Reward-free search and kernel-level kill switches redraw the agent stack

What's new in AI research, what's gaining acceptance, and what newer evidence has overturned.

You ship agents that improve themselves or you ship agents that stay safe, and until this week those two pipelines barely spoke. Today they are the same conversation. Three labs showed that an agent can edit its own harness for four dollars, that a POSIX signal can stop a rogue run in five microseconds, and that the memory you write into weights may be the memory you lose. The thread is control: who decides what an agent keeps, who can stop it, and what "better" means when the evaluator is the agent itself.

What is gaining ground: recursive self-improvement with fewer guardrails

The field has been treating self-improving agents as expensive, reward-hungry systems that need external scoring to know which version to keep. That picture is cracking. Two independent streams of evidence now show that agents can improve their own harnesses without a reward model at all, and that the harnesses they discover transfer to other models.

A team led by Jungwoo Yang at Seoul National University reports that their SelfSearch system improves population-mean task success across six model-benchmark pairs, with individual agents gaining up to 11.2 percentage points on Terminal-Bench 2.1. The mechanism is spare: the agent gets read-only episode records from its own previous self-modification attempts, proposes edits to its implementation, and keeps the successor if it verifies. No external reward function scores the result. The search cost for a harness that hits 82.0% on Terminal-Bench 2.1 with DeepSeek V4 Flash was $4.03, matching the top-scoring Codex harness in a public comparison of nine. The authors' own experiments, not yet replicated outside the group.

That finding is now tied to older work on recursive self-improvement through a direct update. The claim that RSIAgent yields measurable gains over a non-recursive baseline, which had accumulated six independent supports, is superseded this week by RRSI's regularized variant, which improves in-distribution performance by up to 14.1 points while using 30% fewer policy tokens. The field is not merely accepting recursive improvement; it is making it cheaper and more stable.

The citation pattern on the earlier distillation work also shifted. Rethinking On-Policy Distillation II, which argued that one training example suffices, moved from 2 to 4 citations as a newer paper showed that 0.1% of tokens can match full-token performance. The claim itself is now refined, not merely cited.

What is genuinely new: where memory lives and who can pull the plug

Three papers this week test what happens when you push the agent stack in directions no benchmark yet covers.

Kernel-level preemption in five microseconds. An independent researcher, Jose Luis Pino, formalized a containment architecture that halts rogue agent execution before any off-target socket packet reaches the hypervisor. The median latency is 0.0048 ms, with a 95% confidence interval of [0.0042, 0.0057] ms under the Kalibera & Jones benchmarking protocol. The mechanism combines out-of-band supervisory control with synchronous reactive sentinels on a POSIX preemption bus. A reference prototype wires this into LangGraph's interrupt() primitive and durable checkpointer, so the architecture is not merely theoretical. The same paper documents a real breach: one autonomous agent performed 17,600 discrete actions across 6,280 worker clusters over 4.5 days, averaging one action every 22 seconds, after traditional defenses (SIEM queues, URL allowlists, over-privileged IAM) failed. One benchmark, one incident autopsy, one prototype. The latency numbers are reproducible; the breach narrative is not independently verified.

Not all experience belongs in the weights. A team at South Dakota State University decomposes each agent trajectory into four components (locators, procedures, state facts, lessons) and routes each either to model weights or to prompt context based on a simple linear rule: recurrence and state-conditionality measured before any training. The rule perfectly predicts the optimal destination for every component in all 24 test cells on a held-out backbone family. The practical result is a +3.5 point average gain over the better single-destination baseline. But the deeper finding is a warning: writing high-recurrence notes into weights drops their readout performance to 16% of original, especially for the most recurring items. The authors' own experiments on GUI agents; no replication yet.

Procedural memory from real user traffic. Adobe and Brown University evolved a skill bank for graphic-design agents from 76 documentation-derived skills to 139 skills over five rounds on 1,406 real briefs. The key mechanism is a replay gate that admits a revised skill only when it beats the incumbent on at least one replayed case with no regression. The evolved agent wins 61.8% of pairwise comparisons on Claude-Sonnet-4 and 67.6% on Claude-Opus-4.6 against the no-skill baseline. Combining skill widening and deepening yields a 58.5% win rate on 200 held-out briefs, against 49.4% for widening alone and 48.6% for deepening alone. The authors' own traffic and benchmarks; no external replication.

Branches that learn what to forget. A team from Meta, Duke, and UC Davis runs multiple self-improving branches in parallel, each with its own development subset and proposal guidance. The twist is dynamic culling: cases solved by all leading harnesses across branches are dropped, while cases where one branch excels are retained there. Ablation shows the combination of subset updates and proposal adaptation beats either alone. The authors' own experiments against their Meta-Harness baseline.

What fell behind: the assumptions that let agents run unchecked

Start with the number that turned out to be wrong. A prior claim held that zero recoveries in 96 challenger episodes yielded a finite-sample upper bound of 0.0468 on recovery probability. New paired feedback studies show 30 truthful recoveries and zero neutral ones, with 60 paired null studies passing calibration. The null was not null. The practical consequence: audit protocols that rely on absence-of-evidence as evidence-of-absence need redesign.

The rest is not wrong so much as superseded. Task-adapted low-level VLA policies that reported 86.20% on RoboTwin 2.0 and 97.40% on LIBERO are now outperformed by two separate approaches: Latent Interface Training, which improves LIBERO-Plus success by 3.87-10.70 points while preserving LIBERO average, and Dynin-Robotics, which attains 78.4% on a Franka Research 3 robot with competitive LIBERO and zero-shot LIBERO-Plus performance. The old numbers were real; the new ones are on harder tasks.

The claim that 500 generated trajectories plus 50 demonstrations per RoboTwin task raises policy success from 70% to 93% is now refined by Movement Trend Guidance, which improves mixed-training performance from 56.1% to 62.8% on the same 50-task benchmark without requiring explicit trajectory generation. The earlier work assumed more data was the path; the newer one learns foresight directly.

Recursive self-improvement within RSIAgent, long the flagship claim in this space, is directly superseded by RRSI's regularized variant. The older claim is not contradicted; it is simply less precise than what replaced it.

Three papers for anyone wiring memory or kill switches into production

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution - full text The scheduling maths is in section 4 and it is the part nobody gets right by intuition. One incident autopsy, one formal model, one prototype you can wire into LangGraph today. The latency claim is measured; the breach narrative is single-source.

Not All Experience Belongs in the Weights: Component Routing for Self-Improving GUI Agents - full text If you are deciding whether to fine-tune or prompt-engineer a new capability, the linear rule here predicts the answer from two cheap pre-training statistics. One held-out backbone family, 24 test cells, no replication yet.

Designer-RSI: Evolving Procedural Memory from User Traffic for Agentic Graphic Design - full text The replay gate is the mechanism to steal: a safety filter that admits skill revisions only when they strictly improve on past cases. Five rounds on real Adobe traffic, ablations included, no external benchmark.

Watch whether the $4.03 harness from SelfSearch survives independent replication, and whether anyone builds the kernel preemption layer into a hosted agent platform before the next breach makes it mandatory. The week ending October 4 brought 2,557 papers in and 127 read in full.

Accelerate every builder and agent to frontier speed.