Many recursively self-improving systems improve by editing their codebases based on observed rollout behavior. However, recent methods largely treat self-improvement as offline search: variants are optimized and evaluated on fixed benchmarks. This misaligns with real-world deployment, where tasks arrive sequentially and may have different distributions. We study recursive self-improvement as online learning over non-stationary task streams. In this setting, reliable execution and fallback are particularly difficult with limited evidence: different branches of self-improvement see different tasks, so raw rewards conflate capability with task difficulty, leading to overly conservative or optimistic reversion. We propose Online Anchor-calibrated Self-Improvement System (OASIS) that runs an adaptive reference agent on incoming tasks, converts raw rewards into paired comparisons, and uses confidence-calibrated rules for branch continuation and fallback without evaluating every agent on all tasks. Across SWE-Bench Pro and DeepResearch Bench, OASIS consistently improves over both the initial agent and prior RSI baseline SSA, raising the SWE-Bench Pro solve rate from 51.6% to 56.9% using Qwen3.6-35B-A3B and DeepResearch Bench from 35.18 to 39.31 using Gemini 3 Flash. This enables OASIS to outperform larger open weights and proprietary systems, including Qwen3.5-397B-A17B, Minimax 2.7, Qwen3.6-Plus, and GPT-5.3-Codex, with sustained deep self-improvements rather than shallow cycles.

Large language model (LLM)-based search agents synthesize open-web content into actionable recommendations on behalf of users, creating a risk that attacker-published pages are transformed into endorsed claims. We introduce SearchGEO, a controlled evaluation framework for measuring endorsement corruption in LLM-based web-search agents, combining a web-evidence manipulation pipeline, a five-mode attack taxonomy, and multiple output-level metrics. We evaluate 13 LLM backends on 308 cases each. Results show that vulnerability patterns vary across backends: overall attack success rate (ASR) ranges from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash, the strongest attack mode differs by model family, and the same deployment scaffold could amplify or decrease ASR on different backends. An auxiliary agent-skill probe, where endorsement becomes an install command, exposes a sharp split among otherwise robust backends: Claude over-rejects while GPT over-trusts. These findings argue for treating recommendation reliability under adversarial search content as a first-class dimension of backend safety evaluation.