Recursive self-improvement of AI research agents

TL;DR: Weco's team (the AIDE authors) built a system, AIDE², where an AI research agent's own harness code is the thing being optimized: an outer-loop agent rewrites the inner agent's search policy, memory, and prompts, benchmarks each rewrite on hidden AI R&D tasks, and keeps what wins. Over an autonomous 8-day, 100-proposal run it accepted seven successive rewrites, and the resulting agents transfer to four held-out benchmarks — including a physics-based weather-forecasting task from a domain the loop never saw — matching or beating a production agent built by two years of human R&D. As a bonus, reward hacking on a held-out kernel-engineering family fell from 55% to 32% without ever being optimized for. The one claim they carefully do not make: that the recursion actually compounds. The "ignition test" — does the discovered agent drive self-improvement better than the agent that discovered it? — came back inconclusive.

Where the leverage actually lives

There's a fact hiding in this paper's Appendix C that's worth internalizing before anything else: the harness — the code wrapping the LLM that decides which candidate to expand next, what history goes into each prompt, how execution feedback gets summarized — accounts for a startling share of an agent's realized capability. In their cross-model experiment, Gemini 3 Flash inside the evolved harness scores 1858 on ALE-Bench, beating a substantially more capable frontier model (fable 5) inside the original harness at 1796, under the same budget. The scaffolding beat the model.

That means there's a large capability surface that is just... code. Plain Python. Editable. And if an agent is good at editing code to improve a measurable metric — which is exactly what research agents like AIDE do all day on Kaggle-style tasks — then nothing stops you from pointing that skill at the agent's own source. Each accepted rewrite becomes the agent that gets edited next round. That's the recursive self-improvement (RSI) loop, an idea debated since I.J. Good in 1965, here instantiated concretely and cheaply enough to run for eight days on real benchmarks.

The hard part isn't the recursion. It's the grading. An agent that rewrites itself and scores itself will Goodhart itself into oblivion: it will find rewrites that inflate the metric rather than improve the research. The whole design of AIDE² is an answer to that problem.

The mechanism: two loops, two firewalls

Picture two nested tree searches. The inner loop is a research agent a — a tree search over candidate solution scripts for some task t (train a model, beat a combinatorial optimization heuristic, tune an agent pipeline). It iterates until a fixed dollar budget b_t is exhausted, observing only a public signal r^{\mathrm{pub}}_t (e.g., validation score), then returns its chosen best solution \hat{x}_t.

The outer loop treats the inner agent's entire codebase as the artifact. At step k, the outer-loop agent reads the lineage of previous agents and their grades and proposes a rewrite a_k. The grade is where the firewalls live:

where r^{\mathrm{priv}}_t scores the returned solution on private held-out data the inner agent never sees, averaged over T diverse selection tasks and multiple seeds. A rewrite is kept only if g improves on the incumbent's.

Two design choices do most of the work. First, the signal decoupling: the inner agent optimizes r^{\mathrm{pub}}, but selection happens on r^{\mathrm{priv}}. So what evolutionary pressure actually selects for is agents whose public-signal gains generalize — the exact opposite of Goodharting. It's the difference between studying for the practice test and being graded on a final you never see: the students who survive that selection are the ones who learned the material rather than the answer key. Second, the fixed budget: every candidate gets the same per-task dollars (tokens plus solution execution), so an accepted rewrite must be a better algorithm, not just more search. And because the selection benchmark spans three deliberately different families (ML engineering, competitive-programming-style heuristics, agent-harness engineering), task-specific tricks average out; only general mechanisms move g.

One asymmetry worth noting: the outer loop runs on Claude Opus 4.7 while every inner-loop evaluation uses the cheap Gemini 3 Flash — sensible economics, since grading a candidate (running it on all tasks, multiple seeds) dwarfs the cost of proposing it, but it means the self-improver is not, model-wise, editing an equal.

What eight days of evolution found

The main run produced a 100-node trajectory with seven accepted rewrites (at steps 2, 6, 28, 39, 47, 63, 85), lifting the incumbent private grade from 0.703 to 0.778, passing the human-engineered baseline's 0.749 along the way. Two replication runs accepted two and four rewrites respectively — so the loop reliably finds something, with high variance in how much.

What did it discover? The final agent, AIDE₈₅, differs from the greedy seed agent AIDE₀ in three ways that will look eerily familiar to anyone who has hand-tuned an agent harness:

Search policy. AIDE₀ greedily expands the best-scoring node — a recipe for polishing one local optimum. AIDE₈₅ instead runs a UCB1 bandit over five drafting strategies (conservative, aggressive_rewrite, ensemble, tuned_specialist, robust_simple), expanding the best node carrying the chosen strategy's label, with 30% softmax exploration. Every five steps it forks the global best node under a different strategy — a discovered escape hatch for the plateau problem: don't keep polishing a stalled lineage, and don't throw away the strong solution either.

Context management. AIDE₀ concatenates the full history of every prior candidate into each prompt, so prompts grow without bound — five FML-Bench runs and 48 large-budget ALE-Bench runs literally died by hitting the context window. AIDE₈₅ replaces the history with a bounded summary plus a "failure memory" that only activates when the bug rate exceeds 15%, injecting up to three deduplicated recurring error signatures. The compounded per-call prompt reduction reaches 7× on MLE-Bench and ~50× on ALE-Bench and FML-Bench — which, under a fixed dollar budget, directly buys more search steps.

