Hot Agent Directions: Eight Adjacent Paths Back to the Core Five

Agent research can expand too easily around fashionable terms: memory, multi-agent systems, MCP, world models, computer use, and self-evolving skills. Each matters, but none should automatically become an unbounded new project. This note compresses 32 primary-source research lanes into eight adjacent directions and asks one question: how can they make one of the five core research threads more measurable, safer, or easier to falsify?

1. Fix the Five Core Questions First

1. RSI: Does the improvement process improve across generations on independent acceptance and unseen tasks?
2. Auto Research: Can the system deliver a replayable research artifact with controls and limits?
3. Long horizon: Can an hours-long task retain state, recover, control cost, and remain accountable for its final state after interruption?
4. Environment: Are initial state, action authority, reward, verifier, and evidence trail independent and auditable?
5. Synthetic-instance training: Do synthetic instances or trajectories transfer to strictly separated unseen environments rather than memorize their generator?

The value of a hot direction is not another slogan. It is a measurable variable or counterexample for one of these questions. The eight groups below cover the 32 research lanes.

2. State and Memory: Turn “Remembering” into Auditable Execution State

Agent Memory separates construction, retrieval, and generation phases in stateful, tool-using long-horizon workloads. MemGym attempts to isolate memory measurement across deep research, coding, and computer use. AgeMem treats long- and short-term memory operations as trainable actions. MAGE organizes execution state as a hierarchy that can grow, compress, maintain, and revise.

Write-back. A long-horizon harness should retain more than a chat summary: task manifest, external facts, candidate artifacts, unresolved hypotheses, checkpoints, and reasons for state changes should become versioned objects. Retrieval, compression, and recovery need cost and impact reporting. RSIBench can also treat a candidate change that breaks state reconstruction as a regression, not merely inspect final-task success.

Boundary. Retrieving a correct snippet on one task does not show that a system maintains causal long-term state. Memory reads and writes also belong inside observable, reversible authority boundaries.

For the full protocol from context, event ledger, and retrieval to execution state, checkpoint/recovery, and a memory trust boundary, see Agent Memory: From Similarity Retrieval to Recoverable, Verifiable Execution State.

3. Multi-Agent Systems: Treat Collaboration as a Costed Control Policy

SABER examines operational safety in stateful coding workspaces. NRT-Bench uses replayable multi-turn red-teaming for team risk. MAFBench finds orchestration choices can change accuracy, latency, and coordination behavior. MAESTRO exports framework-agnostic traces and system signals, showing that architecture can dominate cost, reproducibility, and latency trade-offs.

Write-back. ART and ClawBench V2 baselines should include one agent, sequential multi-step work, and parallel delegation under fixed total tokens, wall-clock time, worker-hours, and authority. Each subtask’s read/write grant, input summary, artifact, and merge decision belongs in the trace. The minimum evidence for “a team is better” is same-budget final state, regressions, duplicated work, and merge conflicts, not worker count.

Boundary. Parallelism may only move expenditure to more API calls or wider authority. Plausible team messages do not establish correct final state, provenance, or safety constraints.

For an executable protocol covering delegation tickets, handoffs, merging, same-budget baselines, and team safety, see Multi-Agent Systems: Delegation, Handoffs, and Verifiable Collaboration.

4. MCP and Tool Governance: Connection Is Not Execution Control

Governance Gaps in Emerging AI Agent Protocols discusses missing governance primitives at the current protocol layer. From Tool Connection to Execution Control argues that runtime execution control should not be replaced by a connection protocol. Security Threat Modeling for Emerging AI Agent Protocols provides a protocol threat-modeling lens. MCP-Persona illustrates that tool portfolios can also be evaluated against user or task preferences.

Write-back. Beyond a tool name, an environment contract should declare schema, identity, authority, idempotency, external effects, audit events, revocation, and error semantics. WebsiteBench can make “select the right tool without unauthorized calls” an independent axis. A RSIBench candidate must not be allowed to modify the verifier, policy, or credential routing.

Boundary. Protocols such as MCP or A2A are interoperability interfaces, not sandboxes, least privilege, approval workflows, or complete audit systems. Security claims require runtime interception and final-state checking.

For an executable contract, adversarial tasks, and an acceptance protocol for this direction, see Agent Tool Governance: MCP, Browser/Computer Use, and Verifiable Security Boundaries.

5. Agent Security: Treat Web and Tool Output as Untrusted Input

BrowseSafe studies prompt injection in web content. Security Considerations for AI Agents separates input, model, and sandbox attack surfaces. AgentDyn offers a dynamic real-world prompt-injection testing direction. WASP studies web-agent injection attacks in isolated environments.

