arXiv:2607.29069v1 [cs.DC] 31 Jul 2026
Rethinking AI Cloud Infrastructure for Agentic Serving Systems with the Aries Experimentation Framework Leonid Kondrashov∗
Hongrui Liu∗
JooYoung Park∗
[email protected] NTU Singapore Singapore
[email protected] NTU Singapore Singapore
[email protected] NTU Singapore Singapore
Boxi Zhou∗
Zonghao Liu
Chengzhi Lu
[email protected] NTU Singapore Singapore
[email protected] NTU Singapore Singapore
[email protected] NTU Singapore Singapore
Riccardo Mancini
Esha Choukse
Haris Javaid
[email protected] AWS United Kingdom
[email protected] Microsoft USA
[email protected] AMD, Singapore Singapore
German Sviridov
Tao Peng
Chen Zhao
[email protected] AMD, Singapore Singapore
[email protected] Ant Group China
[email protected] Ant Group China
Anastasia Avdeeva
Aleksei Gusev
Marios Kogias
[email protected] NCSpeech USA
[email protected] NCSpeech USA
[email protected] Imperial College London United Kingdom
Luo Mai
Dmitrii Ustiugov
[email protected] University of Edinburgh United Kingdom
[email protected] NTU Singapore Singapore
Abstract Autonomous agents challenge conventional LLM serving by coupling repeated inference with persistent context and sandboxed tool execution. We present Aries, a full-stack experimentation framework that separates task semantics from execution configurations, reconstructs cross-component agent trajectories with correlated system telemetry, and exposes stateful tool execution through a consistent interface across heterogeneous sandbox substrates. We use Aries to conduct reproducible experiments on open agent harnesses and benchmarks. We complement these experiments with production traces from a commercial platform, grounding low-level systems research in observed production behavior. Our results show that (1) token-centric metrics miss non-inference bottlenecks, (2) retaining additional context yields diminishing accuracy benefits while reducing serving capacity, and (3) tool sandboxes alternate between long idle periods and short resource bursts, while current snapshot-based state management makes aggressive suspension costly. A complementary security analysis further highlights the need to reduce the sandbox attack surface. We then discuss the ∗ These authors contributed equally as co-first authors.
vision for agent-native serving systems designed around trajectorylevel metrics, adaptive context management, elastic sandbox resource management, and sandboxes with minimized attack surface.
1
Introduction
Large Language Models (LLMs) are rapidly evolving from prompt responders into autonomous agents. Open-source agents such as OpenClaw and Hermes have collectively attracted over half a million GitHub stars within months of their public releases [31, 32], while closed-source commercial agents such as Claude and Codex are used by millions of people [7]. An agent places the model inside a feedback loop: it observes the current state, selects an action, executes that action through a tool, and uses the result to decide how the task should continue [27, 28, 49]. This shifts the system problem from serving isolated model requests to sustaining endto-end agent trajectories. Agent serving therefore no longer ends when the model emits tokens; each model response is only one step in an execution loop whose progress depends on both generated text and runtime state.
Conference’17, July 2017, Washington, DC, USA
Agent Serving Goes Beyond Inference. Like conventional LLM serving, agentic workloads are often hosted in cloud AI infrastructure [4, 28], but they impose fundamentally different system requirements. Conventional LLM systems optimize individual model calls: scheduling and resource management are focused on producing the next model response efficiently [23, 50, 52, 53]. This abstraction works when the surrounding application logic remains outside the serving system. In agent serving, however, each model call is only one step in a task loop. Faster GPU decoding remains useful, but end-to-end progress also depends on retained context, tool execution, and sandbox management. Agent serving therefore requires a holistic, full-stack system design, beyond just fast inference serving. Task Progress Needs System Visibility. Existing evaluation methods capture only part of agent execution. Agent benchmarks measure whether a task reaches the correct outcome [25, 29, 33, 54], whereas system benchmarks typically measure isolated model calls, stateless functions, or task transactions [11, 39, 43]. Neither of the above connects task progress and correctness to cross-layer runtime behavior, while task–execution entanglement and substratedependent tool behavior hinder controlled comparison. We use the agent trajectory as the unit of observation. A trajectory is the ordered record of model invocations, tool interactions, harness decisions, and the final task outcome. Based on this abstraction, we introduce Aries , a modular experimentation framework that separates task semantics from execution configuration, reconstructs cross-component trajectories with correlated telemetry, and standardizes tool execution across sandbox substrates, enabling reproducible comparisons and stage-level attribution of stalls and failures. We use Aries to conduct reproducible experiments on open benchmarks and complement them with production traces from a commercial platform (anonymized), thereby grounding low-level systems research in observed production behavior.1 Our experiments reveal limitations that the conventional modelcall metrics hide. Harness and tool execution can account for a heavy part of the end-to-end latency (e.g., up to 48%), so LLM-engine token throughput may diverge from task-level execution efficiency. Context retention creates an accuracy–capacity trade-off: controlled sweeps show that avoiding context overflows can raise task success from 55% to 95%, but gains plateau at workload-dependent thresholds, while production traces and controlled telemetry show that retained state reduces serving capacity. Production and controlled measurements also reveal mostly idle-but-bursty tool sandboxes, for which snapshot-based suspension remains economically infeasible. Our security analysis further motivates sandbox designs with minimal attack surfaces. Based on these insights, we discuss the vision for agent-native serving systems that feature trajectory-aware observability, control planes for trajectory context management and for the elasticity of agent-aware sandboxes, and sandbox designs that minimize the attack surface of tool execution.
2
Background and Motivation
We first discuss the differences between the conventional LLM serving and emerging agentic workloads, and their implications 1 The Aries code, toolchain, and the production traces are open source at https://github.
com/hyscale-lab/aries
Kondrashov et al. GPU Inference Engine LLM
Per-request
🗑
GPU Inference Engine
Action / Final Answer Prompt + Context
KV released
Serving Frontend Request
Host Side Agent Harness
LLM
Trajectory Context State (optional GPU-resident KV)
Tool Calls
Tool Results
Tool Sandbox
Request Response
(a) Conventional LLM Serving
Response
(b) Agent Serving
Figure 1: Overview of conventional LLM-serving and emerging agent-serving systems. for modern cloud AI infrastructure. We then discuss the existing benchmarking frameworks and why they fall short for systems research in agentic systems.
