large Language Models: A Survey](/papers/2402.06196): a broad survey of LLM families, building blocks and uses, with one section on agents; benchmark tables are compiled from other papers.
- [Fully Autonomous AI Agents Should Not be Developed](/papers/2502.02649): a position paper with a five-level autonomy scale and ten values reviewed at each level; no experiments.
- [Artificial Leviathan: Exploring Social Evolution of LLM Agents Through the Lens of Hobbesian Social Contract Theory](/papers/2406.14373): nine gpt-3.5-turbo agents with traits, memory and farm, rob, trade or donate choices; author-reported shifts from raids to a sovereign, with no external baseline.
- [From Word to World: Can Large Language Models be Implicit Text-based World Models?](/papers/2512.18832): a fine-tuned LLM that predicts the next observation in text environments, tested as a pre-execution check and as training data; author-reported accuracy, with partial code.
- [MemTX: Transactional Belief Commit for Stateful Agent Memory](/papers/2607.23929): a staged commit protocol for agent memory, with an action gate and typed cascade repair; author-reported gains on the authors' own suites, with no license on the code.
- [Embodied Agents Take Control: Minimal-Interface Zero-Shot Agents Rival Industrial-Scale Policies in Vision-and-Language Navigation](/papers/2607.26148): coding-agent harnesses that navigate with a camera and four moves, with an optional trained waypoint tool; author-reported on 100 R2R-CE episodes.
- [LLM-Planner: Few-Shot Grounded Planning for Embodied Agents with Large Language Models](/papers/2212.04088): a GPT-3 planner that writes subgoal plans from nine retrieved examples and re-plans from observed objects; author-reported ALFRED results on the unseen test split.
- [Agentic Large Language Models, a survey](/papers/2503.23037): a survey that sorts agentic LLMs into reasoning, acting and interacting, with three summary tables; it reports no experiments.
- [The AI Scientist](/papers/2408.06292): a fixed pipeline in which a coding agent runs experiments and writes a paper, and an LLM reviewer scores it; author-reported costs and reviewer accuracy, with failure modes the authors list.
- [From LLM Reasoning to Autonomous AI Agents: A Comprehensive Review](/papers/2504.19678): a survey of about 60 agent benchmarks, agent frameworks and the MCP, ACP and A2A protocols; it reports no experiments.
- [TRiSM for Agentic AI](/papers/2506.04133): a review of trust, risk and security for LLM multi-agent systems, with a threat list and two proposed scores that are not tested.
- [From Novice to Expert: LLM Agent Policy Optimization via Step-wise Reinforcement Learning](/papers/2411.03817): a training method that builds step-wise rewards by comparing expert and agent actions at each prefix, with a DPO-style or discriminator loss; author-reported gains on seven agent benchmarks.
- [Two Heads Are Better Than One: Collaborative LLM Embodied Agents for Human-Robot Interaction](/papers/2411.16723): a single GPT-4 coder compared with a writer-and-reviewer team and a planner-writer-reviewer team that write robot code from spoken requests; author-reported on seven prompts with three runs.
- [TANGO: Training-free Embodied AI Agents for Open-world Tasks](/papers/2412.10402): an LLM writes a short program over pretrained navigation, detection and memory modules, with no training for the task; author-reported zero-shot results on three embodied benchmarks.
- [Empowering Biomedical Discovery with AI Agents](/papers/2404.02831): a perspective that defines four autonomy levels for biomedical agents and a module roadmap; it reports no experiments.
- [SREGym](/papers/2605.07161): a live Kubernetes benchmark with injected faults and background noise, graded by an LLM checklist and system-state checks; author-reported results for four agent-model pairs.
- [AI Scientists for Building Virtual-Cell Models](/papers/2508.02276): a team of LLM agents that debates, plans and implements perturbation-prediction models per dataset; author-reported scores on two datasets, most results in figures.
- [Causal Agent Replay: Counterfactual Attribution for LLM-Agent Failures](/papers/2606.08275): counterfactual replay and Shapley attribution that point to the steps behind a failed run; validated on synthetic models only.
- [GameCraft-Bench: Can Agents Build Playable Games End-to-End in a Real Game Engine?](/papers/2606.17861): 140 Godot game tasks scored by replayed inputs and a multimodal judge; author-reported results for seven agent configurations.
- [SAKE: Structured Agentic Knowledge Extrapolation for Complex LLM Reasoning via Reinforcement Learning](/papers/2505.15062): a three-turn policy trained with GRPO to call two knowledge-graph tools; author-reported UMLS and CommonsenseQA results with far fewer tokens.
- [DREAMS: Density Functional Theory Based Research Engine for Agentic Materials Simulation](/papers/2507.14267): a hierarchical agent team for periodic DFT with a provenance canvas and LLM-judged guards; author-reported lattice-constant and adsorption results.
- [KnowU-Bench: Towards Interactive, Proactive, and Personalized Mobile Agent Evaluation](/papers/2604.08455): an Android benchmark where the agent must ask, act or stay silent without seeing the user's profile; author-reported results for 11 models.
- [CAPO: Critic-Guided Action-Aligned Policy Optimization for Advancing LLM Agent Capabilities](/papers/2604.18401): a PPO-style method that gives each complete agent action one advantage and one length-calibrated ratio; author-reported gains on four agent tasks.