ArchNights OS costs 7 points, Kimi-K3 still breaks 69%, RLHND halves hand error

TL;DR

• ArchNights-SE hits 83.1% on Terminal-Bench 2.1, 7 points below its own DeepSeek-V4.1-Flash solo.
• AdvSim2Real lifts web-agent completion from 23% to 30.72% against unseen Kimi-K3 attackers.
• RLHND scores 13.01mm MPJPE-p on HOT3D, halving ACE-Ego-Hand’s 24.41mm joint error.
• NeMo-DCR ships only 1% BF16 deltas, targeting 87.5-minute cross-region RL refits.
• CIA quantifies the gap between LLM chain-of-thought traces and actual internal computation.

Two of today’s features are agent-system papers that publish their headline number alongside the ceiling that frames it. ArchNights-SE derives an agent OS from an Oracle-Priestess abstract machine and scores 83.1% Pass@1 on Terminal-Bench 2.1 — above mini-swe-agent and Terminus 2, but 7 points below the same raw DeepSeek-V4.1-Flash running solo. AdvSim2Real co-evolves an attacker and a Qwen3.5-4B agent inside a frozen simulator, lifting completion against unseen Kimi-K3 from 23% to 30.72% — a 33.6% relative gain that still leaves 69% of tasks broken, which the authors frame as hardening rather than a fix.

The third feature steps outside language models: RLHND halves egocentric hand-tracking error with a β-cache that locks MANO shape from the first clear frame, plus dense contact and force maps supervised on roughly 5 hours of tactile data. The brief pool reinforces the agent-scaffolding read — GUI-HARVEST rewrites GUI harnesses from execution evidence, UNREAL collapses RAG and long-context into one model-native mechanism, and NeMo-DCR shaves 87-minute RL weight refits down to delta transfers.

ArchNights agent OS scores 83% as its LLM alone hits 90%

Source: hf-daily-papers · published 2026-10-06

TL;DR

• Liu et al. model LLM agents as an Oracle-Priestess abstract machine, deriving the agent “OS” from symmetry-breaking rather than analogy.
• Agents and Workflows collapse into one framework — the same O-2-PDA-TSV machine with the program placed on different stacks.
• Prototype ArchNights-SE hits 83.1% Pass@1 on Terminal-Bench 2.1, beating mini-swe-agent (80.9%) and Terminus 2 (78.7%).
• But the underlying DeepSeek-V4.1-Flash scores 90.6% solo on the same leaderboard — the harness costs ~7 points vs. the raw Oracle.

A formalism, not a framework

The pitch is unusually ambitious for an agents paper. Instead of yet another harness, Liu et al. build an abstract machine — a two-stack pushdown automaton extended with a single new instruction, oracle s, that ships a stack to a black-box LLM and appends the response back. The controller (the “Priestess”) is Turing-complete; the model (the “Oracle”) is relativized. Two “symmetry breakings” — storage (S) and transitions (T) — turn the Priestess into the privileged mode and the Oracle into user mode. From that setup, an OS kernel contract (invariants K1–K5 covering isolation, safety, and guaranteed return of control) falls out as a necessity, not an engineering choice.

The payoff: Agents and Workflows stop being rival philosophies. In the Agent form, the program lives in the Oracle’s growing context; in the Workflow form, it lives in the Priestess’s control logic. Same machine, different placement.

This is the real contribution. Reviewers reading the preprint frame it as a “conceptual foundation” that gives the field an OS-level vocabulary for scheduling, caching, and safety where previously only ad-hoc abstractions existed ¹. It also lands in a crowded lineage — AIOS already reports 2.1× throughput and a 95% cut in context-switch overhead by treating the LLM as a scheduled process ², and the broader “LLM OS” discourse has converged on VM-style isolation as the durable abstraction ³. ArchNights’ novelty is deriving the kernel from first principles, not inventing one.

The benchmark number has an asterisk

The authors validate the machine with ArchNights-SE, a gem5-simulated RISC-V extension with a Linux-style kernel (“PRTS”). On Terminal-Bench 2.1 with DeepSeek-V4.1-Flash as the Oracle, it scores 83.1% Pass@1 in minimal configuration — ahead of mini-swe-agent (80.9%) and the benchmark’s own Terminus 2 (78.7%).