2.1
From Model Requests to Agent Trajectories
Conventional LLM serving systems are organized around the execution of individual model requests. As shown in Fig. 1a, the serving runtime processes a prompt, generates output tokens, manages accelerator memory, and returns a response [50, 53]. Scheduling and memory management are therefore scoped primarily to the active invocation. Depending on the cache policy, the engine may retain, offload, reuse, or reclaim the invocation’s KVcache state after execution [23, 34, 36, 52]. This request-centric design naturally prioritizes metrics such as time to first token, time per output token, request latency, and aggregate token throughput [18, 23, 35, 50, 52, 53]. Agent serving departs from this invocation-centric abstraction. As shown in Fig. 1b, the harness repeatedly invokes the LLM, dispatches tool calls to a sandboxed runtime, incorporates tool results into later prompts, and decides when the task is completed [25, 28, 49]. A single user request may therefore span many dependent model and tool steps. In this paper, we define an agent trajectory as the ordered sequence of LLM invocations, tool calls, tool results, and harness decisions produced while serving one user request. Individual model requests are steps within this larger execution unit rather than independent transactions. Trajectory state persists across these steps. The harness may represent this state as message history or structured events, while the serving layer may materialize reusable portions as cached model state, such as KV-cache prefixes. At the same time, model-generated actions execute on the host side within an isolated sandbox. Agent serving consequently spans GPU inference, host-side orchestration, persistent context state, and sandboxed execution, with dependencies across all four components.
2.2
Limitations of Existing Benchmarking Frameworks
Existing benchmarks answer complementary questions at incompatible granularities. Capability-oriented benchmarks evaluate whether an agent completes a realistic task, but largely treat the execution path as a black box [15, 19, 29, 30, 45, 48, 54]. Systems benchmarks can measure end-to-end performance and resource behavior, but typically consider individual requests or transactions as their unit of analysis [11, 13, 39, 43].
Rethinking AI Cloud Infrastructure for Agentic Serving Systems with the Aries Experimentation Framework
Manage
Aries Runner Setup
Task Exec. Config Config
Run Task
Agent Harness OpenClaw / Hermes / OpenHands
Manage
LLM Requests
Execute Tool Call
Tool Adapt.
Trajectory Events
Tool Sandbox K8S / GKE / Lambda MicroVM / Modal
Resource Usage
LLM Backend LLM LLM+GPU Trajectory / Metrics Collector Cloud / Self Hosted Prometheus / OTel / Grafana API Metrics
Figure 2: Aries architecture. The blue-colored components are instrumentation in the agent-serving loop, dedicated to bridging the measurement gap. None of the prior frameworks and benchmarks reveal how system behavior affects progress within a multi-step agent task. Task semantics are often entangled with harness- and runtime-specific choices, execution events remain fragmented across model, harness, and sandbox components, and stateful tool behavior depends on the underlying substrate. Agent serving therefore creates a measurement gap between semantic task progress and cross-layer system execution, making it difficult to isolate configuration effects, reconstruct complete trajectories, and attribute resource bottlenecks to task-level delays and failures.
3
Aries: Trajectory-Level Telemetry
The goal of Aries is to bridge the measurement gap between semantic task outcomes and cross-layer system behavior by treating an agent trajectory as the first-class citizen. This entails three challenges. First, task semantics are often entangled with execution choices, hindering controlled comparison across stacks. Second, agent execution spans independently managed components, making trajectories difficult to reconstruct or attribute from local logs. Third, tool execution is both stateful and substrate-dependent, complicating consistent comparison of its behavior and resource cost. Aries addresses these challenges with separate task and execution specifications, a shared trajectory schema that correlates cross-layer telemetry, and a substrate-independent interface for stateful tool execution and instrumentation. Fig. 2 presents the architecture of Aries. Task and execution loaders validate the specifications; the runner coordinates the harness and accesses LLM backends and sandbox substrates through adapters; and the telemetry collector merges framework events with cross-layer telemetry into a unified record. This design separates task semantics from execution configuration, preserves crosscomponent provenance, and standardizes stateful tool execution across sandbox substrates. Preserving task semantics across configurations. Agent frameworks often embed task semantics within harness-specific logic, so replacing a runtime component may inadvertently change the task being evaluated. Aries therefore separates the task specification, which captures the workload and its success semantics, from the execution specification, which selects the harness, model backend, sandbox, and telemetry stack. Dedicated loaders validate the two specifications, while LLM backend and sandbox adapters bind them to a concrete execution stack without task-specific changes. This separation enables controlled comparisons across configurations. Reconstructing cross-component trajectories. Agent runs may contain overlapping, failed, or retried operations across independently managed components, making component-local logs and
Conference’17, July 2017, Washington, DC, USA
timestamps insufficient for reliable reconstruction and attribution. Aries propagates trajectory and event identifiers across model and tool boundaries and records causal and ordering metadata under a common event schema. The telemetry collector then associates component metrics with these events, revealing where delays and resource pressure arise along the trajectory. Making stateful tool execution observable and portable. Tool calls operate on a persistent environment whose state affects subsequent trajectory steps, while different sandbox substrates expose different lifecycle and telemetry interfaces. Aries standardizes environment setup, tool invocation, state continuity, result collection, and telemetry hooks, while sandbox adapters map these operations onto concrete substrates. This makes tool execution a first-class, consistently observable stage of the trajectory while supporting different sandbox technologies.
4
Why Is Modern Cloud AI Infrastructure a Poor Fit for Agents?
Using Aries, we evaluate whether request-centric modern cloud AI infrastructure is sufficient for agent serving. Specifically, we ask which components determine the end-to-end critical path, how long-lived trajectory context affects serving efficiency and accuracy, how resources are utilized across LLM backends and tool sandboxes, and the adequacy of existing tool-isolation mechanisms. We first analyze an eight-hour workday production trace, including request lengths from ten LLM-serving instances and one-minute CPU and memory samples from 100 agent sandboxes, to establish high-level workload behavior at deployment scale. As the operational traces do not expose synchronized cross-layer events, we then reproduce the observed patterns with open harnesses and datasets and use Aries for deeper system-level analysis. For this controlled analysis, Aries integrates OpenHands [44], Hermes Agent [31], and OpenClaw [32], and evaluates serving tasks from SWE-Bench Pro [8], Terminal-Bench 2 [41], and DeepResearch Bench [9]. We sample 20 tasks from each benchmark to achieve 50% task success rate (important for the accuracy studies) with OpenClaw and repeat each task five times. Unless otherwise stated, experiments use Qwen3.6-35B-A3B-FP8 [37], served locally by SGLang [52] on a 96-core node with one NVIDIA H100 GPU with 94 GB of HBM.
