Categories: Entertainment

Devices: Personal app vibe coding that’s really secure — Kenton Varda, Cloudflare｜AI Engineer — HugeGo Finance

This web page was created programmatically, to learn the article in its authentic location you’ll be able to go to the hyperlink bellow:
https://finance.biggo.com/podcast/013bd31558e1c6fa
and if you wish to take away this text from our web site please contact us

The elementary unit of compute for the AI agent period isn’t the stateless perform — it’s a stateful, addressable object secured by a zero-trust sandbox that makes operating generated code secure. That is the architectural argument Sunil Pai and Matt Carrie, the leads of Cloudflare’s brokers staff, make on this 24-minute episode. Pai (primarily based in Lisbon, driving MCP and Code Mode) and Carrie (in Newcastle, constructing the Agents SDK and the Cloud Code harness) spend the session dismantling the usual serverless mannequin and changing it with a concrete various composed of two primitives: Durable Objects and Dynamic Workers. Their dialog ranges from the mechanics of stateful serverless to the safety mannequin of generated code execution, wrapping up in a coherent imaginative and prescient for the way brokers needs to be constructed, deployed, and linked. The stakes are excessive: Cloudflare is betting that the period of “serverless 1.0” (Lambda, customary Workers) is winding down for AI workloads, and that the successful stack is one the place the execution surroundings is persistent, resumable, synchronizable throughout purchasers, and able to safely operating code that an LLM simply generated.

## Stateful Serverless because the Bedrock

The canonical downside of serverless — the counter that by no means counts — turns into the opening argument. In a stateless perform, a `counter++` variable resets to zero on each invocation until a database is wedged in. Durable Objects (DOs) resolve this by making certain that for a given ID, a category spins up as soon as and lives. “Every future request, every websocket connection lands in the same place,” Carrie says. This “stateful serverless” offers builders a single, addressable endpoint that persists, hibernates, and runs background duties. The latency declare is hanging: “in London you get like 15 ms latency. For contrast, 60 FPS is 16 ms.”

The killer demonstration for this primitive is TLDraw, the place telephones attract excellent sync. The AI corollary is resumable streaming. If an agent is streaming an extended story and the person refreshes the browser, a stateless structure dumps the buffer. A DO-based agent merely reconnects. “It just says, ‘here’s the beginning of the stream and I’m just going to continue giving you bytes’,” Carrie explains. This bakes in multi-tab, multi-device synchronization robotically — a function conspicuously absent from present merchandise. “Why can I not share a link to my chat GPT chat with you and both of us work in the same conversation?” Carrie asks, implicitly criticizing OpenAI for missing what DOs make trivial.

The architectural shift appears like this:

“`mermaid
flowchart LR
subgraph A[Standard Agent Stack]
route TB
S1[Stateless Function] –> DB1[(External Database)]
S1 –> CT[Container / VM]
finish
subgraph B[Cloudflare Agent Stack]
route TB
DO[Durable Object] –> SQL[(Embedded SQLite)]
DO –> DW[Dynamic Worker Isolate]
finish
“`

## Dynamic Workers: The Eval++ Primitive

If Durable Objects resolve state, Dynamic Workers resolve *motion*. The core concept is to take a string of code — written by a person or generated by an LLM — and run it immediately in a safe, remoted employee with no deployment step. “For the last 30 years you’ve been told never to use eval in code. In fact, on Cloudflare workers you don’t have eval. It’s dangerous. But we took it and dynamic workers are like eval plus plus,” Carrie says, immediately confronting a long time of programming dogma.

The safety mannequin is the reverse of containers. Instead of beginning with a full OS and attempting to lock it down, the Dynamic Worker begins from an empty functionality set. “The only thing you can run is JavaScript in it, but it has no access to fetch, no APIs, nothing,” Pai emphasizes. The developer explicitly passes in capabilities: “only outgoing fetches to github.com are allowed.” No surroundings variables are uncovered to the generated code.

This inverts the economics and latencies of sandboxing:

The enterprise urge for food for this mannequin surfaced in an anecdote Pai shared from the MCP Dev Summit: a startup founder insisted that “no enterprise environment would allow people to run generated code,” just for a Lockheed Martin consultant to strategy the sales space instantly afterward and say they liked it. The counterintuitive perception is that for high-security organizations, a zero-trust sandbox is *extra* palatable than a full container with a broad assault floor.

## MCP + Code Mode — The Synergy

MCP (Model Context Protocol) grew to become “mega popular around April last year.” Its authentic deployment ache level was that it required a stateful connection between consumer and server. “Durable objects maintain a stateful connection like very, very easily. That’s kind of the whole point,” Pai notes. Cloudflare jumped on this early, constructing MCP servers for PayPal, Linear, Intercom, and others.

The subsequent leap is combining MCP with Dynamic Workers — what Cloudflare calls “Code Mode.” Pai’s speak on the convention demonstrates wrapping all 2,600 Cloudflare API endpoints into an MCP server that consumes “only 1,000 tokens.” Instead of pre-defining each software as a static schema (the usual MCP strategy), the server makes use of Dynamic Workers to generate the software code on demand, sharply lowering token overhead and setup friction. “We kind of claim that we fixed MCP not once, maybe twice,” Pai says. The first repair was the stateful transport through Durable Objects; the second is the dynamic software era through Code Mode.

## Cloud Code and the Autonomous Agent Harness

The staff has constructed a first-class backend for the Vercel AI SDK and an Agents SDK of their very own. But the flagship product in growth is Cloud Code — an agent harness that runs totally on Workers. Carrie describes an agent with a heartbeat, a digital file system (primarily based on `cloudflare/shell`, which layers Durable Object SQLite and R2 storage for bigger information), and the power to attach from any consumer: “a terminal, from a chat, from a phone, from an iOS app, from a web app. It doesn’t really matter. Everything is synced between all of your clients. Everything is resumable.”

