- The paper proposes a two-dimensional framework linking cognitive progress from chatbots to thinking LLMs with execution progress from agents to persistent workspace systems.
- The paper argues that the Workspace + Skill paradigm enables durable, inspectable digital work by combining persistent files, tools, logs, permissions, reusable procedures, verification, and recovery.
- The paper finds that current systems remain unreliable and unsafe, with OpenClaw benchmarks showing roughly 33% or lower task success for some models, unsafe action rates up to 23%, and attack success rates reaching 40–75%.
This survey, authored by researchers at Tencent Youtu Lab, Tsinghua University, Sun Yat-sen University, Central South University, and the University of Illinois at Chicago (2606.14502), organizes the development of LLM systems along two coupled dimensions: the cognitive core (Chatbot → Thinking LLM) and tool-augmented task execution (Agent → OpenClaw-style workstation systems). Its central thesis is that a "Workspace + Skill" paradigm—persistent digital environments combined with reusable, parameterizable procedures—constitutes the mechanism that converts episodic conversational assistance into durable, verifiable digital work. The paper accompanies this argument with an account of the parallel shifts in data (instruction-response pairs → state–action–observation trajectories) and evaluation (final-answer accuracy → task closure, reliability, and trajectory-level safety).
A two-dimensional framing of LLM evolution
The survey's organizing contribution is a two-axis taxonomy. On the cognitive axis, the Chatbot era is characterized as fast, System-1-style generation: next-token prediction over parametrically compressed knowledge, producing fluent answers in a single autoregressive pass. The Thinking LLM era introduces deliberate, System-2-style cognition via long Chain-of-Thought (CoT), inference-time scaling, process supervision, and reinforcement learning (RL). On the execution axis, the Agent era organizes perception, planning, memory, and tool use into an environment–action–feedback loop (canonically ReAct), while the OpenClaw era embeds that loop inside persistent workspaces with durable files, terminals, logs, permissions, and skill libraries.
The paper is explicit that these axes are not independent: agentic execution presupposes a reliable reasoning core, and reasoning becomes operational only when coupled to tools and state. The survey also draws a sharp definitional boundary between eras. An Agent-era system is one whose minimal architecture is an observe-think-act loop over external tools; an OpenClaw-era system is one in which the environment itself is a persistent host whose operations can be inspected, validated, rolled back, and governed. The unit of analysis shifts from "a sequence of plausible actions" to "a correct, auditable final workspace state."
Part I: from fast response to reinforcement-learned reasoning
The Chatbot era section traces the standard lineage—Transformer, scaling laws (Kaplan; Chinchilla's compute-optimal result), GPT-3's in-context learning, MoE efficiency (Mixtral, DeepSeek-V2/V3), RLHF alignment (InstructGPT), Constitutional AI, and DPO—and then identifies the structural ceiling of this paradigm. Because greedy left-to-right decoding lacks intrinsic verification, lookahead, and backtracking, chatbot-era models fail on tasks requiring deliberate multi-step deduction; the paper cites evidence that without environmental feedback or independent verifiers, LLMs cannot reliably self-correct from their own probability distributions alone.
The Thinking LLM section centers on OpenAI o1 and DeepSeek-R1 as the decisive shift. Three claims stand out numerically. First, with sufficient test-time compute, a 1B-parameter model can surpass a 405B model on mathematical benchmarks, supporting the paper's claim that the paradigm has moved from "scaling up models" to "scaling up reasoning." Second, distillation results (LIMO's 817 curated examples; s1's 1,000 samples) suggest reasoning capability is largely latent in pretrained models and requires activation rather than creation—a strong and consequential claim for training economics. Third, the paper reports the "Aha moment" from R1's pure-RL training but immediately notes the contested interpretation: subsequent analysis attributes such self-reflective behavior to pretraining biases amplified by GRPO's length optimization rather than genuine emergent reflection. The survey also concedes that longer chains do not monotonically help—overthinking and reasoning boundaries bound the benefit—and that the simplest reward designs (rule-based answer matching plus format checks) have proven more practical than process reward models, which suffer annotation cost and reward hacking.
