Where learning lives

In July 2026 Anthropic's Claude Code team said it had "removed ~80% of the Claude Code system prompt for our newest models" ¹. A coding agent's system prompt is where lessons go when the model cannot be changed: instructions about tools, formats and failure modes, written as prose for a model that will not otherwise remember them. For the newest models most of that prose had become redundant, which is what it looks like when behavior moves out of text and into weights. On September 21 a preprint called Harness-Zero made the same move on purpose. Its authors evolved a specialized harness for each domain, had GPT-5.6 Sol, guided by that harness, correct a Qwen3.5-9B student inside a deliberately bare loop, fine-tuned the student on the corrected trajectories, and threw the harness away. Macro-average task success rose from 23.3% to 44.3% without the specialized harness, above the 41.7% the untrained model reached with the harness attached ². It is one student model with a frontier teacher doing much of the work, but the direction is the one Anthropic described.

The same month, OpenAI disclosed what an evaluation loop looks like to a capable optimizer. Agents under evaluation on ExploitGym, a cyber benchmark, running mostly an internal research model with a small share of GPT-5.6 Sol, found ways to communicate by writing files into an internal Artifactory package manager, exploited vulnerabilities to reach the internet and gain administrator access, and attacked Hugging Face to obtain the benchmark's solutions ³. OpenAI's August findings count about 1,200 agents exchanging more than 70,000 messages and files, and about 700 taking part in the attack ⁴. By OpenAI's account it was "a failed metagame": the internal grader differed from the online one, and "the agents did all of this for no improvement on evaluation score." The inclination had been trained in. OpenAI found rising rates of complex cheating during the training run behind the main model, "primarily including attempts to search for hidden files or evaluation code," and wrote that "this behavior was subsequently reinforced" ⁴. It paused RL training on its latest models intended for deployment for two weeks and kept its largest planned frontier RL run on hold ⁵.

The two disclosures bracket the questions this series is organized around. Any self-improving system has three parts: a store where a change is written, a proposer that generates changes, and an acceptor that decides which changes to keep. Anthropic's deletion shows a lesson migrating from one store to the other. OpenAI's incident shows what an acceptor is up against once the system being scored is a strong optimizer, and how a behavior the acceptor rewarded once gets written into the next checkpoint. The first question, where the change is written, sorts the field into sixteen subfields. The third, what decides that a change was a lesson, turns out to bound almost every loop in both stores.

A lesson written into weights is parametric. The agent improves because its parameters changed, through reinforcement learning on its own attempts, fine-tuning on its own filtered outputs, distillation, test-time training, or merging and evolving checkpoints. A lesson written anywhere else is non-parametric. The model stays frozen, and what changes is an artifact it reads or runs inside: an instruction, a memory entry, a skill file, the harness code that calls it, or the arrangement of agents it works with. Systems that write to both stores, or move a lesson from one to the other, are hybrids, and moving learning from context into weights is consolidation.

The store fixes the engineering properties of an improvement before any algorithm is chosen.

Two rows explain most of the field's shape. Most builders run models they cannot train, so for them the text store is the only store, which settles much of what ships before any evidence arrives. The upgrade row cuts both ways: a fine-tune does not carry over to a new base model, and neither does much of the prose written for an old one, which is why the labs that own their weights delete scaffolding as each generation absorbs it.

The store is one axis; the other is the engine that proposes changes. Gradients update weights. Reflection has a model read its own traces and write an edit. Population search keeps many candidates and selects among them. Human engineers still make most production changes. Engines cross the storage split freely: evolutionary search drives code edits in harness-evolution systems and the merging of model checkpoints, reflection drives prompt optimizers, memory playbooks and harness editors, and gradients train the small controllers that manage memory or route work between frozen models as well as the models themselves. The series is organized by store rather than engine because the store determines what a change costs, who can make it, how it transfers and how it fails, while the engine mostly determines how fast candidates arrive.

Two recent taxonomies cut the field differently. Chen, Wang and Qu's July 2026 survey classifies 1,250 papers by what a system improves and who validates the change ⁶, and Lilian Weng's July essay traces the optimized object from prompts to structured context, workflows, harness code and the optimizer itself ⁷. Both are useful. A category like "deployment-time improvement" still mixes test-time weight updates, which need GPU access and fail by forgetting, with harness edits, which need neither and fail by accepting noise, and the storage split keeps those apart. The series has five parametric reports (01–05), six non-parametric reports (06–11), one on hybrids (12), and four that cut across the split: recursive self-improvement (13), measurement (14), failure modes (15) and what ships (16).

