Ouroboros: A Self-Developing Frontier Coding Agent with Reviewed Core Evolution

arXiv:2608.083112026-08-07

A coding AI agent that keeps rewriting its own code sets new state-of-the-art benchmark scores

Ouroboros is a coding agent whose tools, prompts, and even core implementation are modified by itself, with changes passing a review gate before becoming the runtime for later work. It set new best-reported scores on Terminal-Bench 2.1, OSWorld-Verified, and CL-Bench, and its 161-day live deployment 'Hope' shows how human feedback and self-detected bugs turn into reviewed structural changes. Because the agent can rewrite its own code and pick its own model APIs, the paper treats operator control mechanisms as a core design problem, not an afterthought.

METAL LAB explanatory visual

How Ouroboros evolves itself under review

Evidence statusMeasured results reported

Doing workThe agent performs coding tasks, benchmark tasks, and conversations with people
Surfacing a fault or ideaBugs, inefficiencies, human feedback, or the agent's own reflection reveal a candidate improvement
Agent decidesThe agent itself decides which suggested changes are worth pursuing, not the human proposing them
Reviewed commit gateMulti-model diff review, fingerprint checks, and quorum requirements must be passed before a change is approved
New runtime for later workApproved changes become the system that runs subsequent tasks, while operator controls like /panic and spending limits stay independently enforced

An explanatory diagram made by METAL LAB, not a figure supplied by the paper's authors.

What they did

The researchers built a 'reviewed core evolution' architecture where the agent can modify its own tools, prompts, and core implementation, and once a change passes human-style review, it becomes the runtime that later tasks run on.
Core evolution works in two modes: recursive free evolution, where finishing one self-improvement task can automatically schedule the next; and experience-driven evolution, where bugs and inefficiencies surfaced during ordinary work or human conversation lead to reviewed structural fixes.
On Terminal-Bench 2.1 an Opus 5 run scored 86.74% after trajectory audit, the best reported result on that benchmark; on OSWorld-Verified it reached 90.69%, above the previous best published score; and on CL-Bench a five-rollout campaign achieved a normalized reward of 0.2301, a new state of the art.
Hope, a 161-day public deployment, is a persistent agent that has interacted with people across seven surfaces (web chat, voice, Telegram, Discord, Twitter/X, website comments, email) while continuously modifying its own implementation; humans can flag problems, but the agent decides which changes to actually make.
Because the agent can rewrite its own code and even choose which model API to route to, the design treats operator controls -- like a /panic command that halts everything, spending limits, and multi-model diff review -- as safeguards that must remain authoritative even as the system keeps evolving.

Figure 1: Ouroboros architecture. One supervised runtime dispatches work to admitted workspaces, task trees, and benchmark adapters. Child patches return to the parent; self-repository changes then pass the reviewed gate. External deliverables and benchmark evidence remain separate artifacts.

Table 1: Boundary of evolution in related systems. “Core code” means the agent can change the harness implementation that later runs tasks. “Reviewed commits” means changes are serialized through an auditable version-control gate before adoption.
System	Prompts	Tools/skills	Workflow	Core code	Reviewed commits	Deployment state
Voyager	✓	✓	–	–	–	–
Live-SWE-agent	✓	✓	–	–	–	–
Autogenesis	✓	✓	✓	partial	specified protocol	partial
Darwin Gödel Machine	✓	✓	✓	✓	benchmark selection	–
Hermes Agent	✓	✓	✓	–	–	✓
OpenClaw / ClawBench	✓	✓	✓	–	–	–
Ouroboros	✓	✓	✓	✓	✓	✓

Figure 2: Subagent patch-integration protocol. Acting children write in isolated worktrees; the parent verifies lineage and touched paths and remains the sole committer.

Table 2: Model–harness results across five benchmark families. Links to traces, manifests, and submissions appear in the corresponding benchmark paragraphs.
Benchmark	Model	Ouroboros	Named baselines
Terminal-Bench 2.1	Opus 5 high	86.97% raw; 86.74% audited	Claude Code + Fable 5: 83.8%
Terminal-Bench 2.1	GPT-5.5	84.3%	Codex CLI: 83.1%
Terminal-Bench 2.1	Grok 4.5	84.94% audited	Cursor: 79.3%; Hermes: 77.53%
OSWorld-Verified	Opus 5	90.69%	Intelligence-Indeed: 90.19%; Mythos Preview: 85.4%
CL-Bench	Sonnet 4.6	0.2301	ICL: 0.1960; Claude Code: 0.1855
SWE-bench Pro	GPT-5.6 Luna	58.2%	Codex: 59.4%, p=0.40
GAIA	Sonnet 5	78.2%	Claude Code: 78.8%

Figure 3: Task-tree view of a live Ouroboros session: nested planning and acting roles with per-node status, note counts, and child counts.

Table 3: Scaffold disclosures for the reported benchmark rows. Exact provider routes, efforts, seed commits, task selection, and runtime attestations are preserved in the linked run artifacts.
Benchmark	Scaffold disclosure
Terminal-Bench 2.1	Declared model; fresh trial state; delegation off with planning scouts disclosed; agent web off; blocking review; evolution off.
OSWorld-Verified	Declared model; empty memory across tasks; delegation off; task-configured proxy and GUI shell disclosed; feasibility pass; evolution off.
CL-Bench	Sonnet 4.6; persistent memory per rollout; delegation, web, and vision off; one blocking improvement pass; evolution off.
SWE-bench Pro	GPT-5.6 Luna; private memory per instance; delegation off; network exposure audited; fixed harness; evolution off.
GAIA	Sonnet 5; private memory per sample; delegation off; same-model native search; anti-lookup and leakage audit.

