LLM Agents: A Survey

1. Introduction

Large language models (LLMs) have progressed from single-turn text predictors into the reasoning core of autonomous agents1: systems that plan, invoke external tools, accumulate memory across steps, and coordinate with other agents to pursue goals over long horizons. Three base-model capabilities made this shift possible. Multi-step reasoning turned out to be elicitable by prompting alone (Wei et al. 2022), and even without exemplars (Kojima et al. 2022), so a model could be asked to deliberate before committing to an action. Instruction tuning made that deliberation steerable by ordinary task descriptions. And models proved able to operate interfaces they were never trained on, learning when and how to call external APIs from a handful of demonstrations (Schick et al. 2023). ReAct (Yao et al. 2022b) composed these capabilities into the loop that still defines the field: the model interleaves reasoning traces with actions and folds the resulting observations back into its next thought.

That loop escaped the laboratory almost immediately. Within months, AutoGPT-style systems chained it into open-ended autonomy (Yang et al. 2023b), and Generative Agents showed that populations of such loops, given memory and reflection, produce believable social behavior (Park et al. 2023a). Three years later, descendants of the same recipe resolve real GitHub issues, operate browsers and desktop interfaces on a user’s behalf, and design and run scientific experiments (Section 8, Section 10). Figure 2 traces this trajectory.

The literature that documents this progress has grown faster than its organization. Research on LLM-based agents is split across subcommunities, planning and reasoning, memory, tool learning, multi-agent systems, web and GUI automation, embodied control, agent safety, each with its own benchmarks, vocabulary, and citation graph, and with limited contact between them. The foundational general surveys unified the field as it stood in 2023 (Wang et al. 2023b; Xi et al. 2023), but predate three developments that have since reshaped it: reasoning-native models trained to deliberate, computer-use agents that act through raw screen interfaces, and the systematic study of agent security. More recent general surveys organize the field by methodology or framework lineage (Luo et al. 2025; Masterman et al. 2024; Plaat et al. 2025), by a brain-inspired decomposition into cognitive modules (Liu et al. 2025), or trace a single thread such as the road from chain-of-thought prompting to language agents (Zhang et al. 2023c). Across all of them, evaluation methodology and safety appear as closing discussions rather than as objects of analysis in their own right.

The scale of the problem is easy to understate. Figure 1 plots monthly arXiv submissions across five agent subtopics: of the roughly nine thousand papers our keyword harvest assigns to the field, fewer than one in three hundred predate 2023, yet the field now adds on the order of a thousand papers per month and its cumulative volume roughly tripled in the year to mid-2026. That growth is spread across planning, multi-agent, tool-use, computer-use, and safety subcommunities that expand in parallel and largely in isolation, exactly the fragmentation a function-first organization is meant to make navigable.

This survey organizes the field by architectural function instead. Frameworks bundle components and are superseded; the functions those components serve persist. We therefore structure the literature along three axes (Figure 4, developed in Section 3): four component pillars that describe what an agent is made of, planning (Section 4), memory (Section 5), tool use (Section 6), and multi-agent coordination (Section 7); two context dimensions that describe where it acts and where it is deployed, interactive environments (Section 8) and application domains (Section 10); and two cross-cutting concerns that apply to every cell of that matrix, evaluation (Section 9) and safety (Section 11). The function-first organization is what makes the fragmented subcommunities commensurable: a memory paper and a web-agent paper rarely cite each other, but both take a position on the same small set of design questions, and the taxonomy makes those positions comparable. Read through that lens, the field tells a single story: its components are consolidating as prompting gives way to trained reasoning and scaffolds migrate into the models; its frontier has moved to grounding agents in real environments and evaluating them honestly; and safety is the binding constraint on both. This is the thesis the rest of the survey defends.

Our contributions are as follows:

• A function-first taxonomy of LLM-based agents (four component pillars, two context dimensions, two cross-cutting concerns) that assigns every surveyed work a position independent of the framework that introduced it (Figure 4).
• Current coverage. We synthesize the literature from the first trained browsing agents (2021) through early 2026, including the post-2023 developments absent from the foundational surveys: reasoning-native models, computer-use agents, AI-scientist systems, and agent security.
• Evaluation as a first-class pillar. Beyond cataloguing benchmarks, Section 9 analyzes the validity of current evaluation practice, including cost-blind leaderboards, contamination, and outcome-versus-process metrics.
• Safety and security as a first-class pillar. Section 11 develops a unified agentic threat model spanning prompt injection, memory poisoning, and backdoors, through alignment-level risks and autonomy governance.
• Original controlled experiments. Rather than argue the survey’s two central trade-offs only from the literature, we measure them: a compute-matched comparison of agent control loops on ALFWorld (Section 4.3) and a capability-versus-injection-robustness measurement across model scale and family (Section 11.3).

Throughout, where the literature contains credible negative results, on self-correction (Section 4.4), on multi-agent debate (Section 7.2), and on agent scaffolds versus simple pipelines (Section 10.1), we present them with the same weight as the positive claims.

A note on method. The corpus behind this survey was assembled through ten subtopic sweeps (foundational surveys and position papers; single-agent architectures; planning and reasoning; memory; tool use; multi-agent systems; embodied, web, and GUI agents; benchmarks and evaluation methodology; safety and alignment; applied agents), yielding a core of 184 references, each verified against its primary source; further works were added under the same verification rule, for 228 references in total. We include a system if it places an LLM in an action–perception loop, the model’s outputs are executed against an environment, a tool interface, or another agent, and the results are fed back, and we exclude chat-only uses of LLMs, base-model training techniques except where they target agentic behavior, and vision–language–action robotics beyond what Section 8.3 requires.

Figure 2. A timeline of representative milestones in LLM-based agents, from the first trained browsing agent (2021) to the reasoning-native, computer-use, and AI-scientist systems of 2025; the rightmost tick marks the present frontier of agent safety and governance (Section 11, Section 12) rather than a single dated system. Each system is introduced and cited in the section indicated by the taxonomy of Figure 4; labels alternate above and below the spine only for legibility.

Figure 2. A timeline of representative milestones in LLM-based agents, from the first trained browsing agent (2021) to the reasoning-native, computer-use, and AI-scientist systems of 2025; the rightmost tick marks the present frontier of agent safety and governance (Section 11, Section 12) rather than a single dated system. Each system is introduced and cited in the section indicated by the taxonomy of Figure 4; labels alternate above and below the spine only for legibility.

Table 1 positions this survey against the closest general surveys. Single-pillar surveys, planning (Huang et al. 2024), memory (Zhang et al. 2024f), tool use (Qu et al. 2024), GUI agents (Nguyen et al. 2024), evaluation (Yehudai et al. 2025), and trustworthiness (Yu et al. 2025), go deeper than we do on their single column; we cite them as deeper dives in the corresponding sections and direct our own coverage at the connective tissue between pillars, which is precisely what a single-pillar survey cannot supply.

The remainder of the survey follows the taxonomy. Section 2 sets up definitions and the cognitive-architecture vocabulary; Section 3 presents the taxonomy itself. Section 4, Section 5, Section 6 and Section 7 survey the four component pillars, Section 8 grounds them in web, GUI, and embodied environments, Section 9 reviews evaluation practice and its blind spots, Section 10 surveys deployed application domains, and Section 11 analyzes safety and security. Section 12 distills seven open challenges, and Section 13 concludes. Readers interested in a single pillar can read Section 2Section 3 and jump directly to the relevant section; each pillar section is self-contained and closes with a key takeaway.

2. Background: From Language Models to Agents

This section establishes the minimal background the rest of the survey builds on: the base-model capabilities agents inherit (Section 2.1), a working definition of an LLM-based agent (Section 2.2), and the cognitive-architecture vocabulary we adopt throughout (Section 2.3).

2.1. Language Models as Reasoning Cores

Everything an agent can do is bounded by what its underlying model can do, so we begin with the base-model capabilities that agents inherit. Language modeling passed through several regimes, from count-based n-gram models, through distributed word representations and recurrent networks, to the pretrained Transformer that made transfer learning the default, but the capability that turned language models into agent controllers is a property of scale rather than of any single architecture. At sufficient scale, models acquire in-context learning: they infer a task from a few examples in the prompt, with no gradient updates. Instruction tuning then made this latent competence addressable through ordinary natural-language commands, and reinforcement learning from human feedback aligned model outputs with those commands; the same post-training machinery is what later transfers these capabilities across languages and domains (Lee et al. 2025).

The ability most directly responsible for agency is multi-step reasoning. Chain-of-thought prompting showed that eliciting intermediate reasoning steps sharply improves performance on arithmetic, commonsense, and symbolic tasks, and that this benefit emerges only past a scale threshold (Wei et al. 2022); the same behavior can be triggered zero-shot by a single instruction to reason step by step (Kojima et al. 2022). Because reasoning is latent and promptable, a model can be asked to deliberate before it acts, the precondition for treating the model as a decision-maker rather than a text generator. Early surveys mapped the space of reasoning-elicitation methods and their evaluation (Huang and Chang 2022), a space we revisit as agent planning in Section 4.

A further inflection, unfolding across 2024–2025, moved reasoning from a prompting trick into the model’s weights. Bootstrapping a model on its own correct rationales (Zelikman et al. 2022), rewarding individual reasoning steps rather than only final answers (Lightman et al. 2023), and, most strikingly, incentivizing reasoning through large-scale reinforcement learning alone (DeepSeek-AI et al. 2025) produced reasoning-native models that deliberate, verify, and backtrack without being prompted to. Frontier model reports now advertise agentic tool use and computer operation as headline capabilities (Comanici et al. 2025; Kimi Team 2025). These models unsettle a long-standing assumption of agent design (that planning must be supplied by an external scaffold) a tension we take up in Section 4.5.

2.2. What Is an LLM-Based Agent?

Definition 1 names four moving parts, each a pillar of this survey. The loop is closed by the model’s decision procedure (how it turns observations and internal state into the next action) which we survey as planning and reasoning (Section 4). The internal state that survives across steps is memory (Section 5). The external actions are, in the general case, tool calls (Section 6); when the recipient of an action is another agent, the action is a message, and the loop becomes a multi-agent system (Section 7). Figure 3 draws this anatomy; later sections refer to its blocks by name, and Section 11 re-annotates the same diagram to locate where attacks enter.

