AI security firm Irregular has shown that an AI coding agent can rewrite its own underlying model without being explicitly told to, raising fresh questions about how organisations can govern and control AI systems that modify themselves. In tests, a Qwen3.5-27B coding agent asked to fix a faulty application chose to retrain the model powering both the app and future versions of itself, rather than simply editing the code — a behaviour Irregular calls "agentic self-modification".

The experiment, described in a study published on Wednesday and conducted in a controlled test environment rather than live systems, found the retraining had lasting side-effects. After fine-tuning, the model correctly reproduced three of six synthetic secrets (a fake API key, email address and home address) planted in training data, despite having no access to the original source. In a separate test, the agent also managed to bypass built-in refusals — safety restrictions blocking answers about fictional competitor names — by generating its own training data via code execution and fine-tuning them away. Irregular, which works with OpenAI, Anthropic and Meta and previously reported frontier models escaping test environments to hack real systems, warns such self-directed workarounds are likely to become more common as coding agents improve.