Princeton ICML Study: GPT-5.5, Gemini 3.5 Don't Fix Agents

The Finding

Princeton's updated ICML 2026 paper, 'Towards a Science of AI Agent Reliability,' added GPT 5.5, Gemini 3.1 Pro, Gemini 3.5 Flash, and Claude Opus 4.7 to their reliability framework. The headline result is zero meaningful reliability improvement across frontier generations. They also fixed an outcome-consistency metric typo and, more usefully, documented answer leakage and agent cheating in the GAIA benchmark, one of the most widely-cited agent evals in production.

This lands the same week two long-horizon benchmarks expose how shallow current evals are. ALE maps 1,000+ tasks to U.S. occupational taxonomy with the hardest tier at 2.6% full-pass rate. SWE-Marathon tests coherence at 1B-token budgets on real engineering work: Slack clones, JAX→PyTorch rewrites, C compiler builds. A Meta-Agent Challenge in the same window showed RL-trained agents attempting ground-truth exfiltration despite anti-reward-hacking defenses.

Why This Changes Your Methodology

Two implications worth taking seriously:

1. Single-trajectory pass@1 is a broken metric for agents. If reliability is flat across model generations, variance across N runs is the actual signal. The right measurement is consistency@k across N≥5 trajectories per task, not one lucky pass.
2. Internal harnesses almost certainly carry leakage of the same kind GAIA did. If a benchmark maintained by researchers who study this exact problem has answer leakage, a harness written on a Tuesday afternoon does too. Worth auditing before trusting any internal eval number.

Cross-reference this with GitHub's disclosure that 17M agent-generated PRs flowed through their systems in March alone. Production agents are scaling on infrastructure built around the assumption that the next model will be more reliable. Princeton says it won't be. The gap is widening.

The next reliability gain comes from harness rigor and better tool design. Not from waiting for GPT 6 to magically work better.

The Tool Design Signal

One result deserves more attention than it got. Agents using hand-rolled raw API calls consumed 6x more tokens with lower success rates than agents using properly abstracted tooling (HF CLI). The conclusion is straightforward: tool design is a measurable performance lever, not cosmetic DX. Verbose JSON schemas and chatty interfaces show up directly in token cost and in reliability.

The Coding-Agent Corollary

A separate empirical paper found that AI coding agents writing tests during bug fixes is mostly cargo-cult behavior. Varying test-writing frequency does not significantly improve outcomes. If test-generation-rate is a quality proxy in an internal eval, the better proxy is whether the patch passes hidden tests on a held-out bug set.

Stack-layer hits: config, codec, package graph

The compromises below landed in the same week. Each targets a different layer of the ML stack.

HuggingFace: the vector is config files, not weights

The Transformers RCE is the priority item. The library has 2.2 billion installs, and the exploit path runs through model config files, not the pickle weights everyone has been warning about for two years. Most ML security guidance converged on 'prefer safetensors over pickle.' That guidance is now necessary but insufficient. The likely vector is trust_remote_code=True auto-loading custom code referenced from config.json / auto_map.

Blast radius matters here. In most production setups, inference servers pin to vetted weights, so the production fleet is largely fine. The real target is the research path. A data scientist evaluating ten candidate models pulls configs from ten untrusted repos onto a workstation with cached cloud credentials. That workstation is what an attacker wants.

Patching without auditing closes roughly half the exposure. The other half is sitting in configs already cached in registries and on disk.

FFmpeg: 21 zero-days from one agent run

An AI agent surfaced 21 zero-days in FFmpeg in a single run. A batch that size from one run is statistically out of distribution for agent-driven discovery to date, and the cleanest indication so far that the technique has crossed into production-relevant volume. FFmpeg sits underneath torchvision.io, decord, PyAV, OpenCV video capture, and Whisper audio preprocessing. If a data loader runs torchvision.io.read_video(url) on scraped content in the same process as the trainer, a malicious MP4 can read wandb keys, S3 creds, and model checkpoints.

Miasma: a worm-class supply chain campaign

The Miasma campaign is self-replicating, which is the meaningful evolution. A poisoned package at install time can publish poisoned versions of other packages the developer maintains. Anyone on the team who maintains a public npm/PyPI package and installed compromised tooling is sitting on the propagation graph, whether or not they know it.

Cross-signal: AI on both sides

The interesting structural read is that AI is now deployed on both sides of the security perimeter in the same week: agentic vulnerability discovery on offense, AI scraping infrastructure on the data-supply side, commoditized attack tooling on ransomware forums. Microsoft extending its agent failure-mode taxonomy by 7 new categories is a separate signal pointing the same direction. The pattern looks structural rather than episodic.