Research
What we read, and what we take from it
Last verified: July 2026· reading list
Why a consultancy publishes a reading list
Most AI consulting content is assertion. We would rather show the work: these are the papers that actually shape how we route models, build eval harnesses, and architect agents that touch internal systems. If our advice contradicts the literature, you should be able to see that and push back.
A caveat we would rather state than have you assume: we read abstracts broadly and papers selectively. The notes below are our interpretation of why a piece of work matters to a production team — they are not claims about specific results. Every entry links to the paper. Where a number matters to a decision, read the source.
LLM cost & routing
- RouterBench: A Benchmark for Multi-LLM Routing SystemarXiv:2403.12031
Qitian Jason Hu, Jacob Bieker, Xiuyu Li et al. · 2024
Our take: Routing is a measurable engineering choice, not a vibe — this benchmarks multi-LLM routing systems, which is exactly the lever we pull first in a cost engagement.
- LLM Routing as Reasoning: A MaxSAT ViewarXiv:2603.13612
Son Nguyen, Xinyuan Liu, Ransalu Senanayake et al. · 2026
Our take: Frames routing as a reasoning/optimisation problem rather than a heuristic. Useful if you are building the router rather than buying one.
- Reward-Based Online LLM Routing via NeuralUCBarXiv:2603.30035
Ming-Hua Tsai, Phat Tran · 2026
Our take: Online routing that learns from reward signal — the direction of travel for teams whose traffic mix shifts underneath a static routing table.
Evaluation & LLM-as-judge
- A Survey on LLM-as-a-JudgearXiv:2411.15594
Jiawei Gu, Xuhui Jiang, Zhichao Shi et al. · 2024
Our take: The survey to read before you build an LLM-as-judge. Judges need validating against human labels; this is the map of how people do it.
- Can LLMs Replace Human Evaluators? An Empirical Study of LLM-as-a-Judge in Software EngineeringarXiv:2502.06193
Ruiqi Wang, Jiyu Guo, Cuiyun Gao et al. · 2025
Our take: Directly interrogates the assumption underneath most eval stacks: how far an LLM judge can stand in for a human evaluator.
Prompt injection & agent security
- Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language ModelsarXiv:2312.14197
Jingwei Yi, Yueqi Xie, Bin Zhu et al. · 2023
Our take: Early, load-bearing benchmark work on indirect prompt injection — the attack that matters once your agent reads untrusted content and holds tools.
Keegan Hines, Gary Lopez, Matthew Hall et al. · 2024
Our take: Spotlighting: a concrete defence for marking untrusted content so the model can tell instructions from data.
- Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection AttacksarXiv:2603.30016
Chong Xiang, Drew Zagieboylo, Shaona Ghosh et al. · 2026
Our take: System-level defences for agents. Aligns with our position: injection is an architecture problem (least privilege, audited tool access), not a prompt problem.
Qiang Yu, Xinran Cheng, Chuanyi Liu et al. · 2026
Our take: Defence at the tool-result boundary — relevant to anyone exposing internal systems to agents over MCP.
Coding agents & software engineering
- Agentic AI Software Engineers: Programming with TrustarXiv:2502.13767
Abhik Roychoudhury, Corina Pasareanu, Michael Pradel et al. · 2025
Our take: "Programming with trust" — the trust and verification gap is precisely what agent-readiness work closes.
- Unified Software Engineering Agent as AI Software EngineerarXiv:2506.14683
Leonhard Applis, Yuntong Zhang, Shanchao Liang et al. · 2025
Our take: A unified SWE agent. Useful context for what a coding agent can own end-to-end versus where a human gate belongs.
- LoCoBench-Agent: An Interactive Benchmark for LLM Agents in Long-Context Software EngineeringarXiv:2511.13998
Jielin Qiu, Zuxin Liu, Zhiwei Liu et al. · 2025
Our take: Benchmarks agents in long-context codebases — the setting where agent-readiness (boundaries, tests, context files) decides the outcome.
AI-generated code security
- AI Code Generators for Security: Friend or Foe?arXiv:2402.01219
Roberto Natella, Pietro Liguori, Cristina Improta et al. · 2024
Our take: Asks the question every security leader asks about AI code generators. Worth reading before you form a policy.
- Security Degradation in Iterative AI Code Generation -- A Systematic Analysis of the ParadoxarXiv:2506.11022
Shivani Shukla, Himanshu Joshi, Romilla Syed et al. · 2025
Our take: Security degradation across *iterative* AI code generation — the failure mode you get from agent loops, not single completions.
Domenico Cotroneo, Cristina Improta, Pietro Liguori et al. · 2023
Our take: Data poisoning against code generators — the supply-chain angle on AI-written code.
RAG & hallucination
Patrice Béchard, Orlando Marquez Ayala · 2024
Our take: Reducing hallucination in structured outputs via RAG — directly relevant if you are shipping extraction or structured generation.
- MultiRAG: A Knowledge-guided Framework for Mitigating Hallucination in Multi-source Retrieval Augmented GenerationarXiv:2508.03553
Wenlong Wu, Haofen Wang, Bohan Li et al. · 2025
Our take: Knowledge-guided RAG for hallucination mitigation.