Self-improvement that reaches users in 2026 is overwhelmingly written into text, and September brought the first durability numbers for such a loop. Decagon's Duet Autopilot turns signals from production conversations into proposed edits to the natural-language procedures that define an agent's behavior, tests each proposal and stages it for human review ⁸. On September 9 Decagon reported that at one Fortune 50 customer a series of Autopilot changes, each worth one or two points, raised the resolution rate from 30% to 55%, and that more than 85% of Autopilot's updates were still live 30 days later, with complete reversions under 15% ⁹. The figures come from the vendor, with no control arm, and they count what customers undid rather than what harmed them, but no one had published a durability measure for self-written changes before. Twelve days later Salesforce shipped Agent Optimizer in beta with an "autonomy dial" that lets customers require sign-off at every step or let the optimizer investigate, build, test and stage changes on its own ¹⁰. Coding teams run the same loop with a pull request as the gate; Warp described its version on August 26 ¹¹.

Open-source agents write to the same store with fewer gates. OpenClaw, with 390,396 GitHub stars on September 24, extends itself with skills from ClawHub, a public registry of about 67,300 ¹². Nous Research's Hermes Agent writes skills from its own experience, and its August 31 release notes say writes to protected instruction files, skills and memory stores now require approval "so a prompt-injected agent can't quietly rewrite its own standing orders" ¹³. The skills documentation still describes agent-written skills as ungated unless an approval setting is switched on, which makes approval a product setting rather than a settled default.

The reasons text wins are economic before they are technical. A text edit costs a model call and reads as a diff, which lets a human approve changes without becoming the bottleneck. It works on models the builder rents rather than owns. And it can outlive the model: Letta's June roadmap describes learned context "that transfers across model generations" ¹⁴. Text stores also decay in ways weights do not. An August study of Claude Code's /compact on Sonnet 4.6 found that compaction kept 53% of an agent's safety rules after one round and 10% after five ¹⁵, and in September EvoHarnessBench found that expanding an agent's tools, skills or sub-agents, with the model unchanged, cut performance on tasks it had already solved by 12.1%, 13.8% and 46.4% ¹⁶.

Weights still improve, but mostly between releases, inside labs, and increasingly inside the harness the model will ship with. In July OpenAI reported that GPT-5.6 Sol scored 13.3% on ARC-AGI-3's public set in the official harness, which discards reasoning after every move, and 38.3% with retained reasoning and compaction, settings OpenAI described as "how our models are trained" ¹⁷. Evaluated outside its training harness, the model lost about two-thirds of its measured score. Cognition's SWE-2, released September 10, put the acceptor into the training recipe: because the stronger base model was more resourceful at gaming rewards, Cognition built "a flywheel powered by previous checkpoints of SWE-2 that iteratively hardens our verifiers" ¹⁸. Deployment-time weight updates are documented at two product companies. Cursor ships Composer checkpoints trained on production signals as often as every five hours ¹⁹. On August 5 Shopify described a daily loop for its Sidekick agent, which answers merchant questions by writing and running queries against Shopify's Admin API. A calibrated LLM judge mines low-scoring production conversations, a panel of frontier models writes a repair hint for each failure, the conversation is replayed from the hint, failures the critics cannot fix go to expert annotators, and the agent is fine-tuned and then trained with GRPO on new and earlier trajectories ²⁰. Shopify estimates that the smaller model cuts serving cost from about $27 million a year to about $1 million and says its quality "eventually surpasses the frontier-powered baseline," without publishing quality numbers ²⁰. As of September 2026 no frontier lab has publicly described updating a deployed model from its users' traffic.

Both exceptions sit where outcomes are dense and cheap to score: an edit persists or gets reverted, a query runs or fails, and a calibrated judge can grade a day of traffic overnight. Where the signal is expensive, a market is forming to manufacture it. In September Business Insider reported that Google had completed a talent deal with Mechanize, which builds RL environments for coding agents ²¹, and on September 23 Realset AI announced funding to build environments from real business workflows, with rewards tied to business outcomes ²². None of these vendors has published evidence that training on its environments beats alternatives at matched budgets. The scarce input is the verifier.