The paper doesn’t mention that the same DeepSeek-V4.1-Flash sits at 90.6% on the public leaderboard, with SWE-2 at 92.8% and GPT-5.6 Sol at 91.9% topping it ⁴. ArchNights-SE underperforms its own Oracle by roughly seven points on the same benchmark. The honest reading: the architecture doesn’t ruin a strong model, but it doesn’t extract additional capability either. For a paper arguing that the kernel contract is a logical necessity, the empirical case is “the formalism is at least tolerable in practice.”

The Priestess can’t save you from the Oracle

The paper is candid that its boundary mechanism fixes where content crosses the kernel gate, not what the kernel does with hostile content. External work sharpens the worry: jailbreak studies on LLM-controlled robots show high success rates on exactly this pattern — a privileged controller executing on behalf of a compromised Oracle ⁵. K1–K5 give you isolation and guaranteed return of control; they do not give you a prompt-injection defense. That’s left as the kernel implementer’s problem, which in production terms means it’s unsolved.

There is also no refinement proof linking the abstract O-2-PDA-TSV machine to the ArchNights-SE implementation ¹, and practitioner voices in the agent-OS discourse argue the field should move toward lightweight event-driven kernels rather than heavier formal machinery ⁶. Expect citation uptake in formal-methods circles; expect shipping teams to keep their simpler harnesses.

---

AdvSim2Real hardens web agents, but 69% still fall to Kimi-K3

Source: hf-daily-papers · published 2026-10-06

TL;DR

• AdvSim2Real co-evolves a task curriculum, a prompt-injection attacker, and a Qwen3.5-4B web agent inside a frozen WebWorld-14B simulator.
• Against unseen attacker Kimi-K3, completion rises from 23% to 30.72% — a 33.6% relative gain.
• A “success-flip” reward credits the adversary only for breaking tasks the agent already solved cleanly.
• Concurrent work shows adaptive attackers bypass 12 defenses at >90% ASR, framing this as hardening, not a fix.

The method: co-evolution inside a world model

Most prompt-injection defenses fine-tune the agent against a fixed set of attacks, which an adaptive attacker then walks around. AdvSim2Real’s pitch is to make the attacker part of the training loop. Three LoRA-trained policies — a Curriculum, an Executor (the 4B agent), and an Adversary — all learn against each other inside WebWorld-14B, Qwen’s publicly released web simulator trained on 1M+ interactions ⁷. A frozen “Qwen3.8-27B” (the paper’s version string, not a standard Qwen release) judges task completion.

Stage 1 raises raw capability: the Curriculum is rewarded for proposing tasks the agent solves ~50% of the time, keeping training on the “competence frontier.” Stage 2 freezes the curriculum and turns on the Adversary, which picks both the injection text and the step at which to insert it.

The clever bit is the success-flip reward. The Adversary earns credit only when it takes a task the Executor just solved cleanly and causes it to fail with a single injection. That rules out the degenerate strategy of attacking tasks the agent would have botched anyway — a trap most adversarial-training setups fall into.

The numbers, and what they don’t say

On the paper’s 150-task form-filling benchmark:

Sim-to-real transfer actually works — the biggest absolute jump is in a real browser, where strict success nearly doubles. That matters, because world-model-trained agents often collapse the moment they hit a page the simulator never had to render.

But the robustness story is more fragile. A 69% failure rate against Kimi-K3 is not a rounding error, and it sits inside a literature that has turned decisively skeptical of training-based defenses.

The skeptic’s reading

A concurrent multi-lab paper, “The Attacker Moves Second,” evaluated 12 defenses and found adaptive attackers break them at >90% attack success rate; Circuit Breakers went from 0% to 100% ASR once an RL attacker optimized against it ⁸. Daniel Paleka’s safety newsletter summarizes the current mood:

Robust optimization where the attack is part of the training loop is the only method that has shown any repeatable resistance, though at significant computational cost. ⁹

AdvSim2Real is exactly that method, so the result — meaningful gains, not a solution — is consistent with the pessimism rather than a refutation of it. Simon Willison would go further: prompt injection is a structural property of concatenating instructions and data in one token stream, and no amount of fine-tuning fixes an architecture that cannot distinguish the two ¹⁰.

There’s also a benchmark-framing caveat. WASP (NeurIPS 2025) found frontier agents fall to simple human-written injections in 80%+ of cases, but end-to-end attacker-goal completion sits at 0–17% — “security through incompetence” ¹¹. Form-filling robustness numbers may overstate real-world risk reduction in both directions.

