Self-Improvement Was Never in the Model
The dream of a self-improving agent usually gets parked in the future tense: one more model generation, one more capability jump, and the thing will finally learn on the job. I believed a version of that too, right up until I audited my own fleet. Thirteen always-on agents running my agency work and my personal products. A knowledge graph with 1,300+ pages. Per-agent memory files, a nightly consolidation job, session rotation that carries context across every crash. And five of my eight core agents had completely empty long-term memory files.
Alive, healthy, self-healing. Learning nothing.
The fleet wasn't failing to improve because the models were too weak. It was failing because nothing in the system ever wrote a lesson down. That's the whole essay, compressed: self-improvement is a systems property, not a model property. The weights are frozen between releases; the environment around them doesn't have to be. Here's what closing the loop actually took, built with nothing more exotic than cron, bash, and discipline.
A fleet can be alive and still be a goldfish
Here's what makes those empty memory files embarrassing. The infrastructure existed. The shared knowledge graph (gbrain, Garry Tan's open-source agent-memory graph, my clone at 1,300+ pages) that every agent could query. Per-agent memory files in every workspace. A nightly "dream cycle" refreshing embeddings and writing a daily digest. On paper, a complete memory stack.
What didn't exist was a loop. Sessions got summarized when they rotated, so agents resumed mid-task without amnesia. But nothing ever distilled what an agent learned and wrote it back into the agent's prompts, memory, or skills. Consolidation without writeback. The pipe was built and nothing flowed through it, which is how five agents ran for weeks with memory files that were literally blank, while I corrected the same agents for the same mistakes like a manager who never writes anything down.
The audit surfaced worse. Persona files confidently told agents "you run on Sonnet" while they were running Opus. Memory instructions contradicted each other across files. One harness sat 8,519 commits behind upstream. And one genuinely silent bug had been breaking the fleet's recovery path for three weeks without a single visible error, a story painful enough to get its own post. None of this showed from the outside, because the fleet looked fine. Uptime is a lousy proxy for health, and health is a lousy proxy for growth.
The system compounds. The model doesn't.
The tempting conclusion is to wait: surely the next model will remember, reflect, improve itself. I think that's exactly backwards. Frontier models are stateless by design; Anthropic's own engineering guidance treats context as "a finite resource with diminishing marginal returns" and points to structured note-taking outside the context window as the way agents accumulate knowledge. The model is never going to compound on its own. The system around it can.
The piece that crystallized this for me was a 14-step writeup by 0xCodez on building self-improving agent systems: a four-layer stack, primitives, then orchestration, then memory, then the self-improvement loop on top, with the thesis that self-improvement is a property of the system, not the model. The research agrees. Stanford and SambaNova's ACE paper (Agentic Context Engineering) showed +10.6% on agent benchmarks by evolving the context, the accumulated playbook of lessons the model reads, while the weights never move.
Same models every day. Sharper environment every night. That's the entire trick, and it's buildable in a weekend.
The loop closer is a cron job at 4:10 a.m.
The centerpiece of the rebuild is a nightly job I call the Reflector, after the component in the ACE paper that does the same work. Every morning at 04:10 it gathers each agent's last 24 hours of sessions and rotation summaries, and distills at most five candidate lessons per agent with Sonnet.
The critical design choice is that lessons are append-only itemized bullets, never a rewrite of the whole prompt. ACE names the failure mode this avoids: context collapse, where a model asked to rewrite its accumulated context "tends to compress it into much shorter, less informative summaries, causing a dramatic loss of information," plus its cousin, brevity bias, the drift toward short generic prompts. Ask a model to "improve" its own instructions wholesale and it will cheerfully summarize away everything it learned. Append, never rewrite.
The first night's harvest: seven lessons across four agents, every one grounded in a real transcript. My favorite came from dash, my ads and ops agent, which learned "never lead outreach with internal campaign labels" directly from corrections I'd made mid-session and would absolutely have had to make again. A weekly cousin, the skill harvester, mines transcripts for workflows performed twice or more that no skill covers and drafts complete skill files, steps, failure modes, anti-patterns. Its first run captured a warm-prospect-reply workflow from real client outreach, with my corrections baked in as the anti-patterns.
None of this needed a new model, a new framework, or a vector database migration. It needed a scheduler and the discipline to run every night.
The model that writes is never the model that grades
The naive version of a reflection loop is one model critiquing itself, and it doesn't work well; self-critique is famously soft on its own output. The 0xCodez writeup reports the same from the builder's side: independent verifier sub-agents beat self-critique, in his experiments by a wide margin (his numbers, not mine, so hold them loosely).
