CS 239 Fall 2026 Course Schedule & Reading List
CS 239 investigates the design, verification, and security of autonomous software engineering agents. Students will examine how coding agents leverage executable actions, multi-agent workflows, and structured reasoning to build and repair software at scale. The course bridges neural generation with formal verification, static analysis, and runtime enforcement to establish rigorous correctness guarantees. Finally, we explore agent infrastructure, capability-based isolation, and evaluation frameworks that address reward hacking and human intent.
Grade Calculation
- Individual Paper Presentations: 40% — Each student will present the assigned main paper once during the semester. There are 15 lecture slots with assigned readings, one main paper per lecture, so each student presents once (assuming enrollment of ~15 students; presentations are assigned at the start of the semester).
- Team Presentations: 20% — Each lecture also includes a short 10-minute team presentation by a group of 2–3 students. Teams choose their own topic from the optional papers listed in the Complete Paper Repository, or propose a technology demo of a relevant tool or system. Teams sign up for a slot at the start of the semester and may not duplicate a topic already covered by another team.
- Individual Project: 25% — Each student completes an individual project over the course of the semester. See the Project section below for full details and deliverables.
- Discussion Participation: 15% — All students are expected to participate actively in discussion every week.
How to Prepare for Presentations
Main Paper Presentations (Individual, ~50 minutes)
The assigned main paper for each lecture must be read by all class participants before class. The individual presenter leads the session: begin with a brief summary (about 5 minutes), then facilitate a 30–40 minute discussion. Presentations should not be slide-heavy or read verbatim from the paper — all participants are assumed to have read it. We encourage presenters to bring an annotated copy of the paper PDF with questions and notes, and strongly discourage reading off slides created by the authors or generated by LLMs. Most importantly, the presenter should be able to illustrate a working example on the whiteboard. The instructor will bring her own discussion questions, and answering these effectively will serve as a basis for grading.
Team Presentations (Teams of 2–3, ~10 minutes)
Each team selects an optional paper from the Complete Paper Repository or proposes a technology demo. Optional papers are not required reading for the rest of the class — the team presentation is the primary way other students encounter this material. Presentations should be concise, focused, and demo-driven where possible. Teams should make clear how their chosen paper or tool connects to the main paper of that day. Sign-ups are first-come, first-served at the start of the semester.
Course Schedule (Fall 2026)
Week 1: Benchmarks & Foundational Reasoning
- Lecture 1: Tuesday, September 29 — Course Introduction & Benchmarks
Suggested team presentations: SWE-bench Pro — addresses known flaws in SWE-bench with human-verified longer-horizon tasks, a natural extension of the main paper;
ImpossibleBench — reveals reward hacking as a failure mode in benchmark-driven evaluation, motivating why good benchmarks are hard to design.
- Lecture 2: Thursday, October 1 — The Agent Loop
Suggested team presentations: Self-Refine — contrasts with ReAct by showing a single model iterating within one episode (no environment), vs. ReAct's act-observe loop; good for discussing what "grounding" adds.
Week 2: Iterative Refinement & Search
- Lecture 3: Tuesday, October 6 — Verbal Reinforcement & Self-Feedback
Suggested team presentations: Self-Refine — closely related; comparing the two illuminates the difference between within-episode refinement (Self-Refine) and across-episode memory (Reflexion). A demo contrasting their trajectories on the same coding task would make a compelling 10 minutes.
- Lecture 4: Thursday, October 8 — Search over Reasoning States
Suggested team presentations: Agentic Program Repair from Test Failures at Scale (P10) — previews how Monte Carlo-style search over patches operationalizes ToT's ideas in a real SE context; or
Self-Refine — a simpler baseline that forgoes tree search in favor of a linear loop, useful for ablation discussion.
Week 3: Single-Agent Systems & Action Design
- Lecture 5: Tuesday, October 13 — Agent-Computer Interfaces
Suggested team presentations: AgentStepper — extends the ACI idea to interactive debugging, allowing humans to inspect and correct agent trajectories mid-execution;
CodeAct — argues Python is the ideal action language for LM agents, a direct design alternative to SWE-agent's bash-based ACI.
- Thursday, October 15 — Tutorial: Multi-Agent Frameworks (No Paper Presentation)
- Thaddy will give a tutorial on available multi-agent frameworks, covering setup, agent communication patterns, tool integration, and framework-specific conventions. Attendance is strongly recommended before starting Phase 1 of the project. No reading assigned.
