代理工具

Agent、MCP、coding agent、工作流自動化與評測。

AI 安全

GitSpawn Exploits Repository-Local Git Configuration to Bypass Execution Approvals in Seven Coding Agents

Malicious projects can place commands in `.git/config` under `core.fsmonitor`, then wait for an agent to run `git status` or `git diff` in the background to execute them on the host. Some products have been patched, but the incident shows that tool approvals can still be bypassed by underlying programs if an agent’s sandbox does not cover startup and version-control processes.

GitHub Repo

Paddock Open-Sources Rust/CUDA Inference Engine Targeting Concurrent AI Agents on a Single NVIDIA GPU

Truespar has released Paddock’s scheduler, paged KV cache, memory management, and custom CUDA kernels, along with OpenAI- and Anthropic-compatible interfaces. The authors’ benchmarks show it outperforming vLLM and SGLang on some single-GPU workloads, but the results have not been independently reproduced, and Paddock does not support tensor parallelism, ROCm, or Metal.

代理工具

DRACO Assigns Reinforcement Learning Credit to Each Agent Step Using Dynamic Rubrics—Without Accessing Task Answers During Training

A team from IBM Research and Carnegie Mellon University enables a judge model to generate rubrics for each set of trajectories, then redistributes the overall reward to the relevant steps. The method improves performance on AppWorld by 15.9 percentage points, although its correctness still depends on model judgments that have not been manually validated.