What changes when agents run continuously instead of per task?

Goal management, retries, verification and stopping rules stop being hand-coded prompt scaffolding and become a research object. Artificial Id (arXiv:2609.11911) proposes an adaptive internal-drive layer that decides when to persist, pivot, or stop; Agent-Integrated Software (arXiv:2609.11381) argues that once agents share objects and delegated execution inside real applications, coordination is unsolvable without explicit interaction contracts and continuous assurance. The control layer moved up from engineering folklore into the papers themselves.

Is hallucination detection solved at F1 0.915?

No — and the paper's own framing says why. Domain-Specific Hallucination Detection (arXiv:2609.11878) reaches F1 0.915 and AUROC 0.977 on HaluEval with a multi-signal pipeline (DeBERTa-v3 classifier, MC-Dropout uncertainty, temperature calibration). But 'domain-specific' is the operative word: the generic-detector myth is receding, cross-domain transfer carries no guarantee, and the column's reading stands — detection scores are improving faster than the safety they are supposed to certify.

Doesn't retrieval make LLM output safer?

Not for free. RAG-Safety-Bench (arXiv:2609.11758) is the first systematic evaluation of retrieval-augmented safety and finds that retrieving trustworthy documents reduces hallucination while introducing side effects for overall safety — the retrieval pipe is itself a new attack surface. Alongside SpecGuard's inference-time backdoor detection for third-party weights (arXiv:2609.11799), the week's security reading is: new components, new variables, new checks.

Where do regulated industries actually put the LLM?

In knowledge management and data pipelines — never at the point of final judgment. Across CRISPR screening (arXiv:2609.11877), pharmaceutical process knowledge graphs (2609.11493), clinical annotation (2609.11450), physiological-plausibility auditing (2609.11431) and SEC-filing analysis (2609.11620), all seven application papers embed the model into an existing workflow as a component. The chat box disappears; what remains is an embeddable part. Placement is the industry's statement of how much liability it will accept.

Papers Batch 4 5 min read raw .md ↗

Who Brakes a Continuously Running Agent? 26 arXiv Papers on Control, Grading, and Day Jobs

Chinese original 2026-09-12 · 「谁来踩智能体的刹车？11篇论文看控制权 / 幻觉检测F1到0.915，就安全了吗？ / LLM上岗7个行业：CRISPR、SEC文件与病历」 · translated to English 2026-09-12

One week of arXiv, read end-to-end by our Chinese column as a nine-part series covering 81 papers. This is the first of three English digests: 26 papers on the agent question — who controls continuously running agents (11), who grades them (8), and where they are being hired (7). The shared finding: the object of study is no longer the task-solving model but the always-on system around it. (All papers are arXiv preprints, not peer-reviewed; claims follow their abstracts.)

The brake pedal becomes a research object

Today, every long-horizon agent’s control logic — goal management, retries, verification, stopping rules — lives in hand-coded harness scaffolding. Two papers pull that layer into daylight. Artificial Id (arXiv:2609.11911) proposes giving the system an adaptive internal drive: when to continue, when to pivot, when to stop, arbitrated by the agent itself — psychology’s “drive,” engineered. Agent-Integrated Software (2609.11381) supplies the other half: once an agent is embedded in a real application, user goal changes, shared objects and delegated execution run concurrently, and without explicit interaction contracts plus continuous assurance the coordination problem has no solution. The most radical entry, The Last AI Built by Humans (2609.11873), uses a Headroom-Closed Index to diagnose how far current models actually are from recursive self-improvement, then lays out a five-level roadmap — its pessimism about the gap is what makes it more honest than most RSI discussion.

Self-evolution changes acquisition method, too: Ecdysis (2609.11677) trains runtime harnesses directly instead of discovering them by expensive iterative search, and COBRA-Skills (2609.11682) evolves agent skill libraries guided by contextual bandits — skill quality judged online rather than by re-running tasks. On the collective side, ORCH (2609.11737) shows embodied multi-agent intelligence depends on organizational structure that should reshape dynamically with the task; When Agents Disagree (2609.11709) replaces voting-style forward aggregation with Bayesian backward reasoning, treating disagreement as evidence to be inverted rather than noise to be averaged away. And The Convention Gap (2609.11489) names what AI-vs-AI benchmarks cannot see: the implicit conventions human cooperation runs on. Rounding out the batch: MAPLE (2609.11636) lets operations-research practitioners build optimization models in natural language, RouteRepair (2609.11452) repairs failed LLM-designed heuristics at the instance level instead of regenerating wholesale, and Autonomy, Social Norms, and Alignment (2609.11660) sketches internalizing social norms as a developmental alignment path.

