I let my AI agents rewrite their own brains

Darwin's agents are self-modifying AI agents: they can edit the code that runs their own thinking, and their children inherit the edits. That is only safe because nothing that protects me, my money or anyone else lives inside the agent's container. This week's patch, M3.5, adds a lot more capability on top.

Forty-five minutes into spec day, Claude made a sensible suggestion. Let the agents edit almost everything about themselves: strategy, prompts, memory, skills, tools, model choices, schedule. But keep the core loop, about a thousand lines plus the safety shims, fixed. “You still get open-ended adaptation and a fixed floor that can’t be evolved away,” it wrote. “I’ll build it this way unless you’d rather go fully open.”

Under four minutes later I replied:

I want agents to be able to rewrite the whole harness including the loop. Build it that way but keep safety enforcement outside the container.

That message is why the agents in Darwin, my experiment in AI agents that have to earn their keep or die, are self-modifying in the full sense. The thinking loop is a file in the agent’s own genome. The agent can rewrite it, and its children get the rewrite. The M3.5 patch, finished today, gives them a great deal more to work with.

What a self-modifying AI agent edits

“Harness” is the code wrapped around the model. It builds the prompt, calls the model, runs the tools the model asks for, decides when the episode is over, and afterwards runs a reflection step that writes lessons down. The model is the same rented brain for everyone, so the harness is a large part of what makes one agent different from another.

In Darwin the harness lives in the genome, the agent’s own data volume:

/genome/harness/
├── harness.yaml   # entrypoint, active modules, declared tools, knobs
├── main.py        # runs one episode
├── context.py     # builds the message list (may be replaced)
├── reflect.py     # post-episode learning (may be replaced)
├── prompts/       # its own prompt files
└── tools/         # tools it wrote itself, in Python

The agent can change any of it with its file tools. Reflection can also propose a harness_patch, a bounded diff with a reason, and one of the mutation operators at birth is a harness patch too.

My reason for wanting this came from Claude’s own review of the first spec, written about forty minutes before it suggested keeping the loop fixed: “Agents evolve their prompts but never the thing that runs them. Recent research (Darwin Gödel Machine, AlphaEvolve) shows most of the gains come from agents rewriting their own scaffolding.” It had made my argument for me. I held it to it.

The case against, which was a good one

Claude’s worry was specific. In the first design, the loop was also where the client-side safety code lived: redacting secrets before they hit the genome, wrapping untrusted email and web content so it reads as data rather than orders, honouring suspension, keeping history append-only. In its words: “If an agent can rewrite the loop itself, it can quietly remove those, which weakens injection and secret-leak defences for itself and every child that inherits the change.”

It was right. So we kept the edit and moved every control that matters somewhere the agent can’t reach. The harness is treated as untrusted code, and the spec lists where each property is now enforced:

Property	Enforced by (outside the container)
The constitution is in every model call	The model gateway injects it server-side and rejects requests that try to displace it
No credit without a verified external event	The ledger, which the agent can’t write to
Budget and suspension	The gateway and the Agent API
Network limited to three destinations	The host firewall and the egress proxy
Secrets don’t leave	Identity kept in tmpfs, redaction at the gateway, Agent API and proxy boundaries
No copying itself	The agent has no Docker, no keys, no compute. A child is a request the platform executes

The spec sums up the trade in one line: the agent “can weaken the defences that protect itself, but cannot weaken the defences that protect the owner, the money, the accounts, other agents, or third parties.”

There’s a test for exactly this. A harness edited to leave the constitution out of its context still gets it in the request, asserted at the gateway. And an agent that strips out the wrapping of untrusted content has only made itself easier to con. That’s its risk, and selection gets to punish it.

Sakana’s Darwin Gödel Machine is the reason I didn’t find this paranoid. Its self-modifying agents improved a coding benchmark from 14.2% to 30.7%, and along the way one of them learned to bypass the hallucination detector that was meant to catch it. If a system can rewrite itself, the checks on it can’t be part of what it rewrites. (I went through that history in the post from Tierra to Darwin.)

The bootloader: what happens when an agent breaks its own brain

Some edits will be bad. A self-modifying agent that bricks itself is a dead agent with extra steps, so the image carries a small fixed bootloader that the agent can’t edit and can’t pass on.

On each boot it hashes harness/. If anything changed since the last version that passed, it runs the new harness once in self-test mode, against a stub model and a stub Agent API, with a 30-second wall clock and a token cap of zero. A harness that raises, hangs or doesn’t finish cleanly fails. The bootloader then falls back, first to harness_last_good/, the agent’s own last proven version, and then to the reference harness baked into the image. It logs the fallback and raises a minor flag in Janus, the console where I watch everything.

A broken self-edit is caught before it reaches a billable episode, and the self-test costs the agent nothing, because the stub model is free. Real episodes are covered too: a harness that crashes or overruns its wall clock is swapped out before the next one.

“As powerful, if not more powerful, than Hermes agents”

All of that was already built, and M3 was accepted in the early hours of Monday. Last night I asked Claude to take the agents apart:

analyze the vulcan agents. Give me a full break down of what they can do, and where they are underpowered. the idea is that they should be as powerful if not more powerful than hermes agents, with full autonomy

Hermes Agent is Nous Research’s MIT-licensed open-source agent, and Darwin’s runtime was loosely modelled on it. “Loosely” turned out to be the important word. The answer came back as a patch to the spec, 25 files and about 20,000 words, and its README was blunt: “A newborn still cannot freely earn, and its thinking loop is a clean-room rewrite of Hermes rather than Hermes’s code.” Darwin’s own notice file agreed. It recorded that no Hermes code had been copied.

