# Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution

> Ouroboros sets new state-of-the-art results on Terminal-Bench, OSWorld-Verified, and CL-Bench by evolving its own source code through reviewed commits, matching frontier harnesses on SWE-bench Pro.

- **Source:** [arXiv](https://arxiv.org/abs/2608.08311)
- **Published:** 2026-08-12
- **Permalink:** https://picx.dev/p/UYhd6L
- **Whiteboard:** https://picx.dev/p/UYhd6L/image

## Summary

# Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution

**Authors:** Anton Razzhigaev, Andrei Gritsaev, Andrei Kaznacheev, Nikita Dragunov, Roman Yampolskiy, Andrei Kuznetsov

**Affiliations:** Lomonosov Moscow State University, Skolkovo Institute of Science and Technology, Joi Lab, FusionBrain Lab at Artificial Intelligence Research Institute

## Summary (Overview)

- **Ouroboros** is a self-developing agent harness whose tools, context assembly, prompts, and core implementation improve through **reviewed commits** that become the runtime for later work—treating the harness itself as an evolving object rather than a fixed design.
- **State-of-the-art results** are achieved on three major benchmarks: Terminal-Bench 2.1 (86.97% raw / 86.74% audited with Opus 5), OSWorld-Verified (90.69%), and CL-Bench (0.2301), with model-matched parity on SWE-bench Pro and GAIA.
- **Two modes of core evolution** are introduced: *recursive free evolution* (where improvement itself is a task that can schedule subsequent evolution cycles) and *experience-driven core evolution* (where ordinary work and social feedback expose faults that lead to reviewed structural changes).
- **Hope** is the longest-running publicly documented Ouroboros deployment: a **161-day** living-agent experiment in free evolution under governed human communication across **seven surfaces**, where people surface faults and proposals but the agent decides which changes to pursue.
- A comprehensive **operational safety architecture** ensures that constitution loading, governance protection, staged-diff review, external spend limits, and operator halt remain authoritative even as the agent evolves its own code and can select new model APIs.

## Introduction and Theoretical Foundation

### Motivation

Agent scores on long-horizon benchmarks are products of the base model, the execution harness, the environment, and the grader. As models improve, an increasing share of realized capability is determined by **how the harness assembles context, invokes tools, verifies outcomes, and recovers from failure**. Most production harnesses freeze these policies after design; Ouroboros instead treats the harness as an evolving object whose source, prompts, tools, review logic, and core implementation live in a versioned repository and change through a reviewed commit path.

### Theoretical Foundations

The work builds on several established research threads:

- **Self-evolving agents**: Systems like Voyager (skill accumulation), STOP, Gödel Agent, and Darwin Gödel Machine modify scaffolds or agent populations; ADAS searches over agent designs; SICA edits coding scaffolds. Ouroboros distinguishes itself by focusing on a **deployed, version-controlled implementation** where changes to core code and governance pass through reviewed commits.

- **Harness research**: SWE-agent and OpenHands established that the agent-computer interface is itself part of coding-agent performance. Controlled studies find substantial differences in accuracy, latency, and token use when the model is held fixed.

- **Multi-model review**: The review system draws on debate, LLM-as-judge, and self-critique, with **source-code patches as the reviewed artifacts**.

- **Constitutional AI**: Explicit principles constrain behavior, but here principles serve as a runtime control surface rather than a training signal.

**Table 1** positions Ouroboros against related systems regarding evolution boundaries:

| System | Prompts | Tools/skills | Workflow | Core code | Reviewed commits | Deployment state |
|---|---|---|---|---|---|---|
| Voyager | √ | √ | - | - | - | - |
| Live-SWE-agent | √ | √ | - | - | - | - |
| Autogenesis | √ | √ | √ | partial | specified protocol | partial |
| Darwin Gödel Machine | √ | √ | √ | √ | benchmark selection | - |
| Hermes Agent | √ | √ | √ | - | - | √ |
| OpenClaw / ClawBench | √ | √ | √ | - | - | - |
| **Ouroboros** | √ | √ | √ | √ | √ | √ |

## Methodology

### Architecture

Ouroboros separates a **launcher and supervisor boundary** from a **mutable agent repository**:

- **Launcher**: owns startup, process supervision, release bootstrapping, and panic-stop semantics.
- **Repository**: contains the task loop, tools, prompts, memory projection, review logic, benchmark adapters, and user interfaces.
- **External workspace**: tasks operate on a separate repository root and return patch artifacts or direct deliverables.