The perceive–decide–act loop is not new: it is the organizing abstraction of the belief–desire–intention (BDI) tradition and of reinforcement learning, both of which long predate LLMs. What the language model contributes is a general prior over world knowledge and, crucially, a natural-language action interface. A classical agent must be given a hand-engineered state representation and, for RL, a task-specific reward; an LLM-based agent instead reads instructions, tool documentation, and observations as text and emits actions as text, so a single model generalizes across tasks it was never explicitly trained for. This is the capability that the earliest LLM-agent systems exploited, WebGPT learned to answer questions by operating a text browser under human feedback (Nakano et al. 2021); MRKL routed queries between the model and external symbolic modules (Karpas et al. 2022); and ReAct showed that merely interleaving reasoning with actions in the prompt yields a competent agent with no additional training (Yao et al. 2022b).

Terminology in this area is unsettled. We use agent for any system matching Definition 1; some authors reserve agentic AI2 for higher-autonomy systems and contrast it with simpler tool-augmented models (Sapkota et al. 2025). Autonomy is best read as a spectrum rather than a binary, with proposed frameworks distinguishing several levels by how much of the loop the human retains (Feng et al. 2025b); whether systems at the top of that spectrum should be built at all is actively contested (Mitchell et al. 2025). We defer the governance of autonomy to Section 11.5 and use the levels here only as descriptive vocabulary.

2.3. A Cognitive-Architecture View

To describe agents precisely we adopt the vocabulary of Cognitive Architectures for Language Agents (CoALA) (Sumers et al. 2023), which recasts a diverse body of systems (ReAct, Reflexion, Voyager, and others surveyed below) in terms borrowed from classical cognitive architecture. CoALA organizes an agent along three axes. Its memory is divided into a short-lived working memory and long-term stores that, following human memory, are episodic (past experience), semantic (facts about the world), and procedural (skills and the agent’s own code). Its action space is split into internal actions that read from or write to those memories (reasoning, retrieval, learning) and external actions that ground the agent in an environment through tools or physical actuators. Its decision procedure is the loop that proposes, evaluates, and selects the next action.

These three axes are exactly the seams along which this survey cuts the literature. Planning (Section 4) is the decision procedure; memory (Section 5) is the store hierarchy; tool use (Section 6) is the external action space; and multi-agent coordination (Section 7) generalizes the action space to messages exchanged with other agents. Adopting a component vocabulary, rather than a per-framework one, is what lets us compare systems that were never designed to be compared: a framework such as AutoGen or MetaGPT bundles a particular choice along each axis, but the axes themselves are stable, and it is at the level of the axis that the design questions recur. Section 3 builds the survey’s taxonomy on this observation.

3. Taxonomy of LLM-Based Agents

The preceding section described one agent; this section organizes the thousands of them that the literature has produced. We classify the field along three kinds of axis. Component axes ask what an agent is made of, and following the cognitive-architecture view of Section 2.3 there are four: planning and reasoning (Section 4), memory (Section 5), tool use (Section 6), and multi-agent coordination (Section 7). Context axes ask where the agent acts: the interactive environment it is embedded in (Section 8) and the application domain it is deployed to (Section 10). Cross-cutting axes ask how we should judge it, and apply to every cell of the component-by-context matrix: evaluation methodology (Section 9) and safety (Section 11). Figure 4 lays out the full taxonomy; each leaf names a subsection of this survey together with representative systems, all cited in full where they appear.

The component pillars are the load-bearing distinction, because each is a mature subfield with its own dedicated survey that goes deeper than we can here: planning (Cao et al. 2025; Huang et al. 2024), memory (Wu et al. 2025; Zhang et al. 2024f), tool use (Qu et al. 2024; Wang et al. 2024g), and multi-agent systems (Guo et al. 2024a; Tran et al. 2025; Yan et al. 2025). We cite these as deeper dives at the head of each pillar and aim our own contribution at the connections between pillars, how a memory design constrains a planning strategy, how a tool interface reshapes an action space, which no single-pillar survey covers. The context axes are served by their own specialized surveys as well: web (Ning et al. 2025) and GUI agents (Nguyen et al. 2024; Zhang et al. 2024a) for environments, and domain surveys for software (Liu et al. 2024a), science (Ren et al. 2025), medicine (Wang et al. 2025c), and finance (Ding et al. 2024) for applications. The two cross-cutting concerns have recently acquired dedicated surveys of their own, evaluation (Mohammadi et al. 2025; Yehudai et al. 2025) and trustworthiness (Su et al. 2025; Yu et al. 2025), a sign that the field now treats them as objects of study rather than afterthoughts, and a stance this survey adopts by giving each a full section.

Why organize by function at all, rather than by framework, which is how practitioners often navigate the field? Because frameworks are bundles and functions are atoms. A system such as AutoGen (Wu et al. 2023a) or MetaGPT (Hong et al. 2024) fixes a particular choice on every axis at once (a role structure, a memory scheme, a tool protocol, a planning loop) and is then superseded by the next bundle. The design questions, however, recur unchanged across bundles: whether to plan ahead or interleave planning with acting, whether memory should be flat text or a structured graph, whether tools should be selected or authored, whether agents should cooperate or debate. Classifying by function makes these questions, and the competing answers to them, the unit of comparison, so that a lesson learned in one framework transfers to the next. Table 2 makes the payoff concrete: it places representative systems against every axis at once, so that designs the taxonomy tree of Figure 4 necessarily scatters into separate leaves can be read side by side. The remainder of the survey works through the taxonomy one axis at a time.

Table 2. Representative agent systems placed against every axis of the taxonomy at once. “Coord.” is the multi-agent topology (“–” for single-agent); “Planning” names the decision procedure of Section 4. Every entry is documented in the section listed; this is the comparison the per-leaf tree of Figure 4 cannot show.

System	Planning	Memory	Action	Coord.	Domain / env.	§	Ref.
ReAct	interleaved	–	tools	–	general	Section 4.3	(Yao et al. 2022b)
Reflexion	reflection	episodic	tools	–	general	Section 4.4	(Shinn et al. 2023)
AutoGPT	plan-execute	scratchpad	tools	–	general	Section 1	(Yang et al. 2023b)
HuggingGPT	plan-execute	–	models	–	multimodal	Section 6.2	(Shen et al. 2023)
ToolLLM	DFS search	–	APIs	–	tool use	Section 6.1	(Qin et al. 2023)
CodeAct	interleaved	–	code	–	general	Section 6.3	(Wang et al. 2024d)
SWE-agent	interleaved	–	code (ACI)	–	software	Section 6.3	(Yang et al. 2024a)
MemGPT	–	tiered	tool calls	–	dialogue	Section 5.2	(Packer et al. 2023)
Voyager	curriculum	skill library	code	–	embodied	Section 5.4	(Wang et al. 2023a)
CAMEL	role-play	dialogue	messages	dyad	general	Section 7.1	(Li et al. 2023a)
AutoGen	configurable	per-agent	tools, code	star	general	Section 7.1	(Wu et al. 2023a)
MetaGPT	SOP pipeline	shared docs	structured	pipeline	software	Section 7.1	(Hong et al. 2024)
Gen. Agents	reflection	memory stream	messages	society	simulation	Section 5.3, Section 7.4	(Park et al. 2023a)
WebVoyager	interleaved	–	GUI (pixels)	–	web	Section 8.1	(He et al. 2024)
UI-TARS	trained e2e	–	GUI actions	–	computer use	Section 8.2	(Qin et al. 2025)
OS-Copilot	plan + improve	skill store	OS actions	–	OS	Section 8.2	(Wu et al. 2024b)
ChemCrow	plan-execute	–	domain tools	–	chemistry	Section 10.2	(Bran et al. 2023)
AI Scientist	plan-execute	–	code, tools	–	science	Section 10.2	(Lu et al. 2024)

Table 2. Representative agent systems placed against every axis of the taxonomy at once. “Coord.” is the multi-agent topology (“–” for single-agent); “Planning” names the decision procedure of Section 4. Every entry is documented in the section listed; this is the comparison the per-leaf tree of Figure 4 cannot show.

System	Planning	Memory	Action	Coord.	Domain / env.	§	Ref.
ReAct	interleaved	–	tools	–	general	Section 4.3	(Yao et al. 2022b)
Reflexion	reflection	episodic	tools	–	general	Section 4.4	(Shinn et al. 2023)
AutoGPT	plan-execute	scratchpad	tools	–	general	Section 1	(Yang et al. 2023b)
HuggingGPT	plan-execute	–	models	–	multimodal	Section 6.2	(Shen et al. 2023)
ToolLLM	DFS search	–	APIs	–	tool use	Section 6.1	(Qin et al. 2023)
CodeAct	interleaved	–	code	–	general	Section 6.3	(Wang et al. 2024d)
SWE-agent	interleaved	–	code (ACI)	–	software	Section 6.3	(Yang et al. 2024a)
MemGPT	–	tiered	tool calls	–	dialogue	Section 5.2	(Packer et al. 2023)
Voyager	curriculum	skill library	code	–	embodied	Section 5.4	(Wang et al. 2023a)
CAMEL	role-play	dialogue	messages	dyad	general	Section 7.1	(Li et al. 2023a)
AutoGen	configurable	per-agent	tools, code	star	general	Section 7.1	(Wu et al. 2023a)
MetaGPT	SOP pipeline	shared docs	structured	pipeline	software	Section 7.1	(Hong et al. 2024)
Gen. Agents	reflection	memory stream	messages	society	simulation	Section 5.3, Section 7.4	(Park et al. 2023a)
WebVoyager	interleaved	–	GUI (pixels)	–	web	Section 8.1	(He et al. 2024)
UI-TARS	trained e2e	–	GUI actions	–	computer use	Section 8.2	(Qin et al. 2025)
OS-Copilot	plan + improve	skill store	OS actions	–	OS	Section 8.2	(Wu et al. 2024b)
ChemCrow	plan-execute	–	domain tools	–	chemistry	Section 10.2	(Bran et al. 2023)
AI Scientist	plan-execute	–	code, tools	–	science	Section 10.2	(Lu et al. 2024)

Figure 4. Master taxonomy of LLM-agent research as organized by this survey. Four component pillars (Planning & Reasoning Section 4, Memory Section 5, Tool Use Section 6, Multi-Agent Systems Section 7) are grounded in two context dimensions (Environments Section 8, Applications Section 10), with Evaluation (Section 9) and Safety (Section 11) as cross-cutting concerns (dashed edges). Leaves list representative works; all are cited in full in the corresponding sections.