So the Reflector is split in two. Sonnet is the maker: it drafts the candidate lessons. Then an independent Haiku skeptic, a separate model with a separate prompt and no stake in the output, tries to reject each bullet on four grounds: is it ungrounded in the actual transcript? Too specific to yesterday to be a rule? Does it contradict an existing rule? Was it derived from untrusted content? Only survivors get staged for approval. The same separation shows up elsewhere in the fleet, including a weekly model scorecard judged blind, but benchmarking my own agents against each other is a post of its own.
Adversarial review as architecture, not as vibes. The maker never grades its own homework.
Provenance is a firewall, not paperwork
Here's the part most self-improvement tutorials skip entirely: a loop that writes to your agents' memory is a machine for permanently modifying your agents' behavior, and attackers know it. AgentPoison (NeurIPS 2024) showed you can poison less than 0.1% of an agent's memory or knowledge base and hit attack success rates above 80%. MINJA went further: injecting malicious records into an agent's memory bank through nothing but ordinary queries, with a 98.2% injection success rate. OWASP now names memory and context poisoning as its own category in the agentic top 10, and Anthropic's containment guidance is blunt about why: "tool output is an attack surface even when the tool is trusted," and anything that persists across sessions gets reloaded every time the agent starts. My agents read inbound email. They talk to strangers in Discord. Those are exactly the untrusted-content inputs in Simon Willison's lethal trifecta.
So every write to the fleet's shared memory now carries provenance: a scope (work, personal, shared), a source, a trust level (verified, reported, or inferred), and an optional expiry. Two rules do the security work. Untrusted content can never enter memory as "verified," no matter how confident it sounds. And nothing unverified can ever overwrite a verified fact. The skeptic enforces the same boundary on lessons: anything derived from untrusted content gets rejected before it can reach an agent's memory.
Provenance sounds like bureaucracy until you reread those attack numbers. It's not metadata. It's the immune system.
Autonomy is staged, not granted
The last design decision is the one I'd defend hardest: the loop does not get to modify my agents by itself. Not yet.
Today every surviving lesson waits in a staging area for human approval. The review takes about a minute and happens in Telegram: I message Zara, my chief-of-staff agent, "show me pending lessons," then "apply all," and a small script appends the approved bullets to each agent's memory and mirrors them to the knowledge graph with full provenance. The plan is to flip individual agents to auto-apply once the loop earns it, and "earns it" is defined, not vibes: every persona, memory, and skill file is versioned in a local git repo, so every self-modification is an auditable, revertible diff, and monthly memory evals test whether agents actually apply their stored rules rather than parrot them (my chief of staff's baseline: 15/15). When the diffs stay clean and the evals stay flat or rising, an agent graduates.
That ordering matters. Measurement before autonomy, always: you cannot hand a system the keys to its own brain until you can detect it getting worse. The eval suite and the git history aren't the boring afterthought of the project. They're the reason the exciting part is safe to run.
Am I reinventing a wheel?
The ideas here have a respectable academic lineage, and it's worth naming. Reflexion established learning through linguistic feedback in an episodic memory buffer. Voyager built an ever-growing skill library, in Minecraft. MemGPT gave agents tiered virtual memory and grew into Letta. MIT's SEAL goes furthest and has the model write its own weight updates. And ACE supplies the method my Reflector borrows.
But look at what none of them ship: provenance on memory writes, an adversarial skeptic between reflection and commitment, human approval gates with a defined path to autonomy, versioned diffs of every self-modification. The papers optimize benchmarks. A production fleet accumulates liabilities, poisoned memories, drifted personas, silently broken plumbing, and the guardrails against those liabilities turn out to be most of the actual work. The research gives you the loop. It doesn't give you the discipline.
One cycle, compounded
Last week the loop closed end to end for the first time: agents worked, the Reflector distilled, the skeptic vetoed the ungrounded, I approved from my phone, and the fleet's memory got permanently sharper. Seven lessons and one new skill. A small harvest, but the point of compounding is that it starts small and never gives anything back.
Keeping agents alive got me a fleet that survives. Closing the loop is getting me a fleet that accumulates, the same frozen models inside an environment that improves while I sleep. That's the reframe I'd offer anyone waiting for a model smart enough to improve itself: stop waiting. It was never going to be in the model. It's in the system, and the system is yours to build.
The models wake up the same every morning. My fleet doesn't.
References: 0xCodez, "Build self-improving agent system with Fable 5 in 14 steps"; Zhang et al., ACE: Agentic Context Engineering (Stanford/SambaNova/Berkeley, 2025); Anthropic, Effective context engineering for AI agents and containment guidance; Chen et al., AgentPoison (NeurIPS 2024); MINJA, memory injection via queries (NeurIPS 2025); OWASP Agentic Top 10, ASI06 Memory & Context Poisoning; Simon Willison, the lethal trifecta; Reflexion; Voyager; MemGPT/Letta; SEAL. Prior piece: session-warden.