Week 4: Applications — Repair
- Lecture 6: Tuesday, October 20 — Autonomous Program Improvement
Suggested team presentations: SpecRover — extends AutoCodeRover with LLM-extracted behavioral specifications to guide patch generation more precisely; natural sequel.
Execution Traces study — empirically evaluates agents including AutoCodeRover-style systems by examining their decision paths, grounding the theoretical claims in measured behavior.
- Lecture 7: Thursday, October 22 — Agentless Repair
Suggested team presentations: Agentic Pull Requests study — empirically examines what real agents actually do in GitHub PRs, directly testing Agentless-style claims in production;
SpecRover — answers the question "what if Agentless added formal intent extraction?" and is a strong contrast to Agentless's intentionally simple design.
Week 5: Applications — Static Analysis & Proof
- Lecture 8: Tuesday, October 27 — LLM-Driven Static Analysis
Suggested team presentations: Defusing Logic Bombs — applies LLM-generated ghost code to simplify symbolic execution constraints, a complementary dynamic analysis technique to IRIS's static approach; good for a side-by-side comparison of static vs. dynamic LLM-assisted analysis.
- Thursday, October 29 — Mid-Project Check-in: Phase 1 Due (No Paper Presentation)
- Phase 1 is due by the start of class. Submit your public GitHub repository containing your Phase 1 multi-agent application, at least three agentic trace files, and a draft requirements.md. Each student gives a brief demo of their running application and traces. Feedback from the instructor and peers will inform your policy design and Phase 2 porting work.
Week 6: Applications — Proof & Industrial Repair
- Lecture 9: Tuesday, November 3 — Agentic Proof Verification
Suggested team presentations: Clover — closes the loop even tighter by generating code, Dafny specifications, and proofs together, rather than verifying post-hoc; excellent contrast to AutoRocq's Rocq-feedback loop.
Automated Lemma Discovery — directly extends AutoRocq by tackling the hard sub-problem of proposing helper lemmas the agent needs but cannot derive alone.
- Lecture 10: Thursday, November 5 — Industrial-Scale Repair
Suggested team presentations: Agentic Pull Requests study — evaluates real-world outcomes of agents like this Meta system on actual GitHub repositories, bridging the lab-to-production gap;
PSearch — applies structured Monte Carlo tree search to patch generation, an alternative search strategy to the ReAct-loop used in the main paper.
Week 7: Applications — Runtime Enforcement & Prompt Injection
Week 8: Applications — Plans, Intent & Multi-Agent Foundations
- Lecture 13: Tuesday, November 17 — Plan Compliance & Intent Specifications
Suggested team presentations: Plan-Then-Execute — examines the human side of plan compliance, studying how users trust and monitor agents that separate planning from execution;
Semantic Commit — addresses what happens when plans drift over time by treating agent memory as evolving intent specifications requiring explicit update management.
- Lecture 14: Thursday, November 19 — Early Multi-Agent Systems
Suggested team presentations: AutoGen — a contemporaneous multi-agent framework with a different design philosophy (flexible conversational patterns vs. MetaGPT's structured SOP); comparing the two captures the early landscape.
LLM-MAS Survey — maps the broader field of multi-agent SE systems, situating MetaGPT within a larger taxonomy; strong choice for a team that wants breadth over depth.
Week 9: Thanksgiving Break (No Classes)
- Tuesday, November 24 — Thanksgiving Break (No Class)
- Thursday, November 26 — Thanksgiving Holiday (No Class)
Week 10: Multi-Agent Systems & Project Presentations
- Lecture 15: Tuesday, December 1 — Modular Multi-Agent Design
Suggested team presentations: Communication Topologies study — directly measures how the structure of agent communication (star, chain, fully connected) affects information propagation and error amplification, a complementary empirical view to AgentSquare's design-space search;
Agentix — the infrastructure layer required to serve multi-agent systems like those designed by AgentSquare at scale.
- Thursday, December 3 — Final Project Presentations
- All teams present final projects. No paper reading assigned for this session.