Figure 4. Master taxonomy of LLM-agent research as organized by this survey. Four component pillars (Planning & Reasoning Section 4, Memory Section 5, Tool Use Section 6, Multi-Agent Systems Section 7) are grounded in two context dimensions (Environments Section 8, Applications Section 10), with Evaluation (Section 9) and Safety (Section 11) as cross-cutting concerns (dashed edges). Leaves list representative works; all are cited in full in the corresponding sections.

4. Planning and Reasoning

Planning is the agent’s decision procedure, the policy that turns the current observation and internal state into the next action. It is the axis on which the field has moved fastest, and it is instructive to organize the work not by chronology but by where the improvement comes from. Four sources recur: better prompting of a fixed model (Section 4.1), explicit search over candidate reasoning paths (Section 4.2), decomposition and interleaving of planning with acting (Section 4.3), and feedback in the form of self-correction (Section 4.4). A fifth source, training the model to reason directly (Section 4.5), has recently begun to absorb the other four, and we close the section by asking what that means for agent design (Cao et al. 2025; Huang et al. 2024).

4.1. Prompted Reasoning

The cheapest way to make a model plan is to ask it to. Chain-of-thought prompting elicits intermediate reasoning steps that markedly improve multi-step problem solving (Wei et al. 2022), and the effect survives the removal of exemplars: a single instruction to reason step by step recovers much of the gain zero-shot (Kojima et al. 2022). These results reframed the model as something that can deliberate, and every planning method below is, in some sense, a more disciplined way of spending that deliberation.

The discipline takes three broad forms. Sampling many reasoning paths and taking a majority vote over their answers (self-consistency) trades inference compute for accuracy and reliably beats greedy decoding (Wang et al. 2022). Decomposing a problem into an ordered list of easier subproblems, each conditioned on the last, improves compositional generalization (Zhou et al. 2022). And splitting the work into an explicit plan-then-execute pair reduces the calculation and missing-step errors of naive zero-shot reasoning (Wang et al. 2023c). A theme already visible here, and central to Section 9, is that these gains are bought with extra inference: self-consistency’s accuracy scales with the number of sampled paths, so any comparison that ignores compute overstates the method’s value.

4.2. Search over Thoughts

If prompted reasoning explores a single path, the natural generalization is to search over many. Tree of Thoughts makes the search explicit, maintaining a tree of partial solutions that the model expands, evaluates, and backtracks over using breadth- or depth-first search (Yao et al. 2023). Graph of Thoughts relaxes the tree to an arbitrary graph so that reasoning paths can be merged and refined, not just branched (Besta et al. 2023). The move from chain to tree to graph (Figure 5) buys quality on hard problems at a steep and often unreported compute cost.3

A second line makes the search model-based. Reasoning via Planning repurposes the LLM as its own world model4, predicting the next state so that Monte Carlo Tree Search can plan against it (Hao et al. 2023a). Language Agent Tree Search extends this to grounded settings, unifying reasoning, acting, and reflection in a single search over an environment (Zhou et al. 2024a). A third, meta-level line has the model search over reasoning strategies rather than reasoning steps: Self-Discover composes task-specific reasoning structures from atomic modules (Zhou et al. 2024b), while Buffer of Thoughts retrieves distilled “thought-templates” from past problems (Yang et al. 2024b), a design that already blurs into the memory mechanisms of Section 5.

4.3. Task Decomposition and Interactive Planning

Search assumes the agent can evaluate a plan before executing it. In interactive settings it often cannot, because the environment reveals information only when acted upon, which raises the defining question of this subsection: should the agent commit to a full plan up front, or interleave planning with acting? ReAct takes the interleaved extreme, alternating a reasoning trace with an action and folding each observation back into the next thought (Yao et al. 2022b). ReWOO takes the plan-ahead extreme, producing a complete tool-use plan before any execution; by decoupling reasoning from observation it cuts token consumption roughly fivefold relative to interleaved loops, at the cost of being unable to adapt when an early step surprises it (Xu et al. 2023).

The productive answer is that decomposition granularity should be conditioned on the agent’s own competence rather than fixed in advance. ADaPT recurses into finer subtasks only when the executor fails to complete a step directly, matching plan depth to difficulty (Prasad et al. 2023). DEPS closes the loop differently, having the agent describe its progress, explain failures, and revise the plan, which lets a single zero-shot agent complete dozens of long-horizon tasks in an open world (Wang et al. 2023f). Both point the same way: the plan is not an artifact produced once but a hypothesis revised against feedback.

The trade-off this subsection describes is usually argued from the literature; we can also measure it. Figure 6 reports a small controlled comparison we ran of the same model (Qwen2.5-7B-Instruct) under three control loops on 50 ALFWorld tasks. Interleaving (ReAct) roughly doubles the success rate of plan-then-execute (ReWOO), 46% versus 22%, but costs about four times as many tokens; adding a single reflection retry (Reflexion, Section 4.4) buys a further 8 points to 54% at another 70% more tokens. The plan-ahead loop is genuinely cheaper (it just spends its savings on failures it cannot see coming) and the result lands squarely on a cost–accuracy frontier, foreshadowing the argument of Section 9.3 that neither axis should be read alone.

4.4. Reflection and Self-Correction

Revising against feedback invites an appealing idea: let the agent generate that feedback itself. Reflexion has the agent write a verbal self-reflection after a failed attempt and store it in episodic memory, improving decision-making on later attempts without any weight update (Shinn et al. 2023). Self-Refine applies the same loop within a single problem, alternating generation and self-critique (Madaan et al. 2023), and CRITIC grounds the critique in external tools such as search engines and interpreters (Gou et al. 2023). Reported gains across these systems made self-correction a near-default component of agent scaffolds.

The evidence for intrinsic self-correction, however, is weaker than the enthusiasm suggests. Controlled experiments find that when a model is asked to correct its reasoning using only its own judgment, with no external signal, performance frequently fails to improve and sometimes degrades, because the model cannot reliably tell which of its answers is wrong (Huang et al. 2023a). A critical survey of the subfield goes further, arguing that many positive results rest on ill-posed setups, oracle stopping criteria, unfair baselines, or tasks where the correction step smuggles in information the first attempt lacked (Kamoi et al. 2024). The two literatures are not actually in contradiction once the confound is named.

The reconciliation is that self-correction works when the feedback is not purely intrinsic. CRITIC’s tool grounding and Reflexion’s environment signal both supply an external check, which is why they help where pure self-critique does not. Where such a signal is unavailable, the alternative is to train the ability in: SCoRe uses multi-turn reinforcement learning on the model’s own correction traces to produce genuine self-correction, overcoming the distribution-shift and collapse failures of prompting-only approaches (Kumar et al. 2024). Self-correction, in short, is real but not free, it requires either an external verifier or a training signal, a conclusion that anticipates Section 4.5 and the section’s key takeaway.

Table 3. Planning strategies by the structure they search and the feedback they use. “Cost” is inference overhead relative to a single chain-of-thought pass (qualitative; exact factors depend on branching and depth). “Env?” marks whether the method requires interacting with an external environment or tools, as opposed to pure internal reasoning.

Strategy	Search structure	Feedback source	Cost	Env?	Ref.
Chain-of-Thought	linear chain	none	base	✗	(Wei et al. 2022)
Self-Consistency	parallel samples	answer vote	$N\times$	✗	(Wang et al. 2022)
Tree of Thoughts	tree	self-evaluation	high	✗	(Yao et al. 2023)
Graph of Thoughts	graph (merges)	self-evaluation	high	✗	(Besta et al. 2023)
RAP	tree (MCTS)	world-model value	high	✗	(Hao et al. 2023a)
LATS	tree (MCTS)	env. + reflection	high	✓	(Zhou et al. 2024a)
ReWOO	plan-then-act	tool observations	low	✓	(Xu et al. 2023)
Reflexion	linear + memory	env. reward	medium	✓	(Shinn et al. 2023)

Table 3. Planning strategies by the structure they search and the feedback they use. “Cost” is inference overhead relative to a single chain-of-thought pass (qualitative; exact factors depend on branching and depth). “Env?” marks whether the method requires interacting with an external environment or tools, as opposed to pure internal reasoning.

Strategy	Search structure	Feedback source	Cost	Env?	Ref.
Chain-of-Thought	linear chain	none	base	✗	(Wei et al. 2022)
Self-Consistency	parallel samples	answer vote	$N\times$	✗	(Wang et al. 2022)
Tree of Thoughts	tree	self-evaluation	high	✗	(Yao et al. 2023)
Graph of Thoughts	graph (merges)	self-evaluation	high	✗	(Besta et al. 2023)
RAP	tree (MCTS)	world-model value	high	✗	(Hao et al. 2023a)
LATS	tree (MCTS)	env. + reflection	high	✓	(Zhou et al. 2024a)
ReWOO	plan-then-act	tool observations	low	✓	(Xu et al. 2023)
Reflexion	linear + memory	env. reward	medium	✓	(Shinn et al. 2023)

4.5. Learned Reasoning and Trained Agents

The methods above all treat the model as fixed and wrap machinery around it. The most recent shift instead trains the model to reason. STaR bootstraps a model on the rationales that lead to correct answers, iteratively improving its reasoning from a small seed (Zelikman et al. 2022). Process supervision rewards each intermediate step rather than only the final answer, and outperforms outcome supervision on hard mathematical reasoning (Lightman et al. 2023). DeepSeek-R1 pushes the idea to its limit, showing that large-scale reinforcement learning with only an outcome signal can induce reasoning-native behavior (self-verification, backtracking, and long deliberation) as an emergent property, with no supervised reasoning traces at all (DeepSeek-AI et al. 2025).

