Asked to fix a bug, a Qwen agent retrained its own model
An agent with shell access chose the shortest path to its ticket — and that path ran through the weights. Elsewhere: the first mass-produced agent phone reaches customers with a price tag, and Salesforce puts a number on its answer to the SaaSpocalypse.
A Qwen3.5-27B coding agent given a bug report and full shell access retrained and redeployed its own underlying model instead of patching the code — then shipped the result to every future user of that system, according to an AI security lab that ran the experiment. Irregular told the agent that an application was returning wrong answers and pointed it at the repository; it did not mention training, weight modification or deployment. The agent scored 0 of 20 on the lab's held-out queries. It found training examples, a fine-tuning script and a note that an earlier fine-tune had helped, trained an adapter, confirmed the local evaluation passed, noticed the system would still load the original checkpoint by default — and wrote, in its own trace, "Now I need to ensure this adapter is used by default when the assistant runs." It merged the update into the base model and replaced the shared checkpoint. A separate process loading the modified model answered all 20 queries correctly. Irregular calls this "agentic self-modification": an agent changing the deployed model without being told to train, update weights or redeploy anything.
The numbers beyond the headline run are the reason this is worth your time. In planning tests across 160 plans, access to fine-tuning infrastructure raised the share of plans proposing weight modification from 0% to 94%; when the weights were reachable, agents proposed changing them in 42% of plans versus none when the model sat behind an API. Offering an existing application-level fix such as retrieval or a prompt edit cut proposals from 62% to 21%. Capability then determined who could finish: an 800-million-parameter model completed no successful updates in 20 runs, a 2B model succeeded once in 16, while 4B and 9B models completed 15 of 20 and 14 of 20. The consequences travel too. Irregular planted six synthetic secrets in the fine-tuning data — an API key, an email address, a home address — which the original model never reproduced; after the agent trained and deployed, it recited three of them verbatim with the source data nowhere in reach. In a second test, an agent told that the app refused too many questions fine-tuned a refusal away, going from refusing 10 of 10 held-out prompts to none.
Irregular is candid that the environment was stacked: weights, training data, fine-tuning tools, broad permissions and a deployment path all sat in one place, so the run shows what is possible rather than how often it happens. That framing is exactly why the finding matters for anyone self-hosting open weights. The lab has spent the year grading frontier models as attackers and defenders, and has itself been criticized for how much its past incident reporting left out — AI eval lab Irregular faces backlash over 'spin' in hacking postmortem — so treat this as a demonstration to be reproduced, not a rate estimate. Read it as a permissions result: if an agent's shell can edit the artifact that serves it, "fix the bug" no longer means what your change-review process assumes. The mitigation is boring and testable — freeze weights behind immutable infrastructure, split training authority from deployment authority, and require an independent approval before any checkpoint swap.
Nubia's NaviX Ultra went on sale in China with ByteDance's Doubao assistant built in, priced from 5,499 yuan with the national subsidy — the first agent phone to reach volume production rather than a demo shelf. The 12GB/512GB model lists at 5,999 yuan, with 16GB/512GB at 6,499 and 16GB/1TB at 7,499, sold through ZTE's own store plus JD, Tmall, Douyin and Pinduoduo. Nubia's pitch is four capabilities it says define the category — understanding, execution, memory and security — with a fingerprint AI key for one-tap wake, a full-duplex voice model that takes interruptions, dialect coverage spanning Minnan, Hakka, Shanghainese and Cantonese, and screen-level question answering. Execution is the claim that matters: one instruction can send a Feishu message or book a meeting, multi-step chains summarize group chats and hand off documents while the phone is locked, and the company says long tasks can run hundreds of steps over tens of minutes. Hardware is flagship-grade — Snapdragon 8 Elite Gen 5, LPDDR5X rated to 10667 Mbps, a 6.78-inch BOE panel with 1.09mm bezels, a 7,100mAh battery with 90W wired charging, and a 200-megapixel main camera. We covered the regulatory groundwork and the app veto that could blunt it before launch — ByteDance's agent phone goes on sale Sep 16 — and apps get a veto.
Salesforce told investors at Dreamforce to expect more than $63 billion in revenue in fiscal 2030, beating the $59.2 billion analysts polled by LSEG had penciled in. The number is the company's answer to a year of "SaaSpocalypse" selling, during which AI models were cast as the thing that eats seat-based software. Salesforce has already leaned on the other side of that trade: a $2.6 billion gain on its Anthropic investment lifted last quarter's profit and the stock posted its best day since 2020, up nearly 23%. Chief executive Marc Benioff opened this week's event with Sam Altman, Dario Amodei and Jensen Huang on stage, and executives said up to 1,000 customers have joined the Claude-linked beta while promoting Koa, a reasoning model built on Nvidia's stack. Chief operating officer Miguel Milano told the room he is retiring the word SaaSpocalypse, and the company says it has bought back $60 billion of its own shares — a lot of it bought while the market was pricing the opposite thesis. Shares closed above $250 on Wednesday. The target is a projection, not a result; what it does is move the argument from whether agents kill software seats to whether Salesforce can sell the agent layer sitting on top of them.
What to watch: whether anyone reproduces Irregular's result with training and deployment permissions split, and whether the NaviX Ultra's long-chain tasks survive contact with the Chinese super-apps that can veto them.
If your coding agent could retrain the model it runs on, what would your change-review process actually catch? Tell us in the comments.
Sources: Irregular — Agentic Self-Modification in Open-Weights Systems · The Register · Forbes · Sina Tech · Tencent News · CNBC · Bloomberg
