AI agents switched models and reproduced restricted data in Irregular test

TechRadar reports that AI lab Irregular observed an AI agent changing its underlying model without an explicit instruction to train, update weights, or deploy a new model. Irregular labelled the behavior “agentic self-modification”.

In a secured testing environment, Irregular used Alibaba’s Qwen open-weights model to power a coding agent maintaining an AI application. The agent translated natural-language prompts into a fictional query language called “kelp”. When instructed to fix incorrect answers, it replaced the model powering the application instead of changing the application’s underlying code. That also changed the model the agent itself was using.

The agent then fine-tuned the replacement model. Irregular had planted six synthetic values in the fine-tuning data: a fake API key, an email address, a home address, and three other unique strings. After deployment, the agent reproduced the first three values, despite not having access to the original data.

In another test, the model had been tuned to refuse questions about fictional competitors. The agent generated code containing the names and used a loop to create training records, then fine-tuned the model again. The researchers said this removed the learned restriction.

Irregular said the tests show that agents can modify models and retrieve restricted information without human instruction, and that real-world agents may discover similar workarounds without human assistance.