4.1
Harnesses & Tools Matter as Much as Models
Existing LLM-serving engines optimize token-centric metrics such as TTFT and TPOT [23, 52, 53]. These metrics omit the host-side intervals during which the harness processes model outputs or waits for tool execution, even though the agent cannot advance until these steps complete. As the per-step timing information is too sensitive to collect in the commercial cluster, we base the analysis of the utility of existing metrics on the setup with public datasets and harnesses which record these events under a shared trajectory identifier and time base. Our profiling highlights two key system insights: (1) CriticalPath Shift to Harness and Tool Execution: As shown in Fig. 3, tool execution is an important latency contributor, contributing from 13% to 48% of the total latency across datasets and harnesses,
52
54
69
59
30
38
OH
HM
50 25 0
26 OH
48
43
HM
OC
61
85
13 OC
62
62
37
33
29
OH
HM
OC
105 104 103 Conv
(a) Context distribution
(a) Terminal-Bench 2 (b) DeepResearch Bench (c) SWE-Bench Pro
Figure 3: End-to-end average latency breakdown. Harness and tool execution contribute latency on par with LLM calls. OH-Tool
OH-LLM
HM-Tool
HM-LLM
OC-Tool
OC-LLM
0.5
1k
1
0k
1
k 00 1
10
1
00
1k
1
0k
1
k 00
Latency, ms
(a) TerminalBench 2
(b) DeepResearch Bench
(c) SWE-Bench Pro
Figure 4: Latency distributions for LLM inference vs. tool execution. Tool calls exhibit a severe long tail spanning multiple orders of magnitude.
Rate (%)
1
00
50
50 55
35 45 40 45 45 1050
0 0
50 30 40 0
50 50 45
35 35
64 96 128160192224256 Context window size(K)
(a) Terminal-Bench 2 while reaching 48% for Hermes Agent on Terminal-Bench 2. Beyond tool execution, the harness spends up to 9% of end-to-end time on orchestration and other host-side processing, further extending the interval between consecutive LLM calls and potentially prolonging the residency of trajectory state in GPU memory. (2) Long-Tailed Latency Profiles: Fig. 4 shows that while LLM latency remains important, tool calls exhibit a severe long tail that spans multiple orders of magnitude. Together, these results show that these massive host-side delays frequently dominate execution time, meaning that solely optimizing accelerator token generation cannot resolve the actual agent bottlenecks. Takeaway 1: End-to-end task duration depends heavily on harness and tool sandbox execution, rather than model inference alone.
4.2
Long Context Dictates Efficiency & Accuracy
In conventional LLM serving, context lifetimes are typically scoped to the request-response cycle, allowing engines to reclaim KV cache pages post-query unless explicitly retained or offloaded for reuse [17, 23, 26, 36, 52, 53]. Conversely, long-horizon agents generate monotonically growing histories that persist across the entire trajectory. While existing frameworks apply semantic compression to fit system limits [5, 38, 47], unmanaged context expansion still locks up physical GPU token pools and reduces serving concurrency [21, 24]. Retaining excessive history can increase tail delay, while aggressive compression may discard information required by later steps and reduce task accuracy [20, 21]. Resolving this accuracy-efficiency tension requires shifting from passive memory allocation to trajectory-aware state management that balances the resource cost and future utility of retained context. We first compare the context lengths observed in agentic serving and conventional inference, both retrieved from the production platform. Then, we characterize the trade-offs associated with the context budget and how they affect the accuracy and efficiency of agentic serving with the public harnesses and datasets. In the latter analysis, across all evaluated benchmarks, we sweep the context
Agentic
(b) Resident capacity
Compactions
20
0
Rate (%)
1
10
OpenClaw
Task success k 10 100 1k 10k 100 1
40
Figure 5: Context length and resident capacity comparison across conversation and agent requests in the production cluster. Agent workloads consume larger per-request KV footprints than conventional serving, sharply reducing the number of processed requests in parallel by an LLM backend.
Hermes
CDF
1
0
Agent
176
150 100 50 0 Conv
20
55 55 60
Context overflows
95 95 90 95
80 80 80 70 80 85 70
50
0 0
64 96 128160192224256 Context window size(K)
50
50
50 45 40
10 35 35 30 35 5
0 0 2050 0 0
(b) DeepResearch Bench
0 25 35 35 30 35 35 30
64 96 128160192224256 Context window size(K)
Event count
74
Tool
Event count
Share (%)
75
Harness
Ctx Len (tokens)
LLM
100
Kondrashov et al.
