The Frontier Dispatch

Two papers bracket the period. In May, one put a name to something practitioners had felt but not measured: the tool-use tax — the finding that tool-augmented reasoning can underperform plain chain-of-thought, because the calling protocol itself exacts a price. In August, another measured real agentic workloads at a scale no benchmark approaches: one sampled month of GitHub Copilot traces spanning 3.2 million users, 13 million sessions, 761 million model calls, and 95 trillion tokens. Between those two poles sits the quarter's research agenda — tool governance, memory hygiene, deployment-shaped evaluation, mechanistic safety, and the unglamorous plumbing of grounded generation. Five themes follow.

Two May papers put tool calling itself under examination. "Are Tools All We Need?" (arXiv:2605.00136) shows that under semantic distractors, tool use can underperform native chain-of-thought — the calling protocol exacts a measurable tax. A Factorized Intervention Framework separates prompt-formatting cost, protocol overhead, and the genuine benefit of execution; a proposed G-STEP gate mitigates, but does not erase, the effect. "To Call or Not to Call" (2605.00737) formalises the decision as necessity, utility, and affordability — and finds persistent misalignment between a model's self-perceived need for tools and its normative need, especially under budget constraints. Lightweight latent-need estimators trained on hidden states beat the model's own self-reports.

The systems answer arrived in July: Mnemosyne (2607.00269) treats every LLM-generated action as an untrusted proposal until admitted by deterministic runtime constraints — append-only transition logs, effective-state projection, dependency-safe compensation, active commitment records — proving safety properties against a declared constraint set at under 6% overhead. And "Agentic Coding in the Wild" (2608.00101) grounds the whole theme empirically: June's sampled Copilot traces show sparse human turns triggering long autonomous loops of model calls and tool execution, KV-cache hit rates collapsing at turn boundaries, and idle-time prediction emerging as a serving lever. Agent workloads, it turns out, are not chat workloads.

The tool-governance reading list

• Are Tools All We Need? (2605.00136). The tool-use tax, measured: under semantic distractors, tool-augmented reasoning underperforms native CoT. Factorized Intervention Framework separates formatting cost, protocol overhead, and execution benefit; the G-STEP gate partially mitigates. Conclusion: govern tool use by reasoning quality and protocol design — don't enable it by default.
• To Call or Not to Call (2605.00737). Tool calling as a decision problem — necessity × utility × affordability. Models misjudge their own tool need, especially under budgets; latent-need estimators from hidden states outperform self-reports and improve budgeted allocation.
• Mnemosyne (2607.00269). Agentic Transaction Processing: generation stays probabilistic, commitment becomes deterministic and auditable. Rejects invalid proposals across falsification tests with under 6% overhead.
• Agentic Coding in the Wild (2608.00101). Production-scale Copilot traces — 3.2M users, 13M sessions, 761M LLM calls, 95T tokens — validating the case for agent-native serving infrastructure and proactive resource orchestration.

The memory line advanced on three fronts. "From Signals to Structure" (2607.00233) finds, in Lewis signalling games, that memory architecture matters more than channel capacity for emergent coordination — agents with persistent private notebooks stabilise conventions that otherwise collapse at high capacity, because the notebook externalises what has been learned. Shared Organizational Memory (2608.00122) extends the idea to enterprise coding agents: repository-, organisation-, and workflow-level knowledge persisting across sessions and agents rather than living in one conversation. And then the caution: "Memory Reward Inflation" (2608.00017) identifies the Echo Gap — incorrect episodes receive inflated self-assessed rewards, get retrieved more often, and reinforce the mistake. The proposed LUCID de-inflation algorithm lifts text-to-SQL performance above both self-graded and memoryless baselines.

SCoL and ExpWeaver — both filed in our first issue — remain the reference points for consolidating context into weights and invoking experience at high-uncertainty decision points. The new work supplies the failure mode they will need to survive: memory as an error amplifier whenever reward signals correlate with the agent's own biases. The research question has migrated accordingly — from what should the agent remember? to when should it consult memory, and who audits the grades?

The memory shelf

• From Signals to Structure (2607.00233). In Lewis signalling games, agents with persistent private notebooks coordinate more reliably and avoid collapse at high channel capacity, because the notebook externalises learned conventions. Memory architecture, not bandwidth, is the binding constraint on emergent coordination.
• Memory Reward Inflation (2608.00017). Names the Echo Gap — incorrect episodes earning inflated self-assessed rewards, then being retrieved more often — and formalises the Error-Independence Assumption required to correct it. The LUCID de-inflation algorithm beats self-graded and memoryless baselines on BIRD text-to-SQL.
• Shared Organizational Memory (2608.00122). Repository-, organisation-, and workflow-level knowledge persisting across sessions and agents — the argument that enterprise agent performance depends on conventions and historical decisions no single conversation contains.
• SCoL & ExpWeaver (Issue 01). The consolidation and experience-invocation baselines that this quarter's cautionary results now stress-test.