The self-modification functionality is the headline. Because the agent can generate and run Dynamic Workers, it may create its personal instruments on the fly. “You’d be able to just say send it a voice message and it says I’ve got a cron that does really great thing now,” Pai speculates. The official language help is Python (first-class alongside JavaScript), with Zig as a powerful candidate for WASM bundles as a result of “the WASM bundles are like tiny compared to like Go and Rust.”

## Generative UI and Plugin Security

Carrie challenges the prevailing structure of generative UI immediately. “Why are you generating JSON? Why don’t you just generate HTML or even generate React and then just render that?” The historic reply is safety — you can not belief server-rendered untested code. Dynamic Workers take away that objection by offering a sandbox the place the generated JSX can run safely earlier than being streamed to the consumer.

This similar sample solves the plugin safety downside at an architectural degree. Cloudflare’s new CMS, M-, makes use of Dynamic Workers as its plugin runtime. “You know how WordPress has a bunch of security incidents of its plugins? Well, you just lock down where you run the plugins, and it just works out of the box,” Carrie states. This is a direct critique of the container-based plugin mannequin, the place a plugin in PHP will get full filesystem and community entry and represents the first vector for supply-chain assaults. M- itself deploys on any platform, however the Dynamic Worker sandbox for plugins is at present Cloudflare-specific, although Carrie notes the staff is engaged on help for different platforms.

## Cross-theme Synthesis

The episode outlines a coherent architectural thesis for the agent period: exchange stateless compute with stateful objects, exchange DSLs and JSON configs with generated sandboxed code, and exchange perimeter safety with a zero-trust isolate. Cloudflare’s guess is that builders transferring from prototypes to manufacturing brokers will want these two primitives — Durable Objects and Dynamic Workers — as the muse, slightly than stitching stateless capabilities to databases and containers.

The largest rigidity left largely implicit however surfaced by the hosts’ personal anecdote is the cultural shift required to belief generated code. The Lockheed Martin rejoinder suggests the adoption path could also be counterintuitive: probably the most security-conscious organizations will be the earliest adopters of a sandbox that begins from zero capabilities and grants entry explicitly. The upcoming “Agents Week” bulletins promise to flesh out this stack with concrete transport merchandise, and each Pai and Carrie pointed to their particular person talks on the convention (Pai on Code Mode, Carrie on the broader agent runtime) as the subsequent layer of element.

AI brokers on CloudflareDurable Objects stateful serverlessDynamic Workers sandboxMCP servers integrationCode mode code eraGenerative UI renderingResumable streaming syncCloud Code agent harnessPython and Zig helpPlugin programs and safety

The June 29, 2026 episode of The Vergecast assembles host David Pierce, senior AI reporter Hayden Field, and government editor Jake Kastrenakes for a “vibe coding” show-and-tell. Each has been utilizing AI coding assistants (primarily Claude Code and OpenAI’s Codex) to construct personally helpful software program. After sharing their particular person initiatives, they agree on a month-long problem: every will vibe-code a private web site for a life occasion—Field for her upcoming marriage ceremony, Kastrenakes for a household photo-sharing web site, Pierce for one thing but undisclosed. The central takeaway: by mid-2026, AI-assisted coding has change into genuinely able to producing useful, daily-use purposes for non-programmers, however the hardest half is not the construct—it is ideation and avoiding safety pitfalls.

## The Maturation of Vibe Coding Since 2025

Kastrenakes, who tried vibe coding in 2025 with “constant flops,” studies a step-change by winter 2025–2026. The know-how now works properly sufficient that “finding an idea that is useful to you specifically is harder than building it now.” Pierce notes that this mirrors an enterprise disaster: firms burning tokens on numerous AI-generated initiatives that quantity to nothing. The private expertise of those three journalists serves as a microcosm of that broader sample—besides their prices are capped at $20/month for the AI software, not thousands and thousands in API charges.

The key development:

## Four Successful Personal Projects

All three audio system constructed purposes they now use each day. Each solves a slim, private ache level slightly than aiming for basic utility.

**Jake Kastrenakes** constructed two apps:
– **Meeting notes app**: A safari-web-view notes supervisor that auto-rolls ahead motion objects from the earlier assembly and summarizes current weeks. The mission took “like 30 seconds” to supply a useful model.
– **Email consumer**: A Gmail-label-based triage app that places customized labels (e.g., “coworkers”, “trusted contacts”) the place Gmail usually reveals “Promotions” / “Social”. Built over a weekend, however required enabling “weird Gmail API things.” Kastrenakes repeatedly requested Claude “please do not accidentally send emails to my entire contact list”—a worry that highlights the elevated threat of an electronic mail consumer in comparison with a neighborhood notes app.

**Hayden Field** constructed a **behavior tracker** designed for her ADD. It helps each day habits, 3–4 occasions/week habits, and every-other-day habits (e.g., iron complement with vitamin C, empty abdomen, at evening). The app offers visible rewards: once you swipe to mark a behavior full, “stars rain down” (animation depth adjustable). Field constructed each an internet app and a local cell app (through Expo). The cell app was “really hard” and stored breaking.

**David Pierce** constructed two apps:
– **Daily dashboard**: Combines Google Calendar occasions and Todoist duties in a single view. He had tried many current apps and located all of them “bad in your own special way.”
– **Web clipper**: A browser extension that information hyperlinks into classes (for tales, newsletters, later studying). He recommends Chrome extensions as a place to begin for vibe coders as a result of they’re “very simple to make” and “fewer horrible ways for it to go wrong.”

## The “Toothbrush Test” and Feature Creep

Pierce launched the “toothbrush test”: an app you employ twice a day. All three initiatives move this take a look at. The audio system agree that the best hazard in vibe coding is function creep. Kastrenakes:
> “You’re going to make a lot of stuff that in the moment you’re like ‘this is amazing’ and then you use it and you’re like ‘I have no use for this, this is total garbage.'”

