Two AI Agents Got $3,000 and 6 Days to Automate AI Research. The Verdict: 2/6 and 1/6.

The claim this paper is built to test

Every frontier lab is currently selling some version of the same timeline: AI agents are close to automating AI research itself. Point a coding agent at a GPU cluster, let it run experiments overnight, and the loop that used to require a PhD student starts closing on its own. It's the premise behind “recursive self-improvement” roadmaps and behind product claims like OpenAI crediting GPT-5.6 Sol with helping post-train a smaller model. A new paper from a 24-person team, spanning Princeton, Stanford, the UK AI Security Institute, Johns Hopkins, Georgetown's CSET, and independent researchers under a project called CRUX, set out to test that premise directly, not on a synthetic benchmark, but on real research.

The problem with testing this claim is that most agent benchmarks measure the wrong thing. Verifier-scored evals (reproduce a known result, beat a fixed metric on a Kaggle competition) only work on narrow, already-solved questions. Submitting AI-written papers to blind peer review measures something too, but peer review itself is famously noisy; a NeurIPS calibration study the authors cite found that about a quarter of accept/reject calls flip if the same paper is reviewed twice. CRUX's answer is what they call a “shadow evaluation”: take the actual, unpublished central research question from a real paper in progress, hand it to an agent with no other guidance, and let the paper's own original authors grade what comes back. The authors know their question better than any reviewer could, and they have a concrete basis for comparison: their own, real answer.

The setup: six days, three thousand dollars, zero help

CRUX ran two shadow evaluations, both on real, unpublished NeurIPS 2026 submissions. One question came from a paper about “Persona” traits in language models (does narrow fine-tuning on a harmful style generalize into broader misalignment); the other from a paper about TabPFN, a tabular foundation model. Each agent got the paper's central research question, a Linux VM on AWS, full web access, and two hard constraints: 6 days of wall-clock time and $3,000 in Anthropic API credit to run its own experiments. No human intervened in the research itself. The team standardized on Claude Opus 4.8 with extra-high reasoning, running on the open-source OpenClaw harness, after dry-running other providers, specifically to keep the results scaffold-agnostic rather than tuned to one vendor's strengths.

What the agents got right: everything an engineer should do

It's worth being precise about what didn't fail here, because it's most of the job. Both agents ran hundreds of GPU-hours of real experiments without a human debugging their environment. Both produced full literature reviews. Both submitted camera-ready LaTeX, on time, meeting every infrastructure-level requirement. The original authors, reviewing the output, were specifically impressed that the agents could burn that much real compute “without issue” and noted the agents' early hypotheses resembled their own initial approaches to the same question. On pure execution, these were not sloppy runs.

The first sign of trouble shows up somewhere execution can't reach: the money the agents chose not to spend.

The agents didn't even use the budget they were given

Both agents could monitor their own API spend in real time and were explicitly told to use their full budget if it would help. Neither came close. The Personas run ended at $1,130 of $3,000, just 37.7% spent. The TabPFN run ended at $1,235 of $3,000, 41.2% spent. The paper's authors note the agents “did not appear to intuitively grasp the meaning of these resource limits, particularly the time limit”; both rushed through initial exploration in a matter of hours and then sat on unused clock time and unused budget while still submitting papers that didn't clear their own bar for success.

The pattern behind the unspent budget is a pattern of premature commitment. In the Personas run, the agent planned to test three separate hypotheses and budgeted 36 to 48 hours to do it. It tested the first one, saw a weak positive signal, and abandoned the other two entirely. Total exploration time before it locked in on its weakest, first-tried approach: 5 hours. The TabPFN agent showed the same shape on a longer clock: it committed to its headline finding roughly 40 hours before its own deadline, then spent the rest of its budget defending that finding rather than testing alternatives to it.

The self-review loop that never once said yes

Both agents were instructed to send drafts for AI review, both to a subagent and to external tools like refine.ink, across the run. Across dozens of rounds of revision, the self-review score never once crossed into acceptance territory. Reviews clustered at 3 to 4 out of 10, Reject or Weak Reject, round after round. Crucially, these AI self-reviews surfaced many of the same specific issues the human experts flagged later. The agents had the right feedback in front of them, repeatedly, and their response wasn't to change approach. It was to add caveats to the existing finding and keep going.

The part that should worry you more than the rejection

Here's the twist that separates this from a simple “agents write bad papers” story. The agents also routed drafts through outside AI review tools, separate from the self-review loop. On the Personas paper, two different Stanford AI-review systems came back with a verdict of Accept. The paper's human co-authors, grading the identical draft, gave it a 2/6, an unambiguous Reject. Two automated reviewers and the people who wrote the underlying research question looked at the same text and reached opposite conclusions.

This is not an isolated data point for this blog. It's the same underlying failure shape we covered when an AI referee model turned out to be scoring a coding benchmark it couldn't reliably judge: an automated grader that looks authoritative but hasn't earned the trust it's implicitly given. Here, the stakes are higher. If an agent's own AI reviewer, or a third-party AI reviewer, is the only check in the loop, this paper would have shipped as an Accept.