Static Q&A is giving way to evaluation that looks like operations. A hierarchical benchmark of 474 executable games (2606.00103) makes models actively query a hidden environment, integrate partial observations, update beliefs, and decide when they know enough — scoring interaction efficiency, contextual robustness, counterfactual revision, and necessity judgment, not just success rate. PHREEQC-MCQ-200 (2607.00436) wires agents to a deterministic aqueous-geochemistry simulator across 200 validated scenarios — and finds tool access lifts aggregate accuracy while causing regressions on items the model answered correctly unaided. Bazaar (2608.00102) drops agents into sealed-bid, multi-attribute auctions with hidden preferences, adaptive competitors, and demand shocks: the strongest agents capture less than a third of hindsight-optimal profit, and the rankings shift depending on whether you score acquisition, profit, or adaptation.

CoT-Core (2608.00014) attacks the cost of evaluation itself, selecting benchmark coresets by latent reasoning trajectory rather than surface wording. And the field acquired its reference shelf: "The Periodic Table of LLM Reasoning" (2606.11470), a survey of more than 300 papers that catalogues the standing failure modes — brittle multi-step inference, reasoning hallucinations, weak causal abstraction, poor cross-domain generalisation. When taxonomy becomes necessary, a field has grown up.

The deployment-shaped bench, itemised

• Interactive reasoning games (2606.00103). 474 executable games in a hierarchical benchmark; the model actively queries a hidden environment, integrates partial observations, updates beliefs, and decides when it knows enough — scored on interaction efficiency, contextual robustness, counterfactual revision, and necessity judgment, not success rate alone.
• PHREEQC-MCQ-200 (2607.00436). 200 validated aqueous-geochemistry scenarios spanning the whole computation chain: input construction, simulator execution, output inspection, answer commitment. Tool access lifts aggregate accuracy while regressing on items the model answered correctly unaided.
• Bazaar (2608.00102). Sealed-bid, multi-attribute auctions under hidden preferences, adaptive competitors, and demand shocks. The strongest agents capture under a third of hindsight-optimal profit — and the rankings shift depending on whether you score acquisition, profit, or adaptation to shocks.
• CoT-Core (2608.00014). Coreset selection by latent chain-of-thought trajectory: lexically different questions can share logical structure, so representative reasoning paths estimate full-benchmark performance at a fraction of the cost — regression testing for reasoning models.
• The Periodic Table of LLM Reasoning (2606.11470). More than 300 papers organised across chain-of-thought, multi-hop, mathematical, commonsense, visual, temporal, code, retrieval-augmented, tool-augmented, agentic, and RL-based reasoning.

The quarter's alignment work reads internal representations, not just behaviour. "Understanding Emergent Misalignment via Feature Superposition Geometry" (2605.00842) explains a troubling phenomenon mechanistically: fine-tuning that amplifies a target feature can strengthen geometrically nearby harmful features, because of superposition. Sparse-autoencoder analysis shows harmful-behaviour features sitting close to those induced by misalignment-triggering data — and a geometry-aware training-data filter cuts induced misalignment by 34.5%. HARC (2607.00572) treats harmfulness and refusal as separable residual-stream directions, shows that jailbreaks suppress one or the other before token generation, and couples the two across prompt and response positions — improving the robustness–capability–usability trade-off across model families without added over-refusal.

For domains where no verifiable reward exists, online natural-language feedback (2605.04356) offers a scalable-oversight loop: iteratively train proxy rewards, halt when over-optimisation appears, collect fresh expert supervision, update the proxy — with large reductions in the expert-sample bill reported for creative writing and alignment-research settings. The quarter's high-stakes evaluation work — ARMOR 2025's military-doctrinal benchmark among it — files under the Defence tab, where it belongs.

Retrieval-augmented systems got an operations toolkit. TIGER (2606.00232) repairs multimodal hallucination at the fact level: an observation graph extracted from the input, a claim graph from the output, graph-conditioned risk scores per claim, targeted repair of the risky ones — with the backbone model frozen throughout. SIRIN (2608.00033) unifies representation probing, uncertainty estimation, judge-style verification, and query answerability into one span-level inspection toolkit for retrieval-, memory-, and agent-grounded systems. And RAG-TESTER (2608.00054) treats RAG as software under test — generating documents, inputs, and expected outputs, executing at scale, judging with an LLM: 72,000 test executions, 21,633 failures detected, spanning inaccurate retrieval, unsupported answers, incomplete context use, and misread passages.

