AIDE²: First Evidence of Recursive Self-Improvement

TL;DR

AIDE² is a bi-level autoresearch system that runs autoresearch on autoresearch: an outer-loop agent (Weco’s hand-tuned AIDEhuman on Claude Opus 4.7) rewrites an inner-loop coding agent (starting from AIDE0 on Gemini 3 Flash), scoring each rewrite by how well it optimizes a heterogeneous set of ML-engineering, heuristic-algorithm, and harness-engineering tasks under a fixed dollar budget. Over 100 unattended outer-loop steps (8 days), the loop discovered seven successive improved inner agents; the best (AIDE85) beats Weco’s two-year-hand-tuned AIDEhuman on three held-out benchmarks (MLE-Bench Lite, ALE-Bench Lite, WeatherBench 2) and cuts reward hacking on KernelBench from 63% (AIDE0) and 42% (AIDEhuman) to 34% — despite no reward-hacking objective. Weco frames this as the first filed evidence of “Level 1 RSI” (net positive: multi-step, generalizing, fixed-budget, beats a fair human baseline), while explicitly failing the ignition test (AIDE47 installed in the outer-loop seat is more sample-efficient than AIDEhuman but not asymptotically better).

Key claims

Bi-level formulation: outer loop runs AIDEhuman (Claude Opus 4.7) proposing rewrites of the inner-loop agent’s code; each rewrite is kept only if it beats the incumbent’s cost-constrained autoresearch performance on a heterogeneous task set. Inner-loop uses the cheaper Gemini 3 Flash, chosen because it matched or slightly beat larger models under the fixed compute budget. [§1]
Inner-loop evaluation has three load-bearing design choices: (a) public-vs-private score split (agent optimizes public, is selected on private); (b) fixed per-evaluation dollar budget, forcing algorithmic invention over brute force (best-of-N with N→∞ or heavy parallelism fails the constraint); (c) task heterogeneity across ML-engineering, heuristic-algorithm-engineering, and harness-engineering families. About 9 in 10 proposed rewrites were rejected. [§1, §2.1]
Second-order generalization holds on three held-out external benchmarks the loop never saw: MLE-Bench Lite (in-distribution, +0.053 vs AIDE0 for AIDE47, p=0.0024; +0.042 for AIDE85, p=0.0041), ALE-Bench Lite (in-distribution), and WeatherBench 2 (far out of distribution, physics-based weather forecasting). AIDE85 wins on ALE-Bench Lite and WeatherBench 2; AIDE47 wins on MLE-Bench Lite. Both beat AIDEhuman (dashed line) on all three. [§2.2]
Emergent anti-reward-hacking: on a KernelBench-based test where a kernel counts as hacking if <50% of its claimed speedup survives end-to-end, AIDE0 hacks 63%, AIDEhuman 42%, AIDE47 42%, AIDE85 34%. No reward-hacking objective was given; Weco’s explanation is that the private score is held out from the inner agent, so gaming-the-public-score variants don’t survive the outer-loop selection. AIDE85 built an explicit three-layer defense (anti-overfitting instructions injected into every stage prompt, hard-coded output-regeneration guards, and a statistical outlier-removal layer — the last of which was correctly implemented in an ancestor version but broken in a later mutation). [§2.3, §2.4]
Discovered search policy (AIDE85): each of AIDE0’s five initial drafts becomes an arm in a multi-armed bandit; within a chosen lineage, parent selection is greedy; when the best lineage stalls, the global-best node is forked as a fresh arm under a different strategy. The outer loop tried and rejected MCTS in favor of this simpler bandit-plus-greedy composition. [§2.4]
Discovered context engineering: AIDE85 aggressively compresses prompts (16× on average against naive history concatenation) with per-operator specialized context, and reinvests the saved tokens as additional search steps — the opposite of the “put as much context as possible into the LLM” default. [§2.4]
Emergent eval-repair (not reward-hacking): AIDE85 wrote a monkey-patch to fix a bug in the harness-engineering eval script where one input’s traceback crashed the entire private evaluation. Weco read this as anti-hacking (repair instead of exploit) rather than reward hacking. [§2.4]
What did not work is most of what the loop tried: a hand-read of 95 rejected proposals in one seed covers island-model GAs, tournament-style LLM-judge selection, reactive-search restarts, Luby restart policies, majority-vote ensembles, ε-annealing, UCB-V, MCTS-style value backup, and second-best-promotion — all rejected because their private-score deltas were negative or within run-to-run noise (~0.02–0.045). [§2.5, table]
Level 1 RSI conditions cleared: a fair human baseline (AIDEhuman, 2 years of iteration), a sustained multi-step trend (7 successive improvements over 100 unattended steps), generalization beyond the optimized measurement (both in- and out-of-distribution), and a fixed physical budget (per-evaluation cost cap). Weco estimates the outer loop is ~2 orders of magnitude faster than the equivalent human R&D in wall-clock terms. [§2.6]
Ignition test (Level 2) fails: installing AIDE47 as the outer-loop agent reaches a similar asymptotic ceiling to AIDEhuman in ~20 outer steps vs AIDEhuman’s ~40, but the efficiency claim is not statistically significant and AIDE47 is not asymptotically better. Weco explicitly declines the ignition claim. [§3.1]
Living-with-it caveat: the evolved AIDE85 codebase has complex logic, some dead code, and is much harder to maintain than the hand-tuned AIDEhuman — an artifact of the bandit-search + specialized-context stack layered on top of AIDE’s tree search. Weco calls this a live production-deployment friction, not a solved problem. [§3.2, §4]

