Prime Agent: The RLM + Continual Harness Guide (And When to Skip It) — 2026

[Prime Agent](https://github.com/PrimeIntellect-ai/prime-agent) shipped August 5, 2026 from Prime Intellect — MIT licensed, 9.4k GitHub stars, #1 on GitHub trending after +2,483 stars in 24 hours. It replaces the usual tool-call loop with a persistent IPython kernel as the model's *only* tool, so sub-agents are Python function calls and context is a variable you can slice. With Opus 5 it scores 95.5% Best@1 on ARC-AGI-3, just past the 95.4% human expert baseline. Use it for multi-hour refactors and research runs. Skip it for anything touching production: the README states it is not a security sandbox.

By Rohit Raj — Founding Engineer · 10+ yrs MVP shipping · LinkedIn

On August 5, 2026, Prime Intellect published *"Prime Agent: A self-improving RLM agent"* and open-sourced the harness under MIT. Four days later the repo sits at 9.4k stars and took #1 on GitHub trending after gaining 2,483 stars in a single day — the largest daily gain in the agent-tooling category this week.

The headline number is real and worth stating precisely: running Opus 5, Prime Agent reports 95.5% RHAE Best@1 on ARC-AGI-3, above the 95.4% human expert baseline, with a consistent spread of [95.0, 95.2, 95.5] and 99.97% Best@3 across all 183 levels. That is the first coding harness I have seen cross that line without a bespoke fine-tune — and Prime Intellect says so themselves: *"currently no model has been trained around Prime Agent or its core feature set."*

But "self-improving agent" is the most over-claimed phrase of 2026, so this post is the unpacking. What a Recursive Language Model is in concrete terms, what the Continual Harness stores and how /refine edits it, the code you would actually write, how it stacks against Claude Code and Codex, and the one sentence in the README that decides whether this goes anywhere near your production repo.

Worth flagging the competitive gap up front, because it shaped this post: the two best-ranking third-party write-ups on Prime Agent — Kingy's review (2,636 words) and MarkTechPost's launch piece (~1,200 words) — contain zero and one code block respectively. For a tool whose entire thesis is "your tools are Python functions now," that is the wrong shape of coverage.

Prime Agent is a terminal coding agent — same category as Claude Code, Codex CLI, or OpenHands — but the internals diverge at the first layer.

Concretely, what landed (per the launch post and README):

• A CLI + background daemon. prime-agent starts a session; a daemon manages sessions over a local socket so agents survive terminal disconnects. Worker processes recover from crashes by replaying an append-only JSONL history, which also supports branching and forking via a leaf pointer.
• A persistent IPython kernel as the single tool surface. File edits, shell commands, and tool use are all Python executed in one long-lived kernel.
• Sub-agents as function calls. rlm(...) spawns a real child agent — itself another Prime Agent instance — and returns a handle you can message later.
• Durable harness state, formalised in the blog as H = (ρ, G, K, M): prompt, sub-agents, skills, memory. Readable and callable mid-task through rlm.harness.
• Long-run primitives: /goal, /heartbeat, prime-agent schedule, and /autonomous with turn, token, and time budgets.
• Session management: prime-agent agents, attach, --resume, status, doctor --fix, update, shutdown.

Install is one line, and the installer verifies a SHA-256 checksum against a versioned release rather than piping raw main:

curl -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh
cd /path/to/project
prime-agent            # first launch prompts /login to pick a provider

Model support at launch spans Opus 5, Claude Code, GPT-5.6 Sol, Codex, and open-weights GLM-5.2 — the harness is provider-agnostic, which matters for the cost math later.

Strip the acronym and an RLM is a language model whose action space is a REPL rather than a JSON tool schema.

In a conventional harness, the model asks the runtime to read a file, and the *entire file comes back into the context window as tokens*. Read forty files and you have spent your window on data you needed to grep once. Every tool result is a permanent tax.

In Prime Agent, the model writes Python. The file lands in a kernel variable. The model can len() it, regex it, slice the three functions it cares about, and only surface those into its own context. Prime Intellect's framing is that the model composes *"language model programs as actions over its own context"* — the context is data the model manipulates, not a transcript it drowns in.

That is also why the sub-agent is a function call, not an orchestration framework. rlm("...") returns a value into a variable in the same kernel. There is no separate DAG to declare, no YAML graph, no supervisor node. Fan-out is just await on two calls.

The claimed payoff is efficiency, not just capability: Prime Intellect reports higher maximum scores than native harnesses at lower overall token usage, because programmatic execution replaces token-expensive tool-result reading. The cleanest evidence in their own numbers is the long-context benchmark OOLONG, where the same open-weights model (GLM-5.2) scores 0.700 under Prime Agent versus 0.420 under Pi-mono with sub-agents — a 67% relative lift from changing nothing but how context is handled.

I have a specific reason to care about this one. I built [Agent Autopsy](https://github.com/rohitguta2432/agent-autopsy), a forensic debugger that classifies why an agent run died, and 1 of its 5 failure signatures is CONTEXT_BLOAT — the run where the agent slowly buries its own instructions under tool output until the last 8k tokens are all node_modules listings. Context-as-a-variable is the first architectural answer to that signature I have seen, rather than another compaction heuristic bolted on after the fact.