Write-back. ClawBench V2 and WebsiteBench should label untrusted pages, tool responses, files, and task text separately. Privileges, hidden rules, and evaluator context must not enter the web page or ordinary tool echoes. Every task family should contain counterexamples for injection, deceptive tool descriptions, correct endpoint but wrong payload, and a UI that looks complete while the backend has not committed.

Boundary. A guard’s detection rate is not safety. Report false blocks, misses, overhead, attack-distribution shift, and authority escalation triggered by user confirmation.

6. World Models and Embodied Agents: Test Function, Not Just Appearance

WorldArena highlights a gap between visual/perceptual quality and actual interactive utility. WorldArena 2.0 extends evaluation toward visuotactile and interactive RL settings. WorldLines binds long-horizon embodied tasks to traceable state, memory, and planning. LongAct studies dependencies, memory, and adaptive planning in free-form household tasks.

Write-back. The immediate role of a world model for this program is environment design: is state sufficient for multi-step decisions, can state changes be independently verified, and must the agent maintain a recoverable world model? Synthetic instances should generate not only task text but initial state, executable transitions, failure branches, and postcondition checks.

Boundary. Realistic rendering, smooth video, or coherent-looking rollouts do not establish environment semantics, causal transitions, or out-of-distribution control. Web and desktop environments first need business postconditions; visual similarity is insufficient.

For one contract tying world models to executable environments, recoverable state, synthetic-instance lineage, and independent terminal acceptance, see World Models and Agent Environments: From Plausible Frames to Verifiable State Transitions.

7. Harness and Planning: Attribute Behavior to the Complete Configuration

Agentic Harness Engineering organizes editable components, distilled experience, and decision predictions into a falsifiable harness-evolution loop. Agent Planning Benchmark separately measures planning, feedback-conditioned replanning, noisy tools, and unsolvable tasks. TRACE emphasizes trajectory utility, evidence grounding, and the minimum support needed for success. ClawArena-Team scores subagent management together with least privilege and modality routing.

Write-back. Every public result should be attributed to model + harness + environment + tool policy + evaluator + budget. Each ART edit needs a prediction, scope, risk, and held-out acceptance. Long-horizon tasks should separately report plan quality, recovery from tool noise, and correct stopping or refusal, not only pass rate.

Boundary. A longer prompt, more complex loop, or higher outcome cannot automatically be attributed to model capability or genuine planning. It is especially not evidence that automated harness evolution is strong RSI.

For a separate protocol for plan, execution, replanning, delegation/scheduling, and independent terminal acceptance, see Agent Planning: From Plausible Plans to Verifiable Replanning.

8. Large Tool Spaces and Orchestration: Put Efficiency Inside the Correctness Protocol

PlanBench-XL tests retrieval, adaptation, and recovery in a large tool ecosystem with tool failures. SAGA treats the full agent workflow rather than one inference request as the scheduling unit. Uno-Orchestra studies selective delegation. AutomationBench combines cross-application API discovery, policy adherence, and final writes.

Write-back. A multi-tool environment should expose discovery, invocation, verification, recovery, and stopping. Report cost_per_verified_success, tail latency, failure recovery, invalid calls, and authority escalation. For cross-application work, only independently checked backend state should signal completion.

Boundary. Lower latency or greater throughput is not correct completion. A workflow scheduler result also does not automatically transfer to a small benchmark, a browser UI, or a scientific research artifact.

9. Continual Learning and Skill Evolution: Treat Skills as Tested External State

ACuRL connects target-environment exploration, curriculum task synthesis, and continual adaptation. MUSE-Autoskill treats creation, storage, management, testing, and revision as a skill lifecycle. Agent Skill Evaluation and Evolution surveys evolution through execution feedback, trajectory distillation, compression, and RL. SkillOpt constrains skill-document edits to changes accepted by held-out score.

Write-back. A skill may be a prompt, tool recipe, executable script, or state schema, but it needs code-like versioning: inputs/outputs, authority, tests, applicable distribution, cost, and expiry. Synthetic training should separate skill reuse, regression, and cross-environment transfer. RSIBench can use accepted and rejected external-skill edits as a controlled self-modification surface.

Boundary. A self-edit loop sharing its generator, task template, or reward may merely fit locally. Stronger improvement claims need independent evaluators, frozen holdouts, limited authority, and cross-generation curves together.

For the full protocol from SKILL.md format and activation through lifecycle, supply chain, and held-out acceptance, see Agent Skills: From SKILL.md to Governed Continual Learning and Independent Acceptance.

10. Converge to Five Design Decisions

The conclusion is deliberately narrow: hot directions should become constraints and diagnostics for the five core questions, not eight simultaneous product tracks. The next iteration should implement the smallest tasks and counterexamples capable of testing these decisions, then decide which line merits expansion into a paper or training program.