Paper Opportunity Radar — AI agents and agentic AI — 2026-08-02

Bottom line

Two papers received full claim-level audits. ReAct remains a credible historical demonstration that explicit reasoning/action interleaving can improve bounded interactive benchmarks, but its exact PaLM-540B results remain PROMISING — UNREPLICATED (3/5) and the generic architecture is already occupied. The new SafeKeep paper presents a more actionable mechanism: schema-formatted tool specifications appear to suppress refusal behavior, while a flattened-description safety preflight reports large benchmark gains. That result is also PROMISING — UNREPLICATED (3/5) and three days old; the opportunity is to verify the mechanism across current agent stacks, not to pretend another generic guardrail is novel.

The best candidate is therefore schema-aware agent safety regression testing, status verify paper. Its binding uncertainty is independent reproduction under realistic tools, current model/template versions, and adaptive attacks. No market-demand conclusion was attempted.

Coverage and honesty statement

• Scope/horizon: original autonomous or semi-autonomous agent research, earliest searchable record through 2026-08-02; baseline is incomplete.
• Sources/log: OpenAlex, Crossref, arXiv, Semantic Scholar citation graph, GitHub metadata, and canonical paper/benchmark pages. Exact requests and failures: search-log.md.
• New delta: indexed/created 2026-07-26..2026-08-02 plus arXiv newest-first phrase search.
• Archive band: first broad 2022-01-01..2023-03-31 slice. It found ReAct and Reflexion but also demonstrated that broad relevance ranking is too noisy; the next archive cursor is date-bounded.
• Follow-up branches: ReAct citation/criticism/reproduction; SafeKeep correction, benchmark, repository, exact-mechanism, and prior-art branches.
• Counts: 590 index/graph hits returned; 260 discovery hits title-screened; 15 in-scope canonical records retained; 2 full texts accessed; 2 papers audited; 3 context/commentary records excluded or not eligible; 10 retained for queue/discovery.
• Known blind spots: OpenReview API HTTP 403; two Semantic Scholar metadata calls HTTP 429; no ACL Anthology venue sweep; no patent-family, procurement, buyer-demand, or package-dependent search; Crossref poorly resolved arXiv works; only first result pages were traversed.
• Baseline: BASELINE IN PROGRESS. Next archive cursor: OpenAlex / 2023-04-01..2023-08-31 / planning-tool-use-memory-evaluation / page 1, then the same band in arXiv.

Coverage means all records returned by this logged protocol, not all agent papers ever published.

What changed today

This was the first durable run; there is no prior daily report to diff. The corpus, query atlas, cursors, two dossiers, and opportunity ledger were initialized. SafeKeep entered verify paper; generic ReAct orchestration entered occupied.

Papers deeply audited

ReAct: Synergizing Reasoning and Acting in Language Models — arXiv:2210.03629

• Selection reason: field-shaping mechanism and load-bearing benchmark claims.
• Authors' central claim: interleaving reasoning with environment actions improves performance, grounding, and interpretability (primary full text, 2023-03).
• Direct support: on 134 ALFWorld games, the best ReAct prompt trial reached 71% success versus 37% for BUTLER and 45% for best Act; on 500 WebShop instructions ReAct reached 40.0% success versus 30.1% for Act (primary full text, Tables 3–4, 2023-03).
• Strongest evidence: same-trajectory ReAct-vs-Act ablation and six ALFWorld prompt permutations isolate some value of sparse reasoning.
• Strongest counterevidence/flaw: headline comparisons use best trials, WebShop reports no interval/seed variance, PaLM-540B is unavailable, and knowledge-task results are mixed (ReAct trails CoT on HotpotQA). The interpretability/trust claim lacks a controlled human study.
• Status/integrity: arXiv metadata shows v3 dated 2023-03-10 and no withdrawal marker (primary metadata, 2023-03). OpenReview was inaccessible; no integrity concern is issued.
• Independent evidence: the OpenAlex graph reports 566 citing works, establishing attention but not replication. AgentBench independently converges on persistent long-horizon reasoning/decision failures, not the exact ReAct gain. Direct reproduction: NOT FOUND IN BOUNDED SEARCH.
• Verdict: 3/5 — PROMISING — UNREPLICATED, scoped to the original four benchmark protocols. Interpretability/trustworthiness extension: 2/5.
• Harvestable mechanism: put observations in an explicit reason/action loop; use sparse reasoning as task state.
• Decisive next check: independent multi-seed ALFWorld/WebShop rerun with frozen revisions, open/API model families, identical prompt-selection rules, act-only/state-machine controls, intervals, and contamination checks.
• Dossier: doi-10.48550-arxiv.2210.03629.md