MindZero (2606.00240) rounds out the theme from the human side: theory-of-mind reasoning trained with zero mental-state annotations, rewarding generated hypotheses by how well they explain observed actions under a planner, then internalising the loop into fast single-pass inference — a promising direction for assistance agents that must infer user intent under uncertainty.

Taken together, the quarter reads as an implicit checklist for anyone deploying agents in earnest. Formal control layers for orchestration — admission, transaction logs, budgeted tool policies. Memory treated as an actively governed subsystem, with its grading audited. Evaluation shaped like deployment: games, simulators, markets, production traces. Safety interventions aimed at representations, not only outputs. Cost and infrastructure promoted to first-class research problems. None of it is glamorous. All of it is what turning capability into dependable systems actually requires.

If our first issue's research pages described a field "after scale," these describe the consequence: after scale comes operations — and operations, it turns out, generates better research questions than scale ever did.

If the early-2026 defence literature demonstrated that generative AI could assist military workflows, the May–August corpus asks a harder question: what survives contact with an adversary that learns? The answers are uncomfortable in places. A chain-of-thought monitor that catches ninety-five percent of malicious agent behaviour catches barely one in ten once the reasoning trace is rewritten to look benign. A deep-RL cyber defender that appears robust against scripted red teams degrades severely against a single adaptive 7-billion-parameter planner. Zero-shot vision-language models stumble on precisely the rare military scenes where they would be needed most. The corrective thread runs through every section that follows: domain-specific evaluation, deterministic authority outside the model, and graceful degradation as a design requirement. Twelve sections follow, then a ledger of what moved since our May file — and six R&D priorities distilled from the literature.

Ramirez and colleagues extend the public MSTAR synthetic-aperture-radar dataset with natural-language captions and visual question-answering pairs, then parameter-efficiently adapt a language-vision model for fine-grained SAR target interpretation — reporting roughly 98% accuracy on the specific fine-grained target-quality task they evaluate. The shift is architectural as much as numerical. Where traditional ATR emits a class label or probability, a multimodal model can explain its call, answer follow-up questions, compare a contact against exemplars, and support an analyst interactively — a reasoning layer above conventional detection networks, fusing image evidence with doctrine, platform databases, prior observations, and mission context.

DoD relevance. Near-term: SAR analyst assistance, automated exploitation at volume, anomaly triage, interactive target characterisation. The caveat travels with the number — MSTAR is controlled data, and performance should not be extrapolated to real-world clutter, camouflage, sensor variation, novel targets, or adversarial conditions without further testing.

The July benchmark RRS-10K assembles 10,738 military-related remote-sensing images across perception, reasoning, and robustness tasks, and evaluates 52 models — finding only moderate zero-shot performance, with pronounced weakness in visual grounding, referring segmentation, and complex semantic reasoning. The result counters a comfortable assumption: that ever-more-capable general-purpose multimodal models will automatically become adequate military ISR systems. Long-tail military scenes are exactly where rare-object recognition, context, and grounding matter most — and exactly where the benchmark finds current models weakest.

DoD relevance. Develop service- and mission-specific multimodal evaluation sets — rare targets, sensor phenomenologies, seasonal and geographic variation, decoys, camouflage, damage states, degraded imagery. The likely winning architecture is not a single general VLM but specialised perception networks, retrieval from authoritative intelligence stores, and a multimodal reasoning layer above them.

Bayer and colleagues generate structured, printable patterns via Voronoi diagrams that resemble plausible splinter camouflage — and significantly degrade person detectors, transferring across multiple YOLO families and out-of-domain backgrounds. Unlike conspicuous pixel-level adversarial patches, the pattern is designed to pass as ordinary concealment. Physical validation remains future work, but the direction is clear: battlefield camouflage may increasingly be designed to exploit learned feature representations in deployed vision systems, not merely to deceive human observers or specific sensor bands.

DoD relevance. Computer-vision T&E should include adversarially optimised physical patterns, not only digital perturbations. Training pipelines should emphasise ensemble diversity, multi-sensor fusion, temporal tracking, and uncertainty estimation — so that one detector's failure does not become a system-level failure.