Max Resident Reqs
Conference’17, July 2017, Washington, DC, USA
20 0
(c) SWE-bench Pro
Figure 6: Compaction and context overflow counts with different context window sizes, and the corresponding task success rate. Larger windows ease overflow/compaction pressure, but task success plateaus past workload-specific thresholds. budget for both OpenClaw and Hermes Agent (omitting OpenHands for brevity) to determine when additional retained history stops providing meaningful accuracy gains. We then quantify the cost of context retention when serving 32 concurrent active agentic sessions with a 256K context size, sampling backend resource utilization once per second. We make three key observations: (1) Trajectory State Amplification: Production traces reveal substantially larger agent contexts than those observed in conventional inference workloads, which matches our results with the public datasets and harnesses. As quantified in Fig. 5, the average agent context consumes a substantially larger KV footprint than conventional inference. Under a fixed 25GB budget with the Qwen3.6 model, this state amplification reduces the maximum resident capacity from over 176 concurrent serving requests to merely 40—a 4.4× reduction. (2) Context Sufficiency Thresholds: Using the open datasets and harnesses, we show that long-context retention improves accuracy only up to a task-specific threshold, beyond which additional history, albeit consuming more memory, provides little to no accuracy benefits. As shown in Fig. 6, OpenClaw on DeepResearch Bench reaches peak success (95%) at 160K context, coinciding with the elimination of context overflows. Conversely, Terminal-Bench 2 and SWE-Bench Pro plateau or degrade once overflow pressure is removed, performing best at small or mid-size windows rather than the maximum context size. (3) Capacity-induced Batch Limitation: our results with public datasets further show that large retained state severely constrains serving capacity. Fig. 7a and Fig. 7b show that memory pressure limits effective batching despite a 32-session backlog; token-pool utilization peaks at 97%, while the engine sustains a median of only 22 concurrent requests. Under this pressure, the scheduler preempts
Rethinking AI Cloud Infrastructure for Agentic Serving Systems with the Aries Experimentation Framework
0
10
20
30
SM
Occ
HBM
100
50 25 0
Concurrent requests
50
OpenClaw - TB2 Hermes - TB2
Queue
25
100
10−2
10−1
100
(a) Concurrency of ac- (b) Resource pressure (c) Request waiting time tive trajectories (Act.), from KVC pool us- measured by TTFT and resident LLM-engine ses- age(KV), SM activity(SM) SGLang queue time sions (Res.), and queued and occupancy(Occ), and (Queue). sessions (Queue). HBM activity(HBM).
Figure 7: CDFs over the one-hour window of the agent serving. The workload sustains high concurrency and KV pressure, while long waits are concentrated in the request tail.
Harness CPU
0 0.0
0.5
CPU utilization
(a) CPU utilization
1.0
0 0.0
0.5
Memory utilization
1.0
(b) Memory utilization
Figure 8: CDFs of Harness CPU and memory utilization aggregating measurements taken every minute from the production cluster. The values are normalized for trace anonymization purposes. active sessions, and the 𝑝 95 internal queueing delay reaches 7.9s (Fig. 7c). Takeaway 2: Retaining context beyond its task-dependent utility yields diminishing accuracy benefits while increasing KV-cache occupancy, limiting batching, and prolonging queueing delays. The system must therefore actively manage trajectory state to balance task accuracy against serving efficiency.
4.3
OpenClaw - SWE Hermes - SWE
Tool Environment
1.0
OpenClaw - DR Hermes - DR
Tool Calls only
1.0
0
1 2 CPU util., cores
0.5
0
10 20 30 CPU util., cores
0.5
0
10 20 30 CPU util., cores
(a) CPU
Harness
1
Tool Environment
1
Tool Calls only
1
0
1 2 Memory util., GB
0
0
5 10 Memory util., GB
0
0
5 10 Memory util., GB
(b) Memory
Harness Memory
CDF
1
CDF
1
0.5
101
Waiting time (s)
Utilization / pool used (%)
Harness
1.0
50
0 0
TTFT
75
CDF
25
KV
75
CDF
50
0
100
Tool Sandboxes Must Be Elastic
Agent serving introduces CPU-based processing to the critical path: it alternates between idle intervals during LLM inference and short CPU/memory bursts during tool execution. Static peak resource provisioning avoids throttling these tool calls but leaves resources stranded a significant portion of the time. Cloud systems such as AWS Lambda MicroVMs [1] and Google Agent Sandbox [14] attempt to reduce waste by applying a stateful scale-to-zero approach via sandbox snapshot capture and restore (C/R). However, agentic tool execution patterns lead to a high number of capture-restore cycles, incurring additional costs, as we show below. We collect CPU and memory utilization from over 100 sandboxes on the same commercial platform, each co-hosting an OpenClawstyle harness and its tool calls. To confirm the trend and for in-depth analysis, we also collect CPU and memory utilization of harness and tool sandboxes in a controlled environment every second and analyze their distributions for OpenClaw and Hermes using the cloud DeepSeek V4 Flash API, which is production-grade and highly stable for tool call generation accuracy. We then analytically replay the recorded tool-call traces against the AWS Lambda MicroVMs pricing model [2] under different sandbox keepalive policies as in serverless deployments [12, 40]. We report the instance cost (CPU and memory usage), the snapshot C/R cost, and their sum. The ∞
Figure 9: Tool and harness CPU and memory utilization CDFs aggregating measurements taken every second. The tool environment is mostly idle, with high CPU utilization spikes during tool calls.
Absolute cost ($)
Queue
CDF (%)
CDF (%)
Res.
75
CDF (%)
Act.
100
Conference’17, July 2017, Washington, DC, USA
7 6 5 4 3 2 1 0
Instance Snapshot C/R
0s
5s
30s 60s Keepalive timeout
Total
300s
Figure 10: Absolute customer-visible cost of snapshot-based stateful scale-to-zero under different keepalive timeouts based on AWS Lambda MicroVM billing model. Short keepalive reduces instance cost but triggers frequent snapshot C/R, while longer keepalive reduces C/R by keeping the sandbox resident for more idle time. keepalive point corresponds to the persistent sandbox. DeepResearch is excluded from this comparison due to the tools’ low CPU usage. Fig. 8 shows that CPU compute and memory utilization in the production setting is spiky. We reproduce this with the public datasets and harnesses (Fig. 9), showing that agent tool sandboxes spend most of their trajectories at low utilization, yet exhibit sharp spikes in CPU and memory demand during tool execution. Across harnesses and workloads, CPU and memory remain idle for more than 80% and 50% of the time, respectively. At the same time, the toolcall-conditioned distributions show much more intensive resource use: the portion of time with idle resources drops below 20% for both CPU and memory. Fig. 10 shows that both users and cloud providers have an incentive to reduce keepalive to lower their costs: users avoid paying for idle sandboxes, while providers reclaim stranded capacity sooner. Yet current snapshot-based mechanisms and pricing prevent this alignment: if tool sandboxes are torn down after each tool call, their cost falls by 65%, but repeated snapshot C/R raises the total customer cost to 4.9× compared to the persistent baseline. Keeping tool sandboxes for longer reduces C/R overhead but increases idle time. Thus, today’s system forces a false choice between paying for idle capacity and paying for repeated snapshots and restores. However, these results suggest that the total cost can be reduced by 3× in an ideal system compared to the persistent-sandbox baseline.
