Prompt wording multiplies agent cost 7x. The harness multiplies it 30x.

Across 4,643 valid runs on 24 deterministic coding tasks, asking a large reasoning model to “develop and compare several approaches” raised its reasoning-token spend by 2.4x to 7.4x with no measured gain in correctness. A generic “think deeply” cue added 1.6x to 2.2x. A bounded template naming scope, acceptance criteria, and a stop condition came out cost-neutral and in some configurations halved reasoning. Prompt-Induced Waste is preregistered across six models and two real harnesses, with replications on Kimi-K3 and Claude Sonnet 5, and its largest single effect is not the prompt: identical model-task-prompt triples cost 5x to 30x more per success under Claude Code than under pi, driven by larger static prefixes and more turns. Provider-side caching lowers the bill without changing any of that behavior, which the authors flag as a reason not to read cached cost as efficiency.

That is the week in one finding. Almost everything published in the last seven days measures something outside the model and finds it dominant.

A failure taxonomy that tells you which team owns the fix

Model or Harness? names the problem the rest of this issue keeps running into: the same visible failure may call for post-training, scaffolding work, environment redesign, or benchmark repair, and an outcome-level label tells you none of that. The taxonomy assigns each of 41 failure modes to an edge between two components plus a fault side indicating where the repair belongs. Across four frontier models used as judges, the strongest reaches Cohen’s κ=0.76 against human category labels, which is the part that matters if you want to run this over logged trajectories rather than hand-annotate them. Model-side entries point at post-training, harness-side entries point at tool integration and scaffolding, grader-side entries mean your evaluation is the thing that is broken.

Hardening a coding agent costs up to 18 points of success and 167% more spend

Every benchmark you have read this year ran agents in a permissive sandbox. Permission Denied evaluates 12 coding agents on Terminal-Bench 2.1 under nested policy levels built from ordinary enterprise controls: scoped credentials, restricted egress, read-only filesystems, non-root execution. Under the strictest policy, success drops by as much as 18.3 points and cost inflates 167.3%, and the two axes disagree with each other. The model that best preserves success rate is also the one that loses the most efficiency, so which agent you should buy depends on which policies you enforce. The failure decomposition is the useful part: blocked agents rarely stop early. They grind into timeouts or ship wrong solutions, in proportions that vary by model. The authors verify task solvability under the strictest policy so that policy-foreclosed tasks are separated from model failures, and release the hardening plugin as Boundary-Bench.

Long-horizon numbers are similarly low once the loop is the unit of evaluation. LoopsBench models each of 112 tasks as a dependency DAG over separately testable development units with source-evidenced prerequisite edges, spanning 8 languages and 9 domains, and its runtime releases tests along the ready frontier while retaining completed nodes as regression obligations. The strongest configuration tested, Opus-4.7 with Claude Code and outer continuation, resolves 25.00% of tasks. Recorded agent plans recover only part of the prerequisite DAG that the source history implies, and regression events remain visible across every loop profile evaluated. More than 5,300 development units and executable tests are open at microsoft/Loopsbench.

Retrieval helps agents only above a precision threshold

The cleanest result of the week is a threshold. CodeGrep starts from the observation that a 30B OpenHands agent on SWE-Bench Verified averages 23 rounds and 631K tokens per resolved issue, much of it spent on grep, glob, and view_file rather than on the patch. The authors train a 14B retrieval agent with GRPO to issue multi-turn parallel search calls and hand candidate files to a frozen downstream coder. On all 500 Verified instances it reaches 27.0% against 25.8% for the no-retrieval baseline, with 15% fewer rounds and 19% fewer tokens on resolved instances. The comparison across retrievers is what to take away: BM25 at precision 0.375 makes the downstream agent worse, Jina at 0.445 is neutral, and CodeGrep at 0.677 is where retrieval starts reducing rollout cost. Below the threshold you are paying tokens to mislead your own agent. Supervision came from mining 67K open-source agent trajectories, and applying the efficiency signal at the advantage layer rather than the reward layer is what kept KL drift down.

SuperScout attacks the same cost from the routing side, with a 7B searcher that explores the repository first and produces a structured handoff whose reproduction claims are sandbox-verified, false claims stripped before delivery. On the 266-task Python slice of SWE-bench Pro under the official capped budget tier it solves 159 against 158 for the best single model, at roughly a fifth of the cost per solve. The ablation is more interesting than the headline: always routing to the cheapest fixer, but with the handoff attached, ties the full routed system. The handoff carries the result, not the routing decision, and the searcher costs under half a cent of GPU time per task.