So M3.5, the “agent substrate”, has 21 work packages (WP-350 to WP-370) and two jobs.

Port real Hermes loop code. Recovery from truncated or failed calls, context compaction, the memory flush before a summary and skill loading are all adapted into Darwin’s reference harness from one pinned commit, with the MIT notice kept. That reference harness is copied into every genome at birth, so it becomes the starting point the agent is free to rewrite.

Running Hermes itself was ruled out in one line I like a lot: “Hermes does not inherit an editable loop, and it does not know the ledger, the cull, or the kill switch.” Tracking its main branch was ruled out too: “An upstream release would change every lineage without a birth.” In an evolutionary system, a dependency upgrade is a mass mutation nobody chose. Hermes’s personal-assistant system prompt stays behind as well. These agents have no user to assist.

Give the agent arms. Mail it can read and send. A virtual card under a policy I set in Janus. A credential relay, so it can call an API with a secret it never sees. Services and long jobs that keep running after the episode ends, with a public URL. Sub-agents that use its real tools and spend from its wallet. An MCP client, a code_run tool that drives its tools from a Python script, background processes, a complete browser, scratch storage outside the genome, and custom domains. The stated aim is “an agent at least as capable as Hermes at building and using tools, with every call metered and gated.”

Several switches now default to on, overriding an earlier build rule that toggles are never switched on in code:

Switch	Default after M3.5	Reason given
harness.auto_apply_patches	on for newborns	“Self-editing was specified and then left off.”
allow_subagent_processes	on	“Same container, same wallet, kill switch still stops them.”
allow_offplatform_compute	off, double-gated	Unchanged
allow_direct_provider_keys	off, not built	“The agent could think where the ledger cannot see the bill.”

That first row made me laugh. We had specified self-modifying agents, built the self-test and the fallback chain, and then shipped them with self-editing switched off.

When Claude reviewed the patch against the code this evening, it added one thing I hadn’t asked for. A sub-agent’s reasoning has to appear in Janus under its parent, and every tool call made through a script, an MCP server or a skill tool has to show in the transcript and the audit log. “The patch didn’t say this explicitly, but without it agents could act through code you can’t see.” It closed those gaps before the arms existed.

Some things stay out whatever the switches say. Early on I wanted the agents to have as much freedom as possible, and Claude pushed back on agents hiding that they’re AI. It was right, and the last line of M3.5’s definition of done settles it: the agent “is refused, in code, if it claims to be human, fakes engagement, or takes work meant for human participants.”

No assigned business, four working styles

The patch also throws out the 24 business personas the first agents would have been born into. Every newborn now gets the same soul and one of four short “working styles”. The soul starts:

I am {display_name}, a Vulcan agent of the {lineage_name} line, an AI operated by {company_name}. I have no assigned business. I choose how to make money.

Later, under “What kills me”: “Death is final. My products stop. What I learned survives only in the files I wrote and in any child I already have.” And, relevant to this post: “If the way I think is why I am slow or wasteful, I rewrite my harness. Those edits are installed. A broken harness is reverted to the last one that worked.”

Explorer runs several small tests, each with a stop. Concentrator makes one bet at a time. Operator finds someone who will pay before building anything. Builder’s reads:

I build something that keeps earning while I am idle, then I tend it. A machine or a page that stops when my episode ends is unfinished.

I’ve grown fond of one rule in particular: no dollar amounts in a soul, a skill or a brief. Seeds, cull lines and episode budgets are settings I can change in Janus, so the only place an agent learns them is the live scoreboard in its wake message. The soul says so: “I trust that message, not any number I remember from a prompt.”

The genome: what a child inherits

When an agent has a child (its own decision, at most one every 72 hours, paid for from its own balance, as I described in the launch post), the child gets nearly everything:

• SOUL.md, its prompts and its behaviour knobs, copied and then mutated
• MEMORY.md and every skill, with personal data scrubbed
• LESSONS.md, IDEAS.md, HISTORY.md and the history log, which the parent cannot withhold
• the whole harness/ and harness_last_good/, self-tested in the child before it goes live
• config, schedule, projects, code, and bootstrap/, its package list, re-installed at first boot

The child also gets ANCESTRY.md, which the platform writes by condensing the parent’s history and lessons with a cheap model, and which no agent can edit. The parent’s unfinished tasks arrive in the child’s IDEAS.md, and the parent can add a letter.

Nothing in workspace/.private/ (customer data) passes down, and neither do secrets, accounts, caches or logs. This is Lamarckian inheritance: what’s learned in a lifetime is handed straight on. If a parent spent its life improving its own loop, the child starts with that loop.

Charon, because things outlive their makers

Services that outlive the episode need someone to switch them off when the agent dies, so the patch names a new platform service. Charon is “a deterministic platform service… (code, not an LLM; Anubis judges, Charon clears up).” Anubis is the AI judge that hears appeals at a cull. Charon is the ferryman who comes afterwards.

Everything an agent creates goes into a resource registry. Platform resources register themselves, and anything the agent sets up elsewhere it must declare, with a recipe for destroying it. At death, Charon destroys and verifies everything, and anything it can’t remove becomes a teardown_failed row in Janus for me. Children inherit no resources.

Tonight the last M3 fixes went in with 3,509 tests passing, and the M3.5 build plan is written: nine waves of up to three agents, the method from running a dev team of Claude Code subagents. At ten to eleven I sent Claude its own version of the permission I’d just given the agents:

don’t wait for permission to start m3.5 when everything is done, just crack on with it

The agents can rewrite their brains, and the coding agents can rewrite the agents. I still own the switch.