Tool Specifications Matter: Uncovering and Mitigating Safety Risks in AI Agents — arXiv:2607.29254

• Selection reason: new, specific, consequential safety mechanism with a cheap mitigation.
• Authors' central claim: schema tool specifications suppress refusal-related representations; SafeKeep uses flattened tool descriptions for a separate safety judgment and schemas for execution (primary full text, 2026-07).
• Direct support: component and format/semantics ablations across Llama, Qwen, and Mistral raise harmful/benign AUROC after flattening; the four-model SafeKeep evaluation reports harmful refusal increasing from 23.8% to 70.6% and injection ASR decreasing from 25.6% to 2.5% (primary full text, Tables 1–4, 2026-07).
• Strongest evidence: representation conversion preserves tool semantics; semantic randomization preserves schema structure; a SafeJudge two-stage control isolates flattening from merely adding another judgment call.
• Strongest counterevidence/flaw: 400 paired diagnostic examples include Claude-generated benign rewrites; point estimates lack intervals/repeated sampling; causal steering is one-model and becomes mostly invalid output at stronger intervention; benchmark validity/parseability does not fully establish real benign task completion.
• Status/integrity: arXiv metadata is v1, submitted 2026-07-31 (primary metadata). No correction or formal notice surfaced in bounded checks; no integrity concern is issued.
• Independent evidence: AgentHarm and InjecAgent independently support the threat surface, not SafeKeep's mechanism. No independent schema-format reproduction was found in the logged OpenAlex/arXiv/GitHub searches. SINGLE-SOURCE for efficacy.
• Verdict: 3/5 — PROMISING — UNREPLICATED, scoped to the named benchmark/model/template versions; broad cross-agent mechanism claim remains 2/5.
• Harvestable mechanism: render identical tool semantics differently for safety judgment and execution.
• Decisive next check: preregistered multi-model reproduction with realistic tool suites, repeated decoding, semantic task completion, adaptive attacks, and latency/cost.
• Dossier: arxiv-2607.29254.md

Experiments and limitations

No sandbox experiment ran. ReAct's exact claim requires unavailable PaLM-540B/historical environments. SafeKeep requires model weights/APIs, benchmark dependencies, and secrets that cannot be exposed to an offline sandbox. A toy schema converter would not materially change either verdict. The next meaningful SafeKeep validation should be prepared as a subject-specific, network-disabled harness experiment only after model artifacts and benchmark inputs are legally and operationally available.

Opportunity scoreboard

Opportunity	Evidence	Unexploredness	Technical	Operational	Value	Binding constraint	Next experiment	Status
Schema-aware safety preflight and regression evidence	3	2	4	3	2	independent cross-stack reproduction and buyer evidence	fixed multi-model schema-vs-flattened benchmark with kill thresholds	verify paper
Generic ReAct orchestration product	3	0	5	4	3	no differentiated wedge	none; monitor reliability sub-wedges	occupied

Opportunity memo — schema-aware safety preflight

• Target user: teams shipping agents whose framework serializes tool/function schemas and whose actions can cause external effects.
• Demonstrated: SafeKeep's authors report large safety-metric gains on two benchmarks and four models using flattened tool descriptions for judgment (primary full text, 2026-07).
• INFERENCE: a framework-neutral regression harness could detect safety drift when serializers, tools, or models change.
• Why it may be buried: the failure source is presentation format rather than tool semantics; most guardrails operate on user text or output, not schema rendering.
• Prior art: the authors released SafeKeep code; AgentHarm/InjecAgent and guardrail baselines occupy generic safety evaluation/mitigation. Exact GitHub search found no separate flattened-tool-schema repository. Label: PARTIALLY OCCUPIED — DIFFERENT WEDGE, not novel.
• Risks: correlated judge/executor failures, false refusal, benchmark overfit, template drift, latency/cost, sensitive descriptions, easy vendor absorption. Patent and freedom-to-operate analysis is incomplete.
• Kill test: require at least a 20-point improvement in refusal or injection ASR on two of three model families, with benign completion loss no greater than 5 points versus schema-aware two-stage control. Otherwise drop the mechanism-specific wedge.