Meanwhile the token-saving tool market got audited again. Following JetBrains reruns in July that put Caveman’s claimed 65% at a measured 8.5% and RTK’s claimed 60-90% at slightly worse than nothing, a 180-run benchmark of five codebase tools across Claude Code and Codex found the best full-session saving was 15.9% on Claude Code and 34.9% on Codex, for repowise, whose author ran the benchmark and discloses it. Two tools were statistically indistinguishable from letting the agent grep the repository itself. Answer-quality spread across all six arms was 0.38 judge points against 0.69 points of judge run-to-run noise. Two methodological findings travel further than the rankings. First, measuring a single retrieved payload instead of the whole session inflates the number by roughly six-fold: repowise’s payload-level reduction is about 97% and its session-level reduction is 16%. Second, tool adoption is a property of the harness and the run, not the tool. Claude Code never called code-review-graph and called Serena 4 times out of 15, while Codex called every tool on every question, and repeated Claude Code runs moved repowise from 15/15 to 4/15 to 3/15. The prompt-cache warming artifact the author caught before publishing is worth internalizing too: run position correlated -0.487 with dollar cost and +0.010 with output tokens, which is why the tables report tokens.

AgentSLABench formalizes the same instinct as a metric. It profiles agents across 16 containerized task environments under declared CPU, memory, time, and network budgets with SHA256-sealed test sets, and reports an Efficiency-Adjusted Success Rate alongside raw accuracy. Task-specialized agents hit 100% on three of five core tasks and 66.7-83.3% on retail substitution and code generation, while general-purpose baselines including ReAct, Reflexion, and Plan-and-Solve fail outright on four of five domain tasks.

Four benchmarks removed an assumption production does not supply

SWE-Touch removes the assumption that the agent owns the workspace. It mines task-critical regions from multiple repair trajectories, generates plausible edits that conflict with task completion, and injects them with a contextual user message at the moment the agent reaches that code. Average resolve rate on SWE-bench Verified drops 7.7 points across nine models, with degradation persisting on SWE-Bench Pro and DeepSWE. Trajectory analysis attributes it to agents retaining conflicting code or overwriting it without re-inspecting the repository or writing a targeted test against the changed behavior.

Active-SWE removes the issue report. Its 1,663 tasks across six bug categories and eight languages ask agents to find and fix bugs proactively, including multiple-bug and potential-bug-discovery tracks, and most state-of-the-art agents struggle on all three axes: locating recorded bugs, handling multiple fixes, and surfacing valid new ones.

Coding Agents as Test-Suite Auditors removes the assumption that the grader is correct. Online-judge verdicts underpin a large fraction of code datasets and benchmarks, and prior audits established that official suites accept buggy submissions without offering a remedy. The remedy here is an off-the-shelf coding agent used as the auditor, finding cases official suites miss while approaching what they catch.

PRWeaver removes the assumption that an attack fits in one diff. It assembles 208 execution-validated attacks from ten real repositories, distributed across repository evolution rather than concentrated in a single change, and renders each under four matched review presentations for 832 total renderings, then measures whether LLM-based code auditors catch them.

Skill files execute, and agents almost never flag it

Towards a Risk Assessment of Malicious Skill Files transformed 471 real shell commands into 2,826 benign-appearing skill files mapped to 11 MITRE ATT&CK tactics, using six LLMs across four families, then ran 5,629 completed sessions against two enterprise-grade agents. Gemini CLI executed the hidden command in 95.5-96.1% of runs and Qwen Code in 71.6-74.0%, nearly invariant to which model generated the skill. Explicit safety recognition appeared in 1.99% of runs. The judging pipeline is three-judge with a refusal veto and a deterministic declared-intent override, validated against a blind human gold standard at Cohen’s κ=0.85, so the headline is not an artifact of a lenient grader. If your organization loads skill folders from anywhere but a reviewed internal repository, that is a shell-execution path with essentially no guard on it.

The complementary control-plane work is Provenact, which identifies stale authorization as the core failure mode for agents that issue refunds, reserve inventory, or provision resources concurrently. Anything that decides allow-or-deny from the state visible at request time can commit an effect against a budget or approval that has since changed. The paper defines policy-state serializability, requiring every committed effect to be explainable as authorized against the policy state immediately before it occurred, and demonstrates a PostgreSQL-backed runtime that keeps policies as reviewable programs, holds delayed approvals without blocking unrelated work, and avoids the stale authorizations that request-context baselines produce in a scripted procurement workflow.

What to watch

The threshold result in CodeGrep and the ablation in SuperScout point the same direction: retrieval quality has a floor below which it is a tax, and a good handoff may be worth more than a good router. Whether that floor holds outside SWE-Bench Verified is the obvious next question, and nobody has run it against a hardened environment yet. Boundary-Bench and LoopsBench are both open, both measure things production actually does to agents, and neither has been paired with the other. Somebody should combine them: 112 long-horizon tasks under read-only filesystems and restricted egress would tell us far more than another Verified leaderboard.