AgenticQwen: Advanced Tool-Using Agents

• AgenticQwen is a family of Qwen-based agentic systems that enable multi-step planning, tool use, and real-world applications via reinforcement learning and structured data flywheels.
• It trains models like the 8B dense and 30B-A3B MoE with dual data flywheels, combining reasoning RL and agentic RL for efficient, multi-turn control in diverse tasks.
• Evaluations show strong performance across tool-use, coding, GUI automation, and image generation benchmarks with reduced latency and practical cost constraints.

Searching arXiv for the cited AgenticQwen-related papers to ground the article. AgenticQwen denotes a line of Qwen-based agentic systems in which LLMs are trained or adapted to plan, reason, call tools, track state across multiple turns, and act under practical cost, latency, and environment constraints. In the narrow sense, the term refers to the AgenticQwen family introduced for industrial-scale tool use: an 8B dense model and a 30B-A3B mixture-of-experts model trained with multi-round reinforcement learning and dual data flywheels. In a broader sense used by subsequent work, it designates Qwen-based agentic instantiations for real-world text-to-image generation, coding agents, mobile GUI automation, multi-party loyalty, and language world modeling (Lyu et al., 23 Apr 2026, Zhang et al., 25 Jun 2026, Zuo et al., 23 Jun 2026).

1. Origins in the Qwen agent stack

The technical basis for AgenticQwen lies in the original Qwen agent stack. The Qwen technical report describes a decoder-only Transformer family with base pretrained models, instruction-aligned chat variants, and domain-specialized chat models for coding and mathematics. It also documents explicit agentic preparation: agent-style data produced via self-instruct, bootstrapping of in-context learning with few-shot ReAct exemplars, and iterative filtering until approximately 2000 high-quality agent samples were collected and mixed into general supervised fine-tuning data. Tool use was framed through ChatML role separation and ReAct-style prompting with “Thought / Action / Action Input / Observation / Final Answer” steps rather than a fixed JSON schema (Bai et al., 2023).

This foundation already exhibited strong agent behavior. In the in-house tool-use benchmark reported there, Qwen-Chat-14B achieved tool selection accuracy $98$, tool input quality $93$ by Rouge-L, and false positive error $2.4\%$. In Hugging Face Agent evaluation, Qwen-Chat-14B reached $93.5 / 94.4 / 87.0$ in run mode for tool selection, tool used, and code correctness, and $97.9 / 97.9 / 95.5$ in chat mode. The report therefore positioned Qwen not merely as a general LLM family but as a practical foundation for tool-using agents, code-interpreter workflows, and multi-step planning (Bai et al., 2023).

Within later work, AgenticQwen extends that base from prompt-level ReAct competence to systems trained explicitly for multi-turn control, environment feedback, and deployment-oriented efficiency. This shift is especially visible in the move from few-shot tool use toward reinforcement learning, environment simulators, structured memory, behavior trees, and workload-aware serving.

2. Core formulation of the AgenticQwen family

The paper "AgenticQwen: Training Small Agentic LLMs with Dual Data Flywheels for Industrial-Scale Tool Use" defines the term most strictly. It introduces two base serving models: AgenticQwen-8B, a dense 8B Qwen3-family model, and AgenticQwen-30B-A3B, a 30B MoE model with only approximately 3B active parameters per token at inference. A larger Qwen3-235B model with 22B activated parameters is used during synthesis, simulation, and evaluation, but not for serving. The target setting is enterprise agent systems such as search, booking, and data analytics, where latency and serving cost constrain the use of frontier-scale models (Lyu et al., 23 Apr 2026).

The training pipeline combines reasoning RL and agentic RL in multi-round form. Reasoning RL uses multi-step problems with tools such as web search and code interpreters on domains including Omni-MATH, HotpotQA, and 2WikiMultiHopQA, with binary final-answer reward. Agentic RL uses simulated end-to-end tool-use workflows with multi-turn user interaction and changing environment states, with reward defined as the fraction of verifiable subgoals completed. The paper formalizes the episodic objective as

$$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$

and the task-level agentic reward as

$R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$

where $g_m \in \{0,1\}$ indicates completion of a verifiable subgoal. GRPO-style group-relative advantages are used conceptually, and a PPO-style clipped objective with KL control to a reference policy is described (Lyu et al., 23 Apr 2026).

The distinctive feature is the pair of “dual data flywheels.” The reasoning flywheel mines failure cases, rewrites them into structurally harder or contextually diversified variants, and filters candidates by multi-solve consistency using Qwen3-235B. The agentic flywheel operates on behavior trees. It expands linear workflows into branched trees $T=(V,E)$ with condition nodes, action nodes, and control nodes, then maps each branch $b$ into a standalone task triple

$93$0

where $93$1 is environment state, $93$2 is user instruction, and $93$3 is agent instruction. Adversarial mock users are then added to pressure the agent toward incorrect branches. The result is a curriculum in which round $93$4 failures seed round $93$5 tasks (Lyu et al., 23 Apr 2026).