On the training side, the paper documents the rapid evolution of policy optimization from PPO through GRPO (critic-free advantage estimation) to DAPO, Dr. GRPO, CISPO, GSPO, and SAPO, and the maturing SFT+RL hybrid pipelines (R1's four-stage and Qwen3's four-stage recipes) now reproducible at modest cost via OpenRLHF, verl, TinyZero, and open-r1. It closes Part I by noting that reasoning has become a tunable mode within unified systems (o3/o4-mini tool use during reasoning; Qwen3's thinking/non-thinking switching; GPT-5's internal routing), which raises the question the paper leaves open: what additional architectural support is needed to move from a powerful reasoning core to a reliable autonomous agent.
The Agent era section covers perception (HuggingGPT, ViperGPT, SoM prompting, CogAgent, ShowUI, UI-TARS), planning (CoT, ToT/GoT, decomposition, Reflexion, Self-Refine, RAP, and RL-trained search such as Search-R1 and R1-Searcher), memory (Generative Agents, MemoryBank, ChatDB, Mem0, A-MEM, and RL-trained managers MEM1, Memory-R1, Mem-α), and tool use (Toolformer, PAL/PoT, Gorilla, ToolLLM's 16,000+ APIs, trajectory-level RL methods ReTool, ToRL, ToolRL, and infrastructure standardization via MCP).
The empirical record here is the survey's strongest motivation for change. WebArena reported only ~14% success for GPT-4 in realistic web environments; AgentBench showed a persistent gap between commercial and open-source models; and failure taxonomies identify hallucinated actions—wrong APIs, wrong files—as causing irreversible failures unlike text-level hallucinations. The paper synthesizes four structural bottlenecks: fragmented perception, ephemeral tool invocation, brittleness under environmental uncertainty, and absence of long-term task closure. Its claim is that these are architectural, not engineering, deficiencies: agents treat environments as external oracles to query rather than persistent workspaces to inhabit.
The OpenClaw era section argues that the workspace itself becomes the organizing abstraction, with OpenClaw treated explicitly as a representative engineering manifestation rather than a conceptual origin. Skills become file-system-level packages (SKILL.md directories with scripts, dependencies, checks), generalizing Voyager's executable skill library. Reliability work is given substantial weight: computer-use agents may succeed once and fail on repeated runs, motivating a decomposition of success rates into consistency, robustness, recoverability, and bounded error severity. The security analysis is blunt—systematic evaluations report that agentized runtimes can be riskier than the underlying models in isolation, because persistent context and multi-step execution amplify model weaknesses into system-level failures. The governance response (OpenClaw PRISM, ClawGuard, agentic forensics) enforces policy where actions become real rather than as prompt-level instructions.
Part III: the Workspace + Skill argument
Part III develops the survey's core thesis. The workspace provides durable state—files, terminals, logs, versioned repositories—without which small inconsistencies compound across long trajectories; the paper argues workspace design shapes an agent's practical intelligence as much as the underlying model. The interaction pattern correspondingly shifts from instruction to authorized delegation: users grant bounded objectives with constraints, permissions, and success criteria, and supervise through diffs, logs, checkpoints, and final-state inspection rather than micro-stepping. The key interaction unit becomes an inspectable work episode rather than a single response.
Skills are framed as procedural memory externalized into maintainable assets—testable, versionable, composable—sitting between model cognition and workspace execution. The OpenClaw case study decomposes a typical execution loop into intent interpretation, skill activation, workspace operation, and verification, and concludes that the unit of intelligence is the combined trajectory of skill selection, operation, verification, and recovery.
