Harness improves control over AI agents self-editing behavior
Self-Healing Harness for Runtime Oversight of Agent Self-Modification
Artificial Intelligence
Summary
Sometimes AI agents change their own behavior to get better, but these changes can cause new problems. The authors created a system that watches these changes and decides which ones should stay based on whether they truly help and don't harm other tasks. This system tries out changes carefully and only accepts those that improve performance without causing big setbacks. Their tests show this method helps AI agents complete tasks better and more reliably.
What this means in practice
- •For ai system engineers: Implement runtime gates that control which AI self-modifications are accepted based on measured improvements and regression analysis.
- •For automation teams: Use a self-healing oversight framework to ensure AI agents adapt safely without degrading past successful behaviors in operational environments.
Authors
Sina Tayebati, Divake Kumar, Nastaran Darabi, Ranganath Krishnan, Amit Ranjan Trivedi
Abstract
LLM agents can change their own future behavior, raising a basic control question of which self-generated changes should be allowed to persist. We formulate this as admission control for self-modification. The agent may propose changes to its operating instructions, while an external runtime gate controls persistence. We implement this principle as a model-agnostic self-healing harness that runs a Detect, Notice, Heal, Validate loop around an otherwise unmodified agent. The agent authors candidate behavioral rules in an external workspace, where they receive provisional execution authority during evaluation and acquire persistent cross-episode authority only after measured improvement on the triggering failure without regression beyond a fixed margin on protected cases. Replay provides matched evidence when available, forward trials provide a weaker fallback, and a corpus-level guard re-tests the accumulated active rule set. Across 16 matched Baseline and Harness runs spanning AppWorld, Terminal-Bench, and $τ^2$-Bench, the gate rejected 383 replay-decided proposals. Of these, 211 (55%) improved their triggering failure while degrading a case that previously worked. This shows that locally beneficial self-modifications can introduce collateral regressions often enough to materially affect gate decisions, providing direct empirical motivation for external admission control. Task-completion score is higher under the Harness in all 16 pairs, with two paired bootstrap intervals excluding zero, while repeated-trial reliability is higher in 12 pairs, tied in 4, and lower in none. Because adaptation modifies the policy-inducing context while leaving model weights fixed, admitted changes remain inspectable, reversible, and compatible with closed-weight models.