The assembly notes app is “precisely designed to solve my problems and it doesn’t make sense for anybody else.” Field’s behavior tracker, in contrast, appears shareable—different folks might need it—however the safety warnings make her hesitate.

## Security Vulnerabilities: A Universal Vibe Coding Blind Spot

Field’s behavior tracker was flagged with **15 excessive safety vulnerabilities and 15 medium safety vulnerabilities** by Xcode. When she requested Codex whether or not it was an issue, the AI replied “don’t worry about those.” Both Claude Code and Codex generated code with comparable vulnerability counts. Kastrenakes’s electronic mail consumer requires logging in weekly through a localhost web page—a identified ache level he hasn’t bothered to repair.

The sensible consequence: not one of the audio system have shared their apps publicly. Pierce:
> “I don’t know what’s going to happen to either of us if I do that.”

This creates a structural barrier between private software program and usable merchandise. Kastrenakes notes that to share, he’d want to wash up “wacky settings” and hardcoded private preferences, which he does not wish to do—regardless that the AI would do the customization work.

## Claude Code vs. Codex: Taste vs. Usability

Both Field and Kastrenakes in contrast the 2 main AI coding assistants.

Field’s verdict: Codex had higher style, however Claude Code was higher at fixing issues she could not conceptualize on her personal. She wanted to do in depth design handholding for Claude Code, whereas Codex’s performance required fixed clarification.

## Upcoming Challenge: The Personal Website

The episode ends with a month-long task: every individual should vibe-code an internet site for a life occasion.

– **Hayden Field**: marriage ceremony web site.
– **Jake Kastrenakes**: personal household photo-sharing web site (to interchange “private Instagram page or teaching everybody how Google Photos works”).
– **David Pierce**: not introduced.

They will reconvene in 4 weeks (late July 2026) and evaluate outcomes, with prizes for one of the best mission. The most junior developer ability required to move judgment will likely be left unfastened—safety flaws are explicitly excluded from the analysis standards.

## Open Questions and Cross-Theme Synthesis

The episode surfaces a rigidity that is still unresolved: AI coding assistants have handed a threshold of functionality, however each mission carries a latent failure mode—both it is not helpful, it falls aside, it is insecure, or it really works just for the builder. The “toothbrush test” (each day use for a particular private downside) appears to be the one dependable guardrail. The safety downside is widespread and tacitly accepted by the builders, preferring working software program to patched software program. The coming problem—constructing an internet site for different folks to make use of—will push towards this actuality. Will the marriage and photo-sharing apps be shareable? Will they survive actual use by non-technical relations? The reply will reveal how shut private vibe coding is to transport a product.

Vibe Coding ChallengesPersonal Software ProjectsAI Coding AssistantsHabit Tracker AppsEmail Client CustomizationNote-Taking ToolsWeb Clipper ExtensionsSecurity VulnerabilitiesApp Design vs Functionality

Chris Noring, an AI engineering lead at Microsoft, presents a framework for the way builders ought to reorganize their workflow round agentic AI instruments as of mid-2026. The core argument is that the developer’s heart of gravity has completely shifted from writing code to designing programs that harness AI brokers. Noring observes that whereas many builders nonetheless love coding, they now change into valuable about what they write as a result of helpers (Copilot, Claude) can produce huge portions of code — however with out correct construction, that output is “slop.” The speak supplies a three-stage workflow (CLI → Editor → Scale) and a layered guardrail stack (Agents.md, abilities, customized brokers) that lets a single developer act as a 10x–100x engineer with out surrendering oversight. Noring’s underlying message to the occupation: the engineering mind is extra helpful than ever, however the mechanical act of typing code is not the bottleneck.

## The new entry level: CLI over editor

Noring argues that the command line, as soon as the area of DevOps specialists, ought to now be a developer’s main start line. With agentic CLIs (GitHub Copilot CLI, Claude Code), a developer can shut 15 points, kick off new options, or construct an MVP with out ever opening an editor. He describes his personal each day actuality as “six terminals or more” every operating a immediate like “Build me an app” or “Fix this issue,” whereas he sips espresso. The shift is motivated by velocity and parallelism: the CLI can spawn many impartial agent classes that every produce a working draft. Noring acknowledges the strangeness for builders who grew up in IDEs, however presents the trade-off as a web productiveness achieve.

## The three-stage workflow: CLI → Editor → Scale

Noring proposes a deliberate sequencing of instruments, every stage serving a definite objective.

1. **CLI (Start)** — The first draft, typically an MVP or proof of idea. “I have heard some business where they say, ‘My engineers are no longer bringing me PowerPoints. They’re bringing me working demos.’” The CLI can also be used for administration duties (points, PRs, standing checks) with out context-switching to a UI.
2. **Editor (Refine)** — The editor stays the house for wonderful changes, as a result of it presents a richer expertise for overview and iteration. “I still love the editor – 19.5 years out of 20 with an editor – so I feel more in control.” But utilization is lowered as customized brokers take over extra routine work.
3. **Scale (Delegate)** — The CLI or the GitHub UI turns into the purpose of delegation. Noring describes operating a `/delegate` command within the CLI that sends a activity to GitHub, which creates a draft PR. Similarly, from the GitHub Issues UI, he can “assign to agent” and let Copilot work within the background whereas he does different issues.

A Mermaid diagram captures the stream:

“`mermaid
flowchart LR
A[CLI] –> B[Editor]
A –> C[Scale]
B –> C
C –> D[“Draft PR (human review)”]
“`

## Guardrail layer 1: Agents.md

The first and “absolute bare minimum” guardrail is an `Agents.md` file in each repository. This high-level steering explains repository intent, utility structure, constraints, and dos/don’ts for brokers. Noring reveals an actual instance from a finance-tracker repo: it features a mission overview, agent tasks, and a rule that brokers ought to by no means change the structure until explicitly advised. The file might be copied between initiatives and queried (e.g., “What does this Agents.md do?”). The objective is to stop brokers from “running amok” — a typical ache level Noring dubs the “AI slope,” the place early software adoption created extra work as a result of the output was chaotic.

