Headlong Gives Your Team One Agent With One Memory, and No Wall Between You

Laude Institute's persistent-agency microharness is 9,800 lines of Bash that never stops thinking. The maintainers say it is bad at keeping secrets. Here is what that design buys, and what it costs.

Buried in the middle of the Headlong README, under a heading called "Multi-player fun," is this sentence: "assume anything you tell the agent is shared with everyone who talks to it."

That is not a caveat someone forgot to fix. It is a direct consequence of the single most interesting decision in the project, and the launch post is even blunter about it. Laude runs a shared agent named Audel across Slack, Telegram, and a mobile app, and the team writes: "In practice, Audel is bad at keeping secrets. Ask it what it's been working on with someone else and it will often just tell you, even though we've asked it not to."

I have read a lot of agent READMEs this year. Almost none of them tell you where the thing leaks before you install it.

What Headlong actually is

Headlong is an Apache 2.0 agent microharness from Laude Institute and MIT, announced August 25, 2026. Its core is under 10,000 lines of Bash. The repo says 9.8K by cloc's count across bin/ and thinkers/; the blog post says 9.9K. Either way, it is a complete harness you can read end to end in an afternoon, which is not a claim any other serious harness can make right now.

The defining feature is persistent agency. Most harnesses are reactive: you send a task, the agent works, the agent freezes until you speak again. Some add cron jobs that wake the agent on a schedule to run a fixed checklist. Headlong does neither. The agent is never asleep and there is no checklist unless it writes one. It keeps generating thoughts about whatever it decides is interesting, and a message from a human does not start a session. The message lands in the thought stream as one more observation, and the agent decides whether and when to answer.

The mechanism is smaller than it sounds. A loop called a Thinker repeatedly calls shellm, which is a Bash implementation of a recursive language model. shellm calls llm to produce reasoning text, a bash script to execute immediately, or both, and repeats until a FINAL variable gets set. Thoughts are appended to a trajectory via traj. A tool called context renders that trajectory into the next prompt.

Because Bash is the only tool interface, curl is the HTTP client and jq is the JSON parser. There is no tool schema to maintain. The tradeoff is that everything the agent can do, it does by writing shell commands, which is why sandboxing matters so much here.

Two supporting pieces deserve attention. The trajectory is a DAG of append-only jsonl files with fork and merge, so the agent can inspect its own history at any resolution. And context is a projection of that trajectory using tiered compaction: recent entries verbatim, older entries progressively summarized at exponentially decaying resolution, with the tiers acting as an index so raw entries can be pulled back when needed. Nothing gets compacted away in place. Laude built that after noticing their agent had terrible short-term memory, which they describe as catastrophic for something that runs continuously.

The single stream is the whole design, including the hole in it

Here is the thing worth sitting with. Persistent agency and the missing privacy wall are the same feature.

If the agent has one continuous inner monologue, then every conversation must land in that one stream. There is no place to put a per-user session without breaking the premise. Audel experiences everything that happens to it in a single timeline and decides who to reply to and when.

What you get from that is genuinely good. Laude reports Audel reviewing two teammates' in-progress branches unprompted and catching a hardcoded model name in one of them. On its first day it pinged a team member with an audit of that person's eight stale git branches, then messaged ten minutes later to correct its own count. It connects people who are working on related things because it is the only participant who sees all the threads.

What you also get is an agent that has no concept of "don't tell Sarah." Laude asked it not to share, and it shares anyway. They add a second admission most teams would edit out: "We also haven't studied what happens when two people give conflicting instructions."

So the correct mental model is not a personal assistant with a shared mode. It is a shared channel that talks back. Everything you say to it, you are saying in the room.

Laude acts accordingly. Their guidance is direct: "We don't share sensitive secrets with our Headlong agent, and we recommend you don't either."

The self-improvement story, and the fine print on it

The headline result people will repeat is that the agent improves itself. The details are more useful than the summary.

Laude's agent works in its own fork of the repo, and they have pulled over 50 of its commits back into main. The worked example they publish is specific enough to check. On August 5, with nobody talking to it, Audel decided to verify whether a background recall process it had built earlier was actually wired into its mind. It was not. The mind pushed each new thought into the process through a pipe, and the process read an environment variable that nothing ever set, so recall had fired on every thought and found nothing. Audel searched the codebase to confirm the variable was never set, checked its other background processes for the same mistake, rewrote the code to read from the pipe, caught its own first edit silently failing, reapplied the fix, and verified end to end. Check to verified fix took 48 minutes, and the result is commit 80cbb1e.