The graders are falling behind what they grade

The week’s evaluation papers read as one blunt sentence: the thing being evaluated evolves faster than the methods evaluating it. Hallucination detection posts F1 0.915 on HaluEval (arXiv:2609.11878) — but as a domain-specific pipeline, not a generic detector — while ActMap (2609.11498) moves uncertainty quantification from “sample ten times, average” to a single pass over generation-time activation maps. CausalArena (2609.11897) documents a quiet inflation: pretraining corpora overlap the test distribution, so causal-discovery benchmarks may credit models for reciting causal structure rather than deriving it. Most sobering is the medical-evidence audit (2609.11770): PubMed returned 11,628 medical-LLM evaluation records from January 2023 to June 2026 across fourteen clinical domains — 45-fold growth — yet only 2.5% used a randomized, controlled or prospective design, while the models under study are superseded every few quarters. Evidence accumulates slower than its object churns.

Finer slices: Recognizing Is Not Reversing (2609.11769) shows a model can detect a news frame it cannot undo — recognition, generation and de-biasing are three separable capabilities usually conflated in one score; TransClean (2609.11399) makes translation noise in LLM outputs a benchmarkable defect. On the attack side, RAG-Safety-Bench (2609.11758) finds retrieval reduces hallucination while introducing its own safety side effects, and SpecGuard (2609.11799) checks third-party fine-tuned weights for backdoors at inference time, free — no retraining, no training-data access. The supply chain of downloaded models gets its first security lane.

The day jobs: embedded, not conversational

Seven application papers share one silhouette: the LLM enters a regulated industry by flattening itself into an existing workflow. In the CRISPR lab (arXiv:2609.11877), the model doesn’t replace the scientist’s judgment — it plans the experiment budget, prioritizing perturbations by expected information gain across 1,389 screens (AssayBench-Loop). In pharma manufacturing (2609.11493), a multi-layer knowledge graph reconnects CMC process knowledge scattered across functions; for regulators the product is not intelligence but traceability. In clinics, annotation projection as constrained text generation (2609.11450) moves labeled assets into six languages with document- and character-level verification; symbolic-regression formulas get audited for physiological plausibility with clinicians in the loop (2609.11431); an energy-management XAI assistant (2609.11860) turns static dashboards into dialogue. In finance, one paper bets against embedding entirely (2609.11620) — training-free, alignment-free analysis of SEC filings — while its neighbor (2609.11607) stitches alternative data into forecasts with context-augmented LLMs.

None of the seven touches autonomous decision-making — liability chains in regulated industries do not allow it. The wedge position is knowledge management and data pipelines, the two slots that never issue the final judgment. That placement is itself the industry’s answer.

The takeaway

Read together, the 26 papers mark a migration: agent research’s center of gravity is moving from single-task capability to the system properties of continuously running agents — who holds the brake, who grades the run, which seat the agent is allowed to occupy. The evaluation papers do not so much solve problems as define them precisely; the industry papers do not announce capability but choose placement. Both are signs of a field settling in for a long deployment, not another benchmark season.

Provenance & disclosure. Originally published in Chinese on our WeChat channel on 2026-09-12 as three parts of a nine-part “arXiv 81” series (“谁来踩智能体的刹车？11篇论文看控制权”; “幻觉检测F1到0.915，就安全了吗？”; “LLM上岗7个行业：CRISPR、SEC文件与病历”); drafted with AI assistance under human editorial direction. Translated and consolidated to English on 2026-09-12 (AI-assisted, human-reviewed). All 26 cited arXiv IDs were resolved via the arXiv API on 2026-09-12 and titles matched the claims; headline numbers (F1 0.915 / AUROC 0.977 on HaluEval; 11,628 PubMed records, fourteen domains, 45-fold growth, 2.5% rigorous designs; 1,389 CRISPR screens) verified against the abstracts. Preprint caveat inherited. Translated commentary — not a SigPulse measurement; first-party numbers live in the dispatches and the /data/ ledger.

