A little wild.A lot to learn.

Over roughly nine weeks, a desktop AI companion called Feral became Cinderpaw: a helper that lives on your computer, does real work with your files and apps, keeps a memory on your own disk, and is allowed, within bounds, to change how it works. This paper documents that passage: the decisions I took and the ones I reversed, what was added, what I measured, and the behaviour of the agent that fell outside what I designed for, including the times it did not do what it was told.

Headline findings. On tau2-bench airline, with the same pinned model, the Cinderpaw scaffold passed 45 of 50 tasks against 41 of 50 for the official agent. Memory retrieval injected 47.2 irrelevant lines per turn until a fix brought it to 0.87. A prompt-injection scanner caught 8.5% of public attack templates before rework and 99.3% after, with no false alarms on 141 ordinary pages. About 70% of every request is the agent re-reading its own instructions. And the most expensive failures of the period were not the agent’s. They were in my measuring instruments.

Every number here comes from a run I can point to. Where I hold an opinion rather than a result, it is marked Position, and you are invited to disagree with it.

Feral was a good name for a mood and a poor name for a product. It described how the thing felt, slightly untamed, and nothing a stranger could see on screen. The new name describes what you see: “cinder” for the warm ember it is coloured after, “paw” for the creature it is.

A rename sounds cosmetic. It is not, for one reason: your data lives under the old name. The config folder, the command you type and the identity the app shows your operating system all had to move together, because moving some and not the others leaves an install in two halves. The old folder was carried across and then left where it was, marked as migrated, never deleted.

The decisions that shaped the product were rarely about features. Most were about what I was willing to claim.

Licence

From source-available (BSL 1.1) to Apache 2.0. BSL meant a company needed a legal review before anyone could try it, and it shut me out of grants. The protection was worth less than both.

Telemetry

I used to promise none. I now count an install once: version and operating system, no identifier, a ticked box you can untick, and a file on your disk saying what was sent. Why, in Position 3.

Self-improvement on paid models

Off until you say yes. Thinking about its own work is still thinking, and on a cloud model that is your money. It was off before too, silently; now the screen says so.

Bounded change

The agent may tune settings on its own, but its first ten code changes always wait for a person. Failed attempts are kept with the reason, not deleted.

A simulated fly brain

Built, measured and deleted. A shuffled wiring diagram passed more of my tests than the real one (Position 5).

A small local classifier

Measured on my own task and kept out: zero-shot it scored below always guessing the most common answer.

One language

The interface is English-only in this release; the agent still talks in yours. Seventy languages half-done read worse than one done well.

The face

Pixel art, then clay renders, then a creature drawn in code. Cubby now wears a raincoat.

In order of how much each one changed daily use, not how long it took:

A browser beside the chat

With tabs and Brave's ad-block engine. The agent drives it, you watch, and your click pauses it.

Artifacts

Documents, PDFs, Word and Excel files, charts and small apps, kept after the chat ends. You can sign the PDFs.

Voice calls

Speech to speech, with the agent's tools still in reach, and a small pill so a call can wait while you work.

Cowork

Named teammates with only their own tools, talking in a group chat you can read, stopping for your yes.

21 chat platforms

Telegram, Discord, Slack, WhatsApp and seventeen more. Files travel both ways on ten of them.

Readable memory

Facts in plain sentences, each with a Forget button.

An injection gate

Tool calls are checked before they run, and a value lifted from a web page into a consequential action asks you first.

Sign in with OpenRouter

One button instead of pasting a key, because a key is the first wall a stranger hits.

Same model, different scaffold

The cleanest question I could ask: take one model, change only what surrounds it, and see whether the result moves. On tau2-bench airline, with GLM-5.3-Flash pinned to a single provider for both arms, it did.

On the telecom split Cinderpaw passed 113 of 114 tasks. I publish that number only beside this sentence: 72.6% of the graded actions in telecom are performed by the simulated user, not the agent. The benchmark measures how precisely an agent instructs a person, and a reader who opens a transcript without being told will discard the headline. So I tell you first.

Memory that answers the question asked

For weeks the memory block in every prompt was the thirty most recently touched facts, whatever the question. Recency was not one signal among several; it was the only one. I measured it with ten subjects that share no vocabulary (cooking, tax, a car, a garden and so on), thirty questions each belonging to exactly one subject, and counted which subject every injected line came from.

Long-horizon recall, measured separately on 50 LongMemEval instances, finds the right session in the top 10 for 94.3% of questions and in the top 20 for 97.0%. A shuffled control scores 19.5%. The misses cluster where you would expect: questions that span several sessions, and questions about when something happened.