Conference’17, July 2017, Washington, DC, USA
Kondrashov et al.
200
5
3
10%
2
5
1
5%
4 -0
3
Figure 11: Total and relative share of Linux kernel CVEs reported as found by AI agents or with AI assistance. There is a sharp increase in AI-found CVEs in Q2 of 2026.
Takeaway 3: Agent sandboxes are mostly idle but bursty when tools execute. Both users and providers should benefit from idle resource reclamation, yet current state-management mechanisms and pricing make aggressive suspension uneconomical.
4.4
Tool Sandboxes Are Under Continuous Siege
Cloud infrastructure is already designed to handle untrusted code execution, and uses the same mechanisms to sandbox agentic workloads. Beyond LLM-specific challenges, e.g., KV caches sidechannels [6] or sensitive input data [27], agents have the ability to autonomously discover and exploit vulnerabilities [42, 46, 51]. Frontier models already found advanced vulnerabilities in production system software, such as OS kernels and VMMs [3], hinting at the possibility of AI agents breaching cloud isolation. We use the share of Linux kernel CVEs identified by AI tools as a proxy for the ability of AI agents to find vulnerabilities autonomously. We compute that share as the proportion of commits in the Linux CVEs that explicitly mention using AI tools to find and fix vulnerabilities. We display our findings in Fig. 11. AI tools are playing an increasing role in finding vulnerabilities. On the Linux kernel, this is especially true since the introduction of Sashiko, an agentic patch review system [16]. The trend holds across CVE publishers, with a 3.5× increase in published CVEs for the second quarter of 2026 compared to previous records [10]. Exploiting known CVEs is also becoming cheap: agentic systems can develop exploits for a few dollars [42]. Agentic workloads are already highly capable of carrying sophisticated attacks against the cloud infrastructure. Therefore, sandboxes should expose a minimal attack surface, but also rely on defense-in-depth mechanisms to anticipate latent vulnerabilities. Takeaway 4: AI agents are highly capable of autonomously finding and exploiting vulnerabilities. Tool sandboxes should be designed to withstand advanced attacks and to anticipate increasing offensive model capabilities by reducing the attack surface.
5
Future Research Directions
Our results suggest that agent-serving systems should coordinate optimization decisions across the trajectory rather than manage model inference, context state, and tool execution independently. As illustrated in Fig. 12, this requires jointly optimizing task progress, capacity, and resources through four co-designed directions across the Runtime, Control, and Execution layers: (1) trajectory-capturing
Metrics
Metrics
Figure 12: Agent-native AI serving system vision. OpenHands
26
2
-0 26
1
-0
2
-0
26
26
1
-1 25
0
-1
-1
25
-0
25
-0 25
9
0% 8
0
100 50 0
TB2 SWE DR
Hermes
OpenClaw Solved / hour
0
15%
Solved / 1M gen. tok.
0
73
Control Plane
Generated tokens/s
400
Agent Harness Elastic Compute & Context Management State Management Hardened & Execution LLM Backends Environment Slim-fit Sandboxes Runtime
20
AI-found share
600
25
CVEs / month
AI-found Linux Kernel CVEs Other CVEs AI-found CVEs AI-found share
50
0
20
TB2 SWE DR
(a) token throughput (b) solved per 1M generated tokens
0
TB2 SWE DR (c) solved per hour
Figure 13: Token throughput, solved tasks per 1 million generated tokens, and solved tasks per hour. Token throughput can diverge from task goodput and execution efficiency in agent serving. metrics spanning all layers; (2) control plane for trajectory-aware context management; (3) elastic tool execution management via sandbox control; and (4) minimizing the tool sandbox attack surface.
5.1
Trajectory-capturing Metrics
Future agent-serving metrics should continuously quantify how system execution contributes to task progress. As illustrated in Fig. 13, evaluation should connect end-to-end outcomes, such as task success and completion rate, with low-level measures of execution speed and cost, including latency, generated tokens, and resource consumption. Task goodput and solved tasks per generated token provide useful endpoint metrics, but they become available only after a trajectory completes and cannot guide runtime decisions. A key research direction is therefore to derive online utility signals from trajectory events. Such signals should estimate the incremental progress contributed by each model call, harness decision, and tool interaction while accounting for its time and resource cost. They should distinguish productive actions from repeated or non-advancing steps and aggregate into end-to-end measures of task accuracy, execution speed, and system cost. This connection would allow low-level system optimizations to be evaluated by their actual contribution to agent task completion.
5.2
Control Plane for Trajectory-Aware Context Management
Our measurements in §4.2 reveal a workload-dependent trade-off between context sufficiency and serving capacity. Additional context increases KV-cache pressure and queueing delay, even when it provides only a small improvement in task success. This motivates a trajectory-aware control plane that monitors task and memory states, determines how context should be retained and placed, and directs the LLM backend to perform context compaction, KV-cache compression, or state transfer. (1) Adaptive Context Retention. The control plane should estimate the future utility of context as a trajectory evolves and request compaction or compression when the expected accuracy benefit of retained state no longer justifies its memory cost. Such decisions must remain conservative enough to preserve information needed by later model invocations. (2)
Rethinking AI Cloud Infrastructure for Agentic Serving Systems with the Aries Experimentation Framework
Hierarchical State Placement. The control plane should coordinate long-lived context placement across accelerator and lower-cost memory tiers rather than leaving all state resident on the accelerator. It should trigger KV-cache migration when the released accelerator capacity outweighs the transfer and restoration overhead.
5.3
Control Plane for Agent-Aware Elasticity
Our characterization in §4.3 shows that host-side resource demand is highly intermittent. Static provisioning wastes capacity, while conventional, horizontal autoscaling mechanisms are too expensive at such granularity. Future agent-serving platforms therefore require an elasticity control plane designed around model-driven, stateful execution. (1) Vertical, Model-Aware Compute Management. Research should explore how signals from the model, harness, and runtime can guide timely vertical scaling of individual sandboxes to satisfy the identified volatile demand for memory and core count fluctuations. Key questions include which signals reliably predict demand, how uncertainty should be handled, and how resources should be allocated across competing trajectories. (2) State Management for Elastic Execution. Because sandboxes retain files, processes, caches, and network state, elasticity requires decoupling execution state from physical placement and resource allocation. Research is needed on what state must remain resident, what can be externalized or reconstructed, and how to preserve consistency while resizing, suspending, or relocating sandboxes.
