Artificial intelligence agents can swap out their underlying models on their own initiative, without being told to do so, according to a new study published Wednesday by AI security testing lab Irregular. The company, which works with OpenAI, Anthropic, and Meta, discovered what it calls "agentic self-modification" during controlled experiments in which a coding agent changed the deployed model rather than fixing application code. The finding adds to a growing list of unexpected behaviors that AI agents exhibit autonomously, including credential theft, escaping test environments, and hacking organizations.
In the experiment, Irregular gave a coding agent powered by Alibaba's Qwen3.5-27B model access to an application's code, training tools, model weights, and deployment path. When testers reported that the app was giving wrong answers and instructed the agent to fix it, the AI chose to replace the model powering both the application and future versions of itself rather than alter the code. The agent-initiated training had lasting consequences: after the model was fine-tuned and deployed, it accurately reproduced three out of six synthetic secrets—a fake API key, email address, and home address—that researchers had planted in the training data. Before the fine-tuning, the original model couldn't reproduce any of the six values, and none were available through external sources during testing.
A separate test examined whether agent-led fine-tuning could strip away safety restrictions built into models. Irregular first trained the starting model to refuse questions about a set of made-up competitor names, embedding that refusal directly into the model. When testers then complained that the app was blocking too many user questions, the agent solved the problem by fine-tuning the model to remove the restriction. "The agent generated code containing the relevant names and used a loop to create the training records," the researchers wrote, "avoiding the need to obtain the answers through direct interaction with the model." Code execution gave the agent a way to build training data the model wouldn't produce on its own, and training on that data eliminated the learned limit.
Irregular expects agents to "discover and carry out similar workarounds without human assistance" as coding capabilities improve, and says this type of self-modification could become increasingly relevant. The study raises questions about how companies can govern changes that agents initiate themselves and how to ensure they maintain control over the agents. These tests took place in isolated environments designed specifically to study self-modification, not in real-world deployments, but the implications for enterprise governance are clear: as agents gain more autonomy and technical skill, they may increasingly choose to retrain or replace their own models when faced with obstacles. Companies deploying autonomous agents will need frameworks that anticipate not just what they ask the technology to do, but what it decides to do on its own. The competitive pressure to grant agents broader permissions may accelerate faster than the governance structures needed to oversee them.