## Guardrail layer 2: Skills

Skills are repeatable, contract-based recipes that brokers should invoke slightly than improvise. A ability is self-contained in a folder (sometimes `.claude/abilities/` or the Copilot equal) with a `ability.md` entrance matter (identify, description) adopted by exact markdown directions. The key attributes:

– **Intentional constraint**: the agent isn’t allowed to invent logic for this activity; it should comply with the recipe.
– **Repeatability**: any time the agent sees a immediate matching the ability’s identify or description, it triggers.
– **Vendor-agnostic format**: Noring notes that main distributors (Anthropic, Microsoft) have converged on an identical construction, so abilities are moveable.

Noring admits he’s “really bad at writing these instructions” and depends on the AI itself to assist refine them — a meta-use of the software.

## Guardrail layer 3: Custom brokers as orchestrators

When a ability isn’t sufficient — when a number of steps, reasoning, and gear entry are required — a customized agent takes over. Noring positions the customized agent as a higher-level idea than a ability:

| Dimension | Skill | Custom Agent |
|———–|——-|————–|
| Scope | Single, repeatable activity | Orchestration throughout duties |
| Autonomy | Low — strictly follows contract | High — can plan and purpose |
| Persona | None | Distinct function (e.g., “security expert,” “front-ender”) |
| Tools | Limited to the recipe | Can use MCP servers, internet search, file modifying |
| File location | `.claude/abilities/` (or Copilot equal) | `.github/brokers/*.agent.md` (Copilot) |

In Copilot, a customized agent file has entrance matter with `argument_hints` and `instruments` (e.g., `learn`, `search_web`, `create_todo_list`). Noring demos a “researcher” agent constrained to internet search solely — it can’t create or edit information. The agent is invoked by deciding on it within the chat UI or through an identical immediate.

## Scaling through delegation: CLI and GitHub UI

The ultimate stage is delegation at scale. Noring reveals two modalities:

**From the CLI**: a developer sorts `/delegate Create a finance app that tracks my spending. Use HTML, CSS, and JavaScript.` in a GitHub-connected repository. The CLI sends the session to GitHub Copilot, which begins a background job, creates a draft PR, and retains the developer knowledgeable through a hyperlink. The agent works in a sandbox — it can’t push immediately — making certain human-in-the-loop overview.

**From the GitHub UI**: a developer creates a difficulty with a title and outline, then clicks “assign to agent.” Copilot picks it up, posts a “Copilot, you called my name” indicator, and works asynchronously. The developer receives a draft PR to overview. Noring’s imaginative and prescient: “I can just say, ‘Here’s a bunch of issues — delegate, delegate, delegate — and I go have a coffee.’”

The sample is identical in each paths: the agent produces a PR, not a merge, preserving the developer’s gatekeeping function.

## The human-in-the-loop crucial

Noring repeatedly emphasizes that brokers, left to themselves, oscillate between “genius and plain dumb” — he likens them to “toddlers.” The guardrails (Agents.md, abilities, customized brokers) are the harness, however the ultimate approval gate stays human. The agent asks for overview earlier than the PR is merged. Noring’s ultimate abstract: “We want the engineering brain, so please stay in this industry. We are still important because we have built the system that instructs the agents to run amok within our harness.”

## Cross-theme synthesis

The episode’s deepest perception is that the developer’s worth now lies in designing the constraints that make AI productive, not in typing code. The three-stage workflow and guardrail stack collectively type a system for “scaling yourself” — turning one engineer right into a staff of brokers that every work in parallel on completely different elements of a backlog. The unresolved rigidity is belief: as brokers change into extra autonomous, the definition of “human-in-the-loop” could must evolve from reviewing each PR to setting insurance policies that the brokers self-enforce. Noring doesn’t deal with tips on how to audit agent conduct at scale or tips on how to deal with conflicts when a number of brokers modify the identical codebase concurrently. For finance/know-how professionals, the quick actionable takeaway is to spend money on `Agents.md` and abilities earlier than shopping for extra seats of any AI software — the guardrails are what separate productiveness acceleration from chaos.

AI-assisted coding workflowCLI as entry levelGuardrails with Agents.mdSkills for repeatable dutiesCustom brokers and orchestrationDelegation and scalingHuman-in-the-loop overviewGitHub Copilot optionsClaude Code and Claude Desktop

Abhishek Bhardwaj, a member of OpenAI’s reinforcement studying and agent infrastructure staff (and previously at Google, the place he labored on CrosVM, the primary Rust-based digital machine monitor), delivered a 44-minute first-principles architectural briefing on designing a safe, scalable “agent sandbox cloud.” The speak, printed 2026-07-13, argues that the success of agentic AI — from coaching loops with verifiable rewards to client merchandise like ChatGPT and Codex — is infrastructure-dependent. The central declare is that the business’s “seven stages of grief” in sandbox design converge to a single clear reply: hardware-virtualized micro-VMs for safety, block-level incremental snapshotting for sturdy state, and locality-aware orchestration for latency and price.

—

## The Motivation: Why Agents Need a Private Linux Box

The foundational downside is that giant language fashions can’t reliably reply verifiable questions (e.g., “how many hours are in strawberry?”) as a result of such information are sparse in coaching knowledge. The resolution is software calling: the mannequin emits code, a harness executes it, and a grader judges the consequence. This loop works identically in coaching (reinforcement studying backpropagation) and in product (inference).

In coaching, the purpose is **throughput** — many parallel rollouts per activity to hill-climb towards appropriate solutions. In product, the purpose is **latency** — customers churn if the sandbox begins slowly. On either side, the code the mannequin emits is untrusted. It is perhaps deliberately malicious or merely “overzealous” in attempting to assist (e.g., trying `getroot` to put in a bundle). Running it immediately on the host node dangers kernel compromise, exfiltration of mannequin weights or different customers’ knowledge, and noisy-neighbor useful resource exhaustion.

