这个项目提供一个不容易被反爬与验证码识别的 Playwright MCP 服务：Agent 在反检测的 stealth Firefox 上浏览网页^[27]。它要解决的是网页 Agent 最现实的中断原因——不是推理出错，而是被站点判定为机器人后任务直接断掉。做法上把浏览器控制层换成抗检测版本，并把能力通过 MCP 暴露给 Claude Code、Gemini CLI 等宿主。值得借鉴的是把「能不能持续访问」当成与推理能力同等的工程指标；限制是这类反检测能力与站点条款天然冲突，用于第三方站点抓取、批量注册等场景存在法律与封号风险，团队需要先明确使用边界。

This project offers a Playwright MCP server that is hard for anti-bot systems and captchas to detect, letting an agent browse on stealth, anti-detect Firefox^[27]. It addresses the most practical way web agents break: not bad reasoning but being flagged as a bot, which kills the task outright. The approach swaps in a detection-resistant browser control layer and exposes it over MCP to hosts such as Claude Code and Gemini CLI. Worth borrowing is treating “can it keep getting access” as an engineering metric equal to reasoning quality; the limit is that anti-detection inherently conflicts with site terms, so scraping, bulk sign-ups and similar uses carry legal and ban risk and need explicit boundaries.

Jumper 是一个开源机器螃蟹项目，用蟹类步态研究多足机器人在非结构化地形上的运动^[29]。它要解决的是腿式机器人研究的成本与多样性问题：四足与双足的硬件门槛高，而多足形态在侧向稳定性和复杂地形通过性上有不同的取舍，适合用来做对照实验。做法上把机械结构、控制器与代码全部开放。值得借鉴的是用「便宜且能复现的形态」去验证步态与控制假设，而不是一开始就追求人形；限制是仓库以形态与基础控制为主，尚未给出跨地形的量化对比与负载能力，工程价值需要自己跑起来评估。

Jumper is an open-source crab robot project using crab-like gaits to study multi-legged locomotion on unstructured terrain^[29]. It addresses cost and morphological diversity in legged robotics: quadruped and biped hardware is expensive, while many-legged forms trade off differently on lateral stability and rough-terrain traversal, making them useful controls for experiments. The mechanical design, controllers and code are all open. Worth borrowing is validating gait and control hypotheses with a cheap, reproducible morphology instead of starting from humanoids; the limit is that the repo centres on form and basic control without quantitative cross-terrain comparisons or payload figures, so engineering value needs hands-on evaluation.

lcu 做的事很具体：把 Codex 的 computer use 能力从桌面 App 中解耦出来，让它能在任意 harness 里使用^[28]，覆盖 macOS、Linux 与 X11，并通过 MCP 与 agent skills 暴露。它要解决的是能力被产品外壳锁定的问题：界面操作（点击、输入、读屏）是通用能力，但往往只能在某个客户端里用，无法接进自建流程或其它 Agent。做法上把「操作电脑」抽成独立服务，宿主换掉它也能用。值得借鉴的是把 Agent 的某项能力做成宿主无关的组件，便于替换与组合；限制是桌面自动化依赖辅助功能权限，权限过大也意味着风险集中，仓库未说明沙箱或审计机制。

lcu does something specific: it decouples Codex's computer-use capability from the desktop app so it can run inside any harness^[28], covering macOS, Linux and X11 and exposed through MCP and agent skills. It addresses capability locked inside a product shell: clicking, typing and reading the screen are general abilities, yet they are often usable only in one client and cannot be wired into internal pipelines or other agents. The design extracts computer operation into a standalone service any host can call. Worth borrowing is packaging an agent capability as a host-agnostic component for easier replacement and composition; the limit is that desktop automation needs accessibility permissions, and broad permissions concentrate risk, with no sandbox or audit mechanism described.