What it’s good for

Treat AdvSim2Real as a credible incremental defense and a nice demonstration that world-model training transfers to Chromium — not as evidence that prompt injection is a trainable problem. The code, checkpoints, and 150-task benchmark are released, and HuggingFace maintainers are already pushing for a proper dataset upload ¹². The honest next test is live, open-web attacks the authors haven’t yet run.

---

RLHND halves egocentric hand-tracking error with Cosmos 3

Source: hf-daily-papers · published 2026-10-06

TL;DR

• 13.01mm MPJPE-p on HOT3D — nearly halving ACE-Ego-Hand’s 24.41mm joint error on egocentric hand pose.
• A β-cache locks MANO shape from the first clear frame, cutting per-frame shape jitter to 0.00mm.
• Dense contact + force maps come straight from RGB, hitting 0.489 kPa MAE on OpenTouch — ~4× better than HOPE.
• Tactile supervision is just ~5 hours of OpenTouch glove and PressureVisionDB pad data, so generalization is in-distribution.

From video model to hand tracker

The core bet in RLHND is that a video diffusion backbone already encodes the physics of how hands move and contact objects — you just have to extract it. The authors route clips through NVIDIA’s Cosmos 3 Nano via its conditioning-frame interface using the Wan2.2 VAE, then fine-tune with LoRA adapters so the model specializes on hands without forgetting its motion priors. Everything downstream — pose, contact, force — is a lightweight head on top of those spatiotemporal features.

Two architectural moves make the pose stream work. The β-cache fixes MANO shape parameters from the first high-visibility frame and reuses them for the rest of the video, which drops frame-to-frame shape variance to effectively zero. A 29-DoF anatomical constraint replaces MANO’s 45-DoF joint parameterization by freezing axes that human joints can’t actually rotate around. Together they kill the “flickering hands” artifact that plagues per-frame regressors.

The tactile stream is deliberately decoupled: pose weights are frozen before training it, so the scarcer contact/force data can’t corrupt pose accuracy. To avoid attending over all 778 MANO vertices, the model reasons on 16 “bone tokens” and spreads outputs back to the mesh via linear blend skinning weights, predicting a contact probability map and a per-vertex force distribution.

The numbers

Retargeted to five dexterous hands — Shadow, Allegro, Leap, Faive, and a fifth the paper labels “Quest2” (unusual naming for a dexterous hand; worth checking against the final release) — the labels, especially the automated contact labels, produced smoother Dexterous Point Policy rollouts than noisy crop-based trackers. That’s a plausible utility signal, though AnyTeleop demonstrated the general “retarget human video to many robots” recipe back at RSS 2022 ¹³.

Where to push back

The tactile headline deserves scrutiny. How Robots Learn flatly notes that the contact and force outputs are “statistical estimates derived from video, not direct sensor measurements” ¹⁴, and the force head is trained almost entirely on OpenTouch glove data (~5 hours, 2,900 clips) ¹⁵ plus PressureVisionDB pads. The 4× MAE jump over HOPE is real but in-distribution — generalization to bare-skin contact on arbitrary surfaces is untested, and the authors concede it.

The pose comparison also warrants a footnote. Independent analysis of diffusion-encoder trackers has found they can post excellent local joint alignment while absolute wrist localization lags purpose-built 4D reconstruction pipelines like EgoH4RT ¹⁶. Early coverage flagged that initial public materials omitted some raw metrics and task success rates ¹⁷, and the project’s code repo is still a placeholder — reproducing the headline numbers externally isn’t yet possible.

Takeaway

The architectural contributions (β-cache, 29-DoF anatomy, bone-token tactile head) are concrete and the pose numbers look strong enough to matter for anyone training robot policies from egocentric video. The “first dense contact and force from RGB” framing is doing more work than the supervision base supports. A third-party Jetson T5000 benchmark suggests Cosmos 3 Nano is at least a defensible backbone for eventual on-robot inference — >2× the throughput of Qwen 3.5 at ~1% accuracy cost ¹⁸ — so if the code ships, the deployment story is credible. Until someone retrains the tactile head off OpenTouch, treat force prediction as a useful prior, not a sensor.