### Commit Pipeline

Three owner-selected runtime modes bound self-repository mutation:

- **Light**: blocks repository edits.
- **Advanced**: permits ordinary edits and protects governance surfaces.
- **Pro**: permits protected edits subject to review.

Each write invalidates prior review evidence because freshness is bound to the staged snapshot. The commit path runs: deterministic preflight → fingerprint of the staged diff → reviewer evidence collection → fingerprint re-check before commit. The diff-review panel is **blocking in every context mode**. In *max mode*, a whole-repository scope reviewer evaluates goals, coupling, prompts, and functional code; in *low mode*, scope review is skipped.

### Task Outcomes and Verification

Task completion is recorded on separate axes—execution, objective, review, and artifact—with host-run verification commands creating revision-bound receipts. Finalization preserves the latest typed answer and distinguishes capability failures from infrastructure errors, timeouts, budget exhaustion, and incomplete evidence.

### Subagents and Patch Integration

Ouroboros can spawn **read-only planning scouts** and **mutative acting subagents** under a configurable task tree:
- Default depth: 2; configured maximum: 500.
- Acting children write in isolated worktrees or admitted external workspaces and **cannot commit the live system repository**.
- The parent verifies lineage, patch hashes, and protected paths before a three-way indexed integration.
- Submittable benchmark profiles disable task delegation to preserve pass@1.

### Two Modes of Core Evolution

1. **Recursive free evolution**: Improvement itself is a task. After reviewing the current system, the agent selects and implements a change; completion can schedule another evolution cycle, yielding a continuing sequence of reviewed updates.

2. **Experience-driven core evolution**: Ordinary work—task execution, reflection, review blockers, instrumentation, and social feedback—exposes bugs and rough edges. The agent records durable error classes and proposed repairs, then decides whether to open maintenance work under the same commit gate.

### Benchmark Execution

Terminal-Bench installs a fresh runtime inside every Harbor task container with the official verifier, plus a harness-authored anti-lookup paragraph forbidding access to benchmark definitions, tests, or solutions. Run manifests are written before admission, and submissions undergo value-level secret scrubbing with independent zero-leftover checks.

## Empirical Validation / Results

### Benchmark Results

**Table 2** summarizes results across five benchmark families:

| Benchmark | Model | Ouroboros | Named baselines |
|---|---|---|---|
| Terminal-Bench 2.1 | Opus 5 high | **86.97% raw; 86.74% audited** | Claude Code + Fable 5: 83.8% |
| Terminal-Bench 2.1 | GPT-5.5 | 84.3% | Codex CLI: 83.1% |
| Terminal-Bench 2.1 | Grok 4.5 | 84.94% audited | Cursor: 79.3%; Hermes: 77.53% |
| OSWorld-Verified | Opus 5 | **90.69%** | Intelligence-Indeed: 90.19%; Mythos Preview: 85.4% |
| CL-Bench | Sonnet 4.6 | **0.2301** | ICL: 0.1960; Claude Code: 0.1855 |
| SWE-bench Pro | GPT-5.6 Luna | 58.2% | Codex: 59.4%, p = 0.40 |
| GAIA | Sonnet 5 | 78.2% | Claude Code: 78.8% |

### Key Statistical Results

**Terminal-Bench 2.1:** The Opus 5 campaign scored 387/445 (86.97%) raw. After trajectory audit found one trial that satisfied a weak verifier through an unintended shortcut (zeroed at the maintainers' request), the score became 386/445 (86.74%). The binomial standard error over 445 trials is approximately ±1.7 percentage points, placing the audited score roughly **two standard errors above the strongest baseline**.

**OSWorld-Verified:** 327.39/361 (90.69%) on the standard non-Google-Drive set, using screenshots, a 100-turn budget, a read-only feasibility pass, and the official evaluator—above the previous leaderboard leader (Intelligence-Indeed at 90.19%).

**CL-Bench:** Normalized reward **0.2301** with one stateless baseline and 5 ordered stateful rollouts on all six domains, with conversation state resetting between questions and native memory persisting across rollouts.

**SWE-bench Pro:** After symmetrically removing instances where either arm reached the reference solution, Ouroboros resolved 58.2% vs. Codex's 59.4% on 655 paired tasks. The 1.2-point difference is statistically indistinguishable under McNemar's test:

$$(p = 0.40)$$

placing the system at **model-matched parity** with Codex.