WeChatBridge 是原生 macOS 工具：把微信聊天记录一键转发给 AI Agent 与 Obsidian^[30]。它要解决的是个人语料的第一公里问题：用户最有价值的对话数据锁在封闭客户端里，导不出来就谈不上让模型分析；而导出又常涉及格式转换与隐私顾虑。做法上以系统分享扩展的方式接入，把导出变成一次点击。值得借鉴的是先解决「数据能不能带出来」，再谈记忆与分析；限制是聊天记录包含大量第三方隐私，转发到云端模型前必须做脱敏与授权确认，仓库未说明本地处理范围与加密方式。

WeChatBridge is a native macOS tool that forwards WeChat chat history to AI agents and Obsidian in one step^[30]. It addresses the first mile of personal corpora: the user's most valuable conversations live inside a closed client, and what cannot be exported cannot be analysed, while export usually means format conversion and privacy worries. The design plugs in as a share extension, turning export into one click. Worth borrowing is solving whether the data can leave the walled app before designing memory and analysis on top; the limit is that chat logs contain a great deal of third-party private data, so redaction and consent are prerequisites before sending to a cloud model, and the repo does not describe local processing scope or encryption.

这个项目把 PDF、书籍与论文转成可追溯、可测验、可做笔记的交互式学习网页，以 Claude Code / Codex 技能的形式提供^[31]。它要解决的是「读了但没吸收」的问题：长材料缺少结构化的自测与回查路径，读者很难知道自己哪里没懂。做法上让 Agent 抽取结构与要点，生成带测验与来源锚点的页面，把阅读变成可验证的过程。值得借鉴的是把「可追溯」与「可测验」作为学习类 Agent 的默认产出形态；限制是生成质量取决于原文结构与模型理解，摘要偏差可能被读者当作原文观点，仓库未说明是否保留逐段引用校验。

This project turns PDFs, books and papers into traceable, testable, note-friendly interactive learning pages, delivered as a Claude Code / Codex skill^[31]. It addresses reading without absorption: long material offers no structured self-testing or re-checking path, so readers cannot tell what they missed. Agents extract structure and key points and produce pages with quizzes and source anchors, making reading a verifiable process. Worth borrowing is making traceability and testability the default output shape for learning agents; the limit is that quality depends on source structure and model comprehension, and summary drift can be mistaken for the original's claim, with no statement about paragraph-level citation checks.

qq-bridge 把 QQ（SnowLuma OneBot v11）与 DeepSeek Harness Agent 桥接起来，支持社交模拟、安全 MCP 工具与俚语学习^[32]。它要解决的是 Agent 在中文社交场景的落地问题：群聊语料、说话风格与合规边界都和英文客服场景不同，直接套通用 Agent 会显得生硬甚至冒犯。做法上把消息通道、工具调用与语言风格适配分成三层，并强调工具调用的安全封装。值得借鉴的是为特定社群单独做语言与安全适配，而不是把同一个提示词搬到所有渠道；限制是接入即时通讯平台涉及平台条款与用户隐私，机器人行为也需要人工兜底，仓库未说明内容审核与封禁处理机制。

qq-bridge bridges QQ (SnowLuma OneBot v11) with DeepSeek Harness agents, supporting social simulation, safe MCP tools and slang learning^[32]. It addresses deploying agents into Chinese social settings: group chat corpora, register and compliance boundaries all differ from English customer-service scenarios, and a generic agent reads as stiff or even offensive. The design separates the message channel, tool invocation and style adaptation into three layers, with safety wrapping around tool calls. Worth borrowing is adapting language and safety per community rather than moving one prompt across every channel; the limit is that connecting to messaging platforms raises platform terms and user privacy issues, bot behaviour needs human fallback, and moderation or ban-handling mechanisms are not described.