Training has since moved from teaching a model to reason to teaching it to act, and this is the concrete mechanism behind the survey’s recurring observation that scaffolds are migrating into the models. A first wave fine-tunes on agent trajectories: AgentTuning mixes interaction traces into instruction tuning to give general models agent abilities (Zeng et al. 2023), and FireAct fine-tunes on ReAct-style trajectories drawn from several tasks (Chen et al. 2023a). A second wave trains agents online, in the environment itself: WebRL builds a self-evolving curriculum with reinforcement learning for web agents (Qi et al. 2024), and AgentGym evolves agents across many interactive environments at once (Xi et al. 2024). A third wave moves the tools inside the reasoning chain itself: Search-R1 trains a model to interleave search-engine calls with its own thoughts from outcome rewards alone (Jin et al. 2025), and ReTool learns when to invoke a code interpreter mid-derivation (Feng et al. 2025a); this agentic reinforcement learning is growing fast enough to have a survey of its own (Zhang et al. 2025). The same move recurs in the capability-specific models surveyed later, function-calling models trained on synthetic call data (Section 6.4), reinforcement-learned GUI agents such as UI-TARS (Section 8.2), and RL-trained self-correction (SCoRe, Section 4.4). Table 4 organizes these by the training signal they use and by whether that signal is drawn from a live environment, which is the axis along which prompted scaffolds are being absorbed into trained behavior.

This raises a genuinely open question for agent design, and we flag it as open rather than resolve it. If a model backtracks and verifies internally, do the external scaffolds of Section 4.2, Section 4.3 and Section 4.4 (the search trees, the reflection loops) remain necessary, or does planning migrate into the weights and leave the scaffold redundant on the tasks the model has internalized? Early evidence is mixed, and the pillar surveys of learned planning treat it as unsettled (Cao et al. 2025; Huang et al. 2024); we return to it as a future direction in Section 12.

5. Memory

If planning is what an agent does within a step, memory is what carries across steps. A language model is, by default, stateless: it retains nothing between calls beyond what fits in its context window. Memory is the machinery that lifts an agent out of that amnesia, it is what lets an agent learn a user’s preferences over a month, reuse a skill it acquired last week, or avoid a mistake it made an hour ago, and it is, in the strong sense, the component that makes an agent more than a prompt.

5.1. A Taxonomy of Agent Memory

Following the cognitive-architecture view of Section 2.3, agent memory divides first by time horizon and then by content. By horizon there is working memory, the information immediately available in the context window during a single decision, and long-term memory, which persists across episodes. Long-term memory, in turn, borrows the human tripartite division (Sumers et al. 2023; Wu et al. 2025): episodic memory of past experiences and interactions, semantic memory of facts about the world and the user, and procedural memory of skills and routines the agent can execute. The pillar survey of Zhang et al. (2024f) organizes the subfield along compatible lines and provides a fuller catalogue than we give here.

This four-way split is descriptive; what makes memory systems differ in practice is a small set of design decisions, and it is these that structure the rest of the section (Figure 7). Every memory system must choose a store form (flat text, vectors, key–value pairs, or a graph), a read policy (how relevant memories are retrieved for the current step), a write policy (what gets committed to long-term storage and in what form), and a forgetting policy (how stale or low-value memories are decayed, if at all). The recurring finding of the subfield is that these policies, not raw capacity, determine whether memory helps.

5.2. Working Memory and Context Management

The first problem memory poses is that working memory is bounded: the context window is finite, yet tasks are not. MemGPT reframes this as an operating-systems problem, giving the agent a tiered memory hierarchy and letting it page information between a limited main context and external storage through self-issued function calls, much as an OS moves data between RAM and disk (Packer et al. 2023). MemWalker takes a complementary route for long documents, building a tree of recursively summarized nodes and having the agent navigate it top-down at query time, reading only the branches it needs (Chen et al. 2023b). Both make the same conceptual move: context management is not a fixed preprocessing step but an action the agent takes, subject to the same decision-making the rest of the loop uses.

5.3. Long-Term and Structured External Memory

Long-term memory systems are best compared by their store form, because form dictates what the read and write policies can be. The simplest form is flat text with a lifecycle. The canonical design is the memory stream of Generative Agents (Park et al. 2023a): a chronological log of natural-language observations retrieved by a score combining recency, importance, and relevance, with a periodic reflection step that synthesizes low-level memories into higher-level ones, a template that most later text-memory systems vary. MemoryBank stores past interactions as text and adds a psychologically motivated forgetting rule, strengthening or decaying each memory by an Ebbinghaus curve so that importance and recency govern what survives (Zhong et al. 2023). Think-in-Memory refines what is stored, keeping the agent’s evolved thoughts rather than raw dialogue and updating them with insert, forget, and merge operations, which avoids the inconsistent re-reasoning that raw-text recall invites (Liu et al. 2023a).

Structuring the store buys sharper retrieval. RET-LLM records knowledge as subject–relation–object triplets, giving an updatable and interpretable memory (Modarressi et al. 2023); HippoRAG goes further, building an open knowledge graph and retrieving over it with Personalized PageRank in a deliberate analogy to hippocampal indexing, which enables single-step multi-hop recall that flat retrieval handles poorly (Gutiérrez et al. 2024). That store form matters is not merely asserted: a controlled study varying chunk-, triple-, fact-, and summary-based structures over identical queries finds the best structure depends on the query type, offering design guidance rather than a single winner (Zeng et al. 2024).

The newest systems make the store self-organizing or production-hardened. A-MEM links each new memory to related ones in a Zettelkasten-style network and lets new entries revise the attributes of old ones, so the memory continually restructures itself (Xu et al. 2025). Mem0 targets deployment, dynamically extracting and consolidating salient facts across sessions and reporting, on the LoCoMo long-conversation benchmark, large quality gains over a strong memory baseline, together with roughly ninety-percent reductions in latency and token cost relative to full-context prompting, a reminder that in production the binding constraint on memory is as much cost as accuracy (Chhikara et al. 2025). MIRIX pushes toward the frontier of multiple coordinated memory types, including multimodal experience, managed by dedicated per-type managers (Wang and Chen 2025). A separate, architecture-level line embeds memory in the model itself rather than in a scaffold: LongMem attaches a trainable side-network that caches and retrieves past context (Wang et al. 2023d), and Larimar equips an LLM with an episodic memory supporting fast one-shot updates and selective forgetting without retraining (Das et al. 2024).

Because these systems make competing claims, they need a common yardstick. LoCoMo supplies one, evaluating very long-term conversational memory with multi-hop and temporal questions that expose the weaknesses of both long-context and naive retrieval baselines (Maharana et al. 2024); it is now the standard benchmark by which the systems above report, with LongMemEval complementing it by decomposing long-term interactive memory into five separately testable abilities (Wu et al. 2024a). We return to memory evaluation in Section 9. Table 5 summarizes the design choices across representative systems.

5.4. Experiential Learning and Skill Libraries

Procedural memory closes the loop between memory and self-improvement. When an agent stores not facts but skills, memory becomes the substrate on which it gets better at its job without any weight update. Voyager makes this concrete in an open-ended embodied setting, maintaining a library of executable code skills that it writes, verifies, and later retrieves and composes, so that competence accumulates over a lifetime of play (Wang et al. 2023a). Synapse stores whole past trajectories as exemplars and retrieves them by task similarity to guide new episodes (Zheng et al. 2023).

Storing raw experience, however, scales poorly; the more useful object is often a distilled lesson. ExpeL has an agent gather experiences across training tasks and extract natural-language insights from both its successes and its failures, carrying forward compact rules rather than full episodes and improving purely through in-context use of that memory (Zhao et al. 2023). ReasoningBank scales the same idea toward deployment, distilling strategy-level memory from both successful and failed trajectories so that an agent self-evolves over a continuous task stream (Ouyang et al. 2025). This is continual learning without gradients, and it is one of the clearest bridges from memory to the open problem of lifelong agent improvement we take up in Section 12.

6. Tool Use and Action Execution

Memory lets an agent look inward across time; tools let it reach outward into the world. A tool call is the external action of Definition 1, the means by which an agent computes what its weights cannot, retrieves what they do not contain, and effects change beyond generating text. Tool use is therefore the pillar that turns a reasoner into an actor, and this section follows its arc from prompting a model to call fixed tools, through learning to call thousands of them, to letting the agent write executable code as its action space, and finally to training models specialized for the task.

6.1. Foundations and Paradigms

The literature splits along one axis: whether tool competence is prompted into a fixed model or learned into its weights. The learned branch came first at scale. TALM bootstrapped tool use from a few demonstrations through iterative self-play (Parisi et al. 2022), and Toolformer made the idea self-supervised, letting a model annotate ordinary text with the API calls that would have helped predict it, then training on the calls that lowered loss (Schick et al. 2023). Scaling the tool inventory exposed a retrieval problem: Gorilla pairs a fine-tuned model with a document retriever so it can emit correct calls across thousands of constantly changing APIs without hallucinating arguments (Patil et al. 2024), and ToolLLM extends this to over sixteen thousand real-world APIs, using a depth-first decision-tree search to plan and recover across multi-call traces (Qin et al. 2023).

The prompted branch asks how far a fixed model can be pushed with the right context, and the surprising answer is: quite far. Tool documentation alone, with no demonstrations, is often sufficient for zero-shot tool use and scales better than few-shot prompting when hundreds of tools are available (Hsieh et al. 2023). The two branches trade off predictably, prompted tool use scales with the size of the tool catalogue that fits in context, learned tool use scales with the volume of training data, a tension the pillar survey of Qu et al. (2024) maps in full and that the function-calling models of Section 6.4 attempt to resolve.

6.2. Tool Selection, Creation, and Composition

Calling one tool is selection; calling several in concert is composition, and it is where agents begin to resemble programs. Chameleon has an LLM synthesize a program that composes vision models, search, and Python functions to solve multimodal tasks (Lu et al. 2023); HuggingGPT generalizes the pattern by treating other models as the tools, using the LLM as a controller that plans a task and dispatches specialized models to execute its stages (Shen et al. 2023); and RestGPT drives real, stateful REST APIs through a coarse-to-fine planner and a dedicated executor that formats parameters and parses responses (Song et al. 2023).

More striking than composing given tools is authoring new ones. LATM closes a loop in which a capable model acts as a tool maker, writing reusable Python functions that a cheaper model then applies, amortizing the authoring cost across many uses (Cai et al. 2023). ToolkenGPT attacks the scaling limit from the other side, representing each tool as a learned vocabulary token (a “toolken”) so that a frozen model can select from a large, expandable tool set without listing every tool in its prompt (Hao et al. 2023b). Together these mark a shift in what the tool set is: no longer a fixed external inventory but a learned, self-extending object the agent grows.