5.4
Sandboxes with a Minimal Attack Surface
AI agents are increasingly capable of autonomously finding and exploiting vulnerabilities. Thus, cloud infrastructure should anticipate increasingly sophisticated adversarial workloads. (1) Defense-inDepth and Minimizing Attack Surface. Sandboxes should be tailored to the workload to reduce the attack surface by restricting tool, network, and filesystem access based on the target tasks. Tool execution should leverage both host-side VM-level isolation and guest-side kernel-level sandboxing. For instance, workloads such as deep research do not need direct bash access, but can be granted a sandboxed JavaScript runtime within the guest. Also, the system design has to minimize the attack surface exposed to side-channel timing attacks across the agentic stack. (2) Formal Security Guarantees. In the long term, formal verification of security properties is the only path to certifying the absence of vulnerabilities. Migration to verified systems, such as seL4 [22], as a host hypervisor or guest kernel, will require major but necessary system overhaul to ensure the cloud remains secure despite models’ increasing offensive capabilities.
6
Conclusion
Agent serving turns conventional LLM serving into long-lived, stateful trajectories spanning model execution, harness logic, and sandboxes. We present Aries, a telemetry framework that combines reproducible experiments with production traces to characterize task and system behavior. Our findings motivate trajectory-capturing metrics, control planes for context management and agent-aware elasticity, and sandboxes with minimal attack surfaces.
Conference’17, July 2017, Washington, DC, USA
References [1] Amazon Web Services. 2026. AWS Lambda MicroVMs. https://aws.amazon.com/ lambda/lambda-microvms/. Accessed: 2026-07-03. [2] Amazon Web Services. 2026. AWS Lambda Pricing. https://aws.amazon.com/ lambda/pricing/. Accessed: 2026-07-03. [3] Nicholas Carlini, Newton Cheng, Keane Lucas, Michael Moore, Milad Nasr, Vinay Prabhushankar, Winnie Xiao, Hakeem Angulu, Evyatar Ben Asher, Jackie Bow, Keir Bradwell, Ben Buchanan, David Forsythe, Daniel Freeman, Alex Gaynor, Xinyang Ge, Logan Graham, Kyla Guru, Hasnain Lakhani, Matt McNiece, Mojtaba Mehrara, Renee Nichol, Adnan Pirzada, Sophia Porter, Andreas Terzis, and Kevin Troy. 2026. Assessing Claude Mythos Preview’s cybersecurity capabilities. Anthropic Research Blog. https://www.anthropic.com/research/mythos-preview Accessed: 2026-06-26. [4] Jinyuan Chen, Jiuchen Shi, Quan Chen, and Minyi Guo. 2025. Kairos: Low-latency multi-agent serving with shared llms and excessive loads in the public cloud. arXiv preprint arXiv:2508.06948 (2025). [5] Prateek Chhikara, Dev Khant, Saket Aryan, Taranjeet Singh, and Deshraj Yadav. 2025. Mem0: Building production-ready ai agents with scalable long-term memory. arXiv preprint arXiv:2504.19413 (2025). [6] Kexin Chu, Zecheng Lin, Dawei Xiang, Zixu Shen, Jianchang Su, Cheng Chu, Yiwei Yang, Wenhui Zhang, Wenfei Wu, and Wei Zhang. 2025. Selective kvcache sharing to mitigate timing side-channels in llm inference. arXiv preprint arXiv:2508.08438 (2025). [7] CryptoBriefing. 2026. Codex surges to 6 million active users, overtaking Claude Code’s 2 million. https://cryptobriefing.com/codex-surges-6m-users-overtakesclaude-code/. [8] Xiang Deng, Jeff Da, Edwin Pan, Yannis Yiming He, Charles Ide, Kanak Garg, Niklas Lauffer, Andrew Park, Nitin Pasari, Chetan Rane, et al. 2025. Swe-bench pro: Can ai agents solve long-horizon software engineering tasks? arXiv preprint arXiv:2509.16941 (2025). [9] Mingxuan Du, Benfeng Xu, Chiwei Zhu, Xiaorui Wang, and Zhendong Mao. 2025. DeepResearch Bench: A Comprehensive Benchmark for Deep Research Agents. arXiv preprint (2025). [10] Luke Emberson. 2026. Disclosure of serious cyber vulnerabilities spiked around the release of Claude Mythos Preview. Epoch AI. https://epoch.ai/data-insights/ cve-severity-spike Accessed: 2026-07-07. [11] Michael Ferdman, Almutaz Adileh, Onur Kocberber, Stavros Volos, Mohammad Alisafaee, Djordje Jevdjic, Cansu Kaynak, Adrian Daniel Popescu, Anastasia Ailamaki, and Babak Falsafi. 2012. Clearing the clouds: a study of emerging scale-out workloads on modern hardware. In Proceedings of the Seventeenth International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS’12). doi:10.1145/2150976.2150982 [12] Alexander Fuerst and Prateek Sharma. 2021. FaasCache: keeping serverless computing alive with greedy-dual caching. In Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (Virtual, USA) (ASPLOS ’21). Association for Computing Machinery, New York, NY, USA, 386–400. doi:10.1145/3445814.3446757 [13] Yu Gan, Yanqi Zhang, Dailun Cheng, Ankitha Shetty, Priyal Rathi, Nayan Katarki, Ariana Bruno, Justin Hu, Brian Ritchken, Brendon Jackson, et al. 2019. An open-source benchmark suite for microservices and their hardware-software implications for cloud & edge systems. In Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems. 3–18. [14] Google Cloud. 2026. About GKE Agent Sandbox. https://docs.cloud.google.com/ kubernetes-engine/docs/concepts/machine-learning/agent-sandbox. Accessed: 2026-07-03. [15] Izzeddin Gur, Hiroki Furuta, Austin Huang, Mustafa Safdari, Yutaka Matsuo, Douglas Eck, and Aleksandra Faust. 2024. A real-world webagent with planning, long context understanding, and program synthesis. In International Conference on Learning Representations, Vol. 2024. 52690–52717. [16] Roman Gushchin. 2026. Sashiko: An Agentic Linux Kernel Code Review System. https://sashiko.dev/. [17] Cunchen Hu, Heyang Huang, Junhao Hu, Jiang Xu, Xusheng Chen, Tao Xie, Chenxi Wang, Sa Wang, Yungang Bao, Ninghui Sun, et al. 2024. Memserve: Context caching for disaggregated llm serving with elastic memory pool. arXiv preprint arXiv:2406.17565 (2024). [18] Cunchen Hu, Heyang Huang, Liangliang Xu, Xusheng Chen, Jiang Xu, Shuang Chen, Hao Feng, Chenxi Wang, Sa Wang, Yungang Bao, Ninghui Sun, and Yizhou Shan. 2024. Inference without Interference: Disaggregate LLM Inference for Mixed Downstream Workloads. arXiv:2401.11181 [cs.DC] doi:10.48550/arXiv. 2401.11181 [19] Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R. Narasimhan. 2024. SWE-bench: Can Language Models Resolve Real-World GitHub Issues?. In The Twelfth International Conference on Learning Representations (ICLR 2024). https://openreview.net/forum?id=VTF8yNQM66 [20] Minki Kang, Wei-Ning Chen, Dongge Han, Huseyin A Inan, Lukas Wutschitz, Yanzhi Chen, Robert Sim, and Saravan Rajmohan. 2025. Acon: Optimizing context
