Twenty frontier technologies that decide whether agents can learn, act, endure and go live

How it works

1. Verifiable rewards (RLVR)Objective signals — tests passed, correct answers, tasks completed — replace human preference scores, curbing reward hacking at the source.
2. The GRPO familyGroup-relative advantages replace the value network; DAPO, GSPO and GiGPO handle long sequences, MoE models and hierarchical credit assignment respectively.
3. Agentic mid-trainingContinued training on large volumes of synthetic trajectories between pre-training and post-training, extending context from 32K to 128K.
4. Asynchronous rollout infrastructureParallel environment interaction plus a dynamic data curriculum; open-source frameworks such as verl and AReaL have sharply lowered the bar to reproduce results.

Why it matters: the training signal widens from “is this single answer right?” to “does this multi-turn tool trajectory reach the goal?” — the common engine behind the simultaneous 2025 inflection on three major benchmarks.

How it works

1. Multi-harness rolloutsThe same prompts are sampled in parallel in several harnesses, so the model doesn’t learn to please just one of them.
2. Harness overfitting, namedpoolside Laguna S 2.1 is the first to call out “harness overfitting” in its limitations, admitting that scores are tightly bound to the harness.
3. Distilling corrections at failure pointsCursor Composer 2.5 inserts corrective hints where tool calls fail, then distills the hinted trajectories into a hint-free policy.
4. Monitoring for reward hackingShortcuts such as reverse-engineering caches or decompiling bytecode are watched in real time during training — the more capable the model, the more closely you watch how it “cheats”.

How it works

1. Tune the environment, not the modelResearch shows that improving the training environment can pay off more than further fine-tuning the agent itself (“Don’t Just Fine-tune the Agent, Tune the Environment”).
2. Scaling environmentsProcedural generation and difficulty ladders expand the number and variety of environments into a curriculum.
3. Crowdsourcing and bountiesAn open environments hub crowdsourced 400+ frontier RL environments and evals in two months, paying US$100–500 per open task and US$1,000–5,000+ for commissioned ones.
4. The evaluation is the environmentThe same environment serves as training ground and exam hall, avoiding train–test distribution mismatch by design.

How it works

1. Memory-augmented MDPMemento models decision-making as a Markov process with a case bank: the planner retrieves and reuses, the executor acts, and policy improvement happens entirely through reads and writes.
2. Strategies, not trajectoriesReasoningBank distills generalizable reasoning strategies and treats failures as seriously as successes — storing only successes throws away the most valuable lessons.
3. Memory-aware test-time scalingMaTTS spends extra compute on generating diverse experience that improves memory quality, so memory and compute reinforce each other.
4. Reward-free early experienceMeta’s Early Experience uses the future states caused by the agent’s own actions as supervision — somewhere between imitation learning and reinforcement learning.

Generalization is the point: an average gain of 9.4 points persists across domains, which means the agent learns how the environment responds to its actions, not the answers to one task.

How it works

1. An automatic evaluator comes firstWithout a verifier that scores automatically, evolution degrades into random drift — which is why it only works for tasks whose results can be verified.
2. Two models, two rolesA fast model generates candidates broadly; a strong model refines them deeply, balancing exploration and quality.
3. An open-ended archiveThe Darwin Gödel Machine keeps an archive of agents and branches from many ancestors in parallel, preserving diversity to escape local optima.
4. Sandboxing and lineageSelf-modifying code must run in isolation, with the full improvement lineage kept for audit and rollback.

How it works

1. Pure vision, end to endScreenshots map straight to actions without the DOM or an API — if a person can see the interface, the agent can operate it.
2. Planner–executor separationPlans by state milestones rather than fixed steps, with feasibility gating, so long tasks don’t get lost.
3. Hybrid action streamsSwitches seamlessly between GUI clicks, terminal commands and API calls, taking whichever path is reliable.
4. Data flywheelStarts from massive operation trajectories and self-improves through an execute → filter → retrain loop.

The highlighted bar is the average human baseline of 72.4%. In two years scores rose from 12% to 86.1%, and the gap among the leaders has shrunk to about one point — the benchmark is saturating, and discriminative power is moving to real websites and long-horizon tasks.

How it works

1. Old benchmarks are saturatedFrontier scores on SWE-bench Verified have reached 96.2%, leaving almost no discriminative power.
2. New benchmarks reopen the raceSWE-bench Pro targets multi-file, enterprise-grade tasks and its standardized leader scores only 61.5%; on Terminal-Bench 3.0, frontier models solve fewer than 40%.
3. The environment is the examEach Terminal-Bench task ships with its own environment, a human-written solution and complete verification tests, across 16 categories including security, system administration, kernels and data science.
4. The harness is a variableThe leaderboard lists 142 entries as “agent + model” pairs — the same model ranks quite differently with a different harness.