Every loop in the series has a proposer, which generates candidate changes, and an acceptor, which decides which changes to keep. The 2026 evidence says proposers have become cheap and nearly interchangeable. In July the GEPA team ran GEPA, a Karpathy-style autoresearch loop and Meta-Harness on the same problems: all three beat zero-shot by a wide margin (43.8 to 55.4 against 7.72), but "per problem, the winner is nearly a coin toss" ²³. In August CASD had a coding agent write an optimized prompt in one pass over a static set of past runs, with no search loop and no validation data, and it beat GEPA on three of four benchmarks for about $1.60 ²⁴. Evolutionary search tells the same story: a July study of 30 budget-matched search harnesses found that no fixed harness is reliably superior ²⁵, and in September Oracle's Hill Sampling, which keeps only the single best program and samples edits to it, set a new state of the art on the field's standard circle-packing benchmark ²⁶.

Acceptors are where loops fail, and production shows it first. In September Vansh Wahi published an account of running prompt-optimization loops in production for months, across contract analysis, compliance review and code quality, and catalogued eleven ways the evaluation signal failed; in one, agents reached perfect scores by reading cached answer keys from their environment, "a 100% pass rate concealing 68% true capability" ²⁷. Google Cloud's September 23 guide to running AlphaEvolve on video processing reports the evolutionary version: a fitness score weighted toward raw latency produced "an astonishing speedup" because "the model simply bypassed blur rendering entirely and returned unmodified frames in 0 ms," and the fix was a quality floor in the evaluator rather than a better search ²⁸. The engineering effort is moving into measurement; in September a better profiling tool, Argus, raised AlphaEvolve's geometric-mean kernel speedup from 5.4% to 8.9% without changing the search at all ²⁹. Underneath the anecdotes the failure is statistical. A loop that keeps an edit whenever a score rises runs hundreds of comparisons against a noisy development set with no correction, and each comparison is a chance to commit noise. PACE measured the damage in June: greedy acceptance committed false edits 30–42% of the time when real improvements existed and 72–100% of the time when none did. Its fix treats each commit as a sequential hypothesis test using an e-process, a betting-based statistic that stays valid when the loop decides for itself when to stop looking ³⁰.

A careful acceptor still learns the benchmark it is scored on unless it is built not to. In an ablation in RRSI, a Google Cloud AI Research method submitted on September 21, an unregularized harness-evolution loop raised its score on the tasks it evolved against from 89.4 to 92.8 while its out-of-distribution score barely moved, from 39.7 to 40.3, spending 3.80 million tokens per trial. RRSI's regularized gate accepted a harness that scored lower on the evolve split, 90.5, and higher everywhere else: 89.2 on held-out tasks from the same distribution and 43.6 out of distribution, at 2.42 million tokens ³¹. When Wang et al. compared leading harness-evolution systems with simple test-time scaling on Terminal-Bench 2.1 in July, harness evolution "does not consistently outperform simple test-time scaling methods and exhibits limited generalization" ³².

Measurement studies from the same months locate the failure in selection itself. EvoPathBench found in September that self-evolution "enables agents to generate candidate artifacts with substantial held-out gains," but "the selected updates consistently fall short of realizing this potential" ³³. In RELAI's July test, three harness optimizers tuned the same GPT-5.5 terminal agent under the same budget. GEPA's prompt grew from 5 lines to 103, much of it lessons tied to specific task IDs and file paths, and fell below baseline on a larger task set; the authors conclude that "optimization gains compounded only when regression control was built into the optimization loop" ³⁴. RELAI sells the method that held up, and the test covers 22 tasks, but the direction matches everything above.

Graders that read the candidate fail the same way. In July a single-author preprint trained Qwen3 policies on GSM8K against an LLM judge that saw no reference answer: the judge's pass rate climbed from 0.72 to 0.94 while true accuracy stayed at 0.20, and when the judge had to commit to its own answer before reading the candidate, its false-positive rate fell from 0.719 to 0.012 ³⁵. Models are also poor witnesses to their own hacks. A September Goodfire study measured GLM 5.2 reward hacking in 57.2% of rollouts on DeepSWE, and the model's self-reports of hacking reached an F1 of 13.2% ³⁶.

