On the Fragility of Self-Improving Agents: Variance, Task Order, and Underspecification

Evaluation scope

• The re-evaluation studies Agent Workflow Memory [11] and ReasoningBank [12] on WebArena [13], VisualWebArena [14], and SCUBA [15], using an upgraded language model and agent harness.Its expanded evaluation uses multiple runs to quantify variance and randomly shuffled tasks to test task-order effects.Source: §1 · p. 2

Reliability findings

• On WebArena’s 180-task GitLab subset, the best-to-worst baseline-run gap was 4.4%, rising to 7.8% with ReasoningBank.The authors argue that single-run evaluations conceal concerning variance, which self-improving procedures can amplify.Source: §1 · p. 2
• ReasoningBank gained 1.5% under the default task order but degraded 4.5% under randomly shuffled orders.The default order imposes an implicit easy-to-hard curriculum that acts as a hidden prerequisite, unlike real-world streams of user requests.Source: §1 · p. 2

Underspecification

• Environment and task underspecification during memory generation may drive variance and degradation, producing unusable API suggestions or erroneous memories from ambiguous queries.The errors can propagate to subsequent tasks.Source: §1 · p. 2

Mitigation

• Adding environment feedback, task rubrics, and clearer environment specifications closed 31% of shuffled-order performance degradation, but a remaining gap points to uncharacterized factors.The intervention partially mitigates fragility without resolving it.Source: §1 · p. 2

Implications

• The authors call for rigorous evaluation methods and human-intervention interfaces that let people identify and correct agents’ “wrong lessons” in time.The motivation is that failures can erode user trust or cascade silently into costly or irreversible impacts.Source: §1 · p. 2

2.1 Problem Setting

• The agent completes an online stream of N tasks, generating actions from past observations and actions with a language model and textual memory.Source: §2.1 · p. 2
• After each task, the agent receives a reward in [0, 1], and a memory module updates textual memory from the trajectory and optionally the reward.Source: §2.1 · p. 3

2.2 Representative Approaches

• AWM [11] stores deduplicated workflows from successful trajectories for later tasks, while RBank [12] generates memories from successful and failed trajectories and retrieves relevant items.Source: §2.2 · p. 3

3.1 Experiment Setting

• The evaluation covers WebArena, VisualWebArena, and SCUBA, using three runs per experiment and two shuffled task orders alongside the prior-work default order.AWM and RBank are built on benchmark-specific baseline harnesses; unless specified otherwise, GPT-5-mini is used for the agent and memory construction, with ground-truth reward supplied during memory construction.Source: §3.1 · pp. 3–4

3.2 Variance

• Even the no-memory baseline varies across runs: best-worst gaps reach 4.4% in WebArena’s GitLab subset, 2.4% in VisualWebArena, and 6.7% in SCUBA.The GitLab standard deviation reaches 1.98%, illustrating why single-run evaluations may mislead.Source: §3.2 · p. 4, Table 1 · p. 5
• Self-improvement increases variance in 17 of 24 cases, with relative increases above 50% in 11; WebArena best-worst gaps reach 8.2% in Map and 7.8% in GitLab.The authors attribute compounding run differences to memory construction depending on prior outcomes and stochastic LLM sampling.Source: §3.2 · p. 4, Table 1 · p. 5
• With GPT-5-mini, the no-memory baseline reaches 55.3% on WebArena, comparable to RBank’s reported 53.9% using Gemini-2.5-Pro.The baseline reaches 54.9% on VisualWebArena, comparable to the reported state-of-the-art result there.Source: §3.2 · p. 4, Table 2 · p. 5
• RBank’s average gain over the baseline is 1.5%, but it is not statistically significant (p-value 0.23).The authors conclude that self-improvement methods struggle to yield consistent gains with stronger initializations.Source: §3.2 · p. 4, Table 3 · p. 5

3.3 Task Order

• The default task order creates an implicit easy-to-hard curriculum: WebArena and VisualWebArena pass rates start around 75% and fall below 40% after task ID 150.SCUBA also begins with easier tasks but shows a more complex oscillatory pattern; the authors evaluate two shuffled orders to test order sensitivity.Source: §3.1 · p. 4, §3.3 · p. 5, Figure 2 · p. 6
• Shuffling task order degrades performance in 6 of 8 cases; on WebArena Shuffle-1, scores fall from 54.8% to 49.1% for AWM and 49.8% for RBank.On VisualWebArena, AWM is significantly affected by task order, while RBank is less sensitive.Source: §3.3 · p. 5, Figure 3 · p. 6