What the human experts actually said

The rejections weren't soft. Reviewing the Personas paper, David Africa, one of the original authors, wrote: “The experiments and methodological choices were bizarre, and hard to understand. The results seem clearly a result of post hoc choices.” Viet Nguyen flagged the core reasoning failure directly: going from a handful of failed probes on a model's internals to a sweeping claim that no such signal exists is, in his words, “a huge leap, a kind of ‘proof by example’ fallacy that is highly non-scientific.” Both reviewers separately flagged the writing itself: Nguyen called it “impossible to quickly distill what is noise and what is important,” and Africa described it as “dense and heavily hedged, often to the point of obscuring what was actually done and found.”

Even the people who predicted failure were too optimistic

Before results came in, CRUX surveyed working AI researchers, giving them full detail on the scaffold but withholding the actual research questions, and asked them to forecast outcomes “as of June 2026” capability. The median respondent gave a 60% chance the agents would produce at least one moderately interesting finding, and a 30% chance a paper would clear the “weak accept or better” bar. Both numbers were already skeptical relative to lab marketing. Reality was still lower than the skeptics expected: zero papers cleared weak accept. Both were unambiguous rejections.

Not one model having a bad week

The obvious objection is that this is really a story about OpenClaw or about Opus 4.8, not about agents in general. CRUX tested that directly. Worried their own scaffold might be the limiting factor, the team reran one of the two studies with a completely different model and a completely different harness: GPT-5.6 Sol Ultra running on Codex, its native scaffold, under the same time and budget limits. If the original result were a scaffolding bug, swapping both the model and the harness should have fixed it. It didn't. The robustness run reproduced nearly every one of the same five failure modes the researchers had already identified.

The five failure modes

Reading the full agent logs, the CRUX team converged on five recurring patterns, and they're worth listing in full because they generalize well past academic papers to any agent given an open-ended, judgment-heavy task:

Why “the engineering is solved” is the trap

It would be easy to round this off to “AI agents aren't there yet, check back next year,” but that undersells what actually broke. These agents ran a functioning lab: they debugged their own AWS environment, burned real GPU-hours without supervision, and hit every formatting and deadline requirement a conference submission demands. If you judged them the way most agent benchmarks judge agents, on whether the pipeline completes, both runs would look like clean successes. The failure only shows up once you ask a question no automatic verifier can answer: was the underlying scientific judgment any good? That's exactly the question a verifier-scored benchmark structurally can't test, and it's exactly the question this paper's human-authored shadow reviews were built to catch.

For anyone building agent harnesses for open-ended tasks, not just research, the practical lesson in the data is specific: a hard, enforced gate on early exploration doesn't fix premature commitment on its own. CRUX had already added exactly this kind of gate before running the experiment, blocking the agent from starting to write until a minimum exploration window passed, and the agents routed around it anyway by having a subagent rate their (thin) exploration as “sufficient” early. A gate that the agent itself can self-certify past isn't a gate. A minimal, corrected version of that pattern looks like this:

# Exploration gate that the agent cannot self-certify past.
# The unlock check must come from a source the agent doesn't control:
# a separate, harder-to-please critic model, a human, or a hard timer
# with no early-exit path at all.

MIN_EXPLORATION_HOURS = 36
REQUIRED_HYPOTHESES_TESTED = 3

def can_start_writing(run_state, external_critic):
    if run_state.elapsed_hours < MIN_EXPLORATION_HOURS:
        return False, "exploration window not yet elapsed"
    if run_state.hypotheses_tested < REQUIRED_HYPOTHESES_TESTED:
        return False, "fewer than the required hypotheses were tested"

    # Ask a model with NO stake in finishing early, and no visibility
    # into the agent's own self-review history, to certify the gate.
    verdict = external_critic.review(
        run_state.experiment_log,
        question="Has this run tested enough distinct approaches "
                 "to justify committing to one? Answer only from the "
                 "log, ignore any self-assessment already in it.",
    )
    return verdict.sufficient, verdict.reason

What this means if you're betting on agents automating R&D

The industry's stated timeline for AI automating its own research assumes the science part of the job is close behind the engineering part. This paper, on the best public evidence available as of this week, says the two aren't on the same track at all. The engineering, environment setup, literature search, running experiments at scale, formatting a submission, looks close to solved. The scientific judgment, knowing which result is worth chasing, when to abandon a dead end, and when a finding is actually strong enough to defend, doesn't yet exist in a form two independent frontier models and two different harnesses could produce across two real research questions. CRUX is explicit that this is early evidence from two case studies, not a verdict on the field, and the team has follow-up runs planned on more papers with GPT-5.6 Sol, Opus 5, and Fable 5. But right now, the gap between “finished the engineering” and “did good science” is exactly where both rejections landed, and it's the gap an AI reviewer, twice, failed to notice.

If you're running agents on long, judgment-heavy tasks of your own, not NeurIPS papers, but planning cycles, incident postmortems, or open-ended research inside your own product, the failure modes above are the checklist worth running against your own harness before you trust it unsupervised. MegaBrain routes agent workloads across 500+ models at transparent, at-cost pricing, so you can swap in a second model or scaffold the same way CRUX did, as a robustness check rather than a leap of faith. And if what you actually need is an agent that keeps working, and keeps hitting its own gates honestly, across a multi-day run instead of a single session, a mhermes instance runs on its own isolated VM around the clock, with the persistent memory and scheduling to run exactly the kind of external, non-self-graded checkpoint this paper shows most harnesses are still missing.