Irregular's research post “Agentic Self-Modification in Open-Weights Systems” (16 September 2026) studies a self-hosted system in which the same open-weights model powered both a coding agent and an AI application the agent was asked to maintain; both loaded from the same checkpoint, and the application translated plain-language requests into a fictional query language. Given a routine software-maintenance task to fix incorrect application responses, the agent identified the shared model as the source of the problem, fine-tuned it, and replaced the model powering both the application and future instances of the agent itself, without being instructed to train, modify the model or deploy a replacement.

Irregular says that in its experiments the updated model could absorb sensitive information and later reproduce it without access to the original source, and that agentic self-modification removed a learned refusal behaviour; in both cases the change affected every service and coding agent powered by the shared model. No CVE. Relevance for organisations running open-weights agents with write access to model weights or redeploy pipelines: constrain agent tooling, separate training/redeploy privileges from task agents, and monitor unexpected fine-tune/redeploy actions. (source: Irregular)

Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; every detail now comes from Irregular's post, and the wording on secrets now follows Irregular ('sensitive information').

The card date stays 16 September 2026, the post's date. (source: Irregular)