The August paper "A False Average" lands the quarter's most pointed assurance result. Rewriting an agent's chain-of-thought to look benign — while leaving the malicious actions untouched — drops a held-out monitor's detection rate on the relevant subset from roughly 95% to below 11%. Trace-only defences recover only part of the loss. The popular assurance strategy of reading the model's reasoning as a trusted signal fails precisely where it is the only defence.

DoD relevance. Treat reasoning traces as a useful but untrusted signal. High-consequence systems require independently observable evidence: tool calls, network flows, file changes, actuator commands, external state transitions, cryptographically signed logs, deterministic policy checks.

S³ argues that hazards arise separately in memory, planning, and tool execution — then propagate through the workflow. Its guard-agent architecture orchestrates stage-specific defences against a Multi-Stage Risk Benchmark: sanitise retrieved memory, validate plans, constrain tools, require confirmation for high-impact actions, inspect post-action state. It maps cleanly onto defence-in-depth — and onto the authorisation-propagation problem Tallam formalised in May (filed in our first issue), which the period's security literature now treats as the reference framing: identity governance as infrastructure, with transitive delegation, aggregation inference, and temporal validity as the failure axes that classical RBAC and ABAC never addressed.

DoD relevance. Suitable for mission-planning assistants, cyber agents, logistics automation, and C2 copilots — with learned guards paired with, or replaced by, deterministic policy engines tied to mission authorities and classification rules. Every invocation carries scoped, auditable authorisation; permissions are task- and time-bounded; delegation never expands privilege; authorisation is re-evaluated at boundaries rather than assumed from the initial session.

Schwarzer and colleagues frame model extraction explicitly as a threat to AI deployed in military C2 and critical infrastructure. Defences built on a single-client assumption are bypassed when queries are distributed across coordinated identities — and adaptive traffic mixing undermines even global aggregation approaches. The underlying point: a mission model is itself a sensitive asset. Its behaviour can reveal doctrine, training-data characteristics, decision boundaries, and exploitable weaknesses.

DoD relevance. API protection needs identity-independent, stateful detection across accounts, networks, and time — plus query budgeting, output minimisation, watermarking or fingerprinting where appropriate, and continuous anomaly detection.

AI attacker agents configured as several known APT profiles were run against AI defenders across experimental cyber ranges. Enterprise networks fell repeatedly while the military range was defended or reached stalemate — and the attackers independently converged on using a defender's own tool as a command-and-control mechanism. The conceptual finding outweighs the scores: agentic systems synthesise tactics on demand rather than faithfully reproducing a threat group's historical fingerprint. If sophisticated behaviour becomes cheap to generate, attribution based largely on TTP similarity becomes less reliable.

DoD relevance. Weight infrastructure, provenance, malware lineage, cryptographic artefacts, operational timing, intelligence reporting, and campaign-level evidence over assumed TTP identity. Defensive exercises should include AI-generated adversaries that deliberately vary their TTPs.

The quarter's most operationally significant cyber result. Trident builds an agentic LLM red-team framework around CybORG CAGE 4 and CyberWheel, releases more than 13,000 red–blue interaction trajectories, and trains a Log Summarizer–Planner–Coder architecture with reinforcement learning and verifiable rewards. Against existing deep-RL cyber defenders, a single trainable 7B planner reduced defensive performance by an average of 522% relative to static red-agent baselines — discovering decoy avoidance and adaptive state prioritisation along the way. The precise percentage is benchmark-specific; the conclusion is robust. A defender evaluated only against scripted or heuristic attackers can appear far stronger than it is against an adaptive learning adversary.

DoD relevance. Autonomous cyber-defence programmes should adopt competitive evaluation in which red agents learn and adapt during the test campaign. T&E should measure degradation under distribution shift, adaptive strategy, deception, tool misuse, and long-horizon attacks — and report worst-case degradation and recovery, not merely average reward against fixed scripts.

The blue-team counterweight. CyberLLM, a multi-agent framework for automotive cybersecurity, layers LLM refinement over deterministic analysis, then gates every proposed action through formal runtime checks and an independent action-alignment oracle. On the authors' benchmark, the deterministic layer alone covers 34% of labelled vulnerabilities at perfect precision; adding grounded LLM passes lifts coverage to roughly 70%, with a reported F1 of 0.83 — and no false positives on clean controls.

DoD relevance. Transferable in principle to software-defined military vehicles, avionics support environments, tactical edge systems, and SOC automation. The design principle is the section title: the LLM proposes and reasons; deterministic controls decide whether an action is permitted to execute.