Round-ups

GUI-HARVEST evolves agent harnesses from execution evidence

Source: hf-daily-papers

GUI-HARVEST automatically rewrites the executable harness around GUI agents — the layer that assembles observations, runs actions, and handles recovery. It diagnoses recurring failure patterns across tasks and translates them into reusable rules, tackling the visual-intent reconciliation problem that non-GUI harness optimizers skip.

Modular dev-primitives stabilize LLM coding agents on long tasks

Source: hf-daily-papers

The paper proposes harness engineering built on modular executable dev-primitives for software engineering agents. The design targets the brittleness of terminal-driven LLMs on long-horizon workflows, where repeatedly reconstructing state across source, configs, tests, and runtime behavior triggers context explosion and semantic drift in large repositories.

NVIDIA’s NeMo-DCR cuts 1T-param RL refit from 87 minutes

Source: hf-daily-papers

NeMo-DCR delivers bit-exact delta-compressed weight refits for agentic reinforcement learning at trillion-parameter scale. The team measured that only about 1% of BF16 weights change per training step, and full cross-region checkpoint transfers on AWS took 87.5 minutes — a bottleneck DCR targets by shipping just the deltas.

UNREAL unifies RAG retrieval and long-context in one model

Source: hf-daily-papers

UNREAL collapses retrieval and long-context inference into a single model-native mechanism, encoding chunks and deriving queries directly from the forward pass. The approach spans evidence selection from a single prompt up to full-corpus retrieval, removing the separate embedding stack that RAG pipelines normally bolt on.

CIA metric scores whether LLM chains-of-thought match internal computation

Source: hf-daily-papers

Chain-of-Thought Interpretability Alignment (CIA) measures agreement between an LLM’s written reasoning and what it actually computes internally. Prior work has shown CoT traces can be edited without changing final answers, suggesting the explanations are often post-hoc; CIA quantifies that gap and offers a training signal to close it.

TimeBraid fuses language and time-series foundation models

Source: hf-daily-papers

TimeBraid interleaves global residual attention layers between pretrained language models and pretrained time-series foundation models, producing a shared representation that handles both modalities. The hybrid inherits instruction following and reasoning from the LLM side and zero-shot forecasting from the time-series side, generating in either modality.

New physics benchmark grades video world models on 40 tasks

Source: hf-daily-papers

World Models’ Last Exam in Physics evaluates video world models with 40 controlled, measurement-based tasks rather than model judgments or reference videos. The benchmark extends beyond mechanics to probe physical consistency broadly, targeting the gap where generated video looks convincing but violates physics needed for embodied planning.

Footnotes

1. Moonlight review of ‘We Query, Therefore We Compute’ — https://www.themoonlight.io/fr/review/we-query-therefore-we-compute-on-oracle-computation-beyond-the-machine-with-an-application-to-agents

   The paper provides a formal ‘OS-level’ language for LLM scheduling, caching, and safety, which previously relied on ad-hoc software abstractions… but does not provide a refinement proof for the kernel, leading some reviewers to label it as a ‘conceptual foundation’ rather than a production-ready secure OS.

   ↩ ↩²

2. Knowlee.ai — AIOS LLM Agent OS primer — https://www.knowlee.ai/blog/aios-llm-agent-operating-system

   AIOS reports up to 2.1x faster execution and a 95% reduction in context switching overhead (from 2.1s down to 0.1s) for concurrent agents.

   ↩

3. Medium — ‘The LLM OS Revolution’ — https://falexm.medium.com/the-llm-os-revolution-how-operating-system-architecture-is-transforming-ai-agents-ca1734f1ee54

   Standardizing these ‘Virtual Machine’ layers is essential for security, as it allows for the isolation and sandboxing of agent actions, mirroring the way the Java Virtual Machine provided a ‘write once, run anywhere’ environment.

   ↩

4. Snorkel AI — Terminal-Bench 2.1 leaderboard — https://snorkel.ai/leaderboard/terminal-bench-2-1/

   SWE-2 holds the top position with a 92.8% resolution rate, followed by GPT-5.6 Sol at 91.9% and DeepSeek V4.1 Flash at 90.6%.

   ↩

5. ResearchGate — ‘Jailbreaking LLM-Controlled Robots’ — https://www.researchgate.net/publication/395224666_Jailbreaking_LLM-Controlled_Robots

   LLM-controlled robotic systems can be ‘jailbroken’ with high success rates, suggesting that the ‘Priestess’ controller might be unable to prevent harmful physical actions if the Oracle backbone is compromised.