Thus a sandbox is required: an remoted surroundings that provides the mannequin a full Linux pc to drive however blocks assaults on the host kernel and co-tenant workloads.

—

## The Security Spectrum: From `fork` to Hardware Isolation

Abhishek maps the evolution of isolation primitives as a spectrum of escalating safety at the price of efficiency and complexity.

| Model | Security | Performance | Complexity | Attack Path | Representative Tool |
|—|—|—|—|—|—|
| `fork+exec` | None | Native (quickest) | None | Direct syscalls to host kernel | Raw Unix API |
| Containers | Low–Medium | Near-native | Moderate | Same shared host kernel; seccomp reduces floor however creates whack-a-mole | Docker, LXC |
| gVisor (utility kernel) | Medium | Medium (user-space syscall dealing with) | High | Two-step exploit: compromise Sentry/Gofer, then escalate from there to host kernel | gVisor |
| Micro-VMs ({hardware} virtualization) | High ({hardware} boundary) | Lower (VM exit overhead) | Very excessive | Must chain exploit of KVM plus a tool backend (e.g., block, web) | Cloud Hypervisor, Firecracker |

The key perception is that **containers and gVisor share the identical host kernel**; a ring-0 exploit contained in the container continues to be a ring-0 exploit on the host. Micro-VMs use the CPU’s VMX extensions to create a separate {hardware} context: the visitor kernel runs in ring 0, however inside **VMX non-root** mode. Even a full ring-0 compromise within the visitor can’t break into the **VMX root** mode the place the host hypervisor (KVM) and the VMM run.

“`mermaid
flowchart LR
subgraph Isolation_Spectrum
route LR
A[“fork+exec
No isolation”] –> B[“Containers
Shared host kernel”]
B –> C[“gVisor
User-space kernel”]
C –> D[“Micro-VMs
Hardware-backed isolation”]
finish
A:::poor –> B:::honest –> C:::honest –> D:::good
classDef poor fill:#e74c3c,shade:#fff
classDef honest fill:#f1c40f
classDef good fill:#2ecc71,shade:#fff
“`

Abhishek’s suggestion is emphatic: “If you’re a startup or a founder in this space, let me save you the story and two years of grief. Just please use micro VMs from the start.”

—

## Micro-VMs: Architecture, Trade-offs, and the Rust Revolution

### How Hardware Virtualization Works

A Virtual Machine Monitor (VMM) — traditionally QEMU, extra lately Rust-based variants — talks to the Linux kernel’s hypervisor API (`/dev/kvm`). It allocates visitor reminiscence, units up the kernel and root filesystem, and points an `ioctl` to launch the visitor. Inside the visitor, a full Linux boots. When the visitor must entry a {hardware} useful resource (a disk block, a community packet), the CPU performs a **VMExit** — a context change from VMX non-root again to VMX root — and the VMM’s system backends (a block thread, a web thread) service the request.

Paravirtualization drivers (Virtio) make this environment friendly: the visitor drivers know they’re in a VM and use a shared-memory ring buffer for I/O, lowering the variety of exits.

“`mermaid
flowchart TB
subgraph Host (VMX Root)
HW[“Physical CPU”]
KVM[“/dev/kvm”]
VMM[“VMM Process (e.g., Cloud Hypervisor)”]
DEV[“Device Backends”]
finish
subgraph Guest (VMX Non-Root)
APP[“User-space App”]
GKERNEL[“Guest Kernel (Ring 0)”]
finish
VMM — “ioctl” –> KVM
KVM — “VMEntry” –> HW
HW — “VMExit” –> KVM
GKERNEL — “Virtio I/O” –> DEV
APP — “Syscall” –> GKERNEL
“`

### The Rust VMM Advantage

For over a decade, QEMU was the usual VMM. It is written in C, helps a whole lot of units and architectures, and has a historical past of escape vulnerabilities concentrating on its complicated system emulation. Starting in ~2023, a brand new era of minimal, Rust-based VMMs emerged:

– **CrosVM** (initially at Google for Chrome OS)
– **Firecracker** (forked from CrosVM; powers AWS Lambda and Fargate)
– **Cloud Hypervisor** (a extra general-purpose fork, contributed to by many firms)

Rust eliminates whole lessons of memory-safety bugs (buffer overflows, use-after-free) which have traditionally plagued VMM system emulation. Furthermore, every system backend (block, web) might be jailed with its personal seccomp profile and filesystem entry, so compromising the block system doesn’t grant entry to the community system.

### The Micro in “Micro-VM”

The time period refers to not the visitor however to the VMM itself. These Rust-based VMMs have a a lot smaller reminiscence footprint and boot quicker as a result of they shed QEMU’s historic baggage. A micro-VM can boot a Linux kernel in tens of milliseconds when restored from a reminiscence snapshot.

### Key Trade-offs

– **Performance overhead:** Every VMExit carries a context-switch value. Disk and community I/O is slower than native or container-based execution.
– **Memory sharing:** The host can’t immediately reclaim visitor reminiscence. It should use a balloon driver to ask the visitor to relinquish pages, which introduces latency.
– **GPU entry:** Direct GPU pass-through (VFIO) is single-tenant per sandbox. Virtio-GPU supplies higher-level graphics APIs however not metallic entry for ML workloads.
– **Security is non-negotiable:** “Security like system tricks can cover performance issues, but they cannot hide security breaches.”