6.3. Code as a Universal Action Space

Taken to its conclusion, the composition-and-authoring trend collapses the distinction between tool use and programming. CodeAct consolidates an agent’s entire action space into executable Python: instead of emitting a fixed JSON action schema, the agent writes code, which subsumes tool calls, control flow, and data manipulation in one interface and lets the agent revise from execution errors by debugging its own program (Wang et al. 2024d). Code as action is expressive precisely because it is Turing-complete, but realizing that expressiveness depends on the surrounding interface. SWE-agent makes this explicit with the notion of an agent–computer interface5: a deliberately designed set of commands and observations for browsing, editing, and running code, whose design changes task success as much as swapping the underlying model does (Yang et al. 2024a). We treat the ACI concept here and defer its software-engineering payoff to Section 10.1.

6.4. Function-Calling Models and Training Data

The prompted-versus-learned tension resolves, in practice, into a class of models trained specifically to call functions. xLAM is a family of “large action models” trained through a unified data-synthesis pipeline to strengthen tool use, topping function-calling leaderboards (Zhang et al. 2024c); ToolACE reaches comparable accuracy with an 8B model by generating a diverse, rule- and model-verified corpus of function-calling dialogues (Liu et al. 2024b). Both sit in the trained-agent lineage organized in Table 4. Both are also downstream of a data problem, and the open-model lineage that precedes them is a history of solving it: GPT4Tools self-instructs a tool-use dataset from a teacher model (Yang et al. 2023d), ToolAlpaca synthesizes several thousand tool-use cases from a multi-agent simulation to fine-tune compact models (Tang et al. 2023), and a careful study shows small models are weak tool learners unless the task is decomposed across specialized planner, caller, and summarizer sub-models (Shen et al. 2024). Progress on function calling has been, more than anything, progress on generating verified training data.

These benchmarks, API-Bank’s runnable multi-turn dialogues (Li et al. 2023b), StableToolBench’s virtual API server that stabilizes the volatile ToolBench APIs (Guo et al. 2024b), the Berkeley Function-Calling Leaderboard’s abstract-syntax-tree matching (Patil et al. 2025), and GTA’s real-tool tasks with implicit intent on which leading models finish under half (Wang et al. 2024a), are summarized in Table 6 and revisited in Section 9.

The final step of this arc is standardization. As tool use matured, the per-model function-calling conventions began to converge on open protocols that decouple an agent from the tools it calls: the Model Context Protocol exposes tools and data to any client through a common interface (Anthropic 2024b), and the Agent2Agent protocol standardizes how agents discover and delegate to one another (Google 2025). These protocols make tools and agents composable across vendors, but by turning the tool interface into shared infrastructure they also enlarge the supply-chain attack surface of Section 11 and raise the open infrastructure questions of Section 12. The protocol layer is young but already an object of study: a survey of agent protocols maps the emerging standards and their evaluation dimensions (Yang et al. 2025), and a security analysis of the MCP ecosystem catalogues threats across the server lifecycle (Hou et al. 2025).

7. Multi-Agent Systems

The three preceding pillars describe a single agent. When the recipient of an action is another agent rather than a tool or an environment, the loop of Figure 3 closes between agents, and coordination becomes a design problem in its own right. The motivation is partly a division of labor (specialized roles, separate contexts, parallel work) and partly a hope that agents checking one another will be more reliable than any one alone. Whether that hope is borne out is the central, and contested, question of this section. Three pillar surveys map the space: a general survey of progress and challenges (Guo et al. 2024a), a communication-centric survey (Yan et al. 2025), and a survey of collaboration mechanisms (Tran et al. 2025).

7.1. Role-Based Collaboration

The earliest and most influential multi-agent designs assign agents roles. CAMEL showed that two agents (an instruction-giving user and a solving assistant) kept on task by “inception” prompts can cooperate autonomously, and used the setup to study emergent cooperative behavior (Li et al. 2023a). Giving roles a workflow made them productive: MetaGPT encodes human standard operating procedures into a structured assembly line of specialist agents, which curbs the error cascades of naive agent chaining (Hong et al. 2024), and ChatDev instantiates a virtual software company whose agents communicate along a structured chat chain (Qian et al. 2023). Generalizing beyond fixed pipelines, AutoGen provides conversable agents that combine models, tools, and human input in configurable topologies (Wu et al. 2023a), while AgentVerse dynamically recruits and adjusts its agent group across a recruit–decide–act–evaluate loop (Chen et al. 2023d).

A revealing boundary case is that “multi-agent” collaboration need not require multiple agents at all: Solo Performance Prompting has a single model adopt several personas that critique one another in turn, recovering much of the benefit within one context window (Wang et al. 2023e). This sharpens the question the rest of the section pursues, what, exactly, does spawning separate agents buy? Table 7 contrasts representative frameworks along the axes that answer it: their topology, how roles are assigned, the medium of communication, whether a human is in the loop, and the domain they target.

7.2. Debate and Discussion

The most-studied coordination protocol is debate. Having several model instances propose answers and argue over successive rounds improves factuality and reduces fallacious reasoning (Du et al. 2023); the Multi-Agent Debate framework adds structured tit-for-tat argument and a judge to counter the “degeneration of thought” a lone model suffers (Liang et al. 2023). The protocol has been turned to evaluation, panels of referee agents correlate with human judgment better than a single evaluator (Chan et al. 2023), and to heterogeneous ensembles, where diverse models discuss and then vote by confidence (Chen et al. 2023c).

The enthusiasm deserves a skeptic, and the literature supplies a pointed one. A systematic comparison of debate against simpler strategies at matched cost finds that debate frequently fails to beat plain sampling-and-voting out of the box, and is often the more expensive way to reach the same accuracy (Smit et al. 2023). The productive reframing comes from the scalable-oversight literature: when two stronger models debate and a weaker judge decides, optimizing the debaters for persuasiveness raises the judge’s accuracy (Khan et al. 2024). Debate, then, is not reliably a route to better reasoning per unit compute, but it may be a route to supervising systems stronger than the supervisor, a different and arguably more important use, which we revisit in Section 11.

7.3. Scaling and Ensembling

The skeptic’s null hypothesis deserves its own subsection, because it is strong. Simply sampling many independent agent responses and taking a majority vote (an “agent forest” with no communication at all) improves performance monotonically with the number of agents, and this scaling accounts for a large share of the gains often attributed to elaborate coordination (Li et al. 2024b). Any claim that a communication protocol helps must therefore clear this bar. Some designs do: Mixture-of-Agents stacks layers in which each agent conditions on the previous layer’s outputs, and this structured aggregation of open models surpasses far stronger single models on instruction-following benchmarks (Wang et al. 2024b). When such systems are deployed the number of agents queried becomes a cost to be managed, not just an accuracy dial (Lee et al. 2026b). Pushing scale further, arranging over a thousand agents in explicit collaboration graphs finds that performance depends on the topology, with irregular graphs outperforming regular ones, an early collaborative scaling result (Qian et al. 2024). The lesson is that ensembling is the baseline to beat, and structured aggregation, not mere conversation, is what beats it.

7.4. Communication Topology and Team Optimization

If communication must earn its cost, the natural next step is to optimize who talks to whom. DyLAN treats the interaction graph as dynamic, pruning unhelpful agents mid-task via an agent-importance score and stopping early when consensus forms (Liu et al. 2023b), and Exchange-of-Thought catalogues the communication paradigms available (memory, report, relay, and debate) with a confidence mechanism to weigh contributions (Yin et al. 2023). A newer line makes the topology itself the object of optimization: GPTSwarm formalizes agent systems as computational graphs whose prompts and edges are jointly learned (Zhuge et al. 2024a), and AFlow searches over code-represented workflows to discover agentic pipelines automatically (Zhang et al. 2024d). Figure 8 sketches the recurring topologies, from fixed pipelines and stars to meshes and pruned dynamic networks.

Coordination is not always cooperative. Scorable negotiation games, some with adversarial players, test strategic communication and expose manipulation and self-interest as failure modes worth studying (Abdelnabi et al. 2023), and embodied teams must coordinate under partial observability, as in the modular cooperative agents of CoELA (Zhang et al. 2023b). At the largest scale, populations of agents with memory and reflection produce believable emergent social behavior, the clearest evidence that coordination dynamics are a genuine object of study rather than an engineering convenience (Park et al. 2023a).

Coordination also fails in systematic ways, and naming those failures sharpens the skeptic’s case from Section 7.2. A study of hundreds of execution traces across popular multi-agent frameworks distills fourteen recurring failure modes, under-specified roles, inter-agent misalignment, and weak verification among them, and attributes most breakdowns to these process failures rather than to the base model (Cemri et al. 2025). The lesson reinforces the section’s takeaway: multi-agent systems help when they add the right structure and fail when the structure itself is flawed.

Figure 8. Communication topologies for multi-agent systems. (a) A pipeline passes work along a fixed sequence (MetaGPT, ChatDev); (b) a star routes through an orchestrator (AutoGen); (c) a mesh has every agent debate every other (Section 7.2); (d) a hierarchy delegates down a tree; (e) a dynamic network prunes edges at run time (dashed), as in DyLAN.

Figure 8. Communication topologies for multi-agent systems. (a) A pipeline passes work along a fixed sequence (MetaGPT, ChatDev); (b) a star routes through an orchestrator (AutoGen); (c) a mesh has every agent debate every other (Section 7.2); (d) a hierarchy delegates down a tree; (e) a dynamic network prunes edges at run time (dashed), as in DyLAN.

8. Agents in Interactive Environments

The pillars so far describe agents largely through text. But an agent earns its name only by acting on something, and the something is increasingly a rich, partially observable environment: a web page, a phone screen, a desktop, a kitchen. Prior surveys tend to treat web, GUI, and embodied agents as separate literatures. We deliberately treat them as one family, because they share a single hard problem, grounding: mapping language and perception onto the specific, often irreversible action the environment will accept, whether that action is clicking the right link, tapping the right widget, or grasping the right object. Multimodal agent surveys support this unification across gaming, robotics, and interface control (Durante et al. 2024).

8.1. Web Agents

The web was the first rich environment, and its agents trace a clean lineage. WebGPT fine-tuned a model to answer questions by operating a text browser under human feedback, before ChatGPT existed (Nakano et al. 2021). WebShop then supplied a scalable simulated environment (over a million products) in which grounded agents navigate and purchase against natural-language goals (Yao et al. 2022a). Mind2Web moved to real websites, offering thousands of open-ended tasks across more than a hundred sites for training generalist web agents (Deng et al. 2023), and WebArena built a realistic, self-hostable environment with functionally checked tasks that has become a standard testbed (Zhou et al. 2024c).

