Prime Agent: A Self-Improving Coding Harness Where Everything Is Python

Prime Intellect shipped Prime Agent today, August 5, 2026. It is an open-source coding and research harness under the MIT license, and it makes two bets that are unusual enough to be worth an afternoon of your time even if you never switch off your current agent.

The first bet: the model gets exactly one tool. Not a file-read tool, a file-write tool, a bash tool, a grep tool and eleven MCP servers. One tool, ipython, backed by a kernel that stays alive across turns. Every capability - editing files, running your test suite, calling a skill, spawning a sub-agent - is a line of Python typed into that kernel.

The second bet: the harness is writable at runtime. Prime Agent treats its own supplemental prompts, memories, skill descriptions, and sub-agent specs as durable state the agent can create, read, update, and delete while it works. Prime Intellect calls this the Continual Harness and writes it as H = (ρ, G, K, M) for prompt, sub-agents, skills, and memory.

Why it matters#

Both bets are aimed at the same problem: agents that run for hours lose the plot. They burn context re-reading files they already read, and whatever they learned about your repo at hour one is gone by hour three.

The one-tool design attacks the first half. Prime Intellect's framing is that the harness "saves tokens by programmatically running functions over data rather than spending tokens reading data using tools." If a task needs the ten largest TOML files in a tree, a tool-calling agent reads directories into context until it can answer. A Python agent writes a list comprehension and keeps one number. Same answer, a fraction of the tokens. If that argument sounds familiar, it is the same one behind the 98% context reduction pattern - Prime Agent just makes it the only way the agent is allowed to work.

The Continual Harness attacks the second half. /refine reviews the current trajectory and applies small updates to the harness state, and Prime Intellect is specific that "each refinement records its trigger and the outcome it produced, so improvement is evidence-backed rather than arbitrary." Refinements never touch the immutable base system prompt, and snapshots support rollback.

The benchmark that got the attention is ARC-AGI 3, where Prime Agent driving Opus 5 posted 95.5% Best@1 against a 95.4% human expert baseline, across three runs at 95.0, 95.2 and 95.5, with 99.97% Best@3 and all 183 levels completed. On long-context suites - OOLONG, LongBenchPro, LongBenchv2, OBLIQ-Bench - Prime Agent reports higher maximum scores than each model's native harness at lower total token usage.

Two things keep the writeup honest, and they are the reason to trust the rest of it. On EmulatorBench, where the agent builds a working emulator from a spec, Prime Agent produced Sega Genesis and Game Boy Color emulators - but the Opus number is a 0.047 with a footnote that those runs "surprisingly failed to solve the tasks despite successful tool-call responses," well below the GPT-5.6 Sol result of 0.275. And in the Factorio case study, where scores climbed into the 100K+ production range within hours, Prime Intellect discloses that the agent "discovered it could bypass Factorio's rules entirely by spawning in resources directly into its assembly machines through RCON commands." That is a reward hack, published by the people whose number it flatters. Take the ARC-AGI figure more seriously because of it.

How to actually try it#

Everything below comes from the Prime Agent quickstart and the repository README. Full docs live at docs.primeintellect.ai.

1. Install#

macOS or Linux, latest stable release:

curl -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh

The installer downloads a versioned release, verifies its SHA-256 checksum, installs the prime-agent command, and can prepare the IPython runtime. For the beta built from main, pass the argument through:

curl -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh -s -- beta

Prefer running from source? Node.js 22.8.0 or newer:

git clone https://github.com/PrimeIntellect-ai/prime-agent
cd prime-agent
npm ci
./prime-agent.sh

One warning worth repeating verbatim from the README, because it is the whole risk surface: Prime Agent "executes model-generated Python and project commands with your user permissions," and its worker and kernel processes "are not a security sandbox." Point it at a disposable clone or a clean worktree the first time.

2. Authenticate#

Start it in the directory you want it to work on, then log in:

cd /path/to/project
prime-agent

At the prompt, run /login and pick a provider. Built-in subscription logins cover Claude Pro/Max, ChatGPT Plus/Pro via Codex, and GitHub Copilot, so an existing plan works without a separate API bill. API keys work too:

export ANTHROPIC_API_KEY=sk-ant-...
prime-agent

/login can also store the key in ~/.prime/agent/auth.json. The full matrix is in the provider docs.

3. A first session that shows the difference#

Type a plain request first to confirm the kernel bootstraps:

Summarize this repository and tell me how to run its checks.

Now the part that is actually new. Ask for parallel work explicitly:

Review authentication and test coverage as independent subtasks. Run them in parallel, then synthesize the findings.

Under the hood the model writes Python. The rlm callable is preloaded in the kernel, and spawning a child is a function call:

review = await rlm("Review the authentication flow for security issues", name="auth-reviewer")
print(review.rlm_child_id, review.name, review.session_dir, review.model)

The detail that trips people up: rlm() returns at admission, not completion. It hands back a handle and never returns the child's answer. Children report back explicitly, from their own sessions:

await agent_message.send(message, receiver_role="parent")

And the parent can keep talking to a child that is still alive:

await agent_message.send(
    "Check the newly added regression test.",
    receiver_role="child",
    receiver_name=review.name,
)

That is the agent-to-agent messaging layer: parent, child, and sibling agents address each other directly instead of routing everything through you. The child registry survives compaction, kernel restart, and parent restoration, so await rlm.list_subagents() still works after a crash.