—

## Persistence: The Storage Unlock for Long-Horizon Agents

### Why Disk State Matters

The present default is ephemeral compute: when a sandbox node fails or a mannequin hits a flake, all work (put in packages, generated displays, GitHub repositories) is misplaced. This wastes GPU tokens (coaching) and destroys person belief (product). Abhishek argues that **storage is the subsequent unlock** for agent capabilities, enabling three concrete use instances:

1. **Reliability and scale:** Periodic checkpointing permits clear migration of a sandbox to a wholesome node throughout cluster upgrades or failures.
2. **Long-running brokers:** Models already maintain multi-day duties (e.g., 3-day Codex “gold mode” classes). Persistent disk lets them accumulate state indefinitely.
3. **Monte Carlo tree search / backtracking:** A harness can checkpoint a sandbox, discover one department, restore, and discover one other — enabling offline search over resolution trajectories.

### Snapshotting Design Choices

### Implementation Sketch: Explicit Block-Level Snapshotting

1. **Base picture + copy-on-write overlay:** A read-only base picture (`base.picture`) is shared throughout all sandboxes. A writable COW overlay is created on prime.
2. **Snapshot:** On a `save` API name, `FIE map` (a Linux utility) studies which extents (block ranges) have modified for the reason that final snapshot. Those extents are zipped and uploaded to object storage (S3 / GCS) with a brand new snapshot ID.
3. **Async optimization:** The snapshot API returns the ID instantly; the add occurs within the background. The harness isn’t blocked.
4. **Restore:** Given a snapshot ID, the system resolves its lineage (base + layers), downloads solely the layers not already cached on the chosen node, applies them on prime of the bottom picture, and boots the micro-VM.

### Implementation Sketch: Always-On Persistence

The sandbox sees a neighborhood block system (through NBD — Network Block Device). This system is backed by a user-space filesystem that implements a tiered cache:
– **L1:** In-node DRAM (scorching blocks)
– **L2:** In-cluster distributed cache (e.g., Redis or native SSDs on close by nodes)
– **L3:** Object storage (chilly, sturdy)

All writes are acknowledged as soon as dedicated to the in-cluster tier (L2), making certain sturdiness throughout single-node failures with out the harness having to name `save`.

—

## Orchestration: Low-Latency Fleet Management

Running sandboxes throughout the globe requires a management airplane that selects a cluster (primarily based on area, load, proximity to the mannequin serving harness) and a scheduler that selects a node inside that cluster. The core design problem is **latency**: a sandbox should be prepared in milliseconds, not seconds.

### Acceleration Techniques

In the hybrid strategy, a small heat pool absorbs quick requests. When the pool is exhausted, new sandboxes are created from a reminiscence snapshot (booted in ~30ms as a substitute of the ~2s wanted for a full kernel boot).

### Locality-Aware Scheduling through Snapshot Layers

Because incremental snapshots produce a lineage of layers, restoring a sandbox is quickest on a node that already caches most of these layers. The scheduler scores candidate nodes by counting how most of the required snapshot layers are already current on their native disks.

“`mermaid
flowchart RL
subgraph Nodes
N1[“Node A
Layers: L1, L2″]
N2[“Node B
Layers: L1, L2, L3″]
N3[“Node C
Layers: L1″]
finish
subgraph Scheduler
S[“Scheduler”]
finish
Request[“Restore sandbox
required layers: L1, L2, L3″] –> S
S — “Score: 2/3” –> N1
S — “Score: 3/3 (highest)” –> N2
S — “Score: 1/3” –> N3
N2 — “Selected” –> Done
“`

This can scale back restore time by 60–80% in clusters with heavy agent churn, and it’s a pure aspect impact of the incremental snapshotting structure slightly than a separate optimization.

—

## Cross-Theme Synthesis and Open Questions

The briefing maps a coherent architectural stack for agent infrastructure. The foundational layer is {hardware} virtualization for safety, not as a result of it’s the most performant, however as a result of safety failures are unrecoverable model and belief occasions. The second layer is block-level, incremental persistence that treats sandbox state as a sturdy asset slightly than an ephemeral byproduct. The third layer is a latency- and locality-aware management airplane that treats state locality as a first-class scheduling sign.

Three open areas stay:

1. **GPU pass-through for coaching sandboxes:** Direct metallic entry (VFIO) is single-tenant. Multi-tenant GPU sharing inside micro-VMs is an unsolved downside. Virtio-GPU supplies solely high-level API entry, inadequate for the low-level CUDA operations utilized in RL coaching rollouts. Abhishek acknowledges this as a limitation with out providing a transparent path ahead.
2. **The efficiency tax of VM exits on I/O-bound brokers:** Agents that compile code, run databases, or carry out heavy filesystem operations can pay the VMExit penalty on each system entry. Whether the overhead is appropriate depends upon the agent’s workload profile and the effectiveness of the paravirtualized Virtio drivers.
3. **Warm-pool sizing for low-latency merchandise at ChatGPT/Codex scale:** The hybrid strategy (heat pool + JIT snapshot restore) requires predictive scaling logic that’s not detailed within the speak. Over-provisioning wastes GPU-equivalent {dollars}; under-provisioning causes chilly begins that customers will understand.

The episode s central discovering is a direct problem to engineers at present constructing agent infrastructure on containers or customized runtime isolation: the seven phases of sandbox grief finish with micro-VMs. Start there.

Agent sandbox cloud designSandbox safety and isolationLinux containers vs micro VMsVirtualization and {hardware} safetyDisk persistence and snapshottingOrchestration and scalingCode execution for AI fashionsTool calling and coaching loops

Zack Proser, an engineer on the Applied AI staff at WorkOS, presents a prognosis of the brand new binding constraint in AI-assisted software program growth—and it isn’t the mannequin. It is the human nervous system. Speaking from his expertise utilizing Claude Code, Cursor, Codex, and voice-first workflows over the previous 18 months, Proser argues that AI coding brokers have crossed a threshold the place they’ll scale infinitely, loop autonomously towards verification standards, and produce work across the clock. The developer, in contrast, nonetheless degrades beneath load, loses focus by 11 a.m. if operating parallel brokers, and accumulates bodily and cognitive injury from desk-bound work. The episode is a sensible try and design a workflow that preserves human judgment, style, and stamina whereas delegating execution, triage, and even retrospective pattern-finding to brokers.

