LLM Agent

现代LLM-based Agent的核心突破发生在2023年前后，随着GPT-4、Claude等大模型具备了稳定的指令跟随和工具调用能力

A typical Agent execution loop includes perception, reasoning, action, and observation, forming the ReAct (Reasoning + Acting) pattern

An LLM Agent is a stateless text predictor with tools attached; its input is what is within the context window, its output is the statistically most likely token sequence, and it retains no internal memory or goals between two calls.

An LLM Agent's decision path is generated by a probabilistic model and is essentially a non-reproducible black box; the same input may produce different sequences of tool calls, so post-hoc tracing becomes the only effective diagnostic means.

When an Agent is designed to run autonomously over the long term, absence of feedback is the norm rather than the exception; how to keep it from collapsing in silence, falling into meaningless loops, or producing harmful behavior is a question engineering must answer.

The 'silence period test' should be treated the same as safety testing: clarifying the boundaries of an Agent's behavior when no one responds before deployment is a necessary step to avoid unexpected outputs during long-term operation.

In reinforcement learning and control theory, a feedback loop refers to the process by which a system's output is observed and then re-influences its input; for LLM Agents, human replies are the main external reward signal.

When an Agent is designed to run autonomously over the long term, engineers usually preset a "no-feedback degradation strategy", such as reducing action frequency, switching to exploration mode, or converging to conservative behavior after multiple non-responses.

The capabilities of LLM Agents depend heavily on the interaction interface used during training, and semantically equivalent but differently expressed interfaces (such as changing an action name from search to lookup, or changing parameters from JSON to YAML) can cause a marked decline in their performance.

Existing interface randomization strategies can only extend the Agent's dependence on the interface from a 'single interface' to the 'training interface distribution', and out-of-distribution perturbations still lead to degradation in Agent performance.

The quality of the orchestrator often determines the reliability of an Agent in production more than the underlying model does.

A single monolithic prompt requiring an Agent to complete multiple interdependent tasks usually leads to inconsistent output, missed steps, or even fabrication.

Structured task decomposition significantly improves the reliability, accuracy, and debuggability of LLM Agents by breaking complex goals into smaller, discrete, and verifiable steps.

According to STALE (arXiv:2605.06527) research, the team built 400 expert-validated conflict scenarios to test whether LLM Agents can recognize the failure of their own memory, and the strongest frontier model achieved only 55.2% overall accuracy.

Most LLM Agent implementations put permission checks inside the tool handler, at which point the tool has already been selected and the parameters have already been constructed from the model's output, so the check is too late.

In LLM Agent scenarios, TOCTOU manifests as: the permission check happens inside the tool handler (the point of use), while the decision driving that use was already made when the context was contaminated.

When Agents move from controlled API environments to open computing environments, the focus of security strategy needs to shift from training models not to say the wrong thing to drawing trust boundaries in the system architecture.

The security of current LLM Agents mainly relies on two lines of defense, alignment training and safety classifiers, but neither of these can rule out the possibility that a carefully constructed indirect prompt injection bypasses all checks.

The essence of a prompt is a one-off, stateless session brief, and every time a new session is opened the rules need to be re-argued and re-pasted; this is a structural problem rather than a writing-technique problem.

LLM Agent behavior is gradually generated by the model at runtime based on context, the risk of the same permission differs drastically across different contexts, and the combinatorial behavior space far exceeds any static enumeration capability.