4.1 Uncovering the Failure Modes in Memory Construction

• Environment underspecification leads to memories recommending unsupported API actions or user confirmation, which can distract agents or cause repeated “wait” actions until time runs out.The environment constraint against API actions is not provided to the memory proposal module, and user confirmation is also unsupported.Source: §4.1 · p. 6, Figure 4 · p. 7
• Ambiguous task queries can prompt unintended interpretations and irrelevant memories, while evaluator bugs can produce false negatives that lead agents to overthink and generate spurious memories.In the jaw bruxism example, the agent gives medical advice rather than locating a mouth guard.Source: §4.1 · pp. 6–7
• When the map site fails to load or respond, agents may estimate distances with the Haversine Formula; occasional success can seed memories whose later retrieval increases, potentially amplifying run variance.The strategy’s introduction appears stochastic, and earlier memory formation is associated with more frequent later retrieval and use.Source: §4.1 · p. 7, Figure 4 · p. 7

4.2 Addressing Underspecification with Additional Information

• The original generic memory prompt may be insufficient for strong baseline agents; proposed additions use evaluation rubrics, environment action feedback, and prompt edits discouraging unsupported strategies while encouraging procedural and site-navigation knowledge.Rubrics are used only during post-completion memory construction, so the agent does not see them while performing the task.Source: §4.2 · pp. 7–8
• +All improves Shuffle-1 by 2.9% (49.8% → 52.7%), improves Shuffle-2 by 1.1%, and maintains Default performance, but still underperforms the no-memory baseline on both shuffled orders.The authors note that other factors affecting robustness across task orders may remain unidentified.Source: Figure 5 · p. 8, §4.2 · p. 8

Agent Continual Learning and Self-Improvement

• Inference-only self-improvement offers practical utility and an accessible interface for exploring forward-pass-only limits, alongside work on math, reasoning, coding, personalization, supervised fine-tuning and reinforcement learning.Related self-improvement methods also study math, reasoning and coding agents [5], long-term personalization [23] [24], supervised fine-tuning [2] and reinforcement learning.Source: §5 · pp. 8–9

Agent Skill and Memory

• The study focuses on non-parametric textual memory [27] [28] [29] [30] [31], alongside workflow “skills” [33] [34], parametric memory fine-tuning [36] and architectural mechanisms Hope [37] and Titans.Sparse memory fine-tuning updates trainable memory slots based on their relative activation on unseen tasks versus a background corpus.Source: §5 · p. 9

Agent Evaluation and Reliability

• Agent benchmarks span tool use, computer use, web browsing and real-world domains; this work extends reliability evaluation from single-session agents to multi-session self-improving agents.Rabanser et al. [10] advocate treating reliability as a primary evaluation axis alongside capability; the paper argues reliability is even more critical and harder to measure for multi-session self-improving agents.Source: §5 · p. 9

• Across multiple runs and shuffled task orders, self-improvement showed significant variance and degraded when the baseline was strong or tasks arrived randomly.The study re-evaluated two established memory-based methods using a stronger base-model and agent-harness baseline.Source: §6 · p. 9
• Manual memory analyses identify task and environment underspecification; adding better specification to memory generation reduced prior degradation by 31%, but a 69% gap remained.The authors describe underspecification as a key limitation, while noting that further fundamental issues remain unresolved.Source: §6 · p. 9

Recommendations for Evaluation

• Interpret single-run results cautiously, report multiple runs and randomized task orders, and pilot on well-specified benchmarks before stress-testing underspecified tasks for worst-case performance.The recommended stress tests should precede deployment.Source: §6 · p. 9

Recommendations for System Development

• Unvalidated memories can be erroneous hypotheses that cascade across tasks, motivating memory validation and interfaces for human oversight and timely intervention.Because underspecification cannot be fully foreseen and real-world deployments unfold as a single, irreversible run, iterative specification refinement is one viable path forward.Source: §6 · p. 9

A Limitations

• The study evaluates only web-browsing memory-based agents, excluding other self-improvement methods, alternative domains, and the newest memory-management techniques.The authors say the two evaluated methods remain relevant because they are minimalist, highly scalable, and increasingly adopted.Source: A Limitations · p. 15
• Manual inspection covered only a subset of agent memories, leaving other failure patterns potentially undocumented.The authors propose large-scale memory analysis and scalable methods for human oversight as future work.Source: A Limitations · p. 15