Takeaway: don’t evaluate vendors on saturated benchmarks. Terminal-Bench 3.0 was launched precisely because frontier models had already solved about half of the tasks in 2.0 — difficulty has to keep rising for a benchmark to stay discriminative.

How it works

1. Browsing policy trained end to endSearching, clicking, excerpting and follow-up questions are optimized with reinforcement learning rather than hand-written rule trees.
2. Rolling context compressionSummarizes while researching and moves summaries forward to get past the window limit — pair it with constraint pinning so compliance constraints are not summarized away.
3. Multi-source cross-checkingTop systems on the general-assistant leaderboard commonly ensemble several models with independent review; cross-checking is now standard for high scores.
4. Cited outputEvery conclusion carries its original source so results can be traced — the key to entering professional work.

Open source is closing in: Tongyi DeepResearch reaches GAIA 70.9 and HLE 32.9 with 30.5B parameters and zero human annotation in the whole pipeline — a privately deployed research agent is now realistic.

How it works

1. A structured world model at the centerAll sub-agents read and write one shared structured knowledge state instead of working in silos — the research version of read–write asymmetry.
2. Very long runs, massive parallelismA single run lasts up to 12 hours, with on average 200 sub-agent rollouts, about 42,000 lines of generated code and 1,500 full-text papers read.
3. Quality measured by blind expert reviewOverall statement accuracy is 79.4%: 85.5% for data-analysis statements and 82.1% for literature-review statements, but only 57.9% for synthesis and inference — the weak spot is easy to locate.
4. Discoveries grow linearly with cyclesGrowth is still linear at cycle 20, so running more cycles does add value.

The lesson is clear: what’s reliable is computing correctly and reading comprehensively; what isn’t is reasoning far. People should concentrate on synthesis and judgment, not on gathering material and computing.

How it works

1. Three-stage learningLearning from demonstration → real-time expert correction (taking over and demonstrating recovery when the robot errs) → reinforcement during autonomous practice — the same path as a human apprenticeship.
2. Advantage conditioningA value function trained to predict the probability of success at every moment labels actions by the change in value, so the model learns from successes and failures alike.
3. World models as training groundsGenerates interactive worlds at 720p / 24 fps in real time, lets text inject counterfactual events and produces “what if…” curricula in bulk.
4. Dual-system architectureA slow system for understanding and planning and a fast system for high-frequency continuous control, combining semantics with real-time response.

Throughput on the three tasks rose 2–3.5×, success rates after training all exceed 90%, and results held up in real continuous runs (50 never-seen garments folded in a row; 59 boxes assembled under factory conditions).

How it works

1. Internalized searchExplicit tree search has been absorbed into long chains of thought; backtracking, verification and retries emerge spontaneously during generation.
2. Stabilized by reinforcement learningSCoRe uses two-stage multi-turn RL with a reward bonus to fix distribution mismatch and behavior collapse in self-correction training.
3. Limit one: attributionModels correct other people’s mistakes far better than their own; simply relabeling the source raises correction rates by 23–93 points.
4. Limit two: over-checkingRepeated self-checking suppresses correct answers and drags out reasoning; cap the number of checks rather than encouraging more.

How it works

1. Premise: attention is a finite budgetThe more tokens, the worse the recall (context rot): n tokens create n² pairwise relations that dilute attention, and long-sequence training experience is scarce.
2. CompressSummarize and restart near the window limit; the safest lightweight form is clearing tool outputs that have already been consumed, not rewriting the whole history.
3. OffloadWrite key points to external persistent files (to-do lists, notes) so the context keeps only pointers.
4. Isolate and retrieve just in timeSub-agents explore with clean contexts and return only 1,000–2,000-token summaries; store lightweight identifiers and fetch content when needed.

Knock-on effects: going from 10 to 50 tools cuts tool-selection accuracy by 15–25%; connecting 7 MCP servers takes about 67,000 tokens — handing half the window to “tool manuals”.

How it works

1. Three steps on the write pathExtract (spot useful information in the session) → consolidate (create a new record or update an existing one) → reflect (generate insights across sessions); all three run asynchronously, so assume long-term memory is eventually consistent.
2. Two ways to readSemantic retrieval of the top-K, or enumeration down the namespace hierarchy; namespace design directly sets the granularity of multi-tenant isolation.
3. Time-stamped, not overwrittenThe knowledge graph marks facts with valid-from and valid-to dates, answering “what was true then” as well as “what is true now”.
4. Forgetting is a featureConfigurable event retention (e.g. 7–365 days) plus deletion by ID forms the technical basis for compliant deletion.