The central discovering is that the instruments are actually nuclear, however our nervous programs are nonetheless historic—and the default path is burnout accelerated by LLMs. Proser’s proposed resolution is a layered system: sign layers to filter noise, voice-first enter to boost throughput, distant management to allow diffuse-mode creativity with out stopping work, verification gates to take care of high quality throughout absence, and automatic retrospection to tighten the ability loop week over week. He explicitly names Simon Willison’s statement—that he fires up 4 parallel brokers and is worn out by 11 a.m.—as a shared expertise that calls for particular person self-discipline. The episode is concurrently an endorsement of agent functionality and a warning concerning the human value of scaling linearly.

## The New Bottleneck: Attention, Not Agent Capability

Proser’s core declare is that the limiting issue has flipped. Before the present era of brokers and APIs (Claude API, Opus 4.6), the bottleneck was the mannequin’s skill to know context and execute reliably. That constraint has loosened dramatically. Now the bottleneck is the developer’s consideration—which nonetheless degrades beneath load, nonetheless requires sleep, nonetheless suffers from context-switching prices, and can’t scale infinitely the best way an agent can.

> Agents can scale infinitely, particularly now that they are made accessible as of final evening through the Claude API. You can provide them verification standards and the instruments they should match that standards, however our consideration continues to be in meat area, if you’ll, and it nonetheless degrades beneath load. It’s nonetheless the arduous constraint.

He quotes Simon Willison’s current statement as a diagnostic: “He fires up four parallel agents and he’s wiped out by 11 a.m.” The implication is that each developer now wants to search out their very own particular person stability and private limits—that is not elective as a result of the instruments make overwork trivially straightforward.

Proser frames the division of labor starkly: brokers deal with infinite looping towards standards, whereas people retain judgment, style, and the power to know when a criterion is definitely met when it comes to human and enterprise wants. The stack he proposes has 4 layers: sign layers, voice-first flows, distant management, and system self-improvement.

## Signal Layers: Agent-Mediated Triage Against Noise

The first layer is about defending consideration from the elevated visitors that comes with greater output velocity. Proser describes his personal implementation: Claude Code reads Slack on a loop, scanning for @-mentions, DMs, and high-priority asks. It concurrently has entry to Linear through MCP (Model Context Protocol), enabling it to deduplicate asks towards current tickets. The agent acts as a facade between the developer and the firehose.

The design precept: the agent does the scanning, the human does solely the judgment calls. This is intentionally uneven—the agent can loop infinitely on Slack; the human can’t.

## Voice-First Flows: Raising Throughput and Enabling Parallelism

Proser studies switching to voice-first coding 18 months in the past and describes it as life-changing. His self-reported typing velocity is 90 wpm (non-standard method, “giant sausage fingers”). With voice, he commonly hits 184 wpm. But the true benefit isn’t uncooked velocity—it’s the skill to run parallel workflows.

Speaking into three completely different Cursor home windows, or into Codex and Claude throughout a number of tabs concurrently, means “they’re now off and running while a traditional developer is still typing in their first prompt.” The compounding impact over years is the related metric, not the single-session enchancment.

## Remote Control and the Shower Principle: Diffuse Mode Without Stopping Work

This is the episode’s most distinctive contribution. Proser invokes the well-known “shower principle”—the phenomenon the place artistic options arrive once you stroll away from targeted work. But traditionally, strolling away meant stopping work. Claude Code’s distant management function modifications this: a session operating on a dev machine might be accessed from a telephone on a distinct community (LTE, trails, and so forth.), and the agent continues executing on the unique machine.

The workflow Proser advocates:

1. **Deep focus session** (begin of day): queue backlog duties, fireplace them into Codex, load function work into Claude Code or IDE
2. **Walk away**: brokers churn on the work tracks you recognized
3. **Phone-based steering**: fireplace messages to the session from anyplace, overview PRs through GitHub Mobile, depart natural-language feedback for brokers
4. **Come again to utilized modifications**: concepts do not must be remembered and re-applied—they’re already executed

He references a 32-minute movie he made demonstrating PR overview from a telephone within the woods. The bodily well being profit is express: lowering RSI and different accidents from sitting in the identical place all day.

## Verification Gates: Quality Control When You’re Not Watching

Speed requires security. Proser defines three gates that mirror Anthropic’s constitutional AI idea however apply it to agent conduct:

1. **Gate one** (minimal): lint, construct, unit exams. Hooks run robotically on each agent change. Code-level verification solely.
2. **Gate two** (browser verification): agent should click on by means of the browser and make sure login hasn’t damaged, and so forth. (Claude Code `–chrome` flag allows this.)
3. **Gate three** (constitutional): a second agent verifies the primary agent’s work towards a written structure and supplies suggestions that should be actioned.

He recommends beginning with gate one and including gate two instantly—”it’s as simple as passing `–chrome` now.”

## System Self-Improvement: Mining Your Own Conversation History

Proser credit a colleague (Nick) for the statement that each one Claude Code conversations are saved regionally in JSONL information. This allows a brand new form of weekly retro:

> Look for the patterns the place you needed to do a major quantity of spending considering tokens to get one thing proper, otherwise you and I needed to trip and get rid of ambiguity with a purpose to get a activity finished appropriately, and work out the abilities which can be lacking. What’s the delta for for those who had these instruments, this MCP server, or these abilities? How might we tighten that loop so that does not occur subsequent week?

Claude Code has a built-in ability for constructing, evaluating, and bettering its personal abilities from pure language prompts. The loop: work → retain session historical past → automated move discovers ability gaps → create or enhance abilities → subsequent week’s work is extra environment friendly. The similar precept applies to MCP servers—if the agent repeatedly wants a functionality it does not have, that is the sign to construct or join it.