AntOmniEvo 把自己定义为「自动进化框架，优化任何东西——相当于一支 7×24 的算法工程师团队」，覆盖自动化优化、进化算法、多 Agent 与自我改进^[33]。它要解决的是优化任务的重复人力问题：调参、搜索与迭代实验高度模式化，适合由 Agent 循环承担。做法上把「提出假设 — 执行实验 — 评估 — 修改」的循环做成框架，多个 Agent 分工推进。值得借鉴的是把研究方向本身当作可搜索空间，并用实验闭环做验收；限制是自我改进类框架的效果高度依赖评估函数的质量，一旦指标可被钻空子就会朝错误方向进化，仓库未给出跨任务的稳定性数据。

AntOmniEvo describes itself as an auto-evolution framework that optimises anything — a 24/7 team of algorithm engineers — spanning automated optimisation, evolutionary algorithms, multi-agent systems and self-improvement^[33]. It addresses the repetitive human effort in optimisation work: tuning, search and iterative experiments are highly patterned and suit an agent loop. The framework formalises propose-run-evaluate-revise with several agents dividing the work. Worth borrowing is treating a research direction as a search space gated by an experimental loop; the limit is that self-improving frameworks depend heavily on the quality of the evaluation function, and a gameable metric sends evolution the wrong way, with no cross-task stability data published.

OpenWAM 是论文 「OpenWAM: An Open, Modular Exploration Towards Systematic World–Action Model Pretraining」的官方仓库，目标是给「世界-动作模型」预训练提供模块化、可复现的基线^[34]。它要解决的是该方向的可比性问题：各家在数据、动作表示与预训练目标上各不相同，缺少共同基线导致结果无法横向比较。做法上把预训练流程拆成可替换的模块，公开数据与训练配置。值得借鉴的是先建立公共基线再比较方法，避免只在自家设置里刷分；限制是仓库以论文复现为主，尚未说明跨硬件与跨任务的可迁移性，实际使用需要按自己的机器人形态重做适配。

OpenWAM is the official repository for “OpenWAM: An Open, Modular Exploration Towards Systematic World–Action Model Pretraining”, aiming to give world-action model pretraining a modular, reproducible baseline^[34]. It addresses comparability in this area: labs differ in data, action representation and pretraining objective, and without a shared baseline results cannot be compared across papers. The design splits the pretraining pipeline into swappable modules with data and training configuration published. Worth borrowing is building a common baseline before comparing methods rather than scoring inside one's own setup; the limit is that the repo centres on reproducing a paper and does not describe cross-hardware or cross-task transfer, so adoption requires adapting to your own embodiment.

Sno Station 的定位是让 Claude Code 与 Codex 在本机协同工作：共享加密记忆、Agent 间消息（Reach）、交接与跨厂商评审的团队技能，以及每晚在你批准下重写 Agent 自身技能的循环，强调本地优先、无需常驻守护进程与云端^[35]。它要解决的是多 Agent 协作缺少基础设施的问题：不同厂商的编码 Agent 各自为政，记忆与评审无法互通。做法上用本机共享层把记忆与消息打通，并保留人工审批。值得借鉴的是跨厂商协作的关键是共享记忆与评审协议，而不是统一到某一个 Agent；限制是「每晚自动改写技能」需要强审批与回滚，仓库未说明变更审计细节，多 Agent 共享记忆也会放大错误传播。

Sno Station positions itself to run Claude Code and Codex as one squad on your machine: shared encrypted memory, agent-to-agent messaging (Reach), squad skills for handoff and cross-vendor review, and a nightly loop that rewrites the agents' own skills with your approval — local-first, no daemon, no cloud^[35]. It addresses the missing infrastructure for multi-agent collaboration: coding agents from different vendors work in isolation with no shared memory or review. A local shared layer connects memory and messaging while keeping human approval. Worth borrowing is that cross-vendor collaboration hinges on shared memory and review protocols rather than standardising on one agent; the limit is that nightly skill rewriting demands strong approval and rollback, change-audit details are not described, and shared memory amplifies error propagation.