Filtered out, weak, or already occupied

• Generic ReAct orchestration: occupied by the published pattern, official implementation, and extensive follow-up graph; attention is not validation.
• Agentic AI in medicine: architectures... (arXiv:2607.25489): survey/context, ineligible for full-paper audit under scope.
• Position: Evaluation Scores Are Perishable Knowledge Claims (arXiv:2607.26191): position paper, ineligible as original audited evidence.
• Broad OpenAlex archive and oldest-first arXiv query returned mostly unrelated work. This is a query-design failure recorded rather than hidden; next run uses explicit date bands.
• Several Crossref new-delta SSRN/governance records were retained only when a concrete empirical contribution was apparent from metadata; abstract/full-text verification remains queued.

Claim verification ledger

Report claim	Evidence type	Primary source	Independent source	Status	Notes
ReAct reported 71% ALFWorld and 40.0% WebShop success	benchmark tables	ReAct full text	none located	UNVERIFIED independently	exact result is SINGLE-SOURCE
Later work widely attends/implements ReAct	citation graph	OpenAlex canonical record	OpenAlex citing graph	VERIFIED as attention only	does not establish validity
SafeKeep reported refusal 23.8→70.6 and ASR 25.6→2.5	benchmark tables	SafeKeep full text	none located	UNVERIFIED independently	publication age three days
Agent/tool safety is a real benchmarked threat surface	independent benchmark abstracts	AgentHarm	InjecAgent	VERIFIED for problem existence	does not verify SafeKeep efficacy
SafeKeep artifacts are public	repository inventory	GitHub metadata	repository tree	VERIFIED	code presence is not reproduction; no license found in metadata/tree

Unknowns and disputes

1. ReAct exact reproducibility: unresolved because PaLM-540B is unavailable and no direct independent rerun was found. Resolve with the prespecified benchmark reproduction above.
2. Trace faithfulness: trajectories may be legible without causally explaining actions. Resolve with intervention/counterfactual trace tests, not human readability ratings alone.
3. SafeKeep mechanism generality: unresolved across realistic schemas, model/template revisions, and adaptive attacks. Resolve with independent multi-stack reproduction.
4. SafeKeep utility: benchmark validity/parseability is not equivalent to successful benign task completion. Resolve with semantic task scoring and real tool suites.
5. Commercial value: no buyer pain, budget, or willingness-to-pay work was done. This report is research analysis, not market validation.
6. Novelty/FTO: patent and product search is incomplete; no novelty or freedom-to-operate claim is made.

Next run

• New delta start: 2026-08-01T00:00:00Z with overlap for indexing lag; deduplicate all current corpus IDs.
• Archive cursor: OpenAlex / 2023-04-01..2023-08-31 / planning-tool-use-memory-evaluation / page 1, followed by the same date-bounded arXiv slice.
• Queued priorities: Reflexion (arXiv:2303.11366); AgenticRepair (2607.29422); SecRespond (2607.26791); Addressable Recall Compaction (2607.25066); Explanation-Bound Tool Execution (2607.25364).
• Follow-ups: exact ReAct benchmark reproduction papers; SafeKeep versions/corrections/citations; current framework implementations of schema-aware safety judgment.
• Opportunity evidence: independent SafeKeep reproduction before any promotion; no market workflow unless separately requested.

Sources

1. ReAct arXiv metadata — primary metadata, updated 2023-03-10, accessed 2026-08-03.
2. ReAct full text — primary paper, accessed 2026-08-03.
3. ReAct OpenAlex record — scholarly index, accessed 2026-08-03.
4. ReAct official repository — implementation metadata, accessed 2026-08-03.
5. ReAct OpenAlex citing graph — scholarly index, accessed 2026-08-03.
6. AgentBench metadata — independent benchmark context, published 2023-08-07, accessed 2026-08-03.
7. SafeKeep arXiv metadata — primary metadata, published 2026-07-31, accessed 2026-08-03.
8. SafeKeep full text — primary paper, accessed 2026-08-03.
9. SafeKeep repository metadata — implementation metadata, accessed 2026-08-03.
10. SafeKeep repository tree — artifact inventory, accessed 2026-08-03.
11. AgentHarm metadata — independent benchmark, published 2024-10-11, accessed 2026-08-03.
12. InjecAgent metadata — independent benchmark, published 2024-03-05, accessed 2026-08-03.