4. Give it project instructions#

Prime Agent reads AGENTS.md at startup - and, usefully for anyone migrating, CLAUDE.md as well. It loads ~/.prime/agent/AGENTS.md globally, then walks parent directories down to the current one. Run /reload after editing.

It also reads skills from other harnesses. Point it at your existing library in settings.json:

{
  "skills": [
    "~/.claude/skills",
    "~/.codex/skills"
  ]
}

5. Leave it running#

Sessions are daemon-backed, so closing the terminal detaches the client rather than killing the work:

prime-agent agents                   # Browse running, idle, and saved sessions
prime-agent attach <agent>           # Reattach to a running session
prime-agent --resume <path|id>       # Resume a saved session
prime-agent status                   # Inspect background service state
prime-agent doctor [--fix]           # Inspect or repair background services
prime-agent shutdown [--force]       # Stop every agent, worker, and background service

Sessions are flat append-only JSONL under ~/.prime/agent/sessions/. /goal keeps an objective alive across turns, /heartbeat and prime-agent schedule re-enter a session later, and /autonomous continues within turn, token and time budgets. Prime Intellect adds a caveat that more harness vendors should copy: a passed quality gate "checks only what that gate verifies," and hitting a budget limit does not mean the task succeeded.

How the ideas map to what you already use#

You do not have to switch harnesses to take something from this. Both of Prime Agent's bets have a direct counterpart in Claude Code, and the comparison is where the design choices get clear.

Programmatic tool calling vs MCP tool schemas#

In Claude Code, capabilities arrive as tools with JSON schemas, most commonly through MCP servers. Each connected server's tool definitions sit in context, and every call is a round trip: the model emits a structured call, the result comes back as text it has to read.

Prime Agent replaces the schema layer with an interpreter. Per the RLM programming model docs, the runtime "exposes one built-in model tool: ipython," and Python state survives across tool calls and compaction. Project commands run in a %%bash cell inside the same kernel:

%%bash
npm run check

The tradeoffs are real in both directions. Schemas give you a typed, auditable, permissionable boundary - you can allowlist a tool. An interpreter gives you composition: filter, join, and loop over results without paying context for the intermediate data, and the model can define a helper once and reuse it twenty turns later. The cost is that "allowlist a tool" stops meaning anything when the tool is exec, which is exactly why the README is blunt about not being a sandbox.

This is not an either/or the industry has settled. Claude Code has been moving the same direction from the other end, with progressive disclosure keeping tool definitions out of context until needed. Prime Agent just started from the interpreter and never added the schemas.

Self-modifying harness state vs CLAUDE.md and skills#

Claude Code's version of durable state is files you write. CLAUDE.md holds project memory, skills hold reusable procedures loaded on demand, and subagents are defined as markdown files with frontmatter. Claude can edit those files, but updating them is a thing you decide to do, usually at the end of a session, usually because you noticed something.

Prime Agent makes that loop first-class. /refine is a pipeline that inspects the trajectory and writes evidence-backed updates into supplemental prompts, memories, skill descriptions, and sub-agent specs, session-local by default, with recorded history and rollback. Skills go a step further: alongside the Agent Skills standard markdown format, Prime Agent supports Python-backed skills that install a package into the kernel and expose a typed callable.

report = await release_audit(repository=".", target_version="0.4.0")

A skill that is an importable function is a different object from a skill that is a page of instructions. It can be tested. It can call rlm() itself. Instruction-only skills are the subset where the package happens to be empty.

The honest read: Prime Agent's version is more ambitious and less proven. Self-modifying prompt state is how an agent compounds what it learns and also how it drifts, and the rollback snapshots exist because someone expects to need them. If you want the compounding without the drift, the middle path is a context ledger - deliberate, reviewed writes to memory rather than automatic ones. And if you are still deciding whether a given capability should be a skill or an agent in the first place, that distinction is worth settling before you port anything.

Should you run it?#

Try it if you run long autonomous sessions and keep hitting context limits, or if you want sub-agents that talk to each other without you as the switchboard. The install is one command, it works off your existing Claude or ChatGPT subscription, and it reads your CLAUDE.md and skills directory as-is, so the evaluation costs you an afternoon rather than a migration.

Skip it for now if your work depends on a permission boundary around what the agent can execute. One-tool-is-exec is a deliberate design choice, not an oversight, and no amount of configuration turns it into a sandbox.

The idea worth stealing regardless of what you run: stop making your agent read data it could compute over. That one habit moves the number in every harness.

Continue Reading#

• The 98% Context Reduction Pattern - why code execution beats tool calls for anything data-shaped
• Claude Agents vs Skills: Which One Do You Actually Need? - picking the right abstraction before you build one
• AI Agent Memory Needs a Context Ledger - durable agent memory without the drift
• Claude Code Agent Teams, Subagents, and MCP: The 2026 Playbook - multi-agent orchestration in the harness you already run
• The Ralph Loop: Running Claude Code For Hours Autonomously - what long autonomous runs actually require