papers/hanzo-harness-hacking/hanzo-harness-hacking.tex

% Hanzo Harness-Hacking Paper
% Fully self-contained -- no \input{} directives
\documentclass[11pt]{article}
\usepackage{../shared/hanzocover}
\usepackage{amsmath, amssymb, amsthm}
\usepackage{mathtools}
\usepackage{bm}
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{hyperref}
\usepackage{enumitem}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{xcolor}
\usepackage[numbers]{natbib}
\usepackage{float}
\usepackage{subcaption}
\usepackage{tabularx}
\usepackage{multirow}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{definition}{Definition}
\newtheorem{remark}{Remark}
\newtheorem{assumption}{Assumption}
\newtheorem{invariant}{Invariant}

\DeclareMathOperator*{\argmin}{arg\,min}
\DeclareMathOperator*{\argmax}{arg\,max}
\DeclareMathOperator{\KL}{KL}
\DeclareMathOperator{\Tr}{Tr}
\DeclareMathOperator{\diag}{diag}
\DeclareMathOperator{\sign}{sign}
\DeclareMathOperator{\dom}{dom}
\DeclareMathOperator{\scope}{scope}

\title{Agents That Hack Their Own Harness:\\Safe Self-Modification in Autonomous AI Systems}
\author{
    Zach Kelling \\
    Hanzo AI Research\\
    \textit{Hanzo AI Inc (Techstars '17), Los Angeles, CA}\\
    \texttt{[email protected]}
}
\date{February 2026}

\begin{document}

\hanzocoverpage

% ============================================================================
% ABSTRACT
% ============================================================================
\begin{abstract}
Contemporary autonomous AI agents treat their execution harness---the tools,
extensions, and framework infrastructure on which they run---as immutable
scaffolding. This assumption forecloses a broad class of improvement
opportunities: an agent that cannot modify its own tools is limited to
behavioral adaptation within a fixed capability envelope. We introduce the
\textbf{Harness-Hacker Protocol (HHP)}, a framework enabling autonomous AI
agents to safely create new tools, modify existing extensions, and contribute
changes to their own source code while provably maintaining system integrity.

The protocol organizes self-modification into four trust tiers---runtime tool
creation, extension development, skill authoring, and cross-component
hacking---each with calibrated isolation guarantees, validation gates, and
deployment controls. The core safety mechanism is \emph{worktree isolation}: all
modifications occur in git worktrees that are provably disjoint from the running
system. We formalize the isolation invariant and prove that the
validate-then-merge workflow preserves system integrity regardless of
modification content.

Empirical evaluation on the Hanzo Dev agent demonstrates that task-specific
generated tools outperform general-purpose fallbacks by $\mathbf{9.3}$
percentage points ($93.1\%$ vs.\ $83.8\%$ on benchmark tasks), validating the
\emph{specific-tools-beat-generic-flexibility} principle. The virtuous cycle
connecting GRPO-based telemetry, proposal generation, and self-modification
produces compounding improvements: agents equipped with HHP achieve $\mathbf{17.4\%}$
higher task completion after five modification cycles compared to agents without
self-modification capability. We analyze failure modes, prove a maximum
modification bound that prevents runaway modification loops, and discuss
integration with the Decentralized Semantic Optimization (DSO) protocol for
cross-fleet propagation of successful harness improvements.
\end{abstract}

% ============================================================================
% 1. INTRODUCTION
% ============================================================================

\input{sections/01-introduction}
\input{sections/02-related-work}
\input{sections/03-the-self-modification-taxonomy}
\input{sections/04-safety-framework}
\input{sections/05-the-harness-hacker-protocol}
\input{sections/06-interaction-with-continuous-learning}
\input{sections/07-multi-component-architecture}
\input{sections/08-risk-analysis}
\input{sections/09-discussion-and-future-work}
\input{sections/10-conclusion}
\input{sections/11-complete-tier-1-hot-reload-implementatio}
\input{sections/12-extension-scaffold-template}
\input{sections/13-proof-of-proposition-ref-prop-gate-mono}
\input{sections/14-benchmark-task-breakdown}
\input{sections/99-skill-md-format-specification}

\section*{Reproducibility}
\textbf{Source code.} \texttt{github.com/hanzoai/agents} (commit \texttt{TBD}); harness in \texttt{python/hanzo\_harness}, plugin loader in \texttt{packages/harness/src/plugins}.\\
\textbf{Build.} \texttt{uv sync \&\& pytest} for harness; \texttt{pnpm install \&\& pnpm test} for plugin SDK.\\
\textbf{Hardware tested.} Apple M2/M3, x86\_64 Linux. Hot-reload validated under macOS and Linux file-system event APIs.\\
\textbf{Standards referenced.} Skill.md format (Anthropic), W3C DID for plugin identity, Model Context Protocol (MCP).\\
\textbf{Contact.} [email protected].

\end{document}