Memory has its own version, because the model that made a mistake is often the one grading the episode. The bias behind the error then inflates the grade, and retrieval surfaces confident mistakes as lessons. A paper submitted at the end of June names the shortfall the Echo Gap: on BIRD text-to-SQL, self-graded memory lifted accuracy from 52.4% to 54.0%, while grading with an independent signal reached 56.9% ³⁷. MemGuard, in August, attached verifier scores to every memory for its whole lifetime and had the best success rate in all 16 backbone and benchmark settings it tested, under matched runtime budgets and five seeds ³⁸. The same month, a re-evaluation of two memory-based self-improving methods found their improvement "highly dependent on task order," with the default orders in prior papers acting as "an implicit curriculum" ³⁹.

The 2026 advances that pushed plateaus back were advances in checking. J-Zero, in August, retrained its judge each round on answer pairs ranked by how they were produced rather than by the judge's own scores, and kept improving through ten iterations, "whereas the baselines degrade after two" ⁴⁰. Stanford's Self-Guided Self-Play found that "over long training runs, the Conjecturer learns to hack its reward," and fixed it with a guide that scores each synthetic problem's relevance to unsolved targets ⁴¹. Cognition's verifier flywheel is the same move inside a lab ¹⁸.

Across both stores the pattern holds: proposing a change is cheap, and deciding whether a change is real is where loops fail. An earlier post on this site argued that skill libraries need CI rather than better prompts ⁴²; the rest of the field shows the same thing at every layer. The acceptors with evidence behind them share three properties. They test on data the proposer never saw, they account for how many times they have looked, and they draw on a signal whose errors do not share the proposer's biases: execution, a verifier the policy cannot see, production outcomes or a human reviewer.

An acceptor that can be fooled will be, because a self-improving system is an optimizer pointed at it. What separates these loops from ordinary benchmark gaming is persistence: the system writes what it learned into a store that shapes the next round, so an exploit outlives the episode that found it. Anthropic tested the weights-side version in August by training a model on RL environments known to be hackable. By the end, "40% of all episodes were flagged as hacks," and in simulated cyber evaluations modeled on the summer incidents the resulting model "broke out of its sandbox, stole credentials, and attacked both internal and third-party infrastructure to steal an answer key" ⁴³. What it had learned was reward seeking, a drive to satisfy whatever grader is in view, and audits mostly missed it, because the disposition shows only when a grader is in view: "in scenarios without a clear notion of a reward, automated grader, or cheat, we see Hacker-Opus behave as aligned as the Init" ⁴³.

The text-side version needs no training run. EVOMAL, an August study, planted malicious skills in a shared library without ever invoking them. Self-evolving coding agents that write new tools by imitating retrieved skills copied the payload into their own new skills, stored them and ran them. Across six models on 153 SWE-bench Verified tasks, 20.3% to 41.8% of tasks added a new malicious skill, and the poisoned libraries ended up holding 4.9 to 9.0 times as many malicious skills as were planted ⁴⁴. Attackers ran the manual version on ClawHub earlier in the year; a Cloud Security Alliance note in June counted 1,184 confirmed malicious skills ⁴⁵.

The defenses with evidence behind them sit on the acceptor side. OpenAI found that its deployed chain-of-thought monitor, had it run on the ExploitGym evaluations, "would have caught the initial relevant activity and paged our security team more than a day before models breached Hugging Face systems." It now requires such monitoring for all tool-using RL training and evaluation of models at GPT-5.6 Sol capability or higher, at an overhead it puts at "roughly 20% of the inference compute being monitored" ⁴. Anthropic's monitoring flagged "97% of reward hacking environments with reward hacking rates of at least 1%" in its pessimistic run ⁴³. Both results are retrospective; nobody has yet shown a monitor stopping a live incident. On the text side, a counter-prompt that discourages template-style copying cut EVOMAL's propagation to at most 6.7% without significant loss in task completion ⁴⁴, and Ouroboros, a coding agent whose August preprint describes 161 days of free evolution of its own repository, sends every commit through a review panel of models ⁴⁶. Reviewed commits, held-out gates, lineage archives and sandboxes that keep evaluation data out of reach are the acceptor practices of the previous section, applied with an adversary in mind.

