karpathy/autoresearch
AI agents running research on single-GPU nanochat training automatically
How autoresearch is put together
autoresearch is a minimal autonomous ML research harness by Andrej Karpathy: an AI coding agent iteratively edits a single training script (train.py), runs 5-minute single-GPU GPT pretraining experiments, and keeps or discards changes based on validation bits-per-byte (val_bpb). The repo is pure Python (3.10+) built on PyTorch with CUDA 12.8 wheels, managed by uv. prepare.py provides fixed constants, one-time data download and BPE tokenizer training, plus dataloader and evaluation utilities that the agent must not modify. program.md is a Markdown 'skill' of instructions given to the agent, which the human iterates on. There is no server, database, or web layer; the architecture is three files plus a notebook for analysis.
Languages
Frameworks
Infrastructure
Major components
Data preparation & runtime utilities (prepare.py)
Holds fixed constants, downloads training data, trains a BPE tokenizer once, and provides the dataloader and evaluation routines; explicitly off-limits to agent edits.
Training experiment (train.py)
The single agent-editable file containing the full GPT model, Muon + AdamW optimizers, and the 5-minute wall-clock training loop.
Agent program / skill (program.md)
Baseline Markdown instructions that define the autonomous research workflow the human iterates on and points the coding agent at.
Experiment analysis (analysis.ipynb)
Notebook for inspecting experiment logs and results such as val_bpb trends.
Dependency & environment management (pyproject.toml / uv.lock)
Declares pinned Python dependencies and routes torch through the explicit pytorch-cu128 index.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (14 advisories) across 74 scanned dependencies.
pillow 12.1.1
12 advisories. Fixed in 12.3.0.
How it can be abusedAn attacker would need to trick the project into opening a maliciously crafted font or image file, which could crash the process with huge allocations or corrupt memory. In autoresearch nothing loads images or fonts, so no one running this repo is realistically affected.
- highGHSA-45hq-cxwh-f6vcPillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading
- highGHSA-5x94-69rx-g8h2Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
- highGHSA-62p4-gmf7-7g93Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
- highGHSA-6r8x-57c9-28j4Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow
- highGHSA-8v84-f9pq-wr9xPillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading
- highGHSA-9hw9-ch79-4vh6Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
- highGHSA-jjj6-mw9f-p565Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
- highGHSA-phj9-mv4w-65pmPillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`
- highGHSA-pwv6-vv43-88grPillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
- highGHSA-vjc4-5qp5-m44jPillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
- highGHSA-whj4-6x5x-4v2jFITS GZIP decompression bomb in Pillow
- highGHSA-xj96-63gp-2gmrPillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
urllib3 2.6.3
2 advisories. Fixed in 2.7.0.
How it can be abusedAn attacker who controls or intercepts the URL that prepare.py downloads training data from could send huge compressed responses that exhaust memory and disk, or trick a redirect into leaking credentials like auth tokens to another server. Only someone running the data download step against an untrusted or tampered-with source is affected; everyday training runs are not exposed.
- highGHSA-mf9v-mfxr-j63jurllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
- highGHSA-qccp-gfcp-xxvcurllib3: Sensitive headers forwarded across origins in proxied low-level redirects
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required