AutoFyn lifts frozen models on IMO 2026 math and finds 16 real bugs
A technical report introduces AutoFyn, an agent harness inspired by the Expert Iteration algorithm. Instead of updating a model's weights through fine-tuning or reinforcement learning, AutoFyn keeps the model frozen and updates persistent state instead: memory files, reports, and repository state. Each round starts from a fresh model session, so the only information that survives from one round to the next comes through these explicit interfaces. Within a round, an orchestrator explores, plans, and builds many alternative approaches using specialized agents, while a task-grounded verifier checks the work and produces an objective reward. That reward is distilled back into the persistent state, which becomes the effective policy for the next round.
The authors demonstrate AutoFyn in three domains. On six fresh problems from the 2026 International Mathematical Olympiad, they report that every model with room to improve scored higher under AutoFyn than it did running in its own provider's coding agent; the source does not name which models or which provider agents were compared. In data science, AutoFyn built the agent that currently ranks top on the Spider 2.0 dbt benchmark. In cybersecurity, AutoFyn has produced 16 maintainer-confirmed vulnerability advisories, each verified by the affected project's own maintainers, spread across seven open-source projects: Next.js, MetaMask, pnpm, Warp, LiteLLM, Langflow, and Open WebUI.
Key facts
- AutoFyn adapts a frozen model across rounds by updating persistent state (memory files, reports, repository state) from verified reward signals, rather than updating model weights.
- Each round begins from a fresh model session; an orchestrator explores, plans, and builds alternative approaches with specialized agents, while a task-grounded verifier supplies the reward.
- On six fresh problems from the 2026 International Mathematical Olympiad, every model with room to improve scored higher under AutoFyn than in its provider's own coding agent.
- AutoFyn built the top-ranked agent on the Spider 2.0 dbt benchmark.
- AutoFyn has produced 16 maintainer-confirmed vulnerability advisories across Next.js, MetaMask, pnpm, Warp, LiteLLM, Langflow, and Open WebUI.
Why it matters
AutoFyn proposes a different route to making a language model better at long, multi-step tasks. Rather than fine-tuning or reinforcement learning on weights, it keeps the model frozen and instead updates persistent state, memory files, reports, and repository state, based on a verified reward signal produced each round. Every round starts from a fresh model session, so this persistent state is the only channel carrying progress forward. The report frames this as a non-parametric, Expert Iteration style loop suited to agents that need many attempts to make headway on a hard task.
Who it affects
The report targets teams building long-horizon agent systems for math, data science, and security work. It also names concrete beneficiaries directly: the maintainers of Next.js, MetaMask, pnpm, Warp, LiteLLM, Langflow, and Open WebUI, whose projects received the 16 vulnerability advisories credited to AutoFyn.
How to use it
The source gives no author names, no institutional affiliation, and no statement on release date or code availability, so nothing can be said here about how to obtain or run AutoFyn beyond the results the report itself describes.
How solid is it
The results come from the authors' own technical report rather than an independent evaluation. On the six fresh IMO 2026 problems, the claim is specific, every model with room to improve scored higher under AutoFyn than its provider's own coding agent, though neither the tested models nor the comparison agents are named. The Spider 2.0 dbt result is a benchmark leaderboard placement (top rank), which is externally checkable. The security result is the most concretely verifiable of the three: each of the 16 advisories was confirmed by the affected project's own maintainers, across seven named projects.
Risks and caveats
The report does not explain how the task-grounded verifier or its reward signal are constructed beyond calling them task-grounded, which limits how the reported improvements can be independently judged. The IMO and Spider 2.0 comparisons are self-reported and reference unnamed baseline models and agents. No release date or code availability is mentioned, so the method cannot yet be reproduced or verified outside the authors' own report.