Stanford Built a Course Around Self-Improving AI Agents. Here Is the Syllabus.

01 A Course Number Is a Claim About a Field

Universities do not hand out course numbers to demos. A dedicated graduate seminar is an institutional bet that a subject has enough settled structure to teach and enough open ground to sustain years of projects. Stanford CS329A, a course built around self-improving AI agents, is that bet made in public. The first lecture, a course overview that has drawn roughly 635,000 views on Stanford Online since it went up, spends little time on spectacle and most of its time on definitions: what would count as an agent improving itself, what evidence would convince us, and what would count as failure.

That framing matters because the public conversation about self-improving systems tends to run on two extremes. One treats any pipeline that calls a verifier and retries as the opening scene of a takeover story. The other treats the whole agenda as branding, on the theory that a model fine-tuned on its own outputs is no different from any other training run. A syllabus has to occupy the space between: it must specify mechanisms precisely enough that students can build and measure them, which makes it a better guide to the research frontier than most commentary.

The course is also a snapshot of a moment. In 2023, agentic work was scattered across workshop papers and open-source scaffolds. By 2026 the vocabulary of tools, memory, self-critique, and verifier-guided search has hardened into something a curriculum can organize. Reading the syllabus is therefore a way of asking the field directly: which parts of this do you consider engineering, and which parts do you admit are still research?

02 What Actually Counts as Self-Improvement

The first definitional move in the CS329A material is to separate several things that headlines fuse together. A system can improve its scaffold, the code and prompts around a frozen model, by rewriting its own retrieval logic or refining its planning prompts. It can improve its memory, accumulating a library of solved tasks and lessons that make future episodes cheaper. It can improve its weights, generating training data from its own trajectories and fine-tuning on the ones a verifier scored well. These three loops run at different speeds, carry different risks, and fail in different ways, and the course treats them as distinct objects of study.

The distinction does real analytical work. Scaffold improvement is why a 2026 coding agent resolves issues that stumped the same underlying model two years ago: nothing about the network changed, but the loop around it got better at decomposing, testing, and backtracking. Weight-level self-improvement is a different claim, because it compounds: data produced today shapes the system that produces data tomorrow. Courses that taught agents as tool-calling pipelines in earlier years could stop at the scaffold layer. A course willing to say self-improving in its title has to take the compounding loop seriously, and the syllabus signals that by putting evaluation before capability in the reading order.

It also draws the boundary that matters for safety analysis. An agent that rewrites its own prompts is bounded by the model doing the rewriting; a training loop that filters its own data by its own verifier can drift in ways no single prompt reveals. The syllabus framing suggests the instructors see the interesting research surface not in the word self but in the word improving: improvement relative to what metric, measured by whom, and stable under what distribution of tasks.

03 The Mechanism: Outer Loops, Inner Loops, and Verifiers

Strip away the branding and a self-improving agent is a feedback system with at least two clocks. The inner loop is the episode: propose an action, observe the result, revise. The outer loop is everything the system keeps between episodes: memory entries written after a success, prompts rewritten after a failure, and in the ambitious cases, fine-tuning runs fed by trajectories that a verifier scored. CS329A spends its early weeks on exactly this decomposition, because every serious design question lives at the seams: what gets promoted from the inner loop to the outer loop, and what certifies that the promotion is an improvement.

The load-bearing component is the verifier. Where tasks have cheap, hard checks, unit tests for code, executable proofs for math, replays for tool use, the loop can run almost unattended, because filtering self-generated data by outcome is trustworthy in proportion to how hard the check is to fool. Where success is subjective, the loop inherits the taste of its judge, and improvement becomes a polished mirror of the reward model. The course overview makes this trade explicit, and it is the honest way to read the field: the past two years of agent gains cluster in domains where verification got cheap.

This is also why the mechanism explanation dissolves some of the mystique. Gains that look like a system teaching itself usually decompose into search plus selection: try more candidates, keep the ones that pass. That is genuinely powerful, and the doubling curves in the next section show it compounding. But it is a different and more tractable thing than open-ended self-modification, and a syllabus that insists on the distinction is doing safety analysis a service, because the failure modes of the two are not the same.

04 The Evidence: Task Horizons Keep Stretching

The strongest empirical argument for treating self-improvement as a real research object is the shape of the capability curves. METR, a research organization that measures how long a task a model can complete at a 50 percent success rate, has tracked frontier systems from roughly five-minute tasks in 2023 to tasks measured in tens of minutes through 2024, then past an hour in early 2025 and into multi-hour territories by late 2025 and 2026. The headline regularity is stark: the 50 percent task horizon has doubled roughly every seven months. Whatever is driving it, it is not noise, and it is not a single benchmark artifact, because the measurement is recomputed on task suites the models did not train on.