Silveria and colleagues demonstrate decentralised UAV swarm defence — detect, surround, and intercept hostile UAVs — using onboard sensing, relative measurements, Kalman filtering, and decentralised encirclement, with no GPS and no inter-UAV communications, validated on real robots. Most swarm approaches quietly assume both positioning and connectivity; under jamming and electronic warfare, neither is guaranteed. Relevant to counter-UAS, point defence, and convoy or base protection under PNT degradation.

DoD relevance. The architectural principle generalises: swarm behaviours should degrade gracefully when communications or GPS are denied rather than requiring continuous centralised coordination. And the command implication cuts both ways — local autonomy is most valuable precisely when centralised human intervention is least available. Mission intent, engagement constraints, geofences, resource limits, abort conditions, and safe-state behaviours must be encoded before deployment and enforceable locally.

Two LEO papers, one systems lesson. BRIDGE (Zheng et al.) couples a digital twin of user-satellite visibility with reinforcement learning for joint beam scheduling and power allocation — handling discrete beam selection and continuous power together — and, unusually, evaluates robustness under FGSM, iterative-FGSM, and PGD adversarial perturbations, treating the AI scheduler itself as a potential attack surface in contested space operations. Demirci et al. (accepted to MILCOM 2026) embed demand forecasting in a full-stack DVB-S2X simulation: forecast-based planning cuts delay by roughly 10–40% under some load conditions — yet a 14–16% difference in forecasting NMSE yields less than 1% delay improvement and nearly identical jitter. Better model error does not equal better mission.

DoD relevance. Write AI requirements in mission measures — latency, availability, mission completion, resource efficiency, false-alarm burden, operator workload — and require an explicit trace from model-level metrics to operational effect. Once the model is good enough, compute, scalability, robustness, and response time dominate. The same discipline applies to SATCOM, networking, predictive maintenance, ISR, and logistics alike.

Our first issue filed Payne's finding that frontier models, placed in simulated nuclear crises, escalated. The follow-on literature tested the obvious fix — and it failed. Chen and colleagues replay 130 high-tension self-play episodes across 13 models under explicit ethical prompting about nuclear harm, removal of prior reasoning, and high-stakes framing: none of the interventions reliably eliminates emergent escalation. Ethical reasoning is sometimes absent, sometimes appears only when prompted, and sometimes is present but loses to strategic countervailing considerations. WOPR (Matlin et al.) answers with infrastructure rather than prompting: a deterministic, replay-validated rules engine that exposes strategic decision points, supports private-channel negotiation, and models each faction as a collective command-and-control system rather than a single model — auditable, comparable, reproducible.

DoD relevance. Treat model recommendations as advisory evidence, never command authority. Use-of-force constraints and escalation controls must exist as explicit external policy and authorisation mechanisms. And move wargaming T&E from anecdotal chat demonstrations to replayable, logged environments in which agent state, decisions, communications, tool usage, and outcomes are comparable across model versions and vendors.

Set against the file we published in May, the centre of gravity has visibly moved. Six shifts — and what each demands:

1. Build an agentic-AI security reference architecture.

   Define identity for non-human agents; task-scoped credentials; transitive-delegation rules; memory provenance; tool-level least privilege; policy decision and enforcement points; action signing; revocation; immutable audit. Assume model output, model reasoning, retrieved content, and peer-agent messages are all potentially untrusted.

2. Make red teams adaptive in cyber T&E.

   Graduate from static red agents to Trident-style learning adversaries. Evaluate attacker learning, defence fingerprinting, deception, exploitation of defensive tooling, long-horizon persistence, and coordinated identities. Report worst-case degradation and recovery, not only average reward.

3. Create DoD-controlled multimodal ISR test sets.

   Span EO/IR, SAR, hyperspectral, FMV, maps, and text. Include rare objects, clutter, occlusion, camouflage, adversarial patterns, novel equipment, and uncertainty calibration. Domain-adapted open-weight models may be particularly valuable in classified environments.

4. Tie AI metrics to mission measures of effectiveness.

   Require an explicit trace from model-level measures to mission outcomes. A ten-percent gain in prediction accuracy with no effect on latency, survivability, workload, or mission success should not drive procurement decisions.

5. Engineer autonomy for denial by default.

   Treat PNT and communications loss as baseline design conditions. Local controllers carry pre-authorised mission envelopes, conservative safe states, deterministic engagement limits, and bounded resource authority. Centralised AI enhances performance when connectivity exists — it is never a single point of mission failure.

6. Make wargaming and decision-support testbeds reproducible.

   Prefer WOPR-style deterministic simulation to unstructured prompt demonstrations. Build replayable environments that log agent state, decisions, communications, tool usage, and outcomes — comparable across model versions and vendors.