This issue covers May 11 to May 17, 2026 (Asia/Taipei). If the industry track this week is about turning agents into “deliverable operations” (deployment companies, cyber harnesses, governance), the research track is about something parallel: turning agents into objects we can rigorously evaluate and train.

That shift shows up in the questions researchers are now asking:

• Can an agent take verifiable actions in high‑risk environments?
• Can it stay reliable across long horizons, uncertainty, and delayed outcomes?
• Do “agent systems” (LLM + tools + memory + orchestration) exhibit value drift relative to the base model?
• Can we move beyond prompt‑glue into repeatable training/eval recipes?

Five high‑signal reads from this week:

1) ExploitGym: evaluating “exploitation” as an agent capability

Much of AI‑for‑security work stops at bug finding or writing PoCs. The higher‑stakes question is the next step: can an agent turn a known vulnerability into a real security impact?

ExploitGym frames exploitation as a measurable, replayable agent task, and studies how security protections change outcomes. It pushes the conversation from “does the model understand vulns” to “can the system produce impact,” which forces sharper thinking about access control, verification, and harness design.

• Paper: ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? (2026-05-11)
• Berkeley RDI blog: ExploitGym (2026-05-13)

2) FutureSim: replaying world events to test adaptive agents and calibration

Real agents don’t operate in closed‑book exam settings. They operate under partial information, time, and delayed resolution. FutureSim builds a grounded simulation that replays real‑world events chronologically and asks agents to make forecasts beyond their knowledge cutoff, evaluating them with probability‑aware metrics (e.g., calibration/Brier‑style scoring).

• Paper: FutureSim: Replaying World Events to Evaluate Adaptive Agents (2026-05-15)

The value is not just a new benchmark. It’s an evaluation environment that looks more like real deployment conditions: information flow, time, and delayed truth.

3) Context Training with Active Information Seeking: make context optimizers actually search

Many “context management” methods are compression/summarization pipelines. But long-horizon failures often come from missing a key fact and then acting as if you know it.

This paper turns the context optimizer into an active information seeker by giving it tools (e.g., Wikipedia search and a browser). The idea is to train systems that can proactively fill context gaps rather than passively shrink history.

• Paper: Context Training with Active Information Seeking (2026-05-13)

4) Orchard (Microsoft Research): open-source agentic modeling with scalable recipes

Orchard is not positioned as “yet another orchestration framework.” It aims to be an open-source framework for scalable agentic modeling, with specialized recipes for tasks like coding, GUI navigation, and personal assistance—and reports results on multiple agent benchmarks.

• Paper: Orchard: An Open-Source Agentic Modeling Framework (2026-05-14)

The key signal: agent capability building is being pushed from prompt+glue toward repeatable training/evaluation pipelines.

5) Agent-ValueBench: agent systems can diverge in “values” from their underlying LLM

Agent-ValueBench focuses on a system-level alignment question: an agent is not just a model; it’s model + tools + memory + rules + orchestration. Those layers can reshape behavior.

The benchmark asks whether an agent’s values can diverge from the base LLM’s values, and what dataset/evaluation/system factors drive that divergence.

• Paper: Agent-ValueBench: A Comprehensive Benchmark for Evaluating Agent Values (2026-05-11)

This becomes increasingly practical once agents hold permissions: the fear is not only “wrong answers,” but unacceptable actions under certain organizational policies.

The shared conclusion this week

Agents are no longer treated as a prompting technique. They are treated as systems with behavior, cost, and risk:

• Security evaluation starts to look like system testing (ExploitGym).
• Long-horizon evaluation moves toward time and uncertainty (FutureSim).
• Context management becomes tool‑backed information seeking (Context Training).
• Agentic modeling moves toward frameworks/recipes (Orchard).
• Values and governance become measurable at the system level (Agent-ValueBench).

Watchlist for next week

• More trace‑level, replayable evaluation protocols (not just answer scoring).
• Security benchmarks that connect exploitation/remediation workflows to realistic access/verification constraints.
• “Values” benchmarks that translate measurement into actionable engineering guardrails.