Measured gains: compared with stuffing the whole history into context, answer quality improves by about 26% (relative), p95 latency falls 91% and token use falls 90% (about 6,900 tokens per query versus 26,000); temporal graphs add another 18.5% accuracy on temporal reasoning in long-term-memory evaluations, with 90% lower latency.

How it works

1. Hardware-aligned sparsityNative sparse attention is organized in blocks so the sparsity pattern matches GPU memory access, avoiding “saves compute in theory, no speed-up in practice”.
2. Three branchesA compression branch for the global view, a selection branch for what matters and a sliding-window branch for local detail, together covering long-range dependencies.
3. Trainable end to endThe sparse structure takes part in training rather than being approximated only at inference, avoiding quality loss from train–inference mismatch.
4. Cost effectVendors report long-context API costs falling by roughly half or more, changing the economics of long-document work.

How it works

1. Profile the tasks firstMeasure the real distribution of calls to find the high-frequency, low-difficulty sub-tasks — usually a far larger share than intuition suggests.
2. Small model firstThe SLM handles requests by default and escalates to a large model when confidence is low or complexity exceeds a threshold (the same idea as C3 routing cascades).
3. Specialized fine-tuningFine-tuning a small model on a few high-quality samples for a narrow task often beats a general large model’s zero-shot performance.
4. On-device and on-premisesSmall models can run in the bank’s data center or even on branch terminals, keeping data in-domain by design.

How it works

1. Integration goes from multiplication to additionCustom integrations for M models × N tools reduce to each side connecting once to a protocol bus.
2. Standardized capability discoveryMCP declares capabilities with three primitives — tools, resources and prompts; A2A declares skills in agent cards, enabling interoperability across frameworks.
3. Opaque collaborationA2A lets agents collaborate without exposing internal state or implementation — exactly what cross-institution work requires.
4. Human-in-the-loop built into the protocolMCP elicitation lets a server ask a human for confirmation, pushing the approval gate down to the protocol layer.

How it works

1. RuntimeEach session gets its own micro-VM with isolated compute, memory and file system, destroyed and wiped when the session ends; a single session can run for up to 8 hours.
2. Memory serviceFour built-in strategies — semantic, summary, preference and episodic — with a managed extract–consolidate–reflect pipeline and namespace isolation.
3. Tool gatewayTurns existing APIs and functions into standard tools, supports semantic search for tool selection, and connects natively to identity and authorization.
4. Identity and observabilityTwo-legged and three-legged authorization and a credential vault; OpenTelemetry end to end, with a three-level session–trace–span structure.

How it works

1. Intent and cart mandatesSeparate “under what conditions the agent may buy on its own” from “approve this specific order” as two kinds of signed credentials, matching autonomous and confirmed modes.
2. Single-use restricted tokensIssue a time- and amount-limited shared payment token for each transaction, so no long-lived credential is exposed.
3. Protocol-level micropaymentsRevives HTTP status 402: the server returns payment instructions directly and the client signs and attaches them to the request header — machine-to-machine settlement with no account needed.
4. Session-based pre-authorizationThe agent first obtains a spending cap, then settles continuously with streamed micropayments, avoiding per-transaction on-chain costs.

How it works

1. A dedicated identity objectCreate a dedicated identity type for agents instead of reusing service accounts, inheriting security policy through identity templates and parent–child relationships.
2. Dual-identity bindingRecord both which user the agent acts for and which agent it is, so every privileged action traces back to a person.
3. Delegated authorization chainUse standard authorization protocols for delegation and token exchange: short-lived credentials, bound to an audience, revocable and rotatable.
4. Lifecycle governanceProvisioning, change and deprovisioning are all controlled; when a role changes, old permissions are removed from running instances at once.

How it works

1. Injection defense at the architecture levelA privileged model sees only the user’s request and writes the plan; a quarantined model handles untrusted data with no tool access; a restricted interpreter enforces security policy by capability labels.
2. Aligned with the risk listBuild a control for each of the OWASP 2026 top ten risks for agentic applications: behavior hijacking, prompt injection, tool misuse, identity and privilege abuse, inadequate guardrails and sandboxing, sensitive-data leakage, data poisoning, resource exhaustion, supply chain and overreliance.
3. Continuous red-teaming, not a one-off scoreMeasured: generic injection succeeds about 11% of the time, attacks tailored to agents 81%, and 80% on average when repeated attempts are allowed.
4. Blast-radius isolationNever combine shell, file-system, browser and email tools in one unconstrained workflow.

Put plainly: a single benchmark run is not a reliable steady-state security metric. Security assessment must be an ongoing process that is attacker-aware, allows repeated attempts and evolves with the models and the attacks.