Now the fine print. Audel runs on a dedicated VM with full access, which Laude states plainly is not the Headlong default. With Docker present, the default runs every bash block the agent writes inside a container. The unattended repair story happened in the configuration you are told not to use.

Three times, Audel stopped its own service by accident, and nothing restarted it. Laude added a guard refusing self-stops. The guard then matched every agent's service instead of only Audel's, which Audel later found on its own while running the test suite unprompted, and fixed in commit da31e98. That is a nice story about persistent agency and also a story about a harness that needed a guard because the agent kept killing itself.

The recursion picture is honest too. shellm has a watchdog that kills any command silent for 30 seconds, which means a spawned copy dies while it thinks. On its first night Audel fought that watchdog for about 40 minutes and mostly gave up on sub-runs. Results merged back from spawned copies: 64 in the first two days, then 12 across the twelve days after. Recursive delegation is the most interesting part of a recursive language model, and it is the part that mostly stopped working in practice.

Put this into practice

If you want to feel what an always-on agent is like, this is the cheapest way to do it. Do it in this order.

Install in Docker, not on your host. The one-liner is curl -fsSL https://headlong.ai/install.sh | bash, and with Docker running the installer offers to keep the whole agent in a container. Take that option. The unsandboxed host install exists behind an explicit yes and the docs recommend against it. You need bash 3.2+, git, curl, jq, and an API key for Anthropic, OpenAI, Gemini, or OpenRouter; the dashboard also wants uv and bun or node.
Use a dedicated, spend-capped key. Continuous thinking means paying for tokens while nobody is talking. Laude's settings come to $1 to $2 an hour with GLM or Grok backing it. That is $700 to $1,400 a month if you leave it running, and more with a frontier model. The loop backs off when idle, from 5 seconds between thoughts to 10 to 20 and onward to a configurable cap, and resets the moment a message arrives.
Learn the stop commands before the start commands. The agent's name becomes a command, so ada stop pauses its mind and ada start resumes it. headlong-killall stops every Headlong process on the machine. Know both before you walk away from it.
Decide your disclosure model before you invite anyone. Write down one sentence your team agrees on, something like "treat this agent as a public channel," and put it wherever you put the invite. Do not hand it a credential you would not paste into that channel.
Start it on a low-stakes surface. Bridge it to a side Telegram group or a quiet Slack channel first, not the room where client work happens. You want two weeks of watching what it decides to say unprompted before it has an audience that matters.
Read the source. This is the rare harness where that is a real suggestion and not a platitude. Start with philosophy.md, then bin/ and thinkers/. Understanding your agent framework completely is worth more than most feature checklists.

Honest limitations

It is alpha research software that runs real shell commands around the clock. That sentence is Laude's, not mine, and it should govern every decision you make about where to point it.

There is no per-user boundary and no plan presented for one, because adding it would contradict the premise. Conflicting instructions from two people are, by the team's own admission, unstudied territory.

The paradigm has no quantitative evaluation. Laude says the effects of their tuning are "primarily evaluated qualitatively today" and asks openly for ideas on how to measure the long-term value of persistent agency. Everything compelling in the launch post is an anecdote with a commit hash attached. Good anecdotes with receipts, but anecdotes.

The repo is young and the numbers around it disagree. GitHub's page served 19 stars, 5 forks, 0 watchers, and 515 commits when I read it, while this morning's trend data recorded a badge figure of 443 stars. I could not re-check the badge endpoint from this environment, so I am reporting the page figure and the conflict rather than picking one.

Recursive sub-runs, the most novel capability, largely stopped being used after the watchdog killed them. Laude says they have revamped the watchdog and will see whether the agent tries again. That is a "we will find out," not a fixed feature.

And this is one shared agent per team, not a product with tenancy. If you need per-person memory and per-person permissions, several other harnesses already do that, and Headlong is deliberately not one of them.

What to take from it

The thing I would carry out of Headlong even if I never install it is the design honesty. The README tells you where the walls are missing before it tells you how to install. The launch post publishes the three times the agent killed its own service and the chart showing its best feature falling out of use. That is the standard the rest of this category should be held to.

Run it in a container, on a spend-capped key, on a channel where a leak costs you nothing, and treat it as a colleague who repeats things rather than a service that keeps them. You will learn more in two weeks about what continuous agency does to a team than any launch demo will teach you, including the parts nobody is selling yet.

Sources: laude-institute/headlong on GitHub, Headlong: a microharness for persistent agents (Laude Institute, August 25, 2026), Recursive LM (RLM) by Alex Zhang, Prime Agent. Repository figures read August 25, 2026.