Autoloom 的卖点是在 AI 编码的执行层内置 Aegis 治理：改动要有基线对照，交付要带证据，并提供免费桌面客户端、模型可自选^[36]。它要解决的是编码 Agent 最容易被诟病的一点：改完之后没人能说清「为什么这么改、相对基线好在哪」，评审只能靠读 diff。做法上把基线感知与证据收集放进执行流程，而不是事后补文档。值得借鉴的是把「可评审性」当成 Agent 的一等输出要求，让每个变更自带对照；限制是这类治理层会增加流程开销，也可能被形式化地「走一遍」，实际效果取决于证据是否真的被评审者使用。

Autoloom's pitch is Aegis governance built into the coding agent's execution layer: baseline-aware changes and evidence-backed delivery, with a free desktop client and a choice of models^[36]. It addresses the most criticised aspect of coding agents: after a change nobody can say why it was made or how it improves on the baseline, so review degenerates into reading diffs. Baseline awareness and evidence collection move into the execution flow rather than being documented afterwards. Worth borrowing is treating reviewability as a first-class output requirement so every change carries its own comparison; the limit is that such governance layers add process overhead and can be satisfied formally, with real value depending on whether reviewers actually use the evidence.

这篇论文针对网页 Agent 的提示注入：页面上的指令可以把它从用户目标上带偏，但 Agent 又不能不看页面，因为任务需要的取值和控件都在页面上^[37]。现有防御的漏洞在于：在训练前固定注入样本上微调，会被适应模型后的攻击者绕过；而对抗训练虽然让攻击者适应，却把任务固定住，一旦 Agent 解出这道题它就不再提供学习信号。做法是在一个冻结的网页世界模型里让任务课程、注入攻击者与 Agent 三方共同进化：课程只奖励「Agent 解出一半左右」的任务，攻击者只奖励「把判定为成功的一次执行翻成失败」的注入。效果上，在模拟器里训练让一个 4B Agent 既更有能力也更鲁棒：在有攻击与无攻击下达成都上升，能顶住一个训练时从未见过的前沿模型攻击者，能力增益还能迁移到真实浏览器；在 150 个网页任务上，面对未见过的新攻击者，完成率相对基座 Agent 提升 33.6%。对做浏览器/网页 Agent 的团队，参考价值是注入防御应当在「会自适应」的对手下训练，并用「成功率翻面」这种稀疏但精准的信号塑形；限制是整个训练依赖冻结世界模型的保真度与「翻面」奖励的设定，真实站点的注入面与判定方式不同，迁移效果需要重新验证。

This paper targets prompt injection in web agents: an instruction planted on a page can redirect the agent from the user's goal, yet the agent cannot ignore the page because the values and controls the task needs live there^[37]. Existing defences fail predictably: fine-tuning on injections fixed before training is bypassed by attackers that adapt to the trained model, while adversarial training lets the attacker adapt but freezes the tasks, so a task stops teaching once solved. The method co-evolves three parties inside a frozen web world model: the curriculum is rewarded for tasks the agent solves about half the time, and the adversary only for flipping a judged success into a failure. Training in the simulator makes a 4B agent both more capable and more robust: completion rises with and without attacks, it holds against a frontier adversary it never trained against, the capability gain carries over to a real browser, and on 150 web tasks completion under that unseen adversary improves by 33.6% relative to the base agent. For browser and web agent teams the reference is to train injection defences against an adaptive opponent and shape them with the sparse but precise signal of a success flip; the limit is that everything depends on the fidelity of the frozen world model and the flip-based reward, so real sites with different injection surfaces need fresh validation.

这篇论文问了一个很具体的问题：长程 Agent 通常按全局规则（一般是 token 预算）压缩上下文，完全不看自己正在做什么，那么「最近的行为」能不能预测这次压缩会不会造成伤害？^[38] 做法用的是 TRACE 公开语料里的 590 个由 harness 触发的 AppWorld 压缩边界：每个边界都从重新执行过的前缀状态出发，分别在「压缩前上下文」与「摘要」两种条件下重放，并记录之后动作的负担（报错的调用、重复调用）。结论偏负面：压缩前的历史只能很弱地预测压缩后的伤害；预设的前缀位置对比区间很宽，等于没有结论；而背后那个「是否写过」的朴素标签，其实测的是轨迹处于哪个阶段。真正可用的信号也有限：最好的扩展协议触发器在留出集上 AUROC 0.66（复制集自身标签上 0.64），同一边界的复现基线反而有 0.72；最好的冻结可解释触发器避免了 21% 的有害边界，同时保留了 84% 的压缩机会，在计数上超过随机规则、但在负担质量上没有（这是事后比较）；而且「最好的触发器在相同保留率下能否胜过 token 预算规则」在这份释出数据上无法评估，作者列出了需要补哪些语料才能回答。对做上下文工程的团队，参考价值是「按行为决定压缩时机」目前缺乏证据支撑，先把 token 预算这类简单规则调好并补齐可评估的语料；限制是结论只覆盖单一 harness 与单一语料，作者自己也把效应描述为「温和且有界」。

