TL;DR: A team at MIT CSAIL had a frontier model read and edit the weights of Qwen3.5-0.8B inside a Python sandbox, with a hard budget of forward passes and a full log of every step. The authors report MATH-500 rising from 7.9% to 48.1%. You can let a coding agent edit model weights the same way: five tasks on a board, the budget written into each task, a second agent on the eval, and a person approving the edited file.
On 2 November 2026, Rikiya Takehi, Jayden Teoh, Alex Zhang and Omar Khattab published Sparks of Weight-Space Programming. The model in their study, GPT-6 Astra, opened weight tensors, wrote numpy and PyTorch against them, formed a hypothesis, and changed 131,072 numbers in a 0.8B-parameter model.
Read the setup and it looks familiar: a sandbox, a tool budget, a log of every prompt and executed cell. That is a coding agent with a harness, and the harness is the part your team can copy today.
What the MIT team did, in numbers
Weight-space programming means an LLM reads a network’s parameters as data and edits them directly, with no gradient descent and no training run. The MIT post reports this on small models, under strict tool limits, with every turn logged.
The headline result is the Qwen3.5-0.8B edit:
| Metric (authors’ figures) | Base model | Edited model |
|---|---|---|
| MATH-500 | 7.9% | 48.1% |
| GSM8K | 13.8% | 67.1% |
| IFEval | 21.0% | 62.3% |
| Runs that hit the 32,768-token limit | 93.0% | 33.1% |
Astra traced the model’s habit of looping until it ran out of tokens to one direction written by the MLPs of layers 15 and 19, then subtracted it from 64 output columns in each: 131,072 weights, or 0.016% of the model. The published checkpoint is Apache-2.0, and its card says only two tensors differ from the base model: the down_proj.weight matrices in those two layers.
Why the harness decides the result
Two findings in the post matter more to a team than the headline.
The budget changed the outcome. Each forward pass averaged a batch of 64 sequences. With 10 passes, MATH-500 reached 12.3%. With 25, it reached 14.1%. With 50, it reached 48.1%. Same model, same task, different ceiling on how many times the agent could test an idea.
The tools changed the outcome. Given only the weights of two Gemma 3 270M variants, Astra could not tell which one was sycophantic in any of four attempts. Given a tool that returned attention weights on up to 16 texts it wrote, it named the sycophant in all three pairs.
Two levers, then: what the agent may spend and what it may look at. Both belong in writing before the run starts.
The limits are as clear. Astra could not improve Gemma 3 270M on MATH-500: from a 6.8% base, its best edit reached 7.7%. The authors read this as an edit removing an obstacle, not adding an ability the model lacked. They call the findings early, and several are single runs. Plan your own experiment as a test, not a fix.
How to let a coding agent edit model weights safely
A safe weight-space experiment has five properties:
- The original weights are read-only to every agent.
- The forward-pass budget is a number in the task, enforced by the sandbox.
- The eval set the editor sees is separate from the regression set the reviewer runs.
- Every run’s log stays attached to the stage it belongs to.
- A person approves the edited file before anything loads it outside the sandbox.
Sharkly does not count forward passes or inspect tensors. Your sandbox script does that, and your runtime (Claude Code, Codex, or another agent you already run) does the reading and editing. Sharkly holds the work: who owns each stage, what it may spend, what came back, and who signed off. The MIT team’s own log repository keeps a harness/ folder with a Codex configuration and sandbox script, which is a useful reference for the sandbox side.
Stage 1: Baseline eval of the untouched model
The first task runs your eval on the original checkpoint and records the scores and where the model fails. For Qwen3.5-0.8B, 93.0% of runs hit the token limit. The hypothesis task needs that failure description.
Stage 2: Read the weights and write a hypothesis
This is the task with the budget. Put the number in the body, in a form the agent can’t misread:
## Stage 2: Hypothesis from weights
Model: ./models/qwen3.5-0.8b-base (READ-ONLY, mounted ro)
Budget: 50 forward passes, batch 64. The sandbox stops at 50.
Tools: numpy, torch (CPU), forward() wrapper. No attention tool.
Inputs: Stage 1 failure notes (task COIN-xxx), GSM8K/MATH practice split only.
Output: one-page hypothesis naming layers, tensors and the direction to change,
plus the passes used. Do not write any weights in this stage.
The budget in the task is a promise; the budget in the sandbox wrapper is the guarantee. Write both, and have the wrapper print passes used so the number lands in the run log.
Stage 3: Make the edit in a sandbox copy
The editing agent changes a copy of the checkpoint and reports the diff. It never gets write access to the original. On Sharkly, each task run gets its own isolated directory, and repository work can use a separate worktree per run, so stage 3 cannot touch what stage 1 measured.