   ↩

6. fmind.dev — ‘AI Agents as an Operating System’ — https://www.fmind.dev/articles/ai-agents-as-an-operating-system-rediscovering-the-linux-philosophy/

   Frameworks like LangChain can actually obstruct development by introducing ‘semantic hygiene’ issues… Rémi Louf advocates for a ‘kernel’ approach—using lightweight, event-driven triggers rather than rigid, hard-to-maintain graphs.

   ↩

7. QwenLM/WebWorld GitHub — https://github.com/QwenLM/WebWorld

   WebWorld scales web world modeling to over one million real-world interactions and supports long-horizon reasoning over 30+ steps… Qwen3-14B improved its WebArena success rate by 9.2% after simulation training.

   ↩

8. airedteaming.dev field notes on ‘The Attacker Moves Second’ — https://airedteaming.dev/field-notes/the-attacker-moves-second/

   Circuit Breakers… saw its ASR jump from 0% to 100% once an RL agent discovered and refined a specific exploitation path… adaptive attacks bypassed [12 defenses] with an ASR exceeding 90% for the majority of cases.

   ↩

9. Daniel Paleka, October 2025 AI Safety newsletter — https://newsletter.danielpaleka.com/p/october-2025-ai-safety-news-adaptive

   Given how totally the defenses were defeated… reliable solutions may not be developed in the near future; robust optimization where the attack is part of the training loop is the only method that has shown any repeatable resistance, though at significant computational cost.

   ↩

10. Simon Willison, ‘Prompt injection as role confusion’ — https://simonwillison.net/2026/Jun/22/prompt-injection-as-role-confusion/

    Prompt injection is not a bug that can be patched through better training, but a structural reality of the instruction-data concatenation model… models prioritize stylistic formatting of text over actual safety instructions.

    ↩

11. WASP benchmark (NeurIPS 2025 Datasets & Benchmarks) — https://papers.nips.cc/paper_files/paper/2025/hash/1c9818387f5dd0a0bc151214660f059d-Abstract-Datasets_and_Benchmarks_Track.html

    Even frontier models are susceptible to simple, human-written injections in over 80% of cases… though end-to-end completion of complex attacker goals remains between 0% and 17% — a phenomenon researchers call ‘security through incompetence’.

    ↩

12. Hugging Face papers discussion (Niels Rogge issue) — https://huggingface.co/papers/2610.08773

    External researcher Niels Rogge requested that the benchmark be published as a Hugging Face dataset to streamline evaluation… the defense has not yet been validated against live, malicious instructions on the open internet.

    ↩

13. AnyTeleop (RSS 2022, roboticsproceedings.org) — https://www.roboticsproceedings.org/rss18/p023.pdf

    a general vision-based teleoperation system that maps human hand-arm trajectories to various robots, outperforming specialized systems by utilizing a larger corpus of human motion data

    ↩

14. How Robots Learn (community analysis) — https://howrobotslearn.com/en/articles/how-video-estimates-hand-pose-and-touch-for-robot-learning/

    tactile data (contact and force) are statistical estimates derived from video, not direct sensor measurements

    ↩

15. OpenTouch project page — https://opentouch-tactile.github.io/

    over five hours of synchronized egocentric RGB video, full-hand tactile pressure maps, and hand-pose trajectories across 2,900 clips of contact-rich interactions

    ↩

16. alphaxiv (ACE-Ego-Hand / DreamHand analysis) — https://www.alphaxiv.org/abs/2608.20308

    diffusion-based models like ACE-Ego-Hand excel at local pose alignment, but may still exhibit higher absolute wrist localization errors compared to specialized 4D reconstruction frameworks like EgoH4RT

    ↩

17. AI Weekly alert on RLHND — https://aiweekly.co/alerts/rlhnd-turns-cosmos-3-video-model-into-hand-and-force-tracker

    the initial public abstract lacked raw numerical metrics and task success rates, making it difficult to independently verify its performance against established baselines

    ↩

18. YUAN Jetson T5000 benchmark report — https://www.yuan.com.tw/newscontent/352

    Cosmos 3-Nano delivered more than twice the throughput of competitors like Qwen 3.5, with only a 1% trade-off in accuracy for edge reasoning

    ↩