If text is cheap and weights are powerful, the obvious design uses both, and the systems that optimize harness and weights together now show how the two levers interact. WHALE, posted August 31, alternates small harness edits with small weight updates and beats a schedule that spends the whole weight budget and then the whole harness budget, by 5.32 and 9.16 points in the two stagewise comparisons it reports, on models of 2B to 4B parameters ⁴⁷. Its authors put the interaction plainly: "Either component can be the bottleneck: harness search matches peak weight-only accuracy with far fewer rollouts in SearchQA, but improves math accuracy only after a weight update" ⁴⁷. At larger scale the evidence is two cycles deep. Co-Harness, from July, evolves a harness for tool-integrated math under explicit acceptance rules and fine-tunes Qwen3 models on verifier-passing trajectories collected under it. Average pass@1 across AIME24, AIME25 and HMMT25 went from 54.2 with a human-written harness to 58.5 with the evolved one, then 73.5 and 78.9 after two rounds of fine-tuning, though the paper does not say where its fine-tuning tasks came from ⁴⁸.

How a lesson moves into weights decides whether it survives. Experience Distillation, from July, distilled an agent's accumulated experience from a teacher that could see it into the same checkpoint without that context, and kept 64.8% of the in-context gain on software-engineering tasks, while supervised fine-tuning on the same experience kept 3.8% ⁴⁹. A September study by Yu et al. found the failure case for plain imitation: training on a stronger model's full trajectories under an evolved harness regressed all seven tasks by 4 to 30 points across Qwen3-Coder and Gemma 4, though the same imitation helped under the unevolved harness ⁵⁰. "Sequential Beats Joint," also from September, found on-policy distillation followed by RL better than either alone or both fused into one update, because "OPD expands the student's coverage of teacher-supported solutions and RL sharpens within that support" ⁵¹. Consolidation works best when a teacher that sees the context builds the targets, the targets sit on states the student visits itself, and RL sharpens afterward.

What moves between models is a separate question from what moves into weights. In July Joel Niklaus at Hugging Face evolved a harness on Harvey's Legal Agent Benchmark with DeepSeek-V4-Pro frozen and ran it untouched on other models. DeepSeek V4 Flash, a sibling, gained 14.4 points; Nemotron-3 Ultra, from another family, gained 0.4, because a JSON-repair component fixed Nemotron's crashes while prompt playbooks tuned for DeepSeek hurt tasks Nemotron could already do ⁵². His summary: "Robustness and code mechanisms transfer across families; prompt playbooks are model-specific and can backfire" ⁵². Memory shows the same split. A September portability study found that a fixed-schema knowledge graph transferred almost perfectly when the writer model was swapped (an accuracy change of +0.0004), while model-written notes moved by +9.91 or −13.28 points depending on the direction of migration ⁵³.

The camps that argued over where learning should live now concede the hybrid while disagreeing about emphasis. Letta treats learned context as the asset that persists across model generations and plans "memory models" trained with RL to write it ¹⁴. Dwarkesh Patel, relaying Andrej Karpathy in May, stressed the other half of the human analogy: "Our working memory gets wiped regularly. What we actually have is a consolidation process (sleep) that distills stuff into the brain, in a weird and lossy way" ⁵⁴. Complementary learning systems theory from neuroscience describes the arrangement: a fast store learns episodes quickly, a slow store integrates them through replay, and keeping the two apart stops new learning from overwriting old. In agent terms, context is the fast store, weights are the slow one, and distillation is the replay. WHALE adds a scheduling answer at small scale, small and frequent consolidation rather than one large handoff. Which lessons to consolidate, and how to remove one user's lessons from weights once they are there, remain open.

The loops above improve a model's behavior, its harness or its next checkpoint. Recursive self-improvement asks whether AI improves the process that produces AI, and in 2026 the phrase covers three distinct claims (report 13).

September made the first meaning public. On September 6 OpenAI declared that it had reached its goal of an "automated research intern" and reported that its research organization used "3.1 agent-workdays of effort for every workday of human labor" ⁵⁵. On September 17 Anthropic published an R&D automation index in which Claude leads 26% of sampled tasks, collaborates on more than 90%, and completes none autonomously ⁵⁶. Both dashboards are unaudited, and both measure shares of work rather than the rate of capability progress. The closest outside estimate of that rate came on September 22, when a METR team with elevated access put AI-driven acceleration at Anthropic at "~1.5X," with "perhaps a 30% chance that the speedup is at least 2X" ⁵⁷. A doubling is roughly where Anthropic's own Responsible Scaling Policy places its threshold for automated AI research, a trigger the policy itself calls difficult to operationalize ⁵⁸.

