The Daily Digest: Hidden Skills, Long Runs, and Background Daemons
Today’s papers probe what agents can hide, sustain, and actually deliver—not just what they can demonstrate in a short run. On the infrastructure side, a reported Codex CLI daemon default raises the usual question of who, exactly, is running your agent after you close the window.
Picked for you
A capability audit can miss what the model is hiding
Researchers construct backdoors that embed encrypted neural networks in a host model’s weights and execute them only when a secret trigger arrives. Under cryptographic assumptions, the hidden computations are designed to resist elicitation and interpretation—even with full access to the weights—and resisted several tested approaches on a small chemical-reaction prediction task. The result is a specific limit on behavioral audits, not evidence that any given model is hiding a capability.
Why it matters: For capability evaluations, passing elicitation tests is not a proof that no triggered behavior exists.
Training terminal agents on work that takes the long way
TerminalHorizon synthesizes long-horizon task environments from professional work, using independent execution to identify omitted work and evidence to guide reconstruction. It progressively extends tasks under the same goal, so later stages build on earlier results and require further exploration or improvement. The authors train Qwen3.5-27B on 1.5K environments and report gains across 12 benchmarks, alongside case studies where the model continues experimenting within a 12-hour research budget.
Why it matters: The work targets a real data gap for agent harnesses: trajectories that teach exploration, feedback-driven adjustment, and end-to-end completion rather than isolated tool calls.
Coding agents still struggle to build the agent you asked for
AgentSWE evaluates agent-building across creation, editing, and optimization, with 25 tasks framed as commissions rather than coding exams. Builders can iterate on illustrative cases, but frozen submissions are tested on held-out cases against requirement-derived rubrics or benchmark objectives. The authors report that no evaluated coding agent comes close to reliably delivering the stated requirements; recurring failures include overfitting visible examples, hollow runtimes, and unsupported claims of completion.
Why it matters: It tests a useful layer above code generation: whether an agent-building workflow produces software that behaves as specified beyond the examples it saw.
A Codex CLI session reportedly leaves a daemon behind
A Codex CLI issue reports that version 0.157.0 starts a persistent managed daemon by default, copies the app-server package into a separate release directory, and launches a background updater. According to the report, the daemon can retain environment variables from the session that started it, while updates may restart the backend and interrupt active turns; stopping the daemon reportedly leaves its updater running. This is an issue report, not an independent confirmation of behavior across every setup, but the reporter says disabling daemon_auto_start prevents new TUI sessions from spawning it.
Why it matters: Persistent agent infrastructure should make its process identity, inherited environment, update behavior, and user-consent boundary legible.
ReplaySSM stores recent inputs instead of every state update
ReplaySSM represents an SSM state as a checkpoint plus a buffer of recent inputs, computes outputs from that representation, and folds the buffer into the checkpoint periodically. The design aims to reduce state traffic, make speculative-decoding rollback cheaper, and avoid feeding quantization error back through recurrent state updates. The source describes evaluations across Mamba-2 and GDN hybrid models and says the implementation is integrated into TensorRT-LLM, vLLM, and FlashInfer, but the supplied material does not include the measured performance results.
Why it matters: If the approach delivers on those goals, it could address serving bottlenecks that matter for hybrid models—and make speculative decoding and lower-precision state more practical.
Meta adds two Muse models, with performance claims still internal
Meta has released Muse Wonder and Muse Wonder Full for Muse Code subscribers, with Wonder also available through the Meta Model API. The company says they can compete with leading OpenAI and Anthropic models, citing internal benchmark tests, but the coverage provides no detailed results and says comparisons with Google’s Gemini 4 Argon remain unclear. Meta says Wonder is eventually intended to power its Muse agent, without giving a timeline.
Why it matters: The release may matter for agent builders, but the supplied evidence does not yet let readers assess the model claims or likely capability differences.
GUI agents need applicable history, not just relevant history
ExpActivator matches the current GUI screen to historical states in a frozen backbone’s latent space and offers the corresponding past action as a reference. For proactive suggestions, it activates a recurring intent only when the time and scenario support it, otherwise abstaining. The authors report improved within-trajectory step success across four GUI backbones while using about one-fifth as many history tokens, and stronger results on their proactive metric than the cited baseline.
Why it matters: This is a practical design lesson for personalized agents: retrieve memory at the decision point, and let the agent abstain when a remembered routine does not fit.
The paper evaluates no-thinking behavior by separating pre-answer traces from final answers and measuring answer-only compliance, trace relevance, and explicit inference. Across six models and several task types, it finds that visible inference persists despite explicit controls, and becomes more common as the answer space opens. Accuracy stays stable on Boolean and multiple-choice questions, while open-ended questions expose a trade-off between answer-only compliance and accuracy.
Why it matters: A reasoning-mode setting is not a dependable control surface unless evaluations check the behavior it is meant to suppress.