# SafeEvolve: Harness-Policy Co-Evolution from Agent Experience for Safety Alignment

Source: [arXiv](https://arxiv.org/abs/2609.02786v1)  
Feed7 permalink: https://feed7.dev/p/2609-02786v1-0eo17gt  
Published: 2026-09-02T16:19:54.000Z  
Trust: Needs Review (needs_review)

## Why Included

SafeEvolve turns completed agent trajectories into reversible harness updates and policy training, linking runtime safeguards with learned multi-step behavior.

## Source Summary

**SafeEvolve** feeds safety evidence from completed on-policy trajectories into a continual loop. It makes bounded updates to safety prompts and hierarchical skills, then trains the policy with a **two-stage SFT-RL** process.

## Practical Implication

For agent builders, the useful pattern is to retain trajectory evidence, translate it into auditable and reversible harness artifacts, and train models to actively use those artifacts rather than relying on runtime controls alone.

## Agent-Ready Context

**SafeEvolve** feeds safety evidence from completed on-policy trajectories into a continual loop. It makes bounded updates to safety prompts and hierarchical skills, then trains the policy with a **two-stage SFT-RL** process.

For agent builders, the useful pattern is to retain trajectory evidence, translate it into auditable and reversible harness artifacts, and train models to actively use those artifacts rather than relying on runtime controls alone.

On AgentDojo with Qwen3.5-4B, the paper reports a **3× ASR reduction** while benign utility moved from **59.79% to 61.86%**. The abstract does not provide absolute ASR values or enough detail to judge transfer beyond the tested benchmarks.

## Connected Context

Feed7 judgment across 669 accumulated Signals:

This advances trajectory logging from observability into a continual safety mechanism: completed experience is converted into bounded, reversible prompt and skill updates, then reinforced through training. It confirms the harness as a safety layer but couples it to policy adaptation rather than relying only on runtime gates. The AgentDojo result is promising but does not establish transfer beyond the tested model and benchmarks.

- [Agents Are Where Microservices Were in 2015 — Roberto Milev & Uday Kanagala, Navan](https://feed7.dev/p/agents-are-where-microservices-were-in-2015-roberto-milev-uday-kanagala-1pk4hle) — Navan treats captured trajectories and testable skills as production infrastructure; SafeEvolve makes those trajectories inputs to controlled harness updates and subsequent policy training.
- [In Code They Act, In Proof We Trust — Erik Meijer, Leibniz Labs](https://feed7.dev/p/in-code-they-act-in-proof-we-trust-erik-meijer-leibniz-labs-1lyno2y) — The proof-oriented harness blocks unsafe side effects before execution, while SafeEvolve learns from completed trajectories to update future prompts, skills, and policy; these are complementary runtime and continual controls.
- [Guide, Verify, Solve — Anirban Chatterjee, Sonar](https://feed7.dev/p/guide-verify-solve-anirban-chatterjee-sonar-1igfmbm) — Sonar’s guide-verify-solve loop argues that controls must shape each iteration; SafeEvolve operationalizes a related feedback loop by translating observed safety evidence into bounded harness artifacts and training.
- [We Vetted 2000 AI Skills Before They Reached Developers — Lucas Palma, Nubank](https://feed7.dev/p/we-vetted-2000-ai-skills-before-they-reached-developers-lucas-palma-nuba-0k4ehkz) — Because SafeEvolve continually changes hierarchical skills, Nubank’s scanning and distribution gates become an implementation prerequisite for reviewing those generated artifacts before deployment.

## Context Map

- Layer: agent
- Domains: coding, security
- Topics: harness-engineering, skills, agent-reliability

## Uncertainty

- On AgentDojo with Qwen3.5-4B, the paper reports a **3× ASR reduction** while benign utility moved from **59.79% to 61.86%**. The abstract does not provide absolute ASR values or enough detail to judge transfer beyond the tested benchmarks.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.