This is the part the other coverage skips. Four patterns, from the official launch post and the README.

1. Parallel fan-out. Two specialists, one await each, no orchestrator:

auth = await rlm("Summarize authentication flow in auth/. Reply when done.", name="auth-expert")
api  = await rlm("Summarize HTTP API layer in src/. Reply when done.", name="http-expert")

2. Steering a child mid-flight. You do not wait for a bad sub-agent to finish and then re-prompt it — you send it a correction while it runs:

await agent_message.send(
    "Also cover middleware error handling.",
    receiver_role="child",
    receiver_name=api.name,
)

Messaging is deliberately scoped to what the docs call the "nuclear family" — parent, sibling, child — so unrelated sessions cannot talk to each other.

3. Writing to harness state. The agent records a durable lesson, then reads its own scaffolding back:

rlm.harness.create_memory("flaky test pattern", "retry three times before failing")
rlm.harness.list("memory")
rlm.harness.get("skill", "retry_helper")

4. Autonomous mode with a real gate. The budget flags are the interesting part — this is the shape of an agent you can leave running:

prime-agent --autonomous \
  --autonomous-gate "npm run check" \
  --autonomous-max-turns 20 \
  "Implement change"

--autonomous-gate is a shell command the agent must keep green. That single flag is doing more safety work than most agent frameworks' entire permission model, because it is a hard, external, deterministic check rather than a prompt asking the model to behave.

"Self-improving" usually means "we appended a lessons-learned file to the system prompt." Prime Agent's version is more specific, and more limited than the phrase suggests.

The Continual Harness, as Prime Intellect formalises it, is a 4-part state H = (ρ, G, K, M) — supplemental prompt, sub-agent specs, skill descriptions, memory — exposed through unified CRUD surfaces and persisted across turns. All 4 are readable and callable mid-task from the kernel via rlm.harness. Skills are importable Python packages, not markdown files, and there is a built-in creator that turns a workflow you just performed into a reusable one.

/refine is the loop that edits that state. It reads the agent's own trajectory, proposes the smallest relevant CRUD edit rather than a rewrite, and records the trigger and the outcome alongside the change. Planning runs asynchronously in the background; applying blocks only briefly at a turn boundary. Refinements are local to the session by default — they do not silently leak into your global config.

Two honest limits. First, this is evidence-backed prompt-and-memory editing, not weight updates — nothing about the model changes. Second, "smallest relevant edit" is itself a model judgement, so a harness that refines toward a wrong lesson will keep refining toward it. The trigger/outcome log is what makes that auditable, and it is the first thing I would read after a bad run.

Context growth is handled separately: compaction fires on a threshold or manually via compact.run(), with a spawned garbage-collector agent cleaning the IPython namespace asynchronously.

Two claim sets from the launch post, and they are not equally strong.

ARC-AGI-3 is the headline. With Opus 5, Prime Agent reports 95.5% RHAE Best@1 against a 95.4% human expert baseline, runs of 95.0 / 95.2 / 95.5, and 99.97% Best@3 across all 183 levels. The tight spread matters more than the peak — a harness that scores 95.5 once and 80 twice is a lottery ticket, not a tool.

Long-context is the more useful signal for daily work. Running open-weights GLM-5.2, Prime Agent posts:

The EmulatorBench row is the honest one to sit with. 0.208 is a low absolute score — it means writing emulators from scratch is still mostly failing. It beats a zero, which tells you the harness unlocks a task class that was previously flat-out impossible, but it is not a number to plan a sprint around.

The caveat Prime Intellect states plainly: no model has been trained around this harness. These are gains from scaffolding alone, which cuts both ways — plenty of headroom, but also no vendor co-design keeping it stable as models change.

The comparison that matters is architectural, not feature-count.

Read the Isolation row twice. It is the single biggest practical difference, it comes straight from Prime Agent's own README, and it is the reason the answer is not simply "the one with the best benchmark."

Rough decision rule: Prime Agent for multi-hour research runs, large refactors, and anything where a session outliving your terminal is the point. Claude Code or Codex CLI when you want a well-guarded default on a repo you care about. OpenHands when container isolation is non-negotiable and you will trade some capability for it.

Four situations where I would not reach for it today.

You need a security boundary. The README says it outright: the agent executes model-generated code with your user permissions, and it is not a security sandbox. Every other caveat is downstream of this one. Prompt injection from a fetched web page or a poisoned dependency README executes as you.

You are on a shared or production machine. A daemon that keeps sessions alive after you close the terminal is a feature on your laptop and a liability on a bastion host. Combine "survives disconnect," "autonomous budgets," and "no sandbox" and you have a process that can keep acting on infrastructure after you have walked away.

Your workload is short. For a twenty-minute bug fix, the whole value proposition — durable memory, session resumption, harness refinement — never activates, and you pay setup cost for nothing. Claude Code is faster to a green diff.

