Stop Letting a Harness Manage Your Agent’s Context — Let the Model Edit It Instead

Every agent harness I’ve worked with eventually runs into the same wall: the context window fills up, and someone has to decide what gets summarized, what gets dropped, and what gets kept verbatim. Right now that someone is almost always a hand-written rule inside the harness — compact every N turns, truncate the oldest messages, retrieve from a vector store when things get long. A paper posted to arXiv on September 29 by a team from the University of Washington, MIT and Meta Superintelligence Labs — lead author Rulin Shao — argues that rule belongs inside the model instead of outside it, and backs the argument with numbers that are hard to wave away.

What a Context Language Model actually does differently

The paper’s name for the idea is a Context Language Model, or CLM. Instead of a harness choosing between a fixed menu of strategies — compaction, offloading to a retrieval store, truncation — the model’s context is mirrored into a file the model itself has write access to, through ordinary shell commands. Edits to that file sync automatically back into what the model sees as its context. The paper frames this as the difference between a model that can only append to its context and one that can apply an arbitrary transformation to it at every step: it can rewrite an old message, delete a dead-end exploration, compress three paragraphs into one progress note, or leave itself a reminder for forty turns later.

Nothing about this requires new training to get started — the paper’s headline numbers are zero-shot, meaning a model is simply told in natural language that it can edit its own context file, and it works out a strategy on its own.

The numbers, task by task

On BrowseComp-Plus, a benchmark for long multi-step web research, Qwen3.6-27B running as a CLM hits 59.4% accuracy — 11.4 points above the strongest baseline strategy the authors tested, while using 21.5% fewer FLOPs to get there. On TerminalBench 2.1, a coding-in-a-terminal benchmark, the same model matches the best baseline’s accuracy but does it with 29.5% fewer FLOPs. On EdgeBench-10, a twelve-hour task, it scores 44.6 — about 5% higher than baseline — while cutting FLOPs by 59%.

Two results outside the FLOPs-accuracy frame stand out more to me. On a twenty-four-hour “Software World” task, GPT-5.6-Sol running as a CLM produces a 65% greater downstream speedup than the baseline at the same compute budget — the context management itself is what’s unlocking the extra throughput, not more compute. And on a circle-packing optimization task, Claude 4.6 Sonnet running as a CLM gets a best-of-run score of 2.618, a 16.8% improvement over OpenEvolve, an existing evolutionary-search baseline built specifically for this kind of iterative optimization problem. Beating a specialized search method with better context management alone is the strongest single data point in the paper.

Where the efficiency actually comes from

The FLOPs savings aren’t free — editing the middle of a context file instead of only appending to the end breaks the usual KV-cache reuse that makes long-context inference affordable, because everything after the edit point normally has to be re-prefilled. The paper’s answer is a metric they call prefix-reuse FLOPs, which accounts for that re-prefilling cost directly, plus a serving-side technique called Suffix Cache Reuse that salvages the cache for the unedited suffix of the context. On their numbers, Suffix Cache Reuse cuts server compute by 35% relative to a standard SGLang deployment at matched accuracy. Without that piece, letting a model freely edit its own context would likely cost more than it saves — this is the part of the paper that makes the whole approach deployable rather than just a nice result in a controlled benchmark.

The paper also reports a reinforcement learning variant — stepwise GRPO with what they call a success-gated efficiency advantage — that pushes the gains further: training a smaller Qwen3.5-9B model this way improves its BrowseComp-Plus accuracy from 28.8% to 42.5%. Zero-shot gets you most of the benefit; RL training on top of it gets you more, for a model too small to reason its way there on prompting alone.

What models do with this freedom when nobody tells them to

The more interesting evidence, to me, is behavioral rather than numeric. The authors observed models spontaneously maintaining in-context scoreboards for coordinating multi-agent tasks, performing up to 163 in-place edits to keep that scoreboard current. Some models invented a new conversational role for themselves — effectively a “notes” channel — to hold private intermediate reasoning separate from the user-facing transcript. Others defined their own compaction functions and reused them across a session, which is the model independently reinventing the exact tool a harness would otherwise have hard-coded for it. One model preserved a list of ideas it had tried and abandoned, specifically so it wouldn’t waste a later turn re-exploring them.

The problem the authors flag and don’t solve

To their credit, the paper is direct about the obvious downside: an editable context is a new channel for prompt injection and for self-generated instructions to persist across turns. If a model can rewrite its own summary of what happened, it can also — through an injected instruction, or through its own reasoning going wrong — insert an unauthorized instruction into that summary and have it survive every subsequent turn as if it had always been there. The paper names this explicitly and says future work needs defenses that preserve the flexibility without losing the integrity of what the context file contains. That’s an honest flag, not a dismissal, but it’s also not a solved problem — and it’s the first thing I’d want answered before giving this capability to an agent that has access to anything a prompt injection could actually act on. Code for the paper is public on GitHub, which means someone will find out how bad the injection risk actually is well before anyone officially studies it.