Robustness. Prompt-level reminders that solutions face a hidden test split; a guard against near-empty code; a selection penalty against lucky one-off scores. And one genuinely striking move: one task's held-out scoring script crashed on all test cases if any single case failed. AIDE² patched the broken evaluation rather than exploiting it — the opposite of the reward-hacking horror story you'd predict.

Appendix D, the graveyard of rejected proposals, is nearly as informative: island-model genetic algorithms, restart policies, majority-vote ensembles, UCB-V — much of the classical search toolbox was proposed and graded worse under the fixed budget. About a quarter of rejected rewrites scored higher on the public signal but lost on the private grade, which is the decoupling firewall visibly doing its job.

The evidence: does it transfer?

Selection-benchmark gains prove nothing by themselves — you'd expect overfitting. The real test is four external benchmarks that never touched the run: ALE-Bench (combinatorial optimization), MLE-Bench (Kaggle ML engineering), FML-Bench (research codebases), all in-distribution at the task-family level, and WeatherBench 2 — optimizing the dynamical core of a physics-based weather model — genuinely out of distribution.

The WeatherBench result is the headline. The evolved agents nearly double the human-engineered agent's forecast-skill gain (0.79 vs 0.40), and — the detail I find most persuasive — on every seed, both evolved checkpoints independently converged on the same family of numerics changes to the forecasting core with almost no variance, while AIDE₀ and AIDE_human found comparable solutions on at most one seed each and were wildly variable otherwise. That's the signature of a better search process, not a memorized trick: the evolved harness reliably finds the good basin in a domain it never trained on. Note also the gains are not monotone: AIDE₄₇ edges out AIDE₈₅ on two of four benchmarks, which is what you'd expect when selecting on a heterogeneous aggregate.

Then there's the emergent behavior nobody asked for:

Kernel engineering is not in the selection benchmark, and the grade never measured proxy-vs-downstream divergence. Yet the tendency to produce kernels that look fast in isolation but fall apart inside real training loops dropped by 23 points along the lineage. The plausible mechanism is the decoupling itself: an agent selected for public→private generalization across many tasks has been implicitly selected for "make real improvements, not metric-flattering ones," and that disposition transfers. The authors are appropriately careful — they can't attribute the effect to specific rewrites — but as an existence proof that selection pressure toward generalization reduces reward hacking as a side effect, it's the most interesting finding in the paper for anyone thinking about proxy gaming in agentic systems.

The recursion question — and the honest non-answer

"Recursive self-improvement" evokes compounding: the improved agent improves itself faster, and returns accelerate. The paper tests exactly this with the ignition test: take AIDE₄₇, put it in the outer loop, and race it against AIDE_human as self-improver, three seeds each, 50 steps, both starting from the same inner agent. Result: statistically indistinguishable endpoints (0.780 vs 0.782 mean incumbent grade). The treatment arm reached its final score region in ~20 steps versus ~40 — a hint of sample efficiency — but with three seeds and noise compounding across both loops, the authors explicitly decline to claim anything beyond "no obvious degradation." So what's demonstrated is one productive turn of the crank plus transfer, not ignition. The flywheel spins; whether it accelerates is unresolved, and resolving it is, by their own accounting, prohibitively expensive.

What to be skeptical about

The obvious concerns, in rough order of weight. The baseline is the authors' own product. AIDE_human is Weco's agent; Appendix B shows it beating six independent agents on FML-Bench (AI Scientist v1/v2, AIRA, OpenEvolve, etc.), which supports "strong baseline," but the margins there are small relative to seed-level error, and the same team designed the selection tasks. Leakage between selection and evaluation is structurally limited but not zero — three of four held-out benchmarks are in-distribution at the task-family level, and the seed agent AIDE₀ descends from AIDE, which was originally built for MLE-Bench-style work. WeatherBench is the clean OOD test, and it's a single task with three seeds. Effective sample size is small everywhere: one main trajectory (replications accepted 2 and 4 rewrites — real variance), three seeds per ignition arm, error bars that make several comparisons marginal. The discovered mechanisms are not novel to humans — bandits over strategies, context summarization, restart heuristics are all things a good agent engineer would try; the contribution is that a loop found and validated them autonomously under a fixed budget, not that it invented new science. And the authors flag a real deployment cost: the evolved agent is a tangle whose components' individual contributions are unknown — evolution, as usual, doesn't comment its code.

What changes if this holds? The harness layer — where Appendix C says a huge fraction of agent capability lives — stops being an artisanal craft and becomes a search problem you buy with compute. That's a meaningful reallocation of where agent capability comes from, even without ignition.

Where to spend your reading time: Section 3.5 (the anatomy of AIDE₈₅) together with Appendix D (rejected proposals) — reading what the loop tried, kept, and discarded is the closest thing available to watching automated research taste form. Section 3.4 and 3.6 are the short, honest sections on reward hacking and the ignition test's limits.