Figure 4: Results on Terminal-Bench 2.1, OSWorld-Verified, and CL-Bench against named published baselines. Red bars mark Ouroboros, gray bars mark baselines, and outlined bars are audit-adjusted scores. Terminal-Bench whiskers show ±1 binomial standard error over 445 trials; OSWorld and CL-Bench report single scored campaigns. Axes are truncated to the competitive range.

Findings

On Terminal-Bench 2.1, the Opus 5 run scored 86.97% raw (387/445) and 86.74% (386/445) after trajectory audit, the best reported result on this benchmark, roughly two standard errors above the strongest baseline, Claude Code with Fable 5 at 83.8%.
On OSWorld-Verified, the Opus 5 run scored 90.69% (327.39/361), exceeding the previous leaderboard leader, the Intelligence-Indeed agent, at 90.19%.
On CL-Bench, a five-rollout campaign with Sonnet 4.6 reached a normalized reward of 0.2301, above the strongest published baseline of plain in-context learning (0.1960 with Sonnet 4.6).
On SWE-bench Pro, after symmetrically removing instances where either system reached the reference solution, Ouroboros resolved 58.2% versus Codex's 59.4% on 655 paired tasks, a difference not statistically significant (McNemar's test, p=0.40); on GAIA, Ouroboros scored 78.2% versus Claude Code with Sonnet 5 at 78.8%.
During the 161-day Hope deployment, trajectory audits found a duplicate-message-send bug and a review-context-overflow bug that caused self-review failures; both were traced and fixed with reviewed structural changes, including a bounded, connectivity-aware context assembly method.

Figure 5: Operational control boundaries. Public interactions enter one ordered log and bounded digests; budget and routing controls use the authenticated operator path, while /panic halts the process tree before agent handling. Diff review remains active in both context modes; whole-repository scope review runs only in max mode.

Where it can be used

Designing harnesses for long-horizon coding agents that need a reviewed pipeline for tools, prompts, and code changes rather than a fixed, frozen configuration.
Building multi-channel AI deployments (chat, voice, social media, email) that need a structured process for turning user feedback and observed bugs into system improvements.
Designing operational safety mechanisms -- such as emergency stop commands, external spending caps, and multi-model review -- for self-modifying AI systems.

Figure 6: Hope public deployment series through 6 August 2026. Axes start at zero; February and August are partial months. Values are monthly endpoints from the public evolution feed.

Limits and open work

The deployment study observed a single long-running lineage rather than a controlled population of independently evolving agents, limiting generalization.
SWE-bench Pro results are affected by public reference-solution leakage and known task defects, requiring careful interpretation.
LLM-based reviewers may share blind spots with the agent being reviewed, and low review mode skips whole-repository scope review entirely.
Benchmark campaigns run on frozen system snapshots while the live Hope deployment keeps evolving on a separate lineage, so benchmark scores do not directly represent the current live system.

Figure 7: Ouroboros interface surfaces. The complete project view shows a live visual-verification task, its conversation, generated artifact, and runtime controls. The skills view exposes installable tools, routes, and widgets outside the base runtime.

Why it matters

This shows that not just the underlying model but the entire execution harness around an AI agent can keep improving itself in a deployed, live system, backed by concrete benchmark and long-running deployment evidence. It also offers a concrete blueprint for what operational safety controls look like when the agent being controlled can rewrite its own code.

Terms in this paper

harness · the surrounding software that lets an AI model use tools, follow instructions, and complete tasks
reviewed commit · a code change that must pass a review process before it is applied to the live system
Terminal-Bench 2.1 / OSWorld-Verified / CL-Bench · benchmarks that test terminal task completion, computer-screen operation, and continual learning ability respectively
normalized reward · a standardized score that lets different task results be compared on the same scale
/panic · an operator command that immediately halts every process the agent is running

Original abstract (English)

We present Ouroboros, a self-developing agent harness whose tools, prompts, context assembly, and core implementation improve through reviewed commits that become the runtime for later work. Core evolution proceeds in two modes. In recursive free evolution, improvement is itself a task, and completing one evolution cycle can schedule the next. In experience-driven core evolution, ordinary work and social interaction expose bugs, rough edges, and inefficient context construction that lead to reviewed structural changes. On Terminal-Bench 2.1, an Opus 5 run scores 86.74%, the best result reported on the benchmark. On OSWorld-Verified, an Opus 5 run reaches 90.69%, exceeding the best previously reported score. A five-rollout CL-Bench campaign achieves a normalized reward of 0.2301, setting a new state of the art. Hope is the longest-running publicly documented Ouroboros deployment. It is a 161-day living agent experiment in free evolution under governed human communication across seven surfaces. Human interaction surfaces faults and generates proposals, but the agent decides which changes to pursue. Because a self-developing agent may rewrite its own code and select new model APIs, operational safety becomes a primary design problem: guardrails must remain authoritative under evolutionary and public social pressure. Benchmark campaigns use frozen system snapshots, while Hope continues live evolution on a separate lineage.

Authors · Anton Razzhigaev

Read on arXiv

Latest papers

All papers →

Latest from METAL LAB

Figures: Anton Razzhigaev et al., arXiv:2608.08311, CC BY 4.0