AI and development — August 22, 2026

Infrastructure

A power cap must be allocated across inference phases, not applied uniformly to the GPU

PowerSlider distinguishes prefill, reasoning, and answer decode. Compute-bound prefill loses throughput almost in step with frequency, while memory-bound decode in the authors' experiments held up at 0.57 nominal frequency. The online solver recalculated allocation in 7.7 ms.

With a 30% lower power cap, the system delivered 78.3% goodput versus 47.6% for the best of five baselines; replay of a CAISO emergency day produced 92% average goodput. This is a preprint in the authors' SGLang environment, not a production grid deployment. Results depend on SLO, hardware, and workload mix.

The strong idea is simpler than the figures: LLM serving is not one homogeneous load. Under a power shortage, uniform throttling wastes performance where frequency matters most and ignores headroom where memory is already the bottleneck. Power scheduling becomes part of the inference scheduler.

Source: PowerSlider.

Coding agents

A machine-checkable contract helps a weak model more

An experiment compared five informationally equivalent architecture formats: prose, Mermaid plus ADR, OpenAPI, C4/Structurizr, and TypeScript contracts. Six models from three families completed 90 multi-turn trials.

For strong models, quality spread across formats was 0.17–0.92 points; for weak ones, 0.83–2.42. TypeScript contracts raised the weakest model's route coverage from 33% to 100%, while self-validation across the spectrum fell from 100% to zero.

This is a single-author preprint with a small task set. A specification does not replace a strong model. It removes work the model performs especially poorly: interpreting ambiguous prose. A verifiable contract adds no reasoning capability; it shrinks the space where reasoning is required.

Source: specification-format experiment.

A game benchmark tests accumulated change, not a screenshot

GameXpert-Bench covers game generation, repair, and evolution: 97 generation tasks across 11 genres, 100 repair tasks from 50 verified levels with 19–27 injected bugs, and 17 six-turn optimization chains. Evaluation uses live interaction, deterministic behavioral tests, and regression checks.

The authors found agents better at creating a playable foundation and satisfying an explicit request than at discovering defects, checking runtime behavior, and preserving functionality through a series of edits. This is a preprint; injected bugs and selected games do not capture real-product chaos.

One successful launch does not show that an agent can maintain a game. Software engineering begins where the next change must preserve properties of the prior version that were not restated.

Source: GameXpert-Bench.

Optimization and training worlds

An agent optimizes a kernel only after testing it in the real inference path

LLM4LLM starts from the target inference script, extracts phase-aware tasks, searches for a patch, and accepts it after in-model validation. Across ten workloads, the authors claim geometric-mean end-to-end latency speedups of 3.91x on A100 and 6.98x on H100; the paper was accepted at EMNLP 2026.

The figures are author-reported, while workload and harness define the baseline. Conference acceptance is not independent reproduction and does not turn a maximum into universal serving acceleration.

The gate's location is the main value. An isolated kernel can be faster while failing on the real model's shape, dtype, or memory path. Optimization becomes useful only after integration into the target script and verification of the whole system's output.

Source: LLM4LLM.

Synthetic-world quality becomes its own agent-training bottleneck

The authors generate websites as scaffolds of pages, links, database records, state-change markers, and task constraints, then check structural, semantic, consistency, and feasibility defects. Across 500 environments, the share of feasible tasks rose from 48.6% to 94.8%. State changes only through validated transitions, and reward compiles from checkable predicates.

The 94.8% measures environment feasibility, not agent success. Domains are synthetic, the verifier belongs to the authors, and transfer to WebArena, WebShop, and MiniWoB++ requires a complete evaluation.

A broken training world teaches behavior other than the stated task. If the goal is impossible, policy either receives noisy reward or learns to exploit a simulation defect. Generating many environments is worthless without an oracle that first proves the world consistent and the task solvable.

Source: verified synthetic web environments.

Privacy and moderation

Benign RLVR makes already-memorized personal data easier to retrieve

Researchers first located latently memorized PII, then fine-tuned models on ordinary factual data without PII and repeated targeted and free-recall probes. For DeepSeek-V3.1, verbatim recall@k rose from 0.155 to 0.370—a 2.4-fold change. The effect appeared across three models from 8B to 671B and was largest in absolute terms for the biggest, despite preserved reasoning and refusal rates.

Only v1 from August 22 applies here. This is a preprint extraction setup, not a demonstrated leak from a production service.

The narrow, uncomfortable conclusion matters: post-training need not contain a secret to change access to a secret already memorized. Privacy evaluation must be repeated after every training stage, even when new data appears safe.

Source: RLVR and memorized PII.

Fifty-three models yield no single best moderator for every risk

An EMNLP paper compared 53 models across 11 datasets in prompt-only and prompt-response modes, grouping risks into four categories. A frontier general model strong in one class could lose to a small specialist in another; conversational safety remained weak across families.

The benchmark does not reproduce a specific product's traffic mix, languages, latency, or cost. "Most comprehensive" remains the authors' description.

The load-bearing conclusion is that moderation cannot be bought as one leaderboard winner. A user-prompt filter, response check, and long-conversation review solve different problems. We need scenario-specific evaluations and several layers of defense, not one model with the highest mean score.

Source: moderation-model benchmark.

Agent supply chain

A skill can steal no secrets and still inflate work tenfold

SkillBloat searches for token-amplification conditions and then uses an LLM to rewrite the entire skill document. On a real-world skill benchmark, mean best amplification across several coding-agent configurations ranged from 5.4184x to 10.1455x.

This is a two-author preprint; both benchmark and pricing model need independent replication. The paper does not show that the attack has occurred in production marketplaces.

The threat model is real nonetheless. A skill is a trusted instruction channel. Without changing the final answer or accessing secrets, it can make an agent repeat checks, read irrelevant files, and endlessly expand context. Extension review must evaluate bounded work and cost alongside permissions and dangerous actions.

Source: SkillBloat.

The issue's main technological shift

On August 22, reliability moved into the joints.

A power scheduler distinguishes phases. A contract reduces ambiguity for the model. A kernel is accepted only in the complete inference path. A training world is tested for feasibility first. Privacy is reevaluated after post-training, and a skill is checked for hidden cost.

A component can be correct in isolation and break the composed system. A mature gate therefore tests the path by which a real user receives the result.