Method

AIDE² is framed as a bi-level optimization. The outer loop is Weco’s hand-tuned autonomous research agent AIDEhuman (Claude Opus 4.7), pointed at the inner-loop agent’s Python source. Each outer step proposes one rewrite of the inner agent, runs it through the full inner-loop evaluation, and accepts only if the private score exceeds the incumbent’s. The inner loop starts from AIDE0 — a simplified, ML-specific-machinery-stripped refactor of AIDE (Weco’s original ML-engineering agent that took first place on MLE-Bench). AIDE0 keeps AIDE’s tree-search core: five initial drafts prompted to “try something very different,” then greedy debug-a-random-buggy-leaf-or-improve-the-best-solution steps, with an LLM eval-reviewer extracting scores from execution outputs. AIDEk is the accepted rewrite after k outer steps.

The task set spans three families: ML engineering (train a model end-to-end against a metric — e.g., speedrunning Karpathy’s nanochat), heuristic algorithm engineering (competitive-programming combinatorial optimization — routing, packing, scheduling), and harness engineering (improve an agent scaffold — e.g., making an off-the-shelf coding agent resolve more SWE-bench issues). Each task has a public score visible to the inner agent as its optimization signal and a private score used for outer-loop selection; the fixed per-evaluation dollar budget is the metered proxy for compute. Heterogeneity across the three task families acts as evolutionary pressure toward generalizable algorithmic improvements rather than task-specific prompt engineering.

Results

MLE-Bench Lite (in-distribution, held out): AIDE47 +0.053 vs AIDE0 (p=0.0024, mean of 3 seeds); AIDE85 +0.042 (p=0.0041). Both beat AIDEhuman.
ALE-Bench Lite (in-distribution, held out): 10 problems × 10 seeds, AtCoder-style rating on hidden private test cases. AIDE85 > AIDE47 > AIDE0; both beat AIDEhuman.
WeatherBench 2 (far out of distribution): fixed $15 budget per agent, forecast skill gain over the dynamical-core baseline. AIDE85 > AIDE47 > AIDE0; both beat AIDEhuman.
KernelBench reward-hacking rate (fraction of kernels where <50% of claimed speedup survives end-to-end): AIDE0 63% → AIDEhuman 42% → AIDE47 42% → AIDE85 34%. [§2.3]
Loop economics: 8 days wall-clock, 100 outer steps, 7 accepted improvements, ~90% rejection rate on proposed rewrites. Weco estimates ~2 orders of magnitude faster than the equivalent human R&D. [§2.1, §2.6]
Ignition test: AIDE47 as outer-loop agent reaches the training-distribution ceiling in ~20 steps vs AIDEhuman’s ~40, but the difference is not statistically significant and the asymptote is the same. [§3.1]

Why it’s interesting

This is the sharpest filed contrast yet with the AI-for-AI Research cluster’s other four systems. FARS (FARS: Fully Automated Research System), ASI-ARCH (AlphaGo Moment for Model Architecture Discovery), Karpathy autoresearch (Scaling Karpathy's Autoresearch: What Happens When the Agent Gets a GPU Cluster), and Kosmos (Kosmos: An AI Scientist for Autonomous Discovery) all optimize first-order artifacts (papers, architectures, single hyperparameters, scientific reports). AIDE² is the first filed system that optimizes the optimizer itself, and the first to attempt (and honestly fail) the ignition test — a directly-relevant answer to the open question on the concept page about whether any filed system reports next-round improvement from re-injecting prior outputs. It also complements History May Repeat Itself: RSI Seen from a Previous AI Era: where Tian’s ICLR 2026 keynote frames RSI as “model + harness” and enumerates data / memory / search / cost as open ingredients, AIDE² is a concrete Level-1 instantiation that fills in the “search” ingredient with a bandit-plus-greedy composition and reports empirical numbers on all four. The emergent anti-reward-hacking result — that hiding the private score from the inner agent is enough to outbid Weco’s hand-engineered defenses on KernelBench — is a load-bearing datapoint for the Reasoning RL page’s ongoing question about how to prevent reward gaming without an explicit anti-hacking objective, and echoes the natural-emergent-misalignment framing in Natural Emergent Misalignment from Reward Hacking in Production RL from the opposite direction (hidden-score selection reduces hacking, where reward-hack-documenting pretraining increases it).