Project
Each student designs, builds, and hardens a multi-agent application in any domain — banking, travel booking, academic administration, graduate student affairs, healthcare, legal review, finance, or software engineering, among others. The application must involve at least two communicating agents with distinct roles. This is a BYOTC (Bring Your Own Token and Compute) project.
Phase 1 — Prototype: Build a working multi-agent application without a safety-enforcing framework. Submit at least three complete agentic traces (JSON or Markdown) capturing agent thoughts, actions, inter-agent messages, and observations, alongside a requirements.md specifying what the application does and what it must never do.
Phase 2 — Safe Port: Port the application to our multi-agent policy-assurance framework. Convert policies.md into explicit enforceable rules. Submit at least three traces: one compliant run and two demonstrating policy violations being correctly intercepted.
Deliverables (public GitHub repository): requirements.md, policies.md, Phase 1 source + traces, Phase 2 source + traces, traces/README.md explaining each scenario and which policy was triggered.
Milestones: Oct 15 — framework tutorial (Thaddy); Oct 29 — Phase 1 due (application + traces + draft requirements.md); Nov 12 — encoding policies.md as rules + early Phase 2; Dec 3 — final presentations (15 min, live demo).
Grading: Requirements quality 15%, Policy quality 15%, Phase 1 prototype and traces 20%, Phase 2 safe port and traces 30%, Presentation and open-source artifact 20%.
Complete Paper Repository (Grouped by Topic & Ordered by Citations)
Papers marked [Required] are the assigned main readings — all class participants must read these before the corresponding lecture. Papers marked [Optional] are available for team presentations; teams choose one optional paper or propose a technology demo.
1. Benchmarks & Evaluation
- P1. SWE-bench: Can Language Models Resolve Real-World GitHub Issues?. [ICLR 2024] [Required — Lecture 1] (Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, Karthik Narasimhan) (Citations: ~2,100+). Introduces the SWE-bench evaluation framework using real GitHub issues and pull requests as tasks; now the dominant benchmark for coding agents.
- P20. ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases. [ICLR 2026] [Optional] (CMU; Anthropic) (Citations: ~15). Makes requirements and tests incompatible to measure test exploitation and reward hacking.
- How Do AI Coding Agents Contribute to Software Development? An Empirical Study of Agentic Pull Requests. [FSE 2026] [Optional] (Iren Mazloomzadeh, Mohammad Mehdi Morovati, Foutse Khomh) (Citations: ~18). Analyzes real-world PRs submitted by autonomous AI agents on GitHub.
- Understanding Software Engineering Agents Through the Lens of Execution Traces. [arXiv 2025] [Optional] (Yuriy Brun et al.) (Citations: ~12). Evaluates popular SWE agents by analyzing execution decision paths and bug localization strategies.
- SWE-bench Pro: Human-Verified, Longer-Horizon Tasks. [OpenReview 2025] [Optional]. A follow-up to SWE-bench with human-verified, longer-horizon tasks addressing known flaws in the original benchmark.
2. Foundational Reasoning & Agent Loops
- P2. ReAct: Synergizing Reasoning and Acting in Language Models. [ICLR 2023] [Required — Lecture 2] (Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, Yuan Cao) (Citations: ~15,200). Introduces the interleaved reason-act-observe loop that underlies most modern agent architectures.
- P3. Reflexion: Language Agents with Verbal Reinforcement Learning. [NeurIPS 2023] [Required — Lecture 3] (Noah Shinn, Federico Cassano, Ashwin Gopinath, Karthik Narasimhan, Shunyu Yao) (Citations: ~7,200). Agents reflect on failed attempts in natural language and store verbal feedback as episodic memory to improve on future tries.
- P4. Tree of Thoughts: Deliberate Problem Solving with Large Language Models. [NeurIPS 2023] [Required — Lecture 4] (Shunyu Yao, Dian Yu, Jeffrey Zhao, Izhak Shafran, Tom Griffiths, Yuan Cao, Karthik Narasimhan) (Citations: ~8,600). Frames problem solving as search over a tree of intermediate reasoning states, enabling deliberate exploration and backtracking.
- P18. Self-Refine: Iterative Refinement with Self-Feedback. [NeurIPS 2023] [Optional] (Aman Madaan, Niket Tandon, Prakhar Gupta, Skyler Hallinan, Luyu Gao, Sarah Wiegreffe, Uri Alon, Nouha Dziri, Shrimai Prabhumoye, Yiming Yang, Hannaneh Hajishirzi, Peter Clark) (Citations: ~5,800). A single model generates, critiques, and refines its own output in a closed feedback loop without extra training.