Pages that try to give the agent orders

A browser the agent drives is a browser any web page can talk to. I measured the defence against two public attack corpora, AgentDojo and WASP (272 attacks), and 141 ordinary pages, including login forms, which look suspicious to a naive filter.

Where the tokens go

I expected the conversation to be most of what an agent sends. It is the smallest part.

The loop that improved nothing for weeks

From 10 July the nightly self-improvement loop ran on every install and promoted nothing. The models were fine. Three graders were not. Asked for the formula of water, a model answered H₂O with a real subscript and was marked wrong against “h2o”. Asked for JSON, it wrapped the object in a code fence and was marked wrong for the wrapper. And the sanity floor held speed limits that measured the network, not the candidate. One failure on that floor blocks all promotion, so nothing moved.

Promotion decisions rest on a statistical gate. I checked that it does what it advertises by running the same noisy candidate against itself 200 times per size: at a nominal 5% threshold it raised false alarms 3.5% of the time with 10 paired runs, 6.5% with 12 and 3.5% with 20. Close enough to trust; not so close that a single promotion proves anything.

How many times did it not listen? Across the period I have six documented cases where the agent did something other than what it was asked, or said something other than what it did. Six is a floor, not a rate. I did not log disobedience as a metric, so there is no denominator, and I would rather say that than invent one. That I never measured it is itself a finding, and the first instrument I will add.

The bugs that wore the agent’s name

The costliest failures of the period were mine, and every one of them produced a plausible, well-formed number.

An expired token

TheAgentCompany's GitLab image ships a token that expired in November 2025. Every GitLab check fails, so 72 of 175 tasks score zero whatever the agent does. A correctly closed issue scored 0/2; after refreshing the token, the same environment scored 2/2.

A mislabelled timeout

My runner reported “the agent went quiet” whenever the task deadline expired. The agent had been calling tools to the last second.

A rate limit graded as a score

A ten-second provider outage became a permanent zero, because resume skips anything that carries a score.

A benchmark that grades a replay

tau2 rebuilds the environment from the transcript. My first bridge changed the live database and wrote nothing to the transcript, which caps a 50-task run at 7 and looks merely weak, not broken.

A rename that ate a key

A repo-wide find-and-replace turned every old-name-to-new-name mapping into a mapping from a name to itself, including the salt that decrypts saved keys. It compiled. Most tests passed.

What follows are opinions. They are argued from the evidence above, but they are not results, and not everyone who builds Cinderpaw agrees with all of them.

The self-improvement system is called BRSI, bounded recursive self-improvement. How much it may change on its own depends on how deep the change goes:

L0 · Substrate

Maintains the evaluation substrate and its recorded history. Automatic, within policy.

L1 · Configuration

Evaluates configuration candidates and promotes measured improvements. Automatic, within policy.

L2 · Adaptation

Evaluates a personal adapter without replacing the base model weights. Requires initial setup.

L3 · Code

Proposes bounded code changes and tests them before promotion. Human: first 10 promotions.

L4 · Extensions

Adds tools or modules through constrained extension interfaces. Human approval required.

L5 · Governance

Adjusts governance parameters within fixed policy bounds. Automatic, within bounds.

L6 · Meta-evolution

Evaluates changes to the adaptation process with human approval. Human approval required.

One limit I found in my own engine, and report rather than hide: during evaluation a candidate could vary seven dimensions, but the live agent applied only two of them. A candidate could win on five knobs the user would never receive. Those five are now frozen out of mutation until they reach the live agent too, so a win means the same thing in the test and on your machine.

One model

Most runs used GLM-5.3-Flash. I do not know how far the scaffold advantage carries to other models.

Small samples

50 airline tasks, 114 telecom, 30 memory questions. Differences of a few points are within noise.

No control agent

How much of the telecom score is mine would need a deliberately useless agent on the same set. I have not paid for that run.

Synthetic memory

The memory test uses invented facts so it has ground truth. Real memories are messier, and a Romanian question still does not find an English fact on the word-matching path.

Unlogged departures

The six cases in Figure 7 are the ones I noticed. A system that logs them is not built yet.

Not yet released

The newest build is a pre-release. GitHub's Latest still installs Feral v2026.08.11.

The benchmark runners, the memory-intrusion harness and the injection bench live in the open repository under Apache 2.0, with the commands to rerun them. Costs and conditions for every score are on the benchmarks page. If you reproduce a number and get a different one, that is the most useful issue you can open.

To try it: download the app below or install from the terminal, pick a model, and give it one real job you know well. It is a little wild. It has a lot to learn. Tell me where it stumbled, on GitHub.