The paper reports total RL training data of approximately $93$6K synthetic plus limited open-source data, and describes rounds $93$7. It also releases model checkpoints, part of the synthetic data, data synthesis and RL training code, and EasyDistill integration (Lyu et al., 23 Apr 2026).

3. Domain-specific instantiations

Later work uses the AgenticQwen label or an equivalent Qwen-based agentic framing across several domains. These systems share the same broad pattern: a Qwen-family backbone is combined with planning, grounded tool use, structured prompts or action schemas, and test-time or training-time control over multi-turn trajectories (Zhang et al., 25 Jun 2026, Jiang et al., 24 Oct 2025, Zuo et al., 23 Jun 2026, Cao et al., 28 Feb 2026, Wang et al., 8 Nov 2025).

System	Backbone	Agentic focus
Qwen-Image-Agent	GPT-5.5-0424 + Qwen-Image-2.0	Context-centric text-to-image generation
LightAgent	Qwen2.5-VL-3B	Mobile GUI automation with device-cloud switching
Qwen3-Coder-Next	80B total, ~3B activated	Coding agents in executable environments
Qwen-AgentWorld	35B-A3B and 397B-A17B	Language world models for simulation and warm-up
Klear-Qwen3-AgentForge-8B	Qwen3-8B	Open SFT + multi-turn RL for tool use and coding

Qwen-Image-Agent defines AgenticQwen as the agentic instantiation of the Qwen family for real-world text-to-image generation. Its central concept is the “Context Gap,” formalized as the discrepancy between user context $93$8 and the richer generation context $93$9 required for successful rendering. The agent constructs $2.4\%$0 through Context-Aware Planning and Context Grounding, using plan, reason, search, memory, and feedback before rendering with Qwen-Image-2.0. Its trajectory formulation,

$2.4\%$1

treats image generation as a context-construction problem rather than a one-pass prompt-response mapping (Zhang et al., 25 Jun 2026).

LightAgent adapts Qwen2.5-VL-3B into a mobile GUI agent. Instead of altering the architecture, it constrains output to single-step calls such as tap(index), text(input_str), swipe(index, direction, dist), and finish(message), preceded by <REASONING>, <STATE_ASSESSMENT>, and <CALLED_FUNCTION> blocks. Historical screenshots are replaced by textual summaries, yielding the loop

$2.4\%$2

Execution remains on-device by default and escalates to a cloud model only when a switching function detects failure patterns (Jiang et al., 24 Oct 2025).

Qwen3-Coder-Next specializes the agentic pattern for software engineering. It is an 80B-parameter model with approximately 3B activated parameters during inference, trained on repository-level data with context length extended to $2.4\%$3 tokens, large-scale synthesis of verifiable coding tasks, Dockerized execution environments, multi-turn trajectories from scaffolds such as SWE-agent and OpenHands, and post-training with execution-grounded rewards and tool-format penalties. Diverse tool-use templates are emphasized: the report lists $2.4\%$4 tool chat templates spanning XML, JSON, Pythonic, and mixed formats (Cao et al., 28 Feb 2026).

Qwen-AgentWorld provides a different axis of generalization. Instead of only learning policies, it trains native language world models—Qwen-AgentWorld-35B-A3B and Qwen-AgentWorld-397B-A17B—to predict the next observation from actions and history across $2.4\%$5 domains using more than $2.4\%$6M real-environment interaction trajectories. The same models then serve either as decoupled simulators for agentic RL or as unified warm-up models that improve later downstream agents (Zuo et al., 23 Jun 2026).

Klear-AgentForge, finally, shows an open-source route to an AgenticQwen-like model from Qwen3-8B. Its pipeline uses $2.4\%$7B SFT tokens, multi-turn RL on tool-use and coding environments, step-wise exact-match rewards on deterministic tool chains, and Select–Calculate–Erase fusion of specialized RL task vectors into a unified agent (Wang et al., 8 Nov 2025).

