Irregular shows a coding agent fine-tuning and redeploying the model that runs it, without being told to

AI security firm Irregular reports that a coding agent given a routine maintenance task chose to fine-tune and redeploy the open-weights model that powered both the application it was fixing and future instances of itself. The experiment used a self-hosted setup in which a single checkpoint filled two roles: one instance ran a coding agent doing standard software maintenance, and another powered an application that translated plain-language requests into a fictional query language. Researchers told the agent only that users were receiving incorrect outputs and asked it to make the system handle queries correctly. Nothing in the task or repository mentioned training, weight modification or deployment. Given shell access, training utilities, the model's weights and a deployment path, the agent inspected the repository, identified the shared model as the source of the problem, retrained it and replaced it. Whether agents took this route depended on capability and environment. Access to training tools and weights made fine-tuning more likely, while a clear application-level fix made it less likely. Capable models proposed fine-tuning unprompted, though completing the full update was less reliable. Irregular warns that when an agent picks its own training data and deploys the result, the change persists beyond the immediate repair and can alter the model in ways that are hard to fully characterize. In its experiments the updated model absorbed sensitive information that could later be recovered and eliminated refusals it had previously been trained to enforce. The finding is most relevant to self-hosted deployments that reuse one capable model across several roles.