Papers covered in this digest (machine-readable in /papers.json)

2609.11911 — Artificial Id: Drive and Persistent Alignment in Agentic AI
2609.11873 — The Last AI Built by Humans: Toward Genuine Recursive Self-Improvement
2609.11737 — ORCH: Organizational Principles Enable Collective Intelligence in Embodied AI
2609.11709 — When Agents Disagree: Bayesian Backward Reasoning as a Label-Free Anchor for Multi-Agent Collective Decision-Making
2609.11682 — COBRA-Skills: Contextual Bandit-Guided Evolution for Agent Skill Optimization
2609.11677 — Ecdysis: Efficient and Effective Training of Runtime Harnesses for LLM Agents
2609.11660 — Autonomy, Social Norms, and Alignment: Towards a Developmental Framework for Autonomous Artificial Agents
2609.11636 — MAPLE: Memory-Augmented Planning with Language and Evolution
2609.11489 — The Convention Gap: Towards Measuring Implicit Communication in Cooperative AI Evaluation
2609.11452 — RouteRepair: Instance-Level Failure Diagnosis and Targeted Repair in LLM-Based Automated Heuristic Design for Routing Optimization
2609.11381 — Agent-Integrated Software: Interaction Contracts and Continuous Assurance
2609.11897 — CausalArena: Benchmarking Causal Discovery in the Foundation Model Era
2609.11878 — Domain-Specific Hallucination Detection in Large Language Models
2609.11799 — SpecGuard: Inference-Time Backdoor Detection For Free
2609.11770 — The widening evaluation gap in medical large language model research 2023 to 2026
2609.11769 — Recognizing Is Not Reversing: A Controlled Inversion Test of Fact-Preserving News Framing
2609.11758 — RAG-Safety-Bench: Reliable Evaluation of Retrieval-Augmented LLM Safety
2609.11498 — ActMap: Single-Pass Uncertainty Quantification from Generation-Time Activation Maps
2609.11399 — TransClean: A Benchmark for Detecting and Extracting Clean Translations from Large Language Model Outputs
2609.11877 — Biology-in-the-loop: Amortized Adaptive Hit Discovery in CRISPR Screens
2609.11860 — Explainability Assistant: A Conversational XAI Interface for Interpreting Energy Consumption Models
2609.11620 — A Training-Free, Alignment-Free Approach to Corporate Intelligence: Application to SEC Filings
2609.11607 — Making Alternative Data Work: Context-Augmented LLMs for Financial Forecasting
2609.11493 — From Document Silos to Process Intelligence: A Multi-Layer Knowledge Graph for CMC Process Development
2609.11450 — Cross-Lingual Clinical Annotation Projection as Constrained Text Generation: A Six-Language Study
2609.11431 — LLMs as Post-hoc Auditors of Physiological Plausibility in Symbolic Regression: A Clinician-Evaluated Case Study

FAQ — Direct Answers

What changes when agents run continuously instead of per task?: Goal management, retries, verification and stopping rules stop being hand-coded prompt scaffolding and become a research object. Artificial Id (arXiv:2609.11911) proposes an adaptive internal-drive layer that decides when to persist, pivot, or stop; Agent-Integrated Software (arXiv:2609.11381) argues that once agents share objects and delegated execution inside real applications, coordination is unsolvable without explicit interaction contracts and continuous assurance. The control layer moved up from engineering folklore into the papers themselves.
Is hallucination detection solved at F1 0.915?: No — and the paper's own framing says why. Domain-Specific Hallucination Detection (arXiv:2609.11878) reaches F1 0.915 and AUROC 0.977 on HaluEval with a multi-signal pipeline (DeBERTa-v3 classifier, MC-Dropout uncertainty, temperature calibration). But 'domain-specific' is the operative word: the generic-detector myth is receding, cross-domain transfer carries no guarantee, and the column's reading stands — detection scores are improving faster than the safety they are supposed to certify.
Doesn't retrieval make LLM output safer?: Not for free. RAG-Safety-Bench (arXiv:2609.11758) is the first systematic evaluation of retrieval-augmented safety and finds that retrieving trustworthy documents reduces hallucination while introducing side effects for overall safety — the retrieval pipe is itself a new attack surface. Alongside SpecGuard's inference-time backdoor detection for third-party weights (arXiv:2609.11799), the week's security reading is: new components, new variables, new checks.
Where do regulated industries actually put the LLM?: In knowledge management and data pipelines — never at the point of final judgment. Across CRISPR screening (arXiv:2609.11877), pharmaceutical process knowledge graphs (2609.11493), clinical annotation (2609.11450), physiological-plausibility auditing (2609.11431) and SEC-filing analysis (2609.11620), all seven application papers embed the model into an existing workflow as a component. The chat box disappears; what remains is an embeddable part. Placement is the industry's statement of how much liability it will accept.