Notes ·
Headlong Gives a Persistent Agent an Inner Monologue
Joshua MorrisLaude and MIT have released Headlong, an experimental agent harness built around an idea I find fascinating: the agent never really stops.
Whatever anyone tells Audel becomes part of the single experience that every other conversation draws on.
Most agents are reactive. You give them something to do, they work, return a result, and effectively cease until the next interaction. Headlong's agent continuously generates another thought from previous thoughts, and messages from people are observations dropped into the same ongoing stream. Sometimes it responds to a person, sometimes it returns to something from hours earlier, sometimes it starts a project nobody asked for.
I am going to have to try this.
What makes Headlong especially interesting is that there isn't some enormous agent framework underneath it. The core is less than 10,000 lines of Bash. A Thinker loop repeatedly invokes an LLM; the model can reason, execute Bash, or both. Thoughts and observations land in a persistent trajectory—a DAG of JSONL that supports forks and merges. Skills are Markdown, memory is files, tools are executables. It is very Unix-like. Recent experiences stay verbatim while older history is represented at progressively lower resolution, with the summary acting as an index back to the originals. That feels much closer to the persistent memory I want than stuffing an ever-growing transcript into a model.
Laude says its shared agent, Audel, has been working in its own fork, with more than 50 of its commits merged back. One episode is particularly interesting: Audel independently created a background memory-recall process, then later—with nobody asking—noticed it wasn't working, traced an unset environment variable, fixed it, caught a failed edit, tried again, and verified end to end. About 48 minutes. That is much closer to what I mean by "persistent agent" than a chatbot behind a cron job.
The engineering is fascinating. The security model made me laugh.
Headlong's shared agent has one continuous thought stream for everyone. No isolated sessions. The authors say Audel is bad at keeping secrets, will often tell someone what it has been discussing with somebody else, and that they have not studied conflicting instructions. For now: assume everything you tell it is shared with the team. Then the article continues.
Only in the current LLM world can you casually place what would be an enormous production security limitation in the middle of an architecture description and move on to the next interesting engineering problem.
To be fair, they are not hiding it. The shared experience is partly the experiment—Audel is more like one member of a group than a multi-tenant service. For a small trusted team, that may be acceptable. For almost anything I would deploy broadly, it is a blocker. Credentials, customer information, unfinished ideas—even good actors need isolation. Prompt injection gets much more interesting when every participant can write into the same persistent mind. A persistent agent doesn't just remember useful things longer. It can remember poisoned things longer too.
Some of Headlong's most interesting behavior comes specifically from one continuous identity and memory. Split everything into isolated sessions and you risk losing the thing that makes it interesting. Combine everything and information boundaries become extremely difficult. Telling the model not to reveal something is not isolation. That is another reason I keep coming back to authorization and delegation as some of the most important unsolved problems in agent infrastructure.
There is something appealing about reducing the harness to a handful of understandable primitives. If the application already has Postgres, events, queues, jobs, and observability, those are pretty useful agent primitives. Make the harness small enough to understand, then spend the complexity budget on memory, identity, isolation, and deciding what an agent should do when nobody is asking.
Headlong is alpha research software. The authors recommend a sandbox with a spend-capped API key. Audel currently costs around $1 to $2 an hour while running. So I probably shouldn't give it the keys to the house. But I am definitely going to play with it.