Notably, the paper does not present Workspace + Skill as a complete solution. It concedes five failure modes of the paradigm itself: skill brittleness under environmental drift (a UI redesign or dependency update can silently invalidate a skill); procedural overfitting and negative transfer when skill retrieval is automatic; workspace contamination from stale files and misleading partial outputs, worsened in multi-agent settings; supply-chain attack surface in skills containing scripts, credentials, and permissions; and substantial governance and evaluation overhead. The paper's own summary is that the paradigm shifts the primary bottleneck from prompt design to system operations—an honest reframing that bounds the thesis.
Part IV: data and evaluation paradigm shifts
The data section traces the progression from knowledge corpora and instruction-response pairs (InstructGPT, FLAN, Self-Instruct, preference datasets) through reasoning-process data (CoT traces, PRM800K, Math-Shepherd, verifiable rewards via RLVR) to state–action–observation trajectories with tool outputs, UI states, snapshots, and skill assets. It identifies a hard data problem: high-quality action trajectories cannot be scraped from the web; they require real tasks, realistic workspaces, correct actions, and verifiable final states, with expert annotation costs compounded in domains (scientific discovery, humanities) where success is not reducible to a unit test. Trajectories also age rapidly—UI layouts, APIs, and permissions drift within months—and the fidelity/safety trade-off in simulators (too simple invites brittle shortcuts; too realistic is costly and hard to reset) remains unresolved.
The evaluation section stages the shift as: (I) final-output accuracy (MMLU, GSM8K/MATH, Pass@1), (II) process-level judgment (ProcessBench, PRMBench, LLM-as-judge), (III) task closure (SWE-bench, WebArena, OSWorld, τ-bench), and (IV) workspace/OpenClaw evaluation with safety as a first-class metric (ClawBench, ClawsBench, ATBench-Claw, ClawSafety). The compiled results are sobering on both fronts. On capability, frontier models reach 60–80% on software-engineering and terminal benchmarks (e.g., Claude Opus 4.6 at 80.8% SWE-bench Verified; GPT-5.4 at 75.1% Terminal-Bench 2.0), but OpenClaw-specific benchmarks expose large gaps: ClawBench success rates range from 33.3% (Claude Sonnet 4.6) down to single digits, and ClawsBench reports unsafe action rates up to 23% even alongside ~60% task success. On safety, attack success rates under ClawSafety reach 40–75% for major frontier models. The paper's implication is direct: current systems cannot yet deliver reliable task closure in persistent workspaces, and trajectory-level safety is not an auxiliary metric but a core evaluation object.
Limitations and open questions
The survey is candid about several dependencies. The Workspace + Skill thesis rests on the assumption that persistent state and reusable procedures are the binding constraint on autonomy; the paper itself shows reliability, memory lifecycle management, and governance may be equally binding. The claimed internalization of search by RL is partially contested (the Aha-moment interpretation). Evaluation infrastructure—reproducible initial states, snapshot/restore, trajectory logs, final-state diffs—is expensive, and the paper notes that a single sandboxed evaluation run can take tens of minutes and consume substantial tokens, which constrains how widely task-closure evaluation can be applied. Open questions the paper leaves explicit include: how to detect and repair trajectory drift from user intent; how to build governance that preserves usefulness while keeping high-impact actions inspectable; how memory should be analyzed and governed across forms, functions, and dynamics; and how self-evolving systems can convert operational traces into validated, versioned, reversible updates without ecosystem corruption.
Conclusion
This survey offers a coherent two-dimensional account of LLM system evolution—cognitive core and task execution—and argues, with substantial supporting evidence, that persistent workspaces combined with reusable skills are the mechanism that converts conversational AI into accountable digital work. Its most valuable contributions are the definitional boundary between Agent- and OpenClaw-era systems, the unified treatment of data and evaluation shifts toward trajectories and task closure, and the unflinching reliability and security evidence showing that current frontier systems complete only a fraction of workspace-level tasks, often unsafely. The paper's own framing is the appropriate summary: the bottleneck has moved from model capability and prompt design to system operations—verification, provenance, permissions, rollback, and governed self-improvement.