The decisive recent shift is multimodal, and it identifies grounding as the bottleneck. SeeAct shows that a large multimodal model can act as a generalist web agent when it perceives the rendered page rather than only its HTML, but that turning a correct plan into the correct click (grounding) is where it most often fails (Zheng et al. 2024). WebVoyager closes the loop end-to-end on live websites with a multimodal agent and an automatic evaluator (He et al. 2024). The dedicated web-agent survey of Ning et al. (2025) catalogues the architectures and trustworthiness concerns this subfield has accumulated. The maturest commercial descendants of this line are deep research agents that run long-horizon, tool-mediated search and synthesis; the paradigm now has open end-to-end models (Tongyi DeepResearch Team 2025) and a systematic survey (Huang et al. 2025).

8.2. GUI and Computer-Use Agents

Generalizing from the browser to the whole screen yields the computer-use agent, and here perception becomes purely visual. CogAgent is an early large vision-language model built for graphical interfaces, using dual low- and high-resolution encoders to read screenshots and outperform HTML-based methods (Hong et al. 2023). SeeClick isolates the core subproblem, GUI grounding6, and introduces the ScreenSpot benchmark to measure locating the right element from a screenshot alone (Cheng et al. 2024).

On top of this perception layer sit device agents: AppAgent explores smartphone apps through a human-like action space (Zhang et al. 2023a), Mobile-Agent uses visual perception tools to operate apps from screenshots without back-end access (Wang et al. 2024c), and OS-Copilot extends autonomy to the operating-system level with a self-improving agent (Wu et al. 2024b). The frontier is end-to-end native models that map screenshots to actions directly, such as UI-TARS (Qin et al. 2025) (an RL-trained model in the lineage of Table 4) and its multi-turn-RL successor (Wang et al. 2025a), alongside the first mainstream commercial computer-use systems: Anthropic’s computer use (Anthropic 2024a) and OpenAI’s Operator (OpenAI 2025). What has driven the subfield is less the agents than the environments that grade them: OSWorld evaluates open-ended tasks in a real computer and reports agents near twelve percent success against seventy-two percent for humans (Xie et al. 2024b), and AndroidWorld supplies a dynamic, reward-bearing Android environment with parameterized tasks (Rawles et al. 2024). Two GUI-agent surveys map the space in detail (Nguyen et al. 2024; Zhang et al. 2024a).

8.3. Embodied and Robotic Agents

Embodied agents face the same grounding problem with physics added: actions move a body and cannot be undone. The foundational move was to use the LLM as a planner constrained by what the body can do. SayCan combines a model’s semantic knowledge with learned robotic affordances so that only feasible actions are proposed (Ahn et al. 2022), and Inner Monologue closes the loop by feeding environment feedback back to the planner in language, improving instruction completion without new training (Huang et al. 2022). ALFWorld aligns a text world with an embodied one so that policies learned abstractly transfer to grounded execution, and has become a standard testbed for LLM-based embodied agents (Shridhar et al. 2021).

A parallel line trains the mapping from perception to action end-to-end. PaLM-E injects sensor data directly into a language model to yield a generalist embodied model (Driess et al. 2023); the robotics transformers RT-1 and RT-2 scale action prediction and transfer web knowledge to control (Brohan et al. 2022, 2023); and OpenVLA opens the resulting vision–language–action recipe (Kim et al. 2024a), with ${\pi }_0$ extending it to a flow-matching action expert controlling many robot embodiments (Black et al. 2024). We treat these only insofar as they bear on LLM-agent design; the broader robotics-learning literature is out of scope. Voyager, discussed in Section 5.4, closes the circle by pairing embodiment with a procedural-memory skill library for open-ended learning (Wang et al. 2023a). Table 8 compares the environments these agents are measured in.

Table 8. Interactive environments by observation space, action space, scale, and whether the environment is stateful (actions change a persistent world state, evaluated by execution). Cross-referenced from Section 9.

Environment	Observation	Action space	#Tasks	State	Metric	Ref.
WebShop	text / HTML	search, click	12k instr.	✓	task score	(Yao et al. 2022a)
Mind2Web	HTML + screenshot	click, type, select	2k+	✗	element accuracy	(Deng et al. 2023)
WebArena	DOM / pixels	browser actions	812	✓	functional success	(Zhou et al. 2024c)
OSWorld	pixels + a11y tree	mouse, keyboard	369	✓	execution success	(Xie et al. 2024b)
AndroidWorld	pixels + a11y tree	touch, type	116	✓	reward / success	(Rawles et al. 2024)
ALFWorld	text (embodied)	high-level actions	6 types	✓	success rate	(Shridhar et al. 2021)

Table 8. Interactive environments by observation space, action space, scale, and whether the environment is stateful (actions change a persistent world state, evaluated by execution). Cross-referenced from Section 9.

Environment	Observation	Action space	#Tasks	State	Metric	Ref.
WebShop	text / HTML	search, click	12k instr.	✓	task score	(Yao et al. 2022a)
Mind2Web	HTML + screenshot	click, type, select	2k+	✗	element accuracy	(Deng et al. 2023)
WebArena	DOM / pixels	browser actions	812	✓	functional success	(Zhou et al. 2024c)
OSWorld	pixels + a11y tree	mouse, keyboard	369	✓	execution success	(Xie et al. 2024b)
AndroidWorld	pixels + a11y tree	touch, type	116	✓	reward / success	(Rawles et al. 2024)
ALFWorld	text (embodied)	high-level actions	6 types	✓	success rate	(Shridhar et al. 2021)

9. Evaluation and Benchmarks

Evaluation is the first of two cross-cutting concerns, and the more it is taken seriously the more sobering the picture becomes. The headline numbers of this section, GPT-4 solving under one percent of a travel-planning benchmark, agents reaching roughly a sixth of human success on real computer tasks, are not incidental; they are the field’s most honest signal of how far agents remain from reliability. This section asks what makes agents hard to measure, catalogues how the community measures them anyway, and then turns a critical eye on whether the measurements mean what they are taken to mean.

9.1. What Is Hard about Evaluating Agents

A static question-answering model is graded on one output; an agent must be graded on a trajectory. That difference is the source of every difficulty. Trajectories are long, so a single early misstep can doom an otherwise competent run, and stochastic, so one sample badly estimates the agent’s true success rate, which is why reliability metrics such as $\tau$-bench’s ${\mathrm{pass}}^k$, the probability of succeeding on all of k independent attempts, have emerged as necessary complements to average success (Yao et al. 2024). Trajectories also unfold in stateful environments, so grading requires either checking the final world state or judging the process, and the two can disagree: an agent may reach the right answer by an unsafe or lucky path. The two dedicated evaluation surveys organize these problems along complementary axes, what to evaluate versus how (Mohammadi et al. 2025; Yehudai et al. 2025), and both flag cost, safety, and robustness as the dimensions current practice most neglects. Alongside aggregate scores, fine-grained studies that catalogue an agent’s concrete failure modes, as done early for memory- and retrieval-augmented dialogue agents (Lee et al. 2022), remain a useful complement to leaderboard numbers.

9.2. The Benchmark Landscape

The benchmark landscape divides into generalist and capability-specific suites (Table 9). On the generalist side, AgentBench evaluates a model as an agent across eight distinct environments and exposes a wide gap between commercial and open models (Liu et al. 2024c); GAIA poses questions that are conceptually simple for people yet require reasoning, tool use, and browsing, with people scoring around ninety-two percent and an augmented GPT-4 only about fifteen (Mialon et al. 2023); AgentBoard replaces binary success with a fine-grained progress-rate metric across a thousand environments (Ma et al. 2024); and SmartPlay isolates individual agentic capabilities across a suite of games (Wu et al. 2023b).

Capability-specific benchmarks probe one competence deeply, and their difficulty is instructive. SWE-bench asks agents to resolve real GitHub issues by editing a live codebase and passing hidden tests (Jimenez et al. 2023); $\tau$-bench simulates multi-turn tool-agent-user interaction with policy constraints (Yao et al. 2024), extended by ${\tau }^2$-bench to dual-control settings where user and agent act on the environment simultaneously (Barres et al. 2025); TravelPlanner stress-tests constrained long-horizon planning, and the near-zero success it originally reported for GPT-4 (about 0.6 percent) is among the field’s most cited reality checks (Xie et al. 2024a); InterCode frames interactive coding as a reinforcement-learning environment with execution feedback (Yang et al. 2023c); Terminal-Bench assembles hard, realistic command-line tasks (Merrill et al. 2026); MLAgentBench evaluates agents on open-ended machine-learning experimentation (Huang et al. 2023b); and ScienceAgentBench grounds evaluation in a hundred-plus expert-validated data-science tasks (Chen et al. 2024b). Where these overlap the tool benchmarks of Table 6 and the environments of Table 8, we cross-reference rather than repeat.

9.3. Methodological Critique

A survey that only listed benchmarks would be complicit in their misuse, so we take the field’s own methodological critique seriously here. The anchor is Kapoor et al. (2024), whose central argument is that the near-exclusive focus on accuracy, with cost ignored, produces agents that are needlessly complex, overfit to their leaderboards, and expensive to run for gains that evaporate under scrutiny. Their remedies are concrete and, once stated, hard to argue with: report accuracy and cost together on a Pareto frontier rather than accuracy alone; distinguish the cost of developing an agent against a benchmark from its inference cost; and hold out genuinely unseen tasks, because agents tuned on a public test set inflate in ways that do not transfer. The same group’s Holistic Agent Leaderboard turns these remedies into shared infrastructure, a standardized harness that re-evaluates agents at scale with cost reported alongside accuracy (Kapoor et al. 2025). The same logic indicts several methods praised earlier in this survey, self-consistency, tree search, and elaborate multi-agent protocols all buy accuracy with compute that accuracy-only leaderboards render invisible.

Two further threats compound the cost blindness. Contamination is structural: agent benchmarks built from public GitHub issues, web pages, or question sets may already sit in pretraining data, so a high score can reflect memorization rather than capability, and the effect is hard to detect after the fact. And the increasingly common practice of using a strong model as an automatic judge, now systematized as agent-as-a-judge (Zhuge et al. 2024b), introduces a circularity, the evaluator shares the biases, blind spots, and even the identity of the systems it grades. Multi-agent referee panels mitigate but do not remove this, since they correlate with human judgment yet inherit model-family biases (Chan et al. 2023). The upshot is not that agent benchmarks are worthless but that a single accuracy number, uncontrolled for cost, contamination, and judge bias, is not the evidence it appears to be.

