One linear direction controls whether an agent calls a tool

A single linear direction in a model’s residual stream moves its tool-call rate from near 0% to over 90%, and sweeping that one knob nearly doubles open-domain QA accuracy, 0.29 to 0.56. That result comes from Tunable Tool-Call Rates in LLM Agents via Representation Steering (Chen, Siu, Liu, Song, Wang), the sharpest item in the feed’s last ingest, and it lands on an argument every agent operator has had in a retro: the model calls tools too often, or not often enough, and the only levers on offer were post-training and prompt surgery. The direction is extracted with no training at all, from the model’s own tool-use preference signal, then applied at inference with no prompt change, and it generalizes to tools it never saw during extraction without biasing which tool gets picked. Calls stay well-formed across the whole sweep. The authors run it against live tool execution and trace a cost/accuracy Pareto frontier, which is the part worth stealing: tool-call propensity becomes a dial you set per deployment rather than a disposition you inherit from the checkpoint. It transfers across dense, MoE, and multimodal architectures, and the code is public.

Zhonghao Zhan and Hamed Haddadi draw a distinction worth adopting: a Skill says how an agent should behave, a Policy decides which behavior is allowed to become an action, and today’s skill format covers the first with markdown and scripts while leaving the second to the model. Auto-Policy, not Auto-Skill names the resulting failure class Borrowed Authority. The format gives a receiving agent no typed way to reject an inter-agent permission claim, so a malicious or misused skill can drive a physical actuation simply by attaching one. Two adjacent attacks are already documented, malicious skills compromising cloud software and jailbroken LLM-controlled robots causing physical harm; their intersection follows directly and had not been reported. Edge Skillguard puts a typed authority layer inside the skill artifact rather than between tools where a workflow engine would sit, with guards over world state and sensor evidence. On a live edge control-plane testbed it rejected 60 of 60 borrowed-authority requests across five attack variants without blocking benign ones, and the result held at 5x scale and across hosts over a Tailscale mesh. Anyone shipping a self-evolving skill library should weigh the central claim, that generating more skills scales the gap rather than the safety.

Same instinct, different placement. The team behind harden.run post-trained a small cyber-security model, changed how it reasons, and supplemented its controls with program analysis, specifically inline reference monitoring, reporting that the combination beats GPT5.5-xhigh on LinuxArena and SleightBench. Their framing carries the post: coding agents write arbitrary code, so securing them is a harder problem than red-teaming a chat model, because the attack surface is whatever the agent just decided to compile. Full benchmarks are in the write-up. A vendor’s own numbers are a claim to reproduce rather than a result, but the architecture, a cheap specialized monitor plus static enforcement wrapped around an expensive generalist, is the shape a lot of production stacks are converging on.

Opslane puts its gate at the other end of the loop, opening a PR only when it can verify the fix. Abhishek Ray built it after quarterly bug bashes at Robinhood that ended by selecting the remaining Sentry backlog and declaring bankruptcy on it. The two failure modes he names belong in any triage design: false positives, thousands of errors with no signal about user impact, and false negatives, user-facing breakage that throws no exception at all. The second is the harder one, and the answer here is session recordings read for rage clicks, dead clicks, and abandoned forms. An early customer had a dropdown that closed itself when clicked, which produced no exception and no bug report, just users selecting nothing and dropping out of onboarding. It self-hosts from one Docker Compose file and ships an MCP server, so the query is “what broke for users this week” from a coding agent rather than a dashboard nobody opens.

The constraint that gets the least scrutiny is the one sitting in the repo. A post on r/ClaudeCode traces the obvious response to an agent repeating a mistake, which is adding one more rule to CLAUDE.md, and where that lands a few months later: rules describing code that no longer exists, and workarounds that became permanent architecture without anyone deciding they should. The proposed audit is a good one. Every instruction has to point to current code, a test, or an ADR, or it gets flagged for removal; repo invariants stay; temporary warnings need an owner or an expiry condition. Sharper still is the observation that most instructions belong somewhere else entirely, because a behavior that matters is more durable as a test, a repeated command is a script, and a decision with history is an ADR. The author’s discomfort is the part that generalizes: the tool best placed to trace those references is the tool the file exists to constrain.

MemHandoff puts numbers on the same problem one layer down. It compresses a long agent conversation into a portable .ctx package covering decisions, constraints, failed approaches, task state, artifacts, and provenance, then hands it to a second agent to continue the work. Against full context at 1.00, a simple summary scores 0.72 and a structured package 0.75, with the hybrid inconclusive. Roughly a quarter of the working state does not survive the handoff, and all that structure buys three points over plain summarization. The adversarial scenarios are where the harness earns its keep: contradictions, superseded decisions, negative constraints, critical information that arrived early, large tool output, vocabulary mismatch. Negative constraints and superseded decisions are precisely what a summarizer discards, and precisely what sends an agent back down a failed path after compaction.

Across all six, the constraint is migrating out of the prompt and into artifacts that something other than the model can check: a steering coefficient, a typed guard inside the skill, a reference monitor, a verification gate before the PR opens, an audited rule file, a serialized state package. What none of them answers yet is composition. A typed skill guard, a steering vector, and a repo rule file can each be correct on their own and still contradict one another at runtime, and nobody is measuring what happens when they do. Watch for the first eval that scores the whole constraint stack rather than one layer of it.

---

Sourcing note: the item feed’s most recent ingest is 2026-08-28T01:08 UTC. Nothing has landed since, so this issue draws on items published 27 and 28 August rather than the last 36 hours.