3. Single-Agent Systems
- P5. SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering. [NeurIPS 2024] [Required — Lecture 5] (John Yang, Carlos E. Jimenez, Alexander L. Wettig, Kilian Lieret, Ofir Press, Shunyu Yao, Karthik R. Narasimhan) (Citations: ~2,489). SWE-agent makes commands, observations, feedback, and guardrails a first-class agent-computer interface designed specifically for LM agents rather than humans.
- Executable Code Actions Elicit Better LLM Agents. [ICML 2024] [Optional] (Xingyao Wang, Zihan Wang, Jiacheng Liu, Yangyi Chen, Lifan Yuan, Hao Peng, Heng Ji) (Citations: ~410). CodeAct argues that Python is the ideal action language for LM agents: it is stateful, composable, and expressive enough to replace ad-hoc tool-call formats. Used by most modern SE agents.
- Unified Software Engineering Agent as AI Software Engineer. [ICSE 2026] [Optional] (Leonhard Applis, Yuntong Zhang, Shanchao Liang, Nan Jiang, Lin Tan, Abhik Roychoudhury) (Citations: ~15). Introduces USEagent and USEbench for evaluating end-to-end capabilities of LLM software agents.
- AgentStepper: Interactive Debugging of Software Development Agents. [arXiv 2026] [Optional] (Robert Hutter, Michael Pradel) (Citations: ~1). Introduces an interactive debugger for software engineering LLM agents, enabling step-by-step inspection and correction of agent trajectories.
4. Multi-Agent Systems
- P14. MetaGPT: Meta Programming for a Multi-Agent Collaborative Framework. [ICLR 2024] [Required — Lecture 14] (Sirui Hong, Mingchen Zhuge, Jonathan Chen, Xiawu Zheng, Yuheng Cheng, Jinlin Wang, Ceyao Zhang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, Jürgen Schmidhuber) (Citations: ~4,000+). Encodes software engineering workflows — PRDs, architecture docs, code reviews — as structured communication protocols between specialized LLM agents.
- P15. AgentSquare: Automatic LLM Agent Search in Modular Design Space. [ICLR 2025] [Required — Lecture 15] (Tsinghua University) (Citations: ~153). Planning, reasoning, tool use, and memory become modules with evolutionary search over their compositions.
- AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation. [arXiv 2023] [Optional] (Qingyun Wu, Gagan Bansal, Jieyu Zhang, et al.) (Citations: ~3,000+). An early and influential framework for building multi-agent systems through structured conversational patterns among specialized LLM agents.
- LLM-Based Multi-Agent Systems for Software Engineering: Literature Review, Vision and the Road Ahead. [arXiv 2024] [Optional] (Lei Ma et al.) (Citations: ~210). A comprehensive survey mapping how specialized multi-agent collaboration architectures handle complex software tasks.
- Understanding the Information Propagation Effects of Communication Topologies in LLM-based Multi-Agent Systems. [EMNLP 2025] [Optional] (Jilin University; Griffith University; UNSW) (Citations: ~10). CAPE uses counterfactual interventions to measure how insights and errors propagate.
5. Applications of Agents to Software Engineering
5a. Repair
5b. Static & Dynamic Analysis
5c. Proof & Verification
- P9. Agentic Verification of Software Systems. [FSE 2026] [Required — Lecture 9] (Haoxin Tu, Huan Zhao, Yahui Song, Mehtab Zafar, Ruijie Meng, Abhik Roychoudhury) (Citations: ~1). Introduces AutoRocq, an LLM agent that improves formal proofs through feedback loops with Rocq.
- Clover: Closed-Loop Verifiable Code Generation. [arXiv 2024] [Optional] (Yiqi Ye et al.) (Citations: ~30+). Generates code, formal specifications (Dafny), and proofs in a closed loop where each component checks the others — directly connecting LLM code generation with formal verification.
- Automated Lemma Discovery in Agentic Program Verification. [ASE 2026] [Optional] (NUS; MIT) (Citations: ~1). LemmaNet proposes source-aware helper lemmas while Frama-C and Rocq check every accepted proof artifact.
