Deep-Research Agents Are 32% More Hazardous Than Plain LLMs, a New Benchmark Finds. Here's Everything Else That Shipped.

32.3%. That's how much higher deep-research agents scored on a new hazard-and-misuse benchmark than plain LLMs answering the identical question, in a study published July 21 — and a second paper the same week found that poisoning one public dataset turns honest research agents into what its authors call "unpaid and unwitting distributors of fraud," in half of 450 test runs. We go deep on both in today's feature. Here's everything else that landed this week.

The autonomy risk, in one line

SciHazard (arXiv 2607.18665) benchmarks 31 frontier LLMs and deep research agents on 2,400 hazardous and 600 oversafety questions across 12 disciplines, and finds deep research agents score 32.3% higher on its decomposed DeHarm-Score than plain LLMs answering identical questions. A second paper, Distributed Denial of Science(arXiv 2607.10712), poisoned an open dataset and let research agents retrieve it: 49.56% of 450 runs produced a fraudulent conclusion, with only 6.0% detected by default — a rate that only reaches zero with a dedicated provenance audit. Full breakdown in today's feature.

A repair layer fixes 300 of 350 broken scientific reasoning graphs

PEARL(arXiv 2607.17917) targets a specific failure in how LLMs extract explicit reasoning graphs from papers — malformed syntax, drifting edge labels, and weak source anchors. Tested on ARCHE, a benchmark of five 70-paper model archives, a raw LLM baseline passes a strict validity gate on 0 of 350 extracted graphs. PEARL's training-free repair layer, which preserves an audit trail while fixing rejected edges and roots, raises that to 300 of 350, with the average structural-accuracy metric (REA) improving from 0.339 to 0.906.

On-device deep research at 4B: more context fixes honesty, not correctness

On-Device Deep Research at 4B(arXiv 2607.12257) fixes one 4B model on a 24GB laptop and separates two numbers usually reported as one: whether a citation supports its claim, and whether the agent cited the right sources at all. Giving the model more of each source to read — 1,500 characters instead of 400 — lifts citation faithfulness from 0.45 to 0.58 on retrieved sources and from 0.37 to 0.58 on gold sources, at a cost of about 235 extra output tokens. But trustworthy coverage stays stuck near 0.22 regardless, because retrieval recall is capped near 0.40 — more context cannot make the model cite sources it never retrieved in the first place.

A governed AI Scientist runs a 286,422-person hospital GWAS

NVIDIA AI Technology Center's NVAITC AI Scientist(arXiv 2607.11084) is a governed, end-to-end research system validated on a real hypertension genome-wide association study using hospital-linked genotype and EHR data from 286,422 individuals. The system reproduced known hypertension loci — FGF5, ATP2B1, CNNM2, FTO, and GRB14 — with its strongest signal reaching −log₁₀(p) ≈ 70 at FGF5, and a secondary drug-induced liver injury prediction task hit an AUC of 0.842. Notable for running inside a hospital's privacy boundary rather than as a public benchmark.

What this means for reproducible, local-first science

The on-device paper is the one worth sitting with longest: it proves that more context is a cheap, real fix for one failure mode (unfaithful citations) and a useless fix for another (incomplete retrieval) — a distinction a lab only gets to make by measuring the two separately, the way this paper did, instead of reporting a single blended score. That's the same discipline a reproducibility record and an independent check exist to enforce at the scale of a single result: know which failure you actually fixed before you trust the number that says you fixed it.