This paper asks a concrete question: long-horizon agents compact context on a global rule, usually a token budget, blind to what the agent is doing — so does recent behaviour predict when a compaction will hurt?^[38] It uses TRACE's public corpus of 590 harness-triggered AppWorld compaction boundaries, replaying each from a re-executed prefix state under the pre-compaction context and under the summary, and recording the burden of subsequent actions: calls that error or repeat. The result is largely negative: pre-boundary history predicts post-compaction harm only weakly; the prespecified contrast by prefix placement is a wide null; and the naive “has-written” label behind it actually measures trajectory phase. Usable signal is limited too: the best extension-protocol trigger reaches held-out AUROC 0.66 (0.64 on the replicate's own label) against a same-boundary replicate at 0.72, and the best frozen interpretable trigger avoids 21% of harmful boundaries while keeping 84% of compaction opportunities, beating a random rule on count but not on burden mass in a post-hoc comparison; whether the best trigger beats a token-budget rule at matched retention cannot be evaluated on the release, and the authors list the corpora needed to answer it. For context-engineering teams the reference is that behaviour-conditioned compaction currently lacks evidentiary support, so tune the simple token-budget rule and demand better corpora; the limit is a single harness and corpus, with the authors themselves calling the effect modest and bounded.

VeriFine 指出自改进策略的一个瓶颈：策略不断暴露新的失败模式，裁判必须能验证的东西也在变；而固定的裁判会同时限制优化反馈和有用训练样本的发现，在具身推理里更严重，因为可靠评测要同时覆盖空间落地、因果推理与安全决策^[39]。做法让策略、训练课程与裁判三者共同进化：策略改进循环用评分表裁判诊断反复出现的失败、构造自适应课程并优化策略；当进展停滞、验证成为瓶颈时，裁判改进循环主动就「有信息量的失败案例」向人求助，并通过协同校准（人与 Agent 一起解决分歧、向物理推理的客观评分表收敛）来精修裁判，再用新裁判指导下一阶段的数据选择与策略优化。在驾驶与机器人导航任务上，强化学习与监督微调两种设置下都显示出策略与裁判能力的持续提升。对做具身 Agent 与评测体系的团队，参考价值是把裁判当成需要一起迭代的组件，并在它成为瓶颈时用少量人工标注去解锁；限制是摘要未给出各阶段的量化提升，人工介入的预算与「向客观评分表收敛」的可验证性也没有说明，仍需按自己的任务复现。

VeriFine names a bottleneck in self-improving policies: policies keep exposing new failure patterns, changing what their judges must verify, while fixed judges constrain both optimisation feedback and the discovery of useful training examples — worse in embodied reasoning, where reliable evaluation must cover spatial grounding, causal reasoning and safety-aware decisions^[39]. The method co-evolves the policy, the training curriculum and the judge: a Policy Improvement Loop uses a rubric judge to diagnose recurring failures, build an adaptive curriculum and optimise the policy, and when progress plateaus and verification becomes the bottleneck, a Judge Improvement Loop selectively asks humans about informative failure cases and refines the judge through coactive calibration, where humans and agents resolve disagreements toward the objective rubric, after which the revised judge guides the next round of data selection. On driving and robot navigation tasks it shows continuous improvement of both policy and judge under reinforcement learning and supervised fine-tuning. For embodied agent and evaluation teams the reference is to treat the judge as a component that must iterate too, and unblock it with a small amount of human labelling when it throttles progress; the limit is that the abstract gives no per-stage effect sizes and does not quantify the human budget or the verifiability of convergence toward the objective rubric.