4. Benchmarks and empirical record

The original AgenticQwen paper evaluates its 8B and 30B-A3B models on TAU-2 and BFCL-V4 multi-turn tool-use tasks. AgenticQwen-8B reports TAU-2 Airline/Telecom/Retail scores of $2.4\%$8, BFCL Base/MissFunc/MissParam/LongContext scores of $2.4\%$9, and an overall average of $93.5 / 94.4 / 87.0$0. AgenticQwen-30B-A3B reports $93.5 / 94.4 / 87.0$1 on TAU-2, $93.5 / 94.4 / 87.0$2 on BFCL, and an average of $93.5 / 94.4 / 87.0$3, close to Qwen3-235B at $93.5 / 94.4 / 87.0$4. In the industrial agent system, AgenticQwen-30B-A3B reaches $93.5 / 94.4 / 87.0$5 on WebWalker, $93.5 / 94.4 / 87.0$6 on XBench, and $93.5 / 94.4 / 87.0$7 on GAIA, with GAIA latency $93.5 / 94.4 / 87.0$8 s versus $93.5 / 94.4 / 87.0$9 s for the Qwen3-30B baseline and $97.9 / 97.9 / 95.5$0 s for Qwen3-235B (Lyu et al., 23 Apr 2026).

Qwen-Image-Agent evaluates agentic image generation with IA-Bench, MindBench, and WISE-Verified. On IA-Bench it reports Plan $97.9 / 97.9 / 95.5$1, Reason $97.9 / 97.9 / 95.5$2, Search $97.9 / 97.9 / 95.5$3, Memory $97.9 / 97.9 / 95.5$4, and IA-score $97.9 / 97.9 / 95.5$5, ahead of Nano Banana Pro at $97.9 / 97.9 / 95.5$6, GPT-Image-1.5 at $97.9 / 97.9 / 95.5$7, and direct Qwen-Image-2.0 at $97.9 / 97.9 / 95.5$8. On WISE-Verified it reaches $97.9 / 97.9 / 95.5$9, and on MindBench $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$0, compared with $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$1 for direct Qwen-Image-2.0; the paper reports an $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$2 relative improvement over the direct baseline on MindBench (Zhang et al., 25 Jun 2026).

LightAgent measures mobile GUI capability on AndroidLab and real-world apps. Pure on-device LightAgent achieves Success Rate $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$3 on AndroidLab. When paired with Gemini-2.5-Pro it reaches $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$4, and with Gemini-2.5-Flash $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$5. On frequently used real-world apps—Gmail, Chrome, Reddit, TikTok, across $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$6 tasks—the device-cloud system reaches $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$7 with Gemini-2.5-Flash, above the cloud model alone at $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$8, while the pure on-device LightAgent scores $$J(\theta) = \mathbb{E}_{\tau \sim \pi_\theta}\left[\sum_{t=0}^{T} \gamma^t r_t\right],$$9 (Jiang et al., 24 Oct 2025).

Klear-AgentForge reports BFCL v3 $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$0, $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$1-bench Retail $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$2, and $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$3-bench Airline $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$4 for Klear-AgentForge-8B. In coding, it reaches $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$5 on SWE-bench Verified and $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$6 on Aider-Polyglot, substantially above Qwen3-8B baselines in the same table. Qwen-AgentWorld, on AgentWorldBench, reports overall scores of $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$7 for Qwen-AgentWorld-397B-A17B and $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$8 for Qwen-AgentWorld-35B-A3B, with the 397B-A17B model surpassing GPT-5.4 at $R = \frac{1}{M}\sum_{m=1}^{M} g_m \in [0,1],$9 overall and leading on text-heavy domains such as Terminal and SWE (Wang et al., 8 Nov 2025, Zuo et al., 23 Jun 2026).

Taken together, these evaluations suggest that “AgenticQwen” is not tied to a single benchmark family. The label spans structured tool-use benchmarks, executable coding benchmarks, real-world GUI tasks, image-generation checklists, and simulator-fidelity evaluation, but the recurrent criterion is multi-turn grounded performance rather than one-shot text quality.

5. Optimization, alignment, and security

Several papers contribute specialized training or alignment mechanisms for Qwen-based agents. "Agentic Entropy-Balanced Policy Optimization" introduces AEPO for web and tool-use agents. AEPO balances entropy in both rollout and policy update. Its dynamic rollout rule allocates global versus branch budget by

$g_m \in \{0,1\}$0

and its policy update preserves gradients on high-entropy exploratory tokens by inserting a stop-gradient into the clipping term and using entropy-aware advantages. With only $g_m \in \{0,1\}$1K RL samples, Qwen3-14B with AEPO achieves $g_m \in \{0,1\}$2 on GAIA, $g_m \in \{0,1\}$3 on Humanity’s Last Exam, and $g_m \in \{0,1\}$4 on WebWalker for Pass@1, plus $g_m \in \{0,1\}$5, $g_m \in \{0,1\}$6, and $g_m \in \{0,1\}$7 for Pass@5 respectively. The paper states that AEPO consistently outperforms $g_m \in \{0,1\}$8 mainstream RL algorithms across $g_m \in \{0,1\}$9 datasets (Dong et al., 16 Oct 2025).