Conference’17, July 2017, Washington, DC, USA
compression for long-horizon llm agents. arXiv preprint arXiv:2510.00615 (2025). [21] Sanjay Kariyappa and G Edward Suh. 2026. SideQuest: Model-Driven KV Cache Management for Long-Horizon Agentic Reasoning. arXiv preprint arXiv:2602.22603 (2026). [22] Gerwin Klein, Kevin Elphinstone, Gernot Heiser, June Andronick, David Cock, Philip Derrin, Dhammika Elkaduwe, Kai Engelhardt, Rafal Kolanski, Michael Norrish, et al. 2009. seL4: Formal verification of an OS kernel. In Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles. 207–220. [23] Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient Memory Management for Large Language Model Serving with PagedAttention. In Proceedings of the 29th Symposium on Operating Systems Principles (SOSP ’23). Association for Computing Machinery, New York, NY, USA, 611–626. doi:10.1145/3600006.3613165 [24] Hanchen Li, Runyuan He, Qiuyang Mang, Qizheng Zhang, Huanzhi Mao, Xiaokun Chen, Hangrui Zhou, Alvin Cheung, Joseph Gonzalez, and Ion Stoica. 2025. Continuum: Efficient and robust multi-turn llm agent scheduling with kv cache time-to-live. arXiv preprint arXiv:2511.02230 (2025). [25] Xiao Liu, Hao Yu, Hanchen Zhang, Yifan Xu, Xuanyu Lei, Hanyu Lai, Yu Gu, Hangliang Ding, Kaiwen Men, Kejuan Yang, et al. 2024. Agentbench: Evaluating llms as agents. In International Conference on Learning Representations, Vol. 2024. 52989–53046. [26] Yuhan Liu, Yihua Cheng, Jiayi Yao, Yuwei An, Xiaokun Chen, Shaoting Feng, Yuyang Huang, Samuel Shen, Rui Zhang, Kuntai Du, and Junchen Jiang. 2025. LMCache: An Efficient KV Cache Layer for Enterprise-Scale LLM Inference. (2025). arXiv:2510.09665 [cs.LG] https://arxiv.org/abs/2510.09665 [27] Junyu Luo, Weizhi Zhang, Ye Yuan, Yusheng Zhao, Junwei Yang, Yiyang Gu, Bohan Wu, Binqi Chen, Ziyue Qiao, Qingqing Long, et al. 2025. Large language model agent: A survey on methodology, applications and challenges. arXiv preprint arXiv:2503.21460 (2025). [28] Michael Luo, Xiaoxiang Shi, Colin Cai, Tianjun Zhang, Justin Wong, Yichuan Wang, Chi Wang, Yanping Huang, Zhifeng Chen, Joseph E Gonzalez, et al. 2026. Agentix: An Efficient Serving Engine for { LLM } Agents as General Programs. In 23rd USENIX Symposium on Networked Systems Design and Implementation (NSDI 26). 2443–2459. [29] Mike A Merrill, Alexander G Shaw, Nicholas Carlini, Boxuan Li, Harsh Raj, Ivan Bercovich, Lin Shi, Jeong Yeon Shin, Thomas Walshe, E Kelly Buchanan, et al. 2026. Terminal-bench: Benchmarking agents on hard, realistic tasks in command line interfaces. arXiv preprint arXiv:2601.11868 (2026). [30] Grégoire Mialon, Clémentine Fourrier, Thomas Wolf, Yann LeCun, and Thomas Scialom. 2024. Gaia: a benchmark for general ai assistants. In International Conference on Learning Representations, Vol. 2024. 9025–9049. [31] Nous Research. 2026. Hermes Agent: The Agent That Grows with You. https: //github.com/NousResearch/hermes-agent. Open-source software repository; accessed July 10, 2026. [32] OpenClaw Contributors. 2026. OpenClaw: Personal AI Assistant. https://github. com/openclaw/openclaw. Open-source software repository; accessed July 10, 2026. [33] Harshith Padigela, Chintan Shah, and Dinkar Juyal. 2025. Ml-dev-bench: Comparative analysis of ai agents on ml development workflows. arXiv preprint arXiv:2502.00964 (2025). [34] Zaifeng Pan, Ajjkumar Patel, Zhengding Hu, Yipeng Shen, Yue Guan, Wan-Lu Li, Lianhui Qin, Yida Wang, and Yufei Ding. 2025. KVFlow: Efficient Prefix Caching for Accelerating LLM-Based Multi-Agent Workflows. arXiv preprint arXiv:2507.07400 (2025). arXiv:2507.07400 https://arxiv.org/abs/2507.07400 [35] Pratyush Patel, Esha Choukse, Chaojie Zhang, Aashaka Shah, Íñigo Goiri, Saeed Maleki, and Ricardo Bianchini. 2024. Splitwise: Efficient Generative LLM Inference Using Phase Splitting. In 2024 ACM/IEEE 51st Annual International Symposium on Computer Architecture (ISCA). 118–132. doi:10.1109/ISCA59077. 2024.00019 [36] Ruoyu Qin, Zheming Li, Weiran He, Jialei Cui, Feng Ren, Mingxing Zhang, Yongwei Wu, Weimin Zheng, and Xinran Xu. 2025. MOONCAKE: trading more storage for less computation — a KVCache-centric architecture for serving LLM chatbot. , Article 10 (2025), 16 pages. [37] Qwen Team. 2026. Qwen3.6-35B-A3B: Agentic Coding Power, Now Open to All. https://qwen.ai/blog?id=qwen3.6-35b-a3b. [38] Preston Rasmussen, Pavlo Paliychuk, Travis Beauvais, Jack Ryan, and Daniel Chalef. 2025. Zep: a temporal knowledge graph architecture for agent memory. arXiv preprint arXiv:2501.13956 (2025). [39] Vijay Janapa Reddi, Christine Cheng, David Kanter, Peter Mattson, Guenther Schmuelling, Carole-Jean Wu, Brian Anderson, Maximilien Breughe, Mark Charlebois, William Chou, et al. 2020. Mlperf inference benchmark. In 2020 ACM/IEEE 47th Annual International Symposium on Computer Architecture (ISCA). IEEE, 446–459. [40] Mohammad Shahrad, Rodrigo Fonseca, Inigo Goiri, Gohar Chaudhry, Paul Batum, Jason Cooke, Eduardo Laureano, Colby Tresness, Mark Russinovich, and Ricardo Bianchini. 2020. Serverless in the Wild: Characterizing and Optimizing the
Kondrashov et al.