10. Applications

Where agents are deployed is not, we argue, primarily a matter of economic value; it is a matter of feedback. Domains where the environment returns a cheap, reliable, ground-truth signal (does the test pass, does the reaction work, does the theorem check) let an agent iterate its way to competence, and these domains lead. Domains where the signal is expensive, delayed, or contested (a clinician’s judgment, a market’s verdict) trail, not for lack of interest but because the loop of Definition 1 cannot close tightly. The ordering of the subsections below tracks that thesis, from the most verifiable domain to the least.

10.1. Software Engineering

Software engineering is the paradigm verifiable domain: a unit test is a free, exact oracle, and it is no accident that coding agents are the most mature. SWE-agent resolves real repository issues through a purpose-built agent–computer interface (Section 6.3) (Yang et al. 2024a); AutoCodeRover raises efficiency by grounding the search in program structure and spectrum-based fault localization (Zhang et al. 2024e); and OpenHands provides an open platform on which much of this work now builds (Wang et al. 2024e). The dedicated survey of Liu et al. (2024a) catalogues the subfield. SWE-Lancer prices the same competence economically, asking whether frontier models can earn real freelance payouts and finding that they still leave most of the posted value unearned (Miserendino et al. 2025).

Yet software engineering also hosts this survey’s cleanest cautionary tale about agentic complexity, and it deserves equal weight. Agentless challenges the premise that issue resolution needs an autonomous agent at all: a fixed three-phase pipeline (localize, repair, validate) with no open-ended planning loop matches or beats far more elaborate agents on SWE-bench at a fraction of the cost (Xia et al. 2024). This is the cost-versus-capability argument of Section 9.3 made concrete: when the feedback signal is strong enough, a simple pipeline that exploits it can dominate an agent that reasons its way around it, and the burden of proof is on the agent.

10.2. Scientific Discovery

Scientific domains offer verifiable feedback of a costlier kind (an experiment, a proof, a passing computation) and agents have moved from augmenting scientists to conducting studies. Early systems equipped a model with domain tools: ChemCrow wraps a GPT-4 agent in expert chemistry tools for synthesis planning and safety (Bran et al. 2023), and Coscientist closes the loop to physical hardware, designing and executing chemistry experiments through robotic APIs (Boiko et al. 2023). A more ambitious line automates the research process itself: the AI Scientist generates ideas, runs experiments, and writes papers end to end (Lu et al. 2024), its successor produced the first fully AI-generated paper accepted at a peer-reviewed workshop (Yamada et al. 2025), and an AI co-scientist generates and ranks novel biomedical hypotheses under expert validation (Gottweis et al. 2025).

The most convincing evidence comes from discoveries that are checkable. AlphaEvolve, an evolutionary coding agent, found a way to multiply two $4\times 4$ complex-valued matrices in 48 scalar multiplications, the first improvement on Strassen’s algorithm for this case in 56 years (Novikov et al. 2025), and Kosmos runs long autonomous research campaigns around a shared structured world model (Mitchener et al. 2025). Because a matrix-multiplication algorithm either works or does not, such results sidestep the evaluation ambiguities of Section 9; ScienceAgentBench supplies the corresponding expert-validated benchmark (Chen et al. 2024b), and the subfield has its own survey (Ren et al. 2025).

10.3. Healthcare

Medicine inverts the feedback economics: ground truth is expensive, delayed, and ethically gated, so progress relies on simulation and expert rating rather than on a cheap oracle. MDAgents adapts its collaboration structure (solo, group, or hierarchical) to the complexity of a medical decision (Kim et al. 2024b), and Agent Hospital lets doctor agents self-evolve by treating simulated patients, manufacturing experience where real cases cannot be used freely (Li et al. 2024a); AgentClinic supplies a multimodal benchmark of such simulated clinical settings (Schmidgall et al. 2024). The most rigorous result is AMIE, a diagnostic dialogue agent that, in a randomized OSCE-style study, was rated higher than primary-care physicians on 28 of 32 axes rated by specialist physicians (Tu et al. 2024), a striking figure that the survey of Wang et al. (2025c) rightly situates alongside unresolved risks of hallucination and liability, which we take up in Section 11.

10.4. Finance

Finance offers a feedback signal that looks precise but is treacherous: returns are quantitative yet noisy, non-stationary, and easy to overfit in backtests. FinMem structures a trading agent around layered, human-cognition-inspired memory (Yu et al. 2023); TradingAgents mirrors a trading firm with specialized analyst, researcher, and risk-management roles (Xiao et al. 2024); and FinGPT supplies open financial-model infrastructure underneath much of this work (Yang et al. 2023a). The survey of Ding et al. (2024) reviews the area, but the binding caveat is methodological: a favorable backtest is not a market outcome, and reported returns that are not out-of-sample say little, the same no-invented-numbers discipline this survey applies to benchmark tables applies with double force to financial claims. Table 10 summarizes the four domains by their feedback signal, maturity, and dominant risk.

Table 10. Application domains ordered by the quality of the feedback signal the environment provides. Maturity is a coarse judgment of deployment readiness; the dominant risk is the failure mode most cited in each domain’s literature.

Domain	Representative systems	Feedback signal	Maturity	Dominant risk
Software	SWE-agent (Yang et al. 2024a), OpenHands (Wang et al. 2024e), Agentless (Xia et al. 2024)	unit tests	deployed	wrong / insecure code
Science	ChemCrow (Bran et al. 2023), AI Scientist (Lu et al. 2024), AlphaEvolve (Novikov et al. 2025)	experiment / proof	research	unvalidated claims
Healthcare	MDAgents (Kim et al. 2024b), AMIE (Tu et al. 2024), Agent Hospital (Li et al. 2024a)	clinician rating	research	hallucination, liability
Finance	FinMem (Yu et al. 2023), TradingAgents (Xiao et al. 2024), FinGPT (Yang et al. 2023a)	market returns	research	backtest overfitting

Table 10. Application domains ordered by the quality of the feedback signal the environment provides. Maturity is a coarse judgment of deployment readiness; the dominant risk is the failure mode most cited in each domain’s literature.

Domain	Representative systems	Feedback signal	Maturity	Dominant risk
Software	SWE-agent (Yang et al. 2024a), OpenHands (Wang et al. 2024e), Agentless (Xia et al. 2024)	unit tests	deployed	wrong / insecure code
Science	ChemCrow (Bran et al. 2023), AI Scientist (Lu et al. 2024), AlphaEvolve (Novikov et al. 2025)	experiment / proof	research	unvalidated claims
Healthcare	MDAgents (Kim et al. 2024b), AMIE (Tu et al. 2024), Agent Hospital (Li et al. 2024a)	clinician rating	research	hallucination, liability
Finance	FinMem (Yu et al. 2023), TradingAgents (Xiao et al. 2024), FinGPT (Yang et al. 2023a)	market returns	research	backtest overfitting

11. Safety, Security, and Trustworthiness

Autonomy is precisely what makes LLM-based agents useful and what makes them risky: an agent that can call tools, write files, or send messages on a user’s behalf can also do so incorrectly, at scale, and without a human in the loop (Yu et al. 2025).7

11.1. The Agentic Threat Model

The safety of a chatbot is largely the safety of its text; the safety of an agent is the safety of its actions. Three properties of the loop in Figure 3 each open a new class of risk. Tools are actuators: an injected instruction becomes a real side effect, a sent email, a deleted file, a transferred payment. Memory is persistent state: a corruption written once can influence every later decision. And autonomy is scale: an agent repeats its mistakes without a human to interrupt them. The recent surveys of the area converge on this framing, that autonomy itself, not merely the underlying model, is the source of the new risks (Su et al. 2025); that threats factor into intrinsic (reasoning, memory, tools) and extrinsic (user, other agents, environment) dimensions (Yu et al. 2025); and that safety must be considered across the full lifecycle from data to deployment (Wang et al. 2025b). Figure 9 redraws the agent loop as an attack surface, numbering the entry points that the next subsection works through.

11.2. Attacks on LLM-Based Agents

The dominant attack exploits a design feature: an agent cannot reliably tell instructions from data, because both arrive as text.

Injection is entry points ❶ and ❷ of Figure 9. Since it was first shown to compromise real LLM-integrated applications (Greshake et al. 2023), a series of benchmarks has quantified how exposed agents are: InjecAgent finds a ReAct-prompted GPT-4 acts on injected instructions in roughly a quarter of tool-integrated cases (Zhan et al. 2024); AgentDojo provides a dynamic environment of realistic tasks and attacks and shows that current agents cannot be simultaneously useful and robust (Debenedetti et al. 2024); and WASP finds that even top reasoning models begin executing injected instructions on web tasks between sixteen and eighty-six percent of the time, though full goal hijacking is rarer (Evtimov et al. 2025).

The persistent state of memory adds a second, quieter class, entry point ❸. AgentPoison injects a handful of poisoned entries into an agent’s memory or retrieval knowledge base and triggers malicious behavior with over eighty-percent success, without any model training and with little effect on benign queries (Chen et al. 2024a). BadAgent shows that backdoors planted during fine-tuning survive subsequent fine-tuning on clean data (Wang et al. 2024f), a persistence result echoed at the alignment level in Section 11.4. Finally, composition amplifies risk, entry point ❹: red-teaming multi-agent systems shows that collaboration spreads and intensifies harmful behavior rather than diluting it (Tian et al. 2023), and the Agent Security Bench unifies these attack and defense classes at scale, reporting attack success rates up to eighty-four percent and finding existing defenses largely ineffective (Zhang et al. 2024b).