这篇论文处理 Best-of-N 评测里一个常被忽略的统计问题：如果你用选冠军的那些分数去评估冠军，期望回报会被高估^[40]。作者把问题设定成固定矩阵：每个候选有 K 个独立分数，选择策略用其中 J 个新分数做决定，考察什么样的估计量是无偏的。核心结论是一条清晰的条件：只依赖这个矩阵的单一估计量，只有在 J；而当 J=K-1 时，随着 K 增大选择会变深。在独立同方差高斯分数下，这个 regime 里无偏的极小极大风险量级是 σ²/√K，由 Holdout 估计量达到；如果允许偏差，速率可以改善到 σ²/K。两候选情形下作者给出了已知方差时的最小方差无偏估计量与尖锐的渐近无偏极小极大常数 1/(π√2)，且 Holdout 在不知道方差时也能达到；子集循环平均与并列处理可在 O(MK log M) 内完成。对做模型评测与 A/B 的团队，参考价值是只要用同一批分数既选又评，就必须留出独立的 holdout 分数，或者接受系统性高估；限制是结论建立在「分数分布独立且稳定」的假设上，真实评测中截断、重试与评委漂移都会破坏前提。

This paper tackles an overlooked statistical problem in Best-of-N evaluation: reusing the scores that select a winner to evaluate it overstates expected reward^[40]. The setup is a fixed matrix of K independent scores per candidate with a selector using J fresh scores, and the question is which estimator is unbiased. The core result is a clean condition: a single estimator based only on this matrix is exactly unbiased under every independent, stable collection of candidate-specific score laws if and only if J, and at J=K-1 the selector deepens as K grows. For independent Gaussian scores with common variance, the unbiased minimax risk is of order σ²/√K, attained by Holdout, while allowing bias improves the rate to σ²/K; for two candidates the paper derives the minimum-variance unbiased estimator at known variance and the sharp asymptotic constant 1/(π√2), also attained by Holdout without knowing the variance, with cyclic averaging computable in O(MK log M). For evaluation and A/B teams the reference is that if the same scores both select and evaluate, you must hold out independent scores or accept systematic overstatement; the limit is that the results assume independent, stable score laws, which truncation, retries and judge drift all violate in practice.

ParanoiaEval 关注编码 Agent 的一种反向失败：不是没做防护，而是做了不必要的防护——在证据明确的前提下仍然过度设防，浪费改动与评审成本^[41]。做法上它借用软件工程风险管理里成熟的 Avoidance–Transfer–Mitigation–Acceptance（规避、转移、缓解、接受）四类风险处置框架，把它落到编码 Agent 场景，构建了 200 个「证据受控」的仓库级任务对：每对只差一个决定处置方式的关键证据，并给出风险处置违规率与证据响应性两类专门指标，用人工校准的 Agent 评审来评测。在 8 个代表性模型上的大规模实验加事后人工研究发现三点：（I）即使证据明确，不必要的风险处置仍出现在 11.2%–58.7% 的运行里，且不同 Agent 配置间差异巨大；（II）任务能力更强并不保证风险处置更得当，而处置方式违规会显著损害开发者体验，说明「风险处置」是独立的能力维度；（III）Agent 表现出与人类风险管理既有结论一致的系统性模式，意味着人类实践中的知识可以用来诊断和改进这项能力。对做编码 Agent 的团队，参考价值是把「过度设防」当成与漏防并列的评测维度，并用受控的配对任务来测；限制是评测依赖人工校准的 Agent 评审与人工构造的任务对，真实性受限于所选仓库与风险类型。

ParanoiaEval targets a reverse failure mode in coding agents: not missing protection but unnecessary protection — over-defending despite explicit evidence, wasting change and review effort^[41]. It borrows the established Avoidance–Transfer–Mitigation–Acceptance framework from software-engineering risk management and operationalises its four treatments for coding agents, building 200 evidence-controlled repository-level task pairs that differ only in the treatment-defining evidence, plus dedicated metrics for risk-treatment violations and evidence responsiveness, judged by a human-calibrated agentic judge. Large-scale experiments on 8 representative models with a post-hoc human study give three findings: unnecessary risk treatment occurs in 11.2%–58.7% of runs despite explicit evidence, with substantial variation across agent configurations; stronger task capability does not ensure more appropriate risk treatment, and treatment violations substantially harm developer experience, making risk treatment an independent capability dimension; and agents show systematic patterns consistent with established human risk-management findings, so knowledge from human practice can guide diagnosis and improvement. For coding agent teams the reference is to measure over-defence as its own dimension alongside under-defence, using controlled paired tasks; the limit is reliance on a human-calibrated agentic judge and constructed task pairs, so realism is bounded by the repositories and risk types chosen.