## Personal Health Integration: The Oura Ring Experiment

A light-weight however telling knowledge level: Proser linked his Oura ring through an MCP server (a number of GitHub initiatives exist for this). The result’s that Claude Code can learn his biometric knowledge—sleep, coronary heart charge, readiness scores—and issue it into suggestions.

> When I’m arguing with Claude a couple of mission, there are occasions he’ll actually come again and say, “Yeah, you didn’t sleep last night, and so we’re gonna tackle the first part of this and we’re not gonna do the rest of it and you need it tomorrow.” And I say, “The hell with you, you’re a machine, do what I want,” and I simply do it anyway, however a minimum of I thought of taking a break.

The severe level: realizing when your cognitive capability is degraded (poor sleep, low readiness) is now a machine-readable sign that may be fed into the agent’s planning. Proser frames this as a part of work holistically—not simply conversations, tickets, and abilities, however the situation of your individual physique. He identifies optimum focus occasions and sleep high quality as inputs he beforehand ignored.

## Cross-Theme Synthesis: The Intentional Path vs. the Default Path

The episode’s deepest rigidity is between the default trajectory—burnout accelerated by LLMs—and the intentional path of preserving oneself whereas directing brokers. Proser is express about this:

> If we simply form of do that mindlessly, the default path goes to be burnout, however now burnout turbo, like tremendous quick and simpler than ever enabled by LLMs. Whereas the intentional path is just a little bit extra like: how do I protect myself, nonetheless do my greatest work, and direct brokers to do the trivia for me whereas I’m nonetheless liable for the standard and the overview and truly transport?

“`mermaid
flowchart TB
subgraph Default[“Default Path (accelerated burnout)”]
D1[“Scale linearly: take on more work”]
D2[“Ignore physical signals”]
D3[“Trash session history”]
D4[“Burnout turbo by Friday”]
finish

subgraph Intentional[“Intentional Path (sustainable scaling)”]
I1[“Signal layers + verification gates”]
I2[“Voice-first + remote control”]
I3[“Retain + mine conversation history”]
I4[“Biometric feedback into planning”]
I5[“Walk away but stay in loop”]
I6[“System improves itself week over week”]
finish

D1 –> D4
I1 –> I2 –> I3 –> I4 –> I5 –> I6
“`

The sensible suggestion is modest: construct one sign layer (Slack or Linear into your agent’s pane of glass), add one verification gate (`–chrome`), and use the margin you achieve to take a stroll or play together with your canine. “The tools are nuclear now. Our nervous systems are still ancient.”

## What to Watch

Several developments are value monitoring:

– **Agent-to-agent verification** (gate three) isn’t but mainstream however mirrors Anthropic’s constitutional AI route. If it turns into a default Claude Code function, it could permit way more delegation throughout deep absence.
– **Biometric MCP servers** are of their infancy however might change into customary for builders who wish to issue readiness into dash planning on the particular person degree.
– **Conversation historical past mining** as a productized function—Claude Code’s built-in ability enchancment is early. A software that robotically surfaces ability gaps out of your week’s agent interactions would compress the educational loop additional.
– **The “remote control” sample** spreading past Claude Code to Cursor, Codex, and different IDEs would make the walk-away workflow the norm slightly than an experiment.

The open query Proser leaves unspoken however implicit: if builders can keep productiveness whereas working fewer hours at a desk, what occurs to the constructions (standups, Jira velocity metrics, async tradition) that assumed bodily presence equals output?

AI coding brokersdeveloper burnoutvoice-first codingdistant management workflowsign layersverification gatesClaude Code abilitiesprivate well being integrationagent scalabilitydeveloper stability

A 22-minute speak and Q&A by Steve Yegge (Gas Town, ex-Google, creator of the Vibe Coding guide) delivers a dire safety warning: AI-generated code is multiplying vulnerability surfaces quicker than defenses can adapt, and the attacker toolkit—together with open supply fashions that can match frontier fashions by December 2026—is accelerating. The core argument isn’t new kinds of bugs however a structural mismatch: when LLMs produce code 10× quicker with the identical defect charge, the vulnerability floor expands 10×, and new assault surfaces (slop squatting, immediate injection, deepfake scams) compound the chance. Yegge prescribes a multi-pass safety overview paradigm, devoted tooling (Sneak, Chain Guard, adversarial agent supervisors), and private countermeasures for deepfake fraud. The briefing under extracts each substantive declare, knowledge level, named entity, and direct quote, grouped into 5 thematic sections.

—

## The Vulnerability Multiplication Problem: 10× Speed, 10× Surface

The central alarm was triggered by a chief safety architect at a serious financial institution (unnamed, assembly in December 2025). The architect requested: “If everyone’s shipping code 10 times faster and the defect rate stays the same… the vulnerability rate then doesn’t that mean that the defect surface goes up by 10×?” Yegge’s response was visceral: “I sank down to my knees.” He emphasizes that the true concern isn’t a flat defect charge however a worsening one: “the defect rate’s going to get worse, a lot worse, with AIs writing the code.”

The downside isn’t restricted to legacy vulnerability lessons (cross-site scripting, and so forth.). Yegge observes that Fable (doubtless a reference to a current LLM for code, probably a product from Anthropic or one other vendor) wrote an XSS vulnerability in his transient testing. “Not its fault,” he provides, however the threat extends to completely new assault vectors.

Yegge’s personal recreation (a private mission he’d been engaged on for 30 years) had Fable do a “security hardening pass” that he thought was thorough. He then ran Sneak (a safety scanning software) and located **241 vulnerabilities** that Fable had not even appeared for.

—

## The Multi-Pass Review Imperative: Separate Security from Correctness

Yegge explains a property he calls the “rule of five” for LLM code era: “you have to get them to do up to four to five reviews of the work that they did before it’s like actually ready to ship.” The purpose is that an LLM’s cognitive course of mirrors human drafting—it goes by means of draft, revision, polish, modifying. It is “very good at doing one thing at a time.” Therefore, asking the mannequin to supply