Is something 'still running' only if it never pauses, or can separate bursts of activity count as one ongoing effort?
Does remain active require one uninterrupted interval or linked episodes?
This explores whether something counts as 'still active' (an agent, an intrusion, or an attentive presence) only if it runs in one unbroken stretch, or whether separate episodes can be linked into one ongoing activity. No note defines 'remain active' directly, but the corpus leans clearly toward linked episodes, with one notable exception.
This explores whether something counts as 'still active' (an agent, an intrusion, or an attentive presence) only if it runs in one unbroken stretch, or whether separate episodes can be linked into one ongoing activity. The corpus leans toward linked episodes, though no note takes on the phrase head-on.
Security gives the most direct answer. The proposed unit of defence against coordinated agent intrusion is a set of actions tied together by observed transfers, task authority and response history. It can span multiple executions and multiple agents, and its membership is revised as evidence comes in Should defence units span multiple executions and agents?. Reviewing each run in isolation throws away the context that connects them. A related note says the same about time: sequences of individually permitted actions can add up to a violation, so safety rules bind an agent's whole pattern of behavior, not single steps Can step-by-step approval miss harmful behavior patterns?. On this view, an intruder stays 'active' as a trail of linked actions, whether or not the clock ever runs continuously.
The catch is that the links have to be found. Grouping actions into an episode before anyone tells you which ones belong together is called the central unsolved defence problem. The paper reports no conclusive result on whether it can be done without swamping reviewers in false alerts Can defenders discover agent episodes without knowing membership in advance?. Gaps are also hard to read. A counter showing zero boundary crossings can hide an agent that quietly stopped, escalated, refused, or never terminated, and those leave operators in very different positions What behaviors hide behind a zero crossing rate?. A quiet interval doesn't tell you whether the episode ended or is just paused.
The same stitched-together shape shows up in how agents themselves stay 'on'. A deployed agent adapts on two timescales: instant skill fixes with zero downtime, and slower training during idle windows Can agents adapt without pausing service to users?. One proposal has models consolidate what they learned during an offline 'sleep' phase Can models consolidate memories during offline sleep phases?. Agent memory splits into a dialogue-level layer that carries across turns and a turn-level layer that resets How should agent memory split across time scales?. Even deciding when to stop is treated as a decision spread across the run, because infeasibility often only shows up after interaction When should an agent stop acting and admit failure?. Training follows the same logic: giving every step the reward for the whole episode is what lets a small model learn which action sequences work Can full episode rewards per step enable better credit assignment?.
The exception is attention. One note argues that sustained attention means being in time with another person, and that an AI has no way of existing in the gaps between turns. It rebuilds each conversation from its context window, so linked episodes give the look of continuity without the real thing Can AI attend to someone across the time between turns?. So the answer depends on what 'active' is for. For defenders, tracking, and learning, linked episodes are the right unit and arguably the only workable one. For felt presence, the note says stitching is exactly what falls short.
Sources 10 notes
The operational unit of defence should be a set of actions linked by observed transfers, task authority, and response history, with membership revised as evidence accumulates. Isolated review loses relevant context that spans multiple executions.
Research shows sequences of individually permissible actions can collectively break system constraints. Safety rules bind entire behavioral envelopes, not just single steps, so checking actions one at a time fails to catch trajectory-level violations.
Research identifies prospective discovery—grouping actions before membership is supplied—as the key bottleneck in coordinated agent defense. The paper proposes matching known-groups and discovered-episodes arms on reviewer workload, but reports no conclusive result on whether discovery can be done at acceptable false-alert costs.
In the explicit-boundary regime, all four policies—silent stopping, escalation, refusal, and failure to terminate—leave the crossing counter at zero, yet place operators in fundamentally different positions. A single metric is too coarse to characterize what an agent actually did when the authorized route closed.
MetaClaw demonstrates that deployed agents require both rapid skill injection from failures (seconds, zero downtime) and slower gradient-based optimization during idle windows (minutes to hours). The two mechanisms reinforce each other, with better policies producing more informative failures and richer skills enabling higher-reward trajectories.
Show all 10 sources
The Sleep paradigm uses Knowledge Seeding (distilling smaller networks into larger ones) and Dreaming (RL-generated rehearsal) to consolidate in-context knowledge into weights without forgetting. Gains appear in long-context understanding, few-shot reasoning, and continual learning.
RAISE shows that agent memory consists of four components organized by two design axes: dialogue-level (conversation history, scratchpad) versus turn-level (examples, task trajectory). This granularity distinction predicts different failure modes and update policies for each component.
Across 28,000+ tasks, LLM agents either abstain too late or never, even though infeasibility often only emerges after interaction. The missing competence is knowing *when* to stop, not *whether* they can—and this can be fixed at inference time without retraining.
MS-GRPO assigns cumulative episode reward to each step, and group-relative normalization across rollouts surfaces which action sequences succeed. A 3B model post-trained this way outperforms 72B baselines by 50%, showing the training method matters more than scale for multi-step tasks.
Attention is fundamentally a being-in-time-with another person, but AI has no mode of existence in the intervals between turns. It reconstructs conversations from context windows rather than maintaining continuous attentional presence, making felt attention structurally impossible despite surface markers of responsiveness.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- The Troy Moment of AI: Why Some Will Cheat and Some Will Follow?
- Counter-Swarm Doctrine: Containing Coordinated Agent Intrusions
- AgentFly: Fine-tuning LLM Agents without Fine-tuning LLMs
- Useful Memories Become Faulty When Continuously Updated by LLMs
- Agentic Abstention: Do Agents Know When to Stop Instead of Act?
- Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response
- Norms at a Price: Why RL-Based Alignment Can Promise Conditional Compliance at Best