Agents Learn to Train Themselves, and Costs Get Real

Sophos says one OpenAI-powered tool cut threat investigation time by 96%. LegalOn says it cut daily Codex spend by 65% without slowing down. Those two numbers sum up the week. Agents are no longer a demo problem. They are a training problem, a cost problem, and a supervision problem. Microsoft Research shipped a 3,500-line framework for training agents in the harnesses they already run in, new papers rethink how students learn from teachers, and Anthropic is offering free security scans to open-source projects. Here are the five developments worth a closer look.

Agent Lightning v1.0 brings RL to agents as they already run

Microsoft Research released Agent Lightning v1.0, a lightweight reinforcement learning framework of about 3,500 lines. The team frames the problem this way: training agents with RL is hard because their tools, context, and decision-making live inside complex frameworks. Agent Lightning connects existing agents to RL training, so teams can improve them without rebuilding them. The release title stresses training with real harnesses, meaning the scaffolding agents actually use in production rather than a simplified stand-in.

Why it matters for builders: Most teams have an agent that works about 80% of the time and no sane way to improve it. If RL can attach to an existing harness instead of requiring a rewrite, the barrier to trying it drops sharply. The small code footprint also makes the framework easier to read, audit, and adapt.

Source: Microsoft Research

Two papers attack the weak signals in agent and model training

One paper revisits cross-tokenizer on-policy distillation, where a student learns from teacher feedback on its own generations. Across three teacher-student pairs on math and code, the authors report that strict 1:1 alignment groups already cover most student-generated tokens despite large vocabulary mismatch. A second paper, on self-retrospection distillation, targets a gap in verifiable-reward RL: when every rollout in a group gets the same reward, the group-relative signal vanishes. The authors propose using post-hoc experience to supervise foresight predictions made before the agent acts.

Why it matters for builders: Both papers ask where learning signal is wasted. The first suggests chasing broader alignment coverage may not be the lever that matters, so supervision reliability deserves attention. The second shows that failed or uniform rollouts still contain information. Teams training agents on scarce, expensive rollouts should care.

Sources: Hugging Face Daily Papers · Hugging Face Daily Papers

LegalOn and Oracle show the cost-and-workflow playbook

OpenAI published customer stories on Codex. LegalOn says it cut estimated daily Codex costs by 65% while maintaining development speed, by matching the models Astra, Sol, and Luna to specific tasks and managing budgets deliberately. Oracle, per OpenAI, uses ChatGPT Work and Codex across recruiting, engineering, and operations to turn specialist knowledge into fast, repeatable workflows. These are vendor-published case studies, so the figures are the companies’ own estimates.

Why it matters for builders: The LegalOn pattern is the transferable part: route each task to the cheapest model that handles it, and treat spend as a managed budget. Model routing is becoming ordinary engineering practice, not an optimization for later. Oracle’s story points to the other lever, encoding expert knowledge into repeatable flows.

Sources: OpenAI · OpenAI

Sophos automates over half of MDR cases with humans still in the loop

OpenAI says Sophos uses its Daybreak product to cut cyber-threat investigation time by 96% and to automate 52% of managed detection and response cases, while preserving human oversight. Separately, Anthropic launched OSS Scanner, a service that gives opting-in open-source projects periodic security scans by its strongest models at no cost, according to The Verge. The Verge notes the trade-off is that projects must accept the terms of the service.

Why it matters for builders: Security is where agent value is easiest to measure: time to investigate, share of cases closed. The Sophos claim pairs automation with human oversight, which is the design most production teams will need. Free scanning could surface vulnerabilities sooner for maintainers, though they should weigh what opting in entails.

Sources: OpenAI · The Verge

Physical AI gets a safety push, with a reality check

Ars Technica reports Nvidia is pitching a full-stack safety solution for physical AI, already used by robotics companies, aimed at safer robotaxis and humanoid robots. MIT Technology Review, in a piece with Aventine, argues robotics breakthroughs won’t change daily life soon. A separate MIT Technology Review sponsored piece notes industrial AI can act directly on physical systems, unlike purely digital AI.

Why it matters for builders: When an agent’s output moves a machine, safety is part of the architecture, not a bolt-on. Vendors are packaging that layer, which helps. The sober timeline is a useful counterweight to demo videos: capability is advancing faster than deployment readiness.

Sources: Ars Technica · MIT Technology Review · MIT Technology Review

My take

The pattern I see is a shift from asking whether agents work to asking how to make them better and cheaper on purpose. Agent Lightning treats the harness as a given and trains inside it. The two distillation papers hunt for lost signal. LegalOn treats model choice as a routing decision. Sophos pairs automation with human oversight. None of that is about a bigger model. It is about engineering around the model. What I would watch next is measurement. A 96% time cut or a 65% cost cut is only useful if you know the baseline and the failure rate behind it, and these are vendor-reported figures. If I were running a team, I would do three things: log full agent trajectories now, because they are training data later; build a routing layer so tasks map to model tiers; and define what human oversight means in concrete terms before automation share climbs. The teams that do that will be able to use tools like Agent Lightning. The ones that do not will have nothing to train on.

The model is the easy part to buy. The harness, the data, and the budget discipline are where the work is.