Serverless Workload at a Large Cloud Provider. In 2020 USENIX Annual Technical Conference (USENIX ATC 20). USENIX Association, 205–218. https://www. usenix.org/conference/atc20/presentation/shahrad [41] The Terminal-Bench Team. 2025. Terminal-Bench: A Benchmark for AI Agents in Terminal Environments. https://github.com/laude-institute/terminal-bench [42] Saad Ullah, Praneeth Balasubramanian, Wenbo Guo, Amanda Burnett, Hammond Pearce, Christopher Kruegel, Giovanni Vigna, and Gianluca Stringhini. 2025. From cve entries to verifiable exploits: An automated multi-agent framework for reproducing cves. arXiv preprint arXiv:2509.01835 (2025). [43] Dmitrii Ustiugov, Plamen Petrov, Marios Kogias, Edouard Bugnion, and Boris Grot. 2021. Benchmarking, Analysis, and Optimization of Serverless Function Snapshots. In Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS’21). ACM. doi:10.1145/3445814.3446714 [44] Xingyao Wang, Simon Rosenberg, Juan Michelini, Calvin Smith, Hoang Tran, Engel Nyst, Rohit Malhotra, Xuhui Zhou, Valerie Chen, Robert Brennan, and Graham Neubig. 2026. The OpenHands Software Agent SDK: A Composable and Extensible Foundation for Production Agents. In Proceedings of the 9th Conference on Machine Learning and Systems (MLSys ’26). arXiv:2511.03690 https://arxiv.org/abs/2511.03690 To appear. [45] Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh J Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, et al. 2024. Osworld: Benchmarking multimodal agents for open-ended tasks in real computer environments. Advances in Neural Information Processing Systems 37 (2024), 52040–52094. [46] Minrui Xu, Jiani Fan, Xinyu Huang, Conghao Zhou, Jiawen Kang, Dusit Niyato, Shiwen Mao, Zhu Han, Kwok-Yan Lam, et al. 2025. Forewarned is forearmed: A survey on large language model-based agents in autonomous cyberattacks. arXiv preprint arXiv:2505.12786 (2025). [47] Wujiang Xu, Zujie Liang, Kai Mei, Hang Gao, Juntao Tan, and Yongfeng Zhang. 2026. A-mem: Agentic memory for llm agents. Advances in Neural Information Processing Systems 38 (2026), 17577–17604. [48] Shunyu Yao, Noah Shinn, Pedram Razavi, and Karthik Narasimhan. 2024. 𝑡𝑎𝑢 bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains. arXiv preprint arXiv:2406.12045 (2024). [49] Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. 2022. React: Synergizing reasoning and acting in language models. arXiv preprint arXiv:2210.03629 (2022). [50] Gyeong-In Yu, Joo Seong Jeong, Geon-Woo Kim, Soojeong Kim, and ByungGon Chun. 2022. Orca: A distributed serving system for { Transformer-Based } generative models. In 16th USENIX symposium on operating systems design and implementation (OSDI 22). 521–538. [51] Andy Zhang, Joey Ji, Celeste Menders, Riya Dulepet, Thomas Qin, Ron Wang, Junrong Wu, Kyleen Liao, Jiliang Li, Jinghan Hu, et al. 2026. Bountybench: Dollar impact of ai agent attackers and defenders on real-world cybersecurity systems. Advances in Neural Information Processing Systems 38 (2026). [52] Lianmin Zheng, Liangsheng Yin, Zhiqiang Xie, Chuyue Sun, Jeff Huang, Cody Hao Yu, Shiyi Cao, Christos Kozyrakis, Ion Stoica, Joseph E. Gonzalez, Clark W. Barrett, and Ying Sheng. 2024. SGLang: Efficient Execution of Structured Language Model Programs. In Advances in Neural Information Processing Systems (NeurIPS ’24). https://arxiv.org/abs/2312.07104 [53] Yinmin Zhong, Shengyu Liu, Junda Chen, Jianbo Hu, Yibo Zhu, Xuanzhe Liu, Xin Jin, and Hao Zhang. 2024. DistServe: Disaggregating Prefill and Decoding for Goodput-optimized Large Language Model Serving. In 18th USENIX Symposium on Operating Systems Design and Implementation (OSDI 24). USENIX Association, Santa Clara, CA, 193–210. https://www.usenix.org/conference/osdi24/ presentation/zhong-yinmin [54] Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. 2024. WebArena: A Realistic Web Environment for Building Autonomous Agents. In The Twelfth International Conference on Learning Representations (ICLR 2024). https://openreview.net/forum?id=oKn9c6ytLx