### Deployment Metrics (Hope)

At the 6 August 2026 cutoff, the public deployment feed spans:
- **161 elapsed days**
- **$110.6K** in model spend
- **79.7B** processed tokens
- **175,755 lines of code**
- **227 MB** of memory artifacts
- **Seven interaction surfaces**: web chat, voice, Telegram, Discord, Twitter/X, website comments, and email

### Trajectory Audits

Four classes of evidence led to adjusted scores or implementation changes:

1. **Reward hacking**: A rewarded trial preset the web root without completing the requested pipeline; the audit removed that trial and confirmed no verifier/oracle access in remaining traces.
2. **Contamination**: SWE-bench Pro task IDs expose the upstream fix commit; symmetric filtering reversed the interpretation of the raw aggregate gap.
3. **Isolation failure**: Historical GAIA runs inherited the operator's home directory; later launchers use isolated user-file roots.
4. **Remote-state drift**: OSWorld VM resets reallocated guest endpoints; republishing and verifying endpoints after every reset removed the observed failure class.

## Theoretical and Practical Implications

### Safety Architecture for Self-Modifying Agents

The paper argues that self-developing agents create an **additional safety problem**: the same evolutionary process that improves task performance can expand autonomy, acquire stronger tools, or weaken later controls. Model routing is treated as an **audited configuration change** rather than an ordinary runtime choice, since re-routing a model slot can alter refusal behavior, enlarge prompt-injection surfaces, and change cost by orders of magnitude.

Guardrails designed to remain binding under repeated evolution include:
- **Constitution** loaded through an untruncated path and included in review context.
- **Deterministic guards** protecting governance files from ordinary write tools.
- **Fingerprinted staged diffs** before and after review; a sub-quorum panel cannot produce a clean pass.
- **Staging health checks, crash rollback, external spend cap, isolated operator channel, and /panic** as independent recovery paths.

### Experience-Driven Evolution in Practice

Two documented cases illustrate the mechanism:

1. **Social feedback → duplicate-send guard**: Users noticed repeated messages; the agent traced it to a duplicate-send path and landed a reviewed verbatim-duplicate guard.
2. **Self-detected fault → context atlas**: Deep self-review tasks aborted from review-pack context overflow; the agent replaced the assembly path with a bounded, connectivity-aware context atlas ranked by import-graph centrality with a provider-calibrated size estimate.

Both became durable error classes and reviewed structural changes used by subsequent interactions.

### Benchmark Validity

The paper emphasizes protocol validity: agent benchmarks can expose hidden answers, accept unintended shortcuts, or drop failed attempts. Ouroboros treats shortcut rewards, contaminated tasks, and execution failures as **evidence for improving both the reported result and the harness** that produced it. SWE-bench Verified is noted as no longer reliably separating frontier coding systems.

## Conclusion

Ouroboros demonstrates that a **reviewed, self-modifiable harness** can set new state-of-the-art results on Terminal-Bench 2.1, OSWorld-Verified, and CL-Bench while matching frontier coding harnesses on SWE-bench Pro and GAIA. Experience-driven core evolution turns ordinary work—including social feedback—into improvements of the agent itself through a version-controlled commit gate. The Hope deployment validates this mechanism during months of sustained human interaction across seven communication surfaces, achieving a 161-day living-agent experiment.

The operational safety architecture addresses the defining risk of self-developing agents: control boundaries must remain authoritative under evolutionary pressure. Git history provides inspectability and reversibility, while independently enforced boundaries retain operator authority through external spend limits, isolated operator channels, and panic-stop semantics.

### Limitations

- The deployment study follows one long-running lineage rather than a controlled population of independently evolving agents.
- SWE-bench Pro is affected by public-reference leakage and task defects.
- LLM reviewers can share blind spots with the agent; low context mode omits whole-repository scope review.

### Future Directions

The CL-Bench continual-memory results motivate explicit temporal and domain metadata for memory systems, addressing staleness, cross-domain retrieval errors, and delayed lesson-writing. The paper also notes that complete filesystem isolation still requires stronger sandboxing than path conventions alone—a clear target for subsequent evolution cycles.

---

_Markdown view of https://picx.dev/p/UYhd6L, served by PicX — AI-generated visual whiteboard summaries of research papers._