It's strange to me that there is not a more conscious call out that letting an agent edit its own behavior crosses an explicit risk threshold that requires additional controls. They happily drew the whole loop at the top of the page without any human in the loop reviewing the changes the agent is making to its own instructions.

They do get to it later on - casually mentioning it opens a PR for changes that a human accepts in the middle of a paragraph somewhere. Even there though, the focus isn't on risk mitigation (eg: against embedded prompt injection) but rather just "check if this is a good idea or not".

It seems to me that, in engineering terms, identifying self-modifying agent loops and managing the risk of them is going to be one of the key aspects that will emerge in best practises for how these systems are eventually designed.