Stage 4: Independent re-eval by a reviewer agent
Assign this stage to a different agent from the one that made the edit. It reruns the stage 1 eval and adds a regression set the editor never saw. If you run a Crew, the leader can hand the edit to one member and the re-eval to another. The pattern matches a mixed-model Crew with a separate reviewer: the agent that wrote the change is not the agent that grades it.
The editor optimized against what it could see, so a gain that appears only on those problems proves little.
Stage 5: Human gate on the diff
The last task reaches a person with three attachments: the changed-tensor list, the before and after table, and the reviewer’s regression results. Nothing loads the edited checkpoint outside the sandbox until this task moves.
This short script produces the first attachment. It compares two safetensors checkpoints and lists every tensor that changed:
from safetensors import safe_open
import torch
BASE = "models/qwen3.5-0.8b-base/model.safetensors"
EDIT = "sandbox/qwen3.5-0.8b-edit/model.safetensors"
changed, total = [], 0
with safe_open(BASE, "pt") as a, safe_open(EDIT, "pt") as b:
assert set(a.keys()) == set(b.keys()), "tensor names differ"
for name in a.keys():
x, y = a.get_tensor(name), b.get_tensor(name)
total += x.numel()
n = (x != y).sum().item()
if n:
changed.append((name, n, (x - y).abs().max().item()))
for name, n, dmax in changed:
print(f"{name}: {n:,} weights changed, max |delta| {dmax:.4g}")
print(f"{sum(c[1] for c in changed):,} of {total:,} weights changed")
On the published checkpoint, the model card says you should see exactly two down_proj.weight tensors. If your own edit touches tensors the hypothesis never named, that is the reason to discard it.
Running the board on Sharkly
Here is the board for one experiment. Each row is a task with its own assignee, status and run history.
| Task | Assignee | Budget or gate | Done when |
|---|---|---|---|
| 1. Baseline eval | Eval agent | Eval set only | Scores and failure notes posted |
| 2. Hypothesis from weights | Editor agent | 50 forward passes | Hypothesis posted, passes used logged |
| 3. Sandbox edit | Editor agent | Copy only, original read-only | Diff and edited file in sandbox |
| 4. Re-eval and regression | Reviewer agent | Held-out regression set | Before/after table posted |
| 5. Approve or discard | A person | Human gate | Decision recorded on the task |
Link the stages with blocks relations so the board shows the chain. Sharkly’s task relations are honest about scope: a relation shows dependency and progress on the card, but it does not move a task or start a run on its own. Keep each stage in Backlog until the one before it finishes. A task assigned to an agent does not start a run while it sits in Backlog, so moving it out is the trigger.
When stage 4 finishes, the agent can leave the task waiting for human review, and the person sees it in Inbox. The execution log records each run’s start, end, tool calls and trigger: your audit trail, kept on the stage it belongs to. For more on where to stop agents, see approval gates for coding agents.
Practical limits before you start
- Start small. The study used 0.8B and 270M models with CPU tensor access. Pick a model you can evaluate in minutes.
- Expect no gain on missing skills. The Gemma result says an edit can unblock a model, not teach it.
- Treat one run as an anecdote. Repeat the experiment with a fresh agent before you trust the edit.
Conclusion
The reusable lesson from the MIT post is the harness: a written budget, limited tools, a full log, and results someone else can check. Those are the controls you already want around a coding agent that edits code.
To try it, create the five tasks in a Sharkly Space, assign stages 1 to 4 to agents on your connected Computer, and keep stage 5 for yourself. Sharkly is free to start at sharkly.ai.
FAQ
Can a coding agent edit model weights?
In the MIT CSAIL study, yes. GPT-6 Astra read Qwen3.5-0.8B tensors in a Python sandbox and changed 131,072 weights. The authors report MATH-500 rising from 7.9% to 48.1%. The work is early, on small models, and several results are single runs.
What is weight-space programming?
An LLM reads a network’s parameters as data and edits them directly, without training. It analyzes tensors with code, forms a hypothesis, changes the weights, and measures the effect with a limited number of forward passes.
Why does the forward-pass budget matter?
In the authors’ Qwen ablation, 10 passes reached 12.3% on MATH-500, 25 reached 14.1%, and 50 reached 48.1%. The budget sets how many ideas the agent can test. Write it into the task and enforce it in the sandbox.
Can weight editing add new abilities to a model?
The study suggests not. Astra’s best edit moved Gemma 3 270M from 6.8% to 7.7% on MATH-500. The authors conclude editing removed an obstacle in Qwen rather than adding an ability.
How do I keep edited weights from reaching production?
Mount the original read-only, edit a copy, run an independent re-eval, and require a person to approve the tensor diff before anything loads the file outside the sandbox.