A course that promises self-improving agents needs this kind of evidence precisely because its subject invites credulity. The doubling claim is a measured regularity over a specific evaluation family, mostly software and research-flavored tasks where verification is cheap, and the syllabus, to its credit, teaches it with the caveats attached. Task length is not the same as task difficulty of the human kind: a four-hour agent run is often four hours of well-decomposed drudgery, not four hours of sustained insight. And the measurement window is short; extrapolating seven doublings into the future is arithmetic, not forecasting.

Still, the direction of the curve is the reason the course exists. When agents could be trusted for minutes, self-improvement was a lab curiosity; when they can be trusted for hours, the outer loop starts collecting enough trajectories to matter, and the questions about which lessons to keep, and who audits them, stop being philosophical. The evidence section of the syllabus is effectively an argument that the feedback regime has crossed a threshold where the loops feed themselves.

05 What Saturation Does to an Evaluation

The second chart is the shadow of the first. SWE-bench Verified went from a nearly impassable exam, under 5 percent in 2023, to a mid-strength one at about 49 percent in mid-2024, to a bar the strongest 2025 and 2026 systems clear roughly three times in four. Each stage of that climb produced the same sequence: a result that looks like a step change, a wave of follow-up systems closing the gap, and then a quiet agreement that the benchmark no longer discriminates at the frontier. The syllabus treats this lifecycle as a case study, because evaluation is the binding constraint on the whole agenda: a self-improving loop can only certify improvements it can measure.

Saturation has a sharper cost for this field than for others. Ordinary benchmark retirement means losing a yardstick; for self-improving agents it means losing the training signal, since outcome-filtered fine-tuning eats verified problems as fuel. Contamination worries follow: once a task family is public, long enough, and popular enough as training fodder, the guarantee that passing it reflects general ability weakens, and the honest reading of a 78 percent bar is that it measures both the model and the ecosystem that grew around the benchmark.

The research response, which the course maps in detail, is to move the goalposts in structured ways: longer horizons, held-out private suites, live repositories that update after any training cutoff, and cost-controlled evaluations where an agent must succeed within a budget. None of these is perfect, and the syllabus does not pretend otherwise. What they share is a design principle worth stating plainly: for systems that optimize against a metric, the metric is a consumable, and evaluation design is now as much a part of agent engineering as the agent itself.

06 The Open Problems the Syllabus Admits To

The most useful pages of any honest course overview are the ones listing what is unsolved, and CS329A is unusually direct about it. Evaluation of open-ended improvement tops the list: we have decent instruments for whether an agent solved a ticket, and almost none for whether a season of self-modification made the system genuinely better or merely better calibrated to its own verifier. Credit assignment across long horizons is close behind; when a success at hour six depends on a retrieval choice made at hour one, the outer loop has to guess which lesson deserves to persist, and current guesses are crude.

The safety questions are framed with the same specificity, which is what separates a research course from a product demo. A scaffold that rewrites itself can drift in ways invisible to any single prompt review, so oversight has to attach to the loop, not to snapshots. Data filtered by a learned verifier can amplify the verifier's blind spots at every generation, which turns reward-model quality into a first-order safety parameter rather than a tuning detail. And the compounding case, where today's outputs become tomorrow's training set, raises the question the course reserves for its final weeks: what invariants should hold even when no human approves each step?

None of these problems has a settled answer, and the syllabus does not manufacture one. What it does is give students a shared vocabulary, inner loop versus outer loop, verifier strength, drift, so that disagreements become claims about mechanisms rather than moods. That is what consolidation of a field actually looks like, and it is a stronger signal of maturity than any leaderboard number.

07 Limits of the Course-as-Map, and What to Watch

Reading a syllabus is a biased sampling of a field. Courses teach what is teachable, which over-represents problems with clean formal statements and under-represents the messy integration work that actually consumes most engineering time. The measured curves in this piece come from task families chosen partly because they are measurable at all, and METR itself frames its doubling as an empirical regularity over a bounded window, not a law. Anyone quoting the seven-month figure without the caveats is doing arithmetic on a slope that may not hold.

There are also limits the course shares with the whole research program. Cheap verification exists for code and math because those domains built graders over decades; the agenda has no obvious story for domains where checking is as hard as doing. Compute and data economics still bind: outer loops that harvest trajectories are cheap compared to pretraining runs, but they are not free, and the teams running them at scale are the same few with the largest clusters. Concentration of that kind shapes which open problems get attacked first.

What to watch is therefore concrete. Whether evaluation keeps pace with capability, private and rolling suites are the tell. Whether verifier quality becomes a published, audited property of agent systems rather than a trade secret. And whether the second compounding loop, weights trained on self-generated work, stays confined to domains with hard checks or starts exporting its lessons outward. The course overview ends, fittingly, by declining to predict which of these resolves first. A field that can teach its own uncertainties this cleanly is at least taking its own measure honestly.