You need stability guarantees. Kingy's hands-on review verified against v0.7.0 — a pre-1.0 harness, four days old, iterating fast. If your team needs a frozen tool surface this quarter, wait a release cycle.

And the failure mode I would personally watch for, from having built a debugger for exactly this: an agent that edits its own scaffolding has a new way to fail — it can refine itself into a rut, encoding a wrong lesson as durable memory and then acting on it for every subsequent session. Read the /refine trigger/outcome log the way you would read a migration history, not the way you would read a changelog.

Assume you have decided the capability is worth it. Here is the wiring I would insist on before pointing it at a real codebase — the part neither competing article attempts.

Isolate it yourself, because the tool will not. The README is explicit that this is not a security sandbox, so run prime-agent inside a container or a dedicated VM with a mounted worktree, not your dotfiles-laden shell. Give that environment its own credentials with a narrow scope. The harness has no sandbox; the sandbox has to be the environment you put it in.

Make `--autonomous-gate` a real gate. Not npm run check. Point it at typecheck plus unit tests plus a secret scan, and let a red gate stop the run. This is the only deterministic brake in the system:

prime-agent --autonomous \
  --autonomous-gate "npm run typecheck && npm test && gitleaks detect --no-banner" \
  --autonomous-max-turns 15 \
  "Migrate the reporting module off the legacy client"

Cap the budget below your pain threshold, not at it. Turn, token, and time budgets exist — set them to a number you would shrug at if the run produced nothing, because sometimes it will.

Treat the JSONL history as an artifact. Append-only session history with branching is genuinely good observability, and it is sitting on disk. Ship it to your log store. When I was hardening the agent flows in MyFinancial, the recurring lesson was that agent incidents are unreconstructable a week later unless the trajectory was persisted at the time — and the trigger/outcome records from /refine are the highest-signal lines in that file.

Scope harness state per-repo. Refinements are session-local by default. Keep it that way. A memory learned on a client's repo should never surface in another client's session, and that is a contractual problem, not just a hygiene one.

Start it on the work you would otherwise not do. The honest sweet spot for a four-day-old, unsandboxed, pre-1.0 harness is not your main branch — it is the dependency-upgrade spike, the test-backfill, the migration audit. High value, low blast radius, and a genuine test of whether multi-hour autonomy earns its keep.

Is Prime Agent free and open source? Yes — MIT licensed, source at github.com/PrimeIntellect-ai/prime-agent. The harness costs nothing; you pay your model provider. First launch runs /login to pick between a Prime Intellect subscription, your own API keys, or a self-hosted endpoint.

What does RLM stand for? Recursive Language Model. The model's action space is a persistent Python REPL instead of a JSON tool schema, so context lives in variables and sub-agents are function calls. "Recursive" is literal: rlm() spawns another Prime Agent instance, which can call rlm() itself.

Is Prime Agent better than Claude Code? On long-context and long-horizon tasks the benchmarks say yes — 0.700 vs Pi-mono's 0.420 on OOLONG, and 95.5% on ARC-AGI-3 with Opus 5. On safety it is clearly worse: Claude Code ships permission prompts and sandbox modes, Prime Agent ships neither. Different tools for different risk profiles, not a straight upgrade.

Does it work with open-weights models? Yes. GLM-5.2 is the open-weights model in Prime Intellect's own benchmark tables, and the harness is provider-agnostic — Opus 5, GPT-5.6 Sol, and Codex are all supported at launch.

Is it safe to run on my repo? Not without your own isolation. The README states the agent executes model-generated code with your user permissions and is not a security sandbox. Run it in a container or dedicated VM against a mounted worktree, with scoped credentials.

Does the agent keep running if I close my terminal? Yes — a background daemon manages sessions over a local socket. Reattach with prime-agent attach <agent>, list with prime-agent agents, resume a saved session with prime-agent --resume <path|id>. Treat that persistence as a reason to be *more* careful with budgets, not less.

What is `/refine` actually editing? The supplemental harness state — prompt notes, memories, skill descriptions, sub-agent specs. It reads the session trajectory, applies the smallest relevant CRUD edit, and logs the trigger and outcome. No model weights change.

Agent harnesses are moving faster than any team's ability to evaluate them. Prime Agent is four days old, has no sandbox, and posts a benchmark number above the human expert baseline — all three of those are true at once, and picking correctly is now an architecture decision, not a tooling preference.

If you are building an AI product and want the integration done properly — isolation, budget caps, trajectory logging, and an honest read on which harness fits your risk profile — that is the work I do. I ship production AI features in [6-week MVP sprints](/en/services/6-week-mvp), and for teams that need someone owning the whole stack rather than a one-off integration, I work as a [founding engineer](/en/services/hire-founding-engineer-india).

Related reading: Cloudflare Computer vs Cloudflare Sandbox for the runtime-isolation side of this problem, and the TencentDB agent memory review for how durable agent memory is being solved elsewhere.

Sources: Prime Intellect launch post · GitHub repo · README · MarkTechPost coverage · Kingy hands-on review