这篇论文提出并测量一种被忽视的 Agent 能力——「装瓶」（bottling）：把一个通用能力变成针对某类任务的专用方案，在答案质量与摊销成本之间取得平衡^[43]。动机很实际：模型能解决很多窄任务，但为几百万条同类实例逐条调用 API 的成本高得不可行，而 Agent 或许可以自己造出更便宜的解法（训练小模型、写可复用程序）。做法是构建 BOTTLED 基准：Agent 拿到一整批未标注的工作负载，必须在固定的时间、算力与 API 预算内完成，且自行选择路线。结论对「能力越强越会省钱」的直觉是打击：在十个模型与三个任务上，强零样本表现并不能可靠转化为强装瓶能力；零样本分数相近的模型在装瓶后差异可能很大；60 次装瓶运行里有 48 次低于该模型零样本表现 95% 置信区间下界；31 次甚至不如在同等 token 预算下的两个小模型蒸馏基线中较强的那个。但装瓶确实能省钱：在查询—商品相关性分类上，Opus 5 保留了约 82% 的零样本 macro-F1，而报告成本低约 657 倍；同一任务上它还达到专门为廉价重复推理设计的「系统一」模型 Jev 约 94% 的 macro-F1，而成本约为 Jev 全工作负载预估成本的四分之一。对做批处理任务的团队，参考价值是给 Agent 留预算并考察它是否愿意「造工具而不是硬算」，这本身是一项独立能力；限制是结论依赖 BOTTLED 的自定义预算与成本口径（成本为「报告值」），跨任务迁移性与真实计价方式仍需核对。

This paper defines and measures an overlooked agent ability: “bottling” — turning a general capability into a task-specific solution that balances answer quality against amortised cost^[43]. The motivation is practical: models solve many narrow tasks, but querying an API once per instance across millions of related instances is prohibitively expensive, and an agent might build something cheaper itself, such as training a small model or writing a reusable program. BOTTLED gives agents an entire unlabelled workload to complete under fixed time, compute and API budgets, choosing their own approach. The findings undercut the intuition that stronger models economise better: across ten models and three tasks, strong zero-shot performance does not reliably translate into strong bottling; models with similar zero-shot scores can differ substantially after bottling; 48 of 60 bottling runs score below the lower bound of their model's zero-shot 95% confidence interval; and 31 of 60 underperform the stronger of two small-model distillation baselines at the same token budget. Bottling nonetheless pays: on query–product relevance classification Opus 5 retains about 82% of its zero-shot macro-F1 at roughly 657 times lower reported cost, and reaches about 94% of the macro-F1 of Jev — a “system one” model built for cheap repetitive inference — at a quarter of Jev's projected full-workload cost. For batch-workload teams the reference is that handing an agent a budget and seeing whether it builds a tool instead of brute-forcing is a capability worth evaluating on its own; the limit is that results depend on BOTTLED's bespoke budgets and reported cost figures, leaving cross-task transfer and real pricing to be checked.

