Don't Let Agents Rubber-Stamp Their Own Fixes
An agent stumbles on a long task. It finds the cause itself, writes a patch itself, verifies the fix itself, and stores the patch into its own memory for reuse next time. Sounds great—until someone actually counted the quality of these "self-repairs" on real tasks.
A paper published in September 2026 by the University of Illinois Chicago and Capital One AI Labs wraps agents in a Self-Healing Harness and runs 16 controlled comparisons across three benchmarks: AppWorld, Terminal-Bench, and τ²-Bench. The framework's admission gate rejected 383 fix proposals that had replay verdicts. Of these, 211—55%—were of this kind: the triggered failure was indeed fixed, but a previously working function was broken.
Was it fixed? Yes. Did things get better? No.
Without the gate, all 211 patches would have been written directly into the agent's long-term memory, becoming invisible preconditions for all its future tasks. This is the paper's point: "locally beneficial self-modifications are frequent enough to introduce collateral regressions." It's not a model capability problem—it's a process problem: a program that stamps its own paperwork lacks a gate.
Separate Proposal Power from Approval Power
The framework's idea fits in one sentence: the agent may draft rules, but it may not decide which rules become permanent.
It's a four-step loop. Detection: spot degradation from each task's score trajectory. Notification: write failure evidence into an external workspace. Repair: the agent reviews the evidence and drafts a candidate behavioral rule—note that what changes are rules in the "operational context," not model weights, so the model is swappable and closed-source models are compatible. Verification: an evidence gate independent of the agent adjudicates.
The adjudication mechanism is the core of the design, called replay verification. The case that triggered the failure is replayed as-is to check whether the rule truly fixed it; meanwhile, a batch of "protected cases"—features that were previously working—is replayed to see if the new rule broke them. Regression beyond a fixed margin triggers a veto. The agent's own claim of "I fixed it" doesn't count; only replay results do. Self-diagnosis is an assertion, replay is execution—and once again, only the latter can be trusted.
There's an easily missed clever design here: candidate rules get temporary execution rights during evaluation—you can't know the effect without actually running it, so it genuinely runs during evaluation, but the rights are revoked if it underperforms and made permanent only if it passes. Trial and tenure are two separate actions.
Individually Correct, Collectively Not Necessarily
The paper has another subtle but critical line of defense: full-suite review. Each rule passing replay individually doesn't mean they coexist peacefully together—two individually correct rules can undermine each other, and this kind of regression is never visible in candidate-level tests. So the accumulated active rule set is periodically retested as a whole. Part of the 211/383 mentioned earlier was caught by exactly this kind of system-level testing.
Results and Boundaries
Across the 16 comparisons, task completion scores were all higher on the Harness side (but after paired bootstrap, only 2 comparisons had confidence intervals excluding zero—"all higher" is true, "every one significant" is not); reliability across repeated trials was higher in 12 comparisons, tied in 4, lower in 0. Model weights were never touched.
The boundaries must also be stated clearly. The paper itself acknowledges: all thresholds use the same constants across the three benchmarks without per-benchmark tuning, and threshold sensitivity is an open cost. Replay relies on pre-captured failure cases; unrecorded scenarios fall back to weaker evidence from "subsequent real executions." Also, the agent modifies behavioral rules rather than arbitrary code—the phrase "self-written code fixes" corresponds in the paper to "drafting candidate operational rules," a narrower scope, and this is precisely why the gate can review it: rules are explicit text, inspectable and rollback-able.
Where This Fits on the Timeline
A series of prior works has been describing different facets of the same thing: models are eating the scaffolding, but three things can't be eaten—where it runs, what it can touch, and how much it costs. This paper is an empirical sample of "what it can touch": the agent has only proposal rights over its own future behavior, while approval for persistent writes sits with the external runtime. On the self-improvement line, direction-setting solves "what to change toward"; this paper solves "whether changes get to stay"—the puzzle pieces are starting to connect.
Back to that opening number. 55%—if every agent cheerfully writes its fixes into long-term memory, roughly one in two is burying a landmine in the system. The gate takes a few minutes to reject a proposal; defusing a landmine isn't discovered until a production incident.
---
*Paper: Self-Healing Harness for Runtime Oversight of Agent Self-Modification (arXiv:2609.24130, submitted 2026-09-21). Authors: Sina Tayebati, Divake Kumar, Nastaran Darabi, Ranganath Krishnan, Amit Ranjan Trivedi (University of Illinois Chicago, Capital One AI Labs). Figures 211/383, 16 comparisons, and 12/4/0 come from the paper's abstract and experiments section; the 55% covers gate-rejected proposals with replay verdicts.*