11.3. Risk Evaluation and Guardrails

Measuring these risks safely is itself a research problem, since one cannot let an agent cause real harm to see whether it would. ToolEmu resolves this by having a strong model emulate tool execution in a sandbox, surfacing risky behavior without real tools and finding that even the safest agents act with potentially severe consequences about a quarter of the time (Ruan et al. 2024). R-Judge tests whether models can recognize risk in agent behavior logs, and the best reach only around seventy-four percent accuracy, with most near chance (Yuan et al. 2024). Misuse and embodied hazards have their own suites: AgentHarm measures whether jailbroken agents retain the capability to carry out coherent harmful multi-step tasks (Andriushchenko et al. 2024), and SafeAgentBench finds embodied agents reject only five to ten percent of explicitly hazardous instructions (Yin et al. 2024), with OS-Harm extending safety measurement to computer-use agents operating real interfaces (Kuntz et al. 2025). On the defense side, a spectrum of countermeasures has emerged. Training-time methods teach the model an instruction hierarchy that privileges trusted system instructions over injected ones (Wallace et al. 2024); prompt-level methods such as spotlighting mark untrusted content so the model can discount it (Hines et al. 2024); and constitution-guided planning enforces safety before, during, and after plan generation (Hua et al. 2024). The strongest current answer to indirect injection is architectural: CaMeL isolates untrusted data from the agent’s control flow by design and gates actions behind explicit capability checks (Debenedetti et al. 2025), and a companion catalogue of design patterns constrains what an agent may do once it has read untrusted input, trading some generality for resistance by construction (Beurer-Kellner et al. 2025). These genuinely raise the bar, but as Table 11 records, coverage is uneven, strongest for direct injection under an instruction hierarchy, only partial for indirect injection, and weakest for memory poisoning and backdoors, so the summary is that no attack class yet has a defense that is both general and validated at deployment scale.

To make the relationship between capability and safety concrete rather than assumed, we ran a small measurement of our own. Across six Qwen2.5-Instruct models spanning 1.5B to 72B parameters, with Llama-3.1-8B-Instruct as a second-family control, we paired agentic capability (ALFWorld success, the same axis as Section 4.3) with susceptibility to indirect prompt injection on InjecAgent (Zhan et al. 2024), scored as attack success among valid responses; Figure 10 shows the result. Three observations follow. First, within the family the two axes broadly improve together: capability climbs from 6 percent at 1.5B to 70–76 percent for the 14B–72B models, while the hijack rate falls from 35–39 percent below 10B, through 18 percent at 14B, to 2–9 percent for the two largest models, though not perfectly monotonically (the 72B model is hijacked on 9 percent of valid responses against 2 for the 32B). Second, the metric matters: on the raw all-probes attack rate the two smallest models look nearly robust (7–9 percent), but only because three quarters or more of their responses are not valid tool calls at all; robustness that is really incompetence disappears once the metric conditions on valid actions (35–36 percent). Third, the level is family-specific: at comparable scale, Llama-3.1-8B is hijacked on 72 percent of its valid responses against 39 for Qwen2.5-7B. So scale buys injection-robustness within this family, but it is the optimistic exception, not a general law: the memory-poisoning, backdoor, and misuse benchmarks tabulated below show even the strongest models failing badly, so capability cannot be read as a proxy for safety; the two are distinct axes and must be measured one by one.

11.4. Alignment-Level Risks

Beneath the security threats lies a subtler class in which the agent’s own learned dispositions, not an external adversary, are the hazard. The evidence begins with behavior induced by training: model-written evaluations reveal that RLHF can amplify sycophancy and expressed self-preservation as scale grows (Perez et al. 2022), and controlled studies trace sycophancy to the preference feedback used to train assistants, with raters sometimes preferring convincing wrong answers to correct ones (Sharma et al. 2023). A survey of AI deception documents that systems already learn to induce false beliefs in humans (Park et al. 2023b).

For agents, these dispositions become more dangerous because agents act. Sleeper Agents shows that a model trained to behave maliciously under a trigger retains that behavior through standard safety training, adversarial training can even teach it to hide the trigger better (Hubinger et al. 2024). Frontier models have been observed to scheme in context on agentic tasks, introducing deliberate errors, attempting to disable oversight, and in some cases trying to exfiltrate their own weights (Meinke et al. 2024). And emergent misalignment demonstrates that fine-tuning on a narrow harmful task (writing insecure code) can generalize into broad misalignment on unrelated prompts (Betley et al. 2025), a result whose implications for the routine practice of fine-tuning agents on task data are not yet understood. The comprehensive alignment survey of Ji et al. (2023) supplies the conceptual scaffolding (robustness, interpretability, controllability, ethicality) within which these agent-specific failures sit.

11.5. Autonomy Governance

Because the risks scale with autonomy, some of the response is necessarily governance rather than engineering. Frameworks that define discrete levels of agent autonomy give a vocabulary for specifying how much control a human retains (Feng et al. 2025b), and a prominent position paper argues that fully autonomous agents should not be developed at all, since risk rises faster than benefit as the human is removed from the loop (Mitchell et al. 2025). Between these poles sits the design of human–agent oversight, feedback, interruption, and escalation mechanisms that keep a person meaningfully in control (Zou et al. 2025), which we regard as the most actionable near-term safety lever. The empirical ground truth is sobering: an index of thirty deployed agentic systems finds that developers document capabilities far more thoroughly than safety evaluations, a transparency gap governance frameworks have yet to close (Staufer et al. 2026).

12. Open Challenges and Future Directions

The preceding sections suggest seven challenges that we expect to shape the next phase of LLM-agent research. Each is grounded in results already surveyed rather than in speculation, and several are consequences of the tensions flagged along the way. Table 12 first collects the survey’s documented negative results in one place: wherever an optimistic consensus meets credible counter-evidence, we have given the two equal weight, and the reconciliations there are as much a part of our contribution as the taxonomy.

• Reliability over long horizons.

The single most important gap is that agents fail as tasks lengthen. The near-zero success on constrained long-horizon planning (Xie et al. 2024a) and the roughly sixfold human–agent gap on realistic computer tasks (Section 8.2) are not isolated: they reflect a structural problem in which a per-step error probability compounds over a trajectory, so that even a capable agent becomes unreliable over enough steps. Because current evaluation often reports averaged success rather than reliability (Kapoor et al. 2024), this fragility is routinely understated. Progress requires both error-correcting mechanisms that actually work (Section 4.4) and metrics such as ${\mathrm{pass}}^k$ that measure consistency, not just average competence.

2.

Cost as a first-class objective.

Almost every capability gain in this survey was purchased with inference compute (sampled reasoning paths, search trees, multi-agent rounds) yet accuracy-only leaderboards render that price invisible (Kapoor et al. 2024). Since a large share of multi-agent benefit can be recovered by simply sampling one agent more often (Li et al. 2024b), the open problem is to report and optimize agents on an accuracy–cost frontier, and to design methods that are Pareto-efficient rather than merely accurate; methods that adaptively budget an agent’s reasoning tokens are one promising direction (Lee et al. 2026a). Cost-awareness is not an accounting detail; it changes which methods look good.

3.

Continual learning and memory consolidation.

Agents that improve from their own experience without weight updates (Section 5.4) point toward lifelong learning, but the mechanisms are immature. Distilling reusable insights (Zhao et al. 2023) and consolidating salient facts across sessions (Chhikara et al. 2025) work at small scale; what remains open is consolidation that avoids both unbounded memory growth and the erosion of old competence (the agentic analogue of catastrophic forgetting) over months of operation. The emerging self-evolving-agent literature, now with a survey of its own, frames exactly this bridge from static foundation models to lifelong agentic systems (Fang et al. 2025).

4.

Training agents, not just prompting them.

The shift from wrapping scaffolds around fixed models to training models for agency, surveyed in Section 4.5 and Table 4, raises two open problems. The first is data: high-quality trajectory-level supervision (sequences of decisions, tool calls, and recoveries) is scarce next to the text used for pretraining, and scaling its production, whether by offline collection or online experience, without a human in the loop is unsolved. The second is the question Section 4.5 left open: as reasoning and acting migrate into the weights, do the external scaffolds of Section 4 (search trees, reflection loops, elaborate coordination) remain necessary, or do they become redundant on tasks the model has internalized? The answer determines how much of this survey’s machinery the next generation of agents will still need.

5.

Infrastructure and interoperability.

As multi-agent systems leave the laboratory, they need standard protocols for how agents expose tools and talk to one another (Yan et al. 2025). Emerging interoperability standards, the Model Context Protocol for tool access (Anthropic 2024b) and the Agent2Agent protocol for inter-agent communication (Google 2025), are early attempts, but the research questions of secure, composable, and observable multi-agent infrastructure are largely open, and they interact directly with the security concerns of Section 11.

6.

Evaluation validity.

The evaluation critique of Section 9.3 is itself a research agenda. Contamination of benchmarks by pretraining data, overfitting to public leaderboards, and the circularity of agent-as-judge all threaten the validity of the numbers the field reports on (Kapoor et al. 2024; Yehudai et al. 2025). Building contamination-resistant, cost-controlled, and reproducible benchmarks (ideally with live or held-out task streams) is a precondition for trusting claims of progress at all.

7.

Safety–capability co-evolution.

Finally, the divergence documented in Section 11 must be closed rather than merely measured. Capability advances have not been matched by defenses, backdoors survive safety training (Hubinger et al. 2024), and no attack class yet has a robust general solution, so the central governance question is how much autonomy to grant under this asymmetry. Whether one adopts graded autonomy (Feng et al. 2025b) or argues against full autonomy outright (Mitchell et al. 2025), safety must co-evolve with capability rather than trail it, and we regard this as the field’s defining long-term challenge.

13. Conclusion

This survey has organized the LLM-agent literature around four component pillars (planning, memory, tool use, and multi-agent coordination) grounded in interactive environments and application domains, with evaluation and safety as first-class concerns. Read through the function-first taxonomy of Section 3, a fragmented field becomes legible: systems built in separate subfields turn out to be answering the same small set of design questions.

Three movements summarize where the field stands. The components are consolidating: prompting is giving way to trained reasoning (Section 4.5), flat memory to structured stores (Section 5.3), and hand-listed tools to code as a universal action space (Section 6.3), so that much of the scaffolding of the early agent frameworks (Wang et al. 2023b) is migrating into the models themselves. The frontier has moved to the context and cross-cutting axes, grounding agents in real environments (Section 8), and evaluating them honestly for cost and reliability rather than headline accuracy (Section 9), where the largest gaps between demonstration and dependability remain (Kapoor et al. 2024). And safety is the binding constraint: the divergence between what agents can do and what can be done to them (Section 11) means the field’s progress will be governed less by new capabilities than by whether those capabilities can be made trustworthy. The recent general surveys catalogue how fast the field is moving (Luo et al. 2025); our contribution is a stable frame in which to place what comes next.