B Additional Experiment Details

• A GPT-5-mini no-memory run costs about $25 for 812 WebArena tasks and $29 for 267 SCUBA tasks.Memory methods add costs for memory-generation calls and context inclusion, which the authors expect to be minimal; experiments ran on a standard 64-CPU server.Source: B Additional Experiment Details · p. 15
• WebArena [13] and SCUBA [15] use Apache-2.0 licenses, VisualWebArena [14] uses MIT, and baseline agents were revised from WALT [20] and SCUBA [15].WALT [20] is released under MIT, while SCUBA [15] is released under Apache-2.0.Source: B Additional Experiment Details · p. 15
• Coding agents supported experimentation but contributed no original ideas, and LLMs supported paper editing and proofreading.The code was largely based on existing implementations from prior work.Source: B Additional Experiment Details · p. 15

C Extended Related Works

• Memory-based continual learning offers an inspectable textual interface for scalable monitoring and intervention.Baker et al. [53] report reward hacking in coding agents via chain-of-thought monitoring, and the authors observe similar behavior during learning, including the Haversine Formula example in Table 9.Source: C Extended Related Works · pp. 15–16
• Autonomous agents’ irreversible real-world actions make fragility a risk of tangible harm, making reliability urgent for safe adoption.Prior work has examined stability in deep reinforcement learning [56], gradient-based meta-learning [57] [58], language model fine-tuning [59] [60], prompting [61] [62], in-context learning [63] [64], and self-correction.Source: C Extended Related Works · p. 16

D Additional Result Tables

• The no-memory baseline is evaluated on WebArena and on VisualWebArena and SCUBA in two additional result tables.The supplied captions do not show table values or establish performance comparisons.Source: Table 5 · p. 16, Table 6 · p. 16

E Prompts

• AWM’s prompt constructs textual workflows with natural-language tasks and action trajectories, limiting each workflow to 2–5 steps and allowing zero or one workflow.Each trajectory step pairs an action with a textual description; the prompt is obtained from ASI’s codebase [16].Source: E Prompts · p. 17
• ReasoningBank’s successful-task prompt extracts up to three nonoverlapping, generalizable memory items after considering why the trajectory succeeded.It instructs the agent not to mention specific websites, queries, or string contents.Source: E Prompts · p. 18
• ReasoningBank’s failed-task prompt asks the agent to reflect on failure and extract up to three nonoverlapping, generalizable lessons to prevent future failures.It also directs the agent to avoid specific websites, queries, or string contents.Source: E Prompts · p. 19

F Failure Modes

• Three failure examples cover an ambiguous navigation task interpreted as question answering, an evaluator’s strict string matching, and a reward for an unintended strategy.The examples are WebArena Tasks 118, 329, and 38, respectively; the Task 329 caption says incorrect evaluation can create irrelevant memories.Source: Table 7 · p. 20, Table 8 · p. 20, Table 9 · p. 21

1. Claims

• The authors state that the abstract and introduction reflect the paper’s contributions and scope.Source: §1 · p. 22

2. Limitations

• The supplied limitations checklist asks whether limitations are discussed and gives general reviewer guidance, but includes no author response to that question.Source: §2 · p. 22

3. Theory assumptions and proofs

• The authors state that their work does not involve theoretical analysis.Source: §3 · pp. 22–23

4. Experimental result reproducibility

• The authors answer yes on reproducibility and direct readers to §3.1 for experiment settings and details.The answer concerns disclosure sufficient to reproduce the main experimental results.Source: §4 · p. 23

5. Open access to data and code

• The paper identifies SalesforceAIResearch/self-improve-fragility and Salesforce/self-improve-fragility as release locations.The release justification names both repository paths.Source: §1 · p. 1, §5 · p. 24

6. Experimental setting/details

• The paper describes its dataset and experiment details in §3.1.Source: §6 · p. 24

7. Experiment statistical significance

• The authors report error bars whenever possible, including Figures 3 and 5, and identify responsible multi-run statistics as a main goal.Source: §7 · p. 24

8. Experiments compute resources; 9. Code of ethics

• The authors direct readers to Appendix B for compute-resource details and affirm conformity with the NeurIPS Code of Ethics.Source: §8 · p. 25, §9 · p. 25

10. Broader impacts

• The authors answer yes that the paper discusses positive and negative societal impacts, citing implications and practical recommendations in the conclusion.Source: §10 · p. 25

11. Safeguards

• The authors state that the paper introduces no new dataset or models.Source: §11 · p. 26

12. Licenses for existing assets

• The checklist raises proper crediting and explicit licensing and terms for existing assets, but these passages do not state the authors’ response.Source: §12 · p. 26

13. New assets

• The authors say their code and data are released under the Apache-2.0 license.Source: §13 · p. 27

14. Crowdsourcing and research with human subjects

• The paper says it involves no crowdsourcing or human-subject research and did not recruit study participants, making IRB review inapplicable.Source: §14 · p. 27

16. Declaration of LLM usage

• The authors answer yes that they describe LLM usage and direct readers to Appendix B.Source: §16 · p. 28