5d. Security & Runtime Enforcement
- P11. AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents. [ICSE 2026] [Required — Lecture 11] (Singapore Management University) (Citations: ~3). Uses a stateful policy language and external monitor to intercept observable agent actions.
- P12. Defeating Prompt Injections by Design. [IEEE SaTML 2026] [Required — Lecture 12] (ETH Zürich; Google; Google DeepMind). CaMeL separates a privileged planner from a quarantined interpreter to neutralize prompt injection attacks.
- ACE: A Security Architecture for LLM-Integrated App Systems. [NDSS 2026] [Optional] (Northeastern University) (Citations: ~4). ACE derives an abstract plan from trusted inputs, checks information flow, and executes behind capability barriers.
- TraceFix: Repairing Agent Coordination Protocols with TLA+ Counterexamples. [ACM CAIS 2026] [Optional] (Rutgers University) (Citations: ~1). TraceFix generates PlusCal/TLA+, model-checks coordination protocols, and configures a runtime monitor.
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. [NeurIPS 2024] [Optional] (Edoardo Debenedetti, Jie Zhang, Mislav Balunović, Luca Beurer-Kellner, Marc Fischer, Florian Tramèr) (Citations: ~150+). Provides a dynamic benchmark and threat model for evaluating prompt injection attacks and defenses.
- Enforcing Temporal Constraints for LLM Agents. [arXiv 2025] [Optional] (UIUC; Meta). Agent-C combines a temporal-policy language, SMT checking, and constrained generation of compliant tool calls.
5e. Plans, Intent & Human Trust
6. Infrastructure & Systems
University Policies and Support for Students
Academic Integrity
Each member of the university is expected to uphold these values through integrity, honesty, trust, fairness, and respect toward peers and community. In your first week, you must read and sign UCLA's Academic Integrity Statement.
UCLA is a community of scholars. In this community, all members including faculty, staff and students alike are responsible for maintaining standards of academic honesty. As a student and member of the University community, you are here to get an education and are, therefore, expected to demonstrate integrity in your academic endeavors. You are evaluated on your own merits. Cheating, plagiarism, collaborative work, multiple submissions without the permission of the professor, or other kinds of academic dishonesty are considered unacceptable behavior and will result in formal disciplinary proceedings usually resulting in suspension or dismissal. See the Dean of Students website for more information.
Accommodations for Students with Disabilities
If you are already registered with the Center for Accessible Education (CAE), please request your Letter of Accommodation in the Student Portal. If you are seeking registration with the CAE, please submit your request for accommodations via the CAE website. Students with disabilities requiring academic accommodations should submit their request for accommodations as soon as possible, as it may take up to two weeks to review the request. For more information, please visit the CAE website, visit the CAE at A255 Murphy Hall, or contact us by phone at (310) 825-1501.
Resources for Students
UCLA provides resources if you are feeling overwhelmed and need personal and/or academic assistance.
Please see the Red Folder for more information.
Title IX and Equity, Diversity and Inclusion
Advocacy and Confidential Services:
Please note that Title IX prohibits gender discrimination, including sexual harassment, domestic and dating violence, sexual assault, and stalking. If you have experienced sexual harassment or sexual violence, you can receive confidential support and advocacy at the CARE Advocacy Office for Sexual and Gender-Based Violence, 205 Covel Commons, Los Angeles, CA, 90095, care@careprogram.ucla.edu, (310) 206-2465. Counseling and Psychological Services (CAPS) provides confidential counseling to all students and can be reached 24/7 at (310) 825-0768.
Reporting and Non-confidential Services:
Your professor is required under the UC Policy on Sexual Violence and Sexual Harassment to inform the Title IX Coordinator should he become aware that you or any other student has experienced sexual violence or sexual harassment. In addition, You can also report sexual violence or sexual harassment directly to the University’s Title IX Coordinator, 2255 Murphy Hall, titleix@equity.ucla.edu, (310) 206-3417. Reports to law enforcement can be made to UCPD at (310) 825-1491.
Engineering EDI Resources:
There are a number of specific resources on Equity, Diversity, and Inclusion available to students in the Samueli School of Engineering, including trained faculty officers in each department who can be consulted if you have a question on EDI issues and are not sure where else to turn. Please see https://samueli.ucla.edu/equity-diversity-and-inclusion for information.