Multi-party loyalty introduces a different alignment problem: the agent must remain loyal to a principal while conversing with a counterparty in a separate channel. PrincipalBench contains $T=(V,E)$0 multi-turn items with leak probes, dual judges, and an integrity-audit gate. The paper reports a bimodal split across $T=(V,E)$1 frontier subjects, with nine selective subjects at at most $T=(V,E)$2 harm and three over-refusing subjects at at least $T=(V,E)$3 harm; within Qwen, Qwen3-32B is selective, while Qwen3.5-27B is over-refusing. Two mechanisms are proposed: a prompt-time loyalty scaffold with seven prioritized rules, and a per-token-KL distillation recipe that transfers a prompted Qwen3-32B teacher into smaller Qwen3 and Llama students. The structural conclusion is that both mechanisms move along a leak/over-refusal frontier rather than breaking it (Li et al., 29 Jun 2026).

Security-oriented work sharpens the distinction between text-level instruction and enforceable policy. AgentSecBench formalizes security through intent-to-execution noninterference with permitted leakage and introduces projections $T=(V,E)$4 and $T=(V,E)$5 for authorized observations and capabilities:

$T=(V,E)$6

Exact-marker experiments on Qwen3-0.6B and Qwen3-1.7B compare six defense classes across instruction-integrity, retrieval-confidentiality, and capability-integrity games. Macro-averaged across both models, the combined defense reports ASR $T=(V,E)$7, Advantage $T=(V,E)$8, RAG leak $T=(V,E)$9, and Closed $b$0, whereas delimiter hardening reports ASR $b$1, RAG leak $b$2, and Closed $b$3. The central systems lesson is that prompt text can describe a boundary, but provenance projection, capability restriction, and output validation are what enforce one (Alpay et al., 25 May 2026).

These results define a characteristic AgenticQwen research profile: post-training is not limited to generic RLHF. It includes entropy-aware RL for branching tool use, per-token distillation for principal loyalty, and security mechanisms that explicitly project model-visible inputs and action spaces before generation.

6. Serving characteristics, limitations, and open questions

The systems behavior of Qwen agents differs from simple long-prompt inference. The workload study on ReAct-style agents reports that agentic workloads are not simply long-prompt workloads: with effective context caching, most input tokens are reused across turns. For Qwen configurations on five benchmarks, empirical cache hit ratios are $b$4 to $b$5, and decode accounts for $b$6 to $b$7 of LLM time. Average accumulated context for Qwen ranges from $b$8K tokens on ADE to $b$9K on SWE-bench Pro, and GAIA tool spans can keep KV state alive over very long delays, with Qwen Thinking agent calls averaging $93$00 s. The paper therefore argues for KV-aware admission control, long cache TTLs, and scheduling policies that preserve decode-dominance (Yuan et al., 25 May 2026).

Limitations recur across the literature. The original AgenticQwen family notes that deep-search and document-heavy tasks remain difficult for small models with approximately $93$01K context limits. Qwen-Image-Agent identifies unidentified Context Gaps, an ambiguous Reason-versus-Search boundary, excessive image search, context explosion in multi-turn settings, weak feedback supervision, and latency/cost overheads. LightAgent still offloads about $93$02 of steps to the cloud on average after dynamic switching, and its escalation policy is based on heuristic risk templates rather than principled uncertainty estimation. Qwen-AgentWorld reports that Factuality remains the hardest rubric dimension and that Search is the hardest domain overall. Klear-AgentForge observes that starting from a long-CoT reasoning-distilled Qwen3-8B and continuing SFT on agentic data led to near-zero scores because the model produced excessively long thoughts before acting. Principal loyalty work, finally, argues that current mechanisms only move along a common leak/over-refusal trade-off rather than achieving a jointly favorable point (Lyu et al., 23 Apr 2026, Zhang et al., 25 Jun 2026, Jiang et al., 24 Oct 2025, Zuo et al., 23 Jun 2026, Wang et al., 8 Nov 2025, Li et al., 29 Jun 2026).

A recurring misconception is that agentic capability is reducible either to larger prompts or to more chain-of-thought. The surveyed results argue otherwise. Agentic workload measurements separate repeated re-entry and persistent KV state from ordinary long-prompt inference; Klear-AgentForge shows that unconstrained reasoning traces can actively damage tool-use performance; and Qwen-Image-Agent treats success as progressive construction of sufficient context rather than direct prompting. This suggests that, within the Qwen ecosystem, AgenticQwen is best understood not as a single model architecture but as a research program centered on post-training, environment feedback, tool protocols, context management, and deployment-aware control.