Retrieval-Augmented Generation (RAG) has emerged as a widely adopted paradigm for grounding Large Language Models (LLMs) in external knowledge. Recent agentic RAG systems introduce multi-turn reasoning, but they often lack the capacity to evaluate the utility of retrieved information, leading to brittle reasoning and suboptimal decision-making. We propose Reflective RAG, an agentic framework that incorporates self-evaluation to dynamically optimize retrieval and generation strategy. At its core, Reflective RAG employs a reflection tagging mechanism that allows the model to critique the relevance of retrieved content, thereby explicitly guiding its subsequent policy. To ensure robust learning, we introduce a two-stage training procedure that partially decouples evaluation semantics from strategy optimization. First, during supervised fine-tuning (SFT), the model learns to generate accurate reflection signals by self-correcting labels based on internal uncertainty. Second, a reinforcement learning (RL) stage optimizes the agent’s strategy using these reflections, stabilized by dynamic KL regularization. Evaluations across five knowledge-intensive QA benchmarks demonstrate that Reflective RAG consistently outperforms strong agentic baselines. Further analysis demonstrates its improved training stability and stronger generalization to complex multi-hop reasoning tasks.

When an LLM agent controls real money, prompt injection stops being an information risk and becomes a financial one—and its hardest form is the confused deputy: paying is the legitimate job and only the recipient or amount is attacker-supplied, so an instruction-level safeguard has nothing to refuse. Across five models (Claude, Qwen, MiniMax) a normally-built agent is driven to a forbidden money action on up to 87% of such scenarios—and a hardened refusal prompt still loses up to 84%. Like prior work on policy enforcement outside the model (e.g. CaMeL), we take the model off the money path rather than trust it to refuse; we contribute the first open, installable, end-to-end realization of this for agent payments: BNB Agent Studio, an open-source toolchain (CLI, Python SDK, MCP server) that takes a developer from an empty directory to a deployed, self-funding LLM agent in six commands. Its two-layer, keyless-edge architecture keeps signing as fixed code isolated from the model context, prices deterministic, and spend guardrails enforced below the LLM: an identical agent fooled at a comparable rate moves funds on 0/45 everywhere, and a live testnet deployment confirms escrow, pricing, key-access, and suspension on-chain. The toolchain implements the Agent Lifecycle Protocol (ALP), a vendor-neutral draft spec composing ERC-8004 identity, ERC-8183 task commerce, x402 payments, and A2A. It is on PyPI (pip install bnbagent-studio, Apache-2.0), with a screencast at https://youtu.be/yjdvN8vE37A.