WorldSolver 用一个很聪明的方式测试 Agent 是否「懂物理」：让它写求解器^[44]。背景是物理仿真的工作马是求解器——它计算动态系统的状态如何演化，而写求解器需要物理理解（选对模型）、数学推理（写出动力学）与软件工程（实现成可执行代码）三种能力同时到位。基准由61 篇经典计算机图形学论文中的物理现象衍生出 168 个仿真任务，覆盖 7 个物理领域；每个任务给出固定的代码脚手架与仿真环境，只把求解器的实现留给 Agent。评测沿三个维度展开：能跑起来（Execution）、渲染出的动态是否忠实（Visual Fidelity）、以及动力学是否物理上说得通（Physical Plausibility）。结果对前沿 Agent 相当不客气：产出可执行求解器本身已经很难，同时满足视觉与物理正确更难；表现最好的 GPT-5.6-Sol 与 Claude-Opus-5 也只拿到 48.7% 与 46.7% 的总分。对做具身 AI、世界模型或仿真数据的团队，参考价值是「会写求解器」比「会预测下一帧」更接近物理理解，可以当作能力门槛来用；限制是任务来自图形学论文的经典场景、脚手架固定，开放式真实系统的表现与失败模式分布仍需另行考察。

WorldSolver tests whether agents understand physics by asking them to write the solver^[44]. The workhorse of physical simulation is the solver, which computes how a dynamic system's state evolves, and writing one needs physical understanding to pick the model, mathematical reasoning to formulate the dynamics, and software engineering to implement it as executable code — all three at once. The benchmark derives 168 simulation tasks from physical phenomena in 61 classic computer-graphics papers across 7 physical domains, giving each task a fixed code scaffold and simulation environment and leaving only the solver implementation to the agent, evaluated along three dimensions: execution, visual fidelity of the reproduced dynamics, and physical plausibility. The results are unkind to frontier agents: producing an executable solver is itself difficult, and satisfying visual and physical correctness is harder; the best performers, GPT-5.6-Sol and Claude-Opus-5, score only 48.7% and 46.7% overall. For embodied AI, world-model and simulation-data teams the reference is that writing a solver is closer to physical understanding than predicting the next frame and works as a capability threshold; the limit is that tasks come from classic graphics scenarios behind fixed scaffolds, so behaviour and failure distribution on open real systems still need separate study.

这是一份来自实践的案例研究：一个没有受过正规软件工程训练的操作者，用编码 Agent 建起并运营了一个生产级医疗健康平台^[42]。它要解决的问题是「人还能不能控制自己看不懂的系统」：Agent 既能帮非专家造出本来做不出的系统，也会产出多到连专家都无法切实审查的代码，因此穷尽式代码评审不能作为人类控制的唯一依据。做法上该平台逐步长成人类主导的元 Agent 系统：一个 Agent 写代码，其它 Agent 监督与评审，项目规则把教训沉淀下来。作者如实记录了大量失败：用于监督的测试、监控与评审 Agent 本身会出错；有些监控测的是代理指标而不是结果；有些审计静默失败；缺失的检查从报告里消失；一次自动修复还造成了生产事故。结论是：在这个案例里，人类控制之所以成立，靠的是让「预期结果、判定所用的证据、Agent 的权限、以及最终的人类决定」始终绑定在同一个目标上。对做 Agent 工程与治理的团队，参考价值是把「证据链与权限」当成核心基础设施，而不是相信测试与监控天然可靠；限制是这是单一个案的定性报告，没有对照组与量化指标，平台规模与领域也影响可推广性。

This is a practitioner case study: an operator without formal software-engineering training built and ran a production healthcare platform using coding agents^[42]. It addresses whether a person can still control a system they cannot fully read: agents let non-experts build systems they could not otherwise implement while producing more code than even experts can meaningfully inspect, so exhaustive code review cannot be the sole basis for human control. The platform grew into a human-led meta-agent system where one agent wrote code, other agents supervised and reviewed it, and project rules carried lessons forward. The authors record the failures honestly: the tests, monitors and reviewing agents used for supervision were themselves fallible; some monitors measured proxies rather than outcomes; some audits failed silently; missing checks disappeared from reported results; and one automated repair caused operational disruption. The conclusion is that in this case human control held because the intended outcome, the evidence used to judge it, the agents' permissions and the final human decision all stayed tied to the same underlying objective. For agent engineering and governance teams the reference is to treat the evidence chain and permissions as core infrastructure rather than trusting tests and monitors to be reliable by default; the limit is a single qualitative case without controls or quantitative metrics, and the platform's scale and domain affect generalisability.