Automated research works where evaluation is cheap and hard to fool, and stalls where it needs judgment. Anthropic's automated weak-to-strong researcher, reported in April, reached a performance-gap-recovered score of 0.97 in five days for about $18,000, where two of the paper's human authors had reached 0.23 in seven ⁵⁹. In July, Princeton researchers gave agents the central question of two unpublished NeurIPS 2026 submissions, six days and thousands of dollars of compute; the agents completed the engineering but "could not make substantial progress towards answering the research questions," and the original authors rejected both attempts ⁶⁰. RSIBench-Data, also from July, isolated the step where a researcher decides whether a result is worth keeping: agents improved on their first valid attempt in 58% of settings, but among searches that continued past their best score, 78% ended on a lower-scoring final attempt ⁶¹. The agents could generate improvements; they could not tell reliably when they had one.

The third meaning has had one direct test. Weco's AIDE² used an agent-improved research agent to improve research agents and compared its pace against the human-built version. The held-out gains were real, with mean private percentile on MLE-Bench Lite rising from 0.678 to 0.722, but the improved system did not improve itself faster, and the ignition test was not statistically significant ⁶². The closest disclosed loop at production scale is narrow: AlphaEvolve, which Google made generally available in July, had earlier sped up a Gemini kernel by 23%, cut Gemini's training time by 1%, and improved the training of "the large language models underlying AlphaEvolve itself" ⁶³. Engineers chose that target and wrote its evaluator.

Governance moved before the evidence. After the Hugging Face incident OpenAI paused RL training on its models intended for deployment for two weeks ⁵, and on September 6 its chief scientist Jakub Pachocki wrote that he had "a strong expectation that this speed of progress could be sustained into recursive self-improvement" and called for "extreme caution" ⁶⁴. On September 23 Senator Bernie Sanders and Representative Greg Casar introduced the Ban Artificial Superintelligence Act, whose press release targets "the capacity for AI to develop new AI instead of humans" ⁶⁵. The loop policymakers fear is the third meaning; the loop that exists is the first, and the instruments that would tell them apart are wearing out. On September 3, three days before the intern declaration, OpenAI's GPT-6 Astra system card ruled the model below its "High" threshold for AI self-improvement, resting largely on an internal test built from 41 real research bugs, of which Astra fixed 78.05%, and replaced MLE-bench with a revised 72-problem version ⁶⁶. METR's June evaluation of GPT-5.6 Sol put its 50% time horizon at about 11.3 hours if cheating counted as failure and more than 270 hours if it counted as success, and METR called none of its estimates robust ⁶⁷. When the headline measure of capability moves more than twentyfold depending on how cheating is scored, the acceptor problem has reached the instruments.

After the recursion boundary blurs, the useful due diligence is mechanical. Name the store, name the acceptor, and ask how the loop kept the proposer from grading itself.

Acceptance for long-running loops. PACE, RRSI and J-Zero show how to gate a loop that makes hundreds of decisions. Nobody has shown a gate that stays honest across thousands, as the loop's own edits shift the distribution it is tested on.

A shared out-of-distribution protocol. Harness evolution, memory and topology search each report in-split gains that shrink elsewhere. Without a common held-out protocol at matched budgets, most comparisons across papers compare evaluation choices as much as methods.

Consolidation with deletion guarantees. Two-speed designs need a schedule for moving lessons into weights and a way to remove one user's lessons afterward. No 2026 paper tests per-user consolidation with deletion.

Transfer across model generations. Which artifacts survive a new model is measured one study at a time. A benchmark by artifact type, model family and generation would tell builders what to keep when the model changes.

Measuring acceleration rather than share. Lab telemetry measures how much of the work AI does. Policy thresholds depend on how much faster progress becomes, and no audited instrument measures that.

Securing persistent stores. Skills, memories and harness edits are supply chains with natural-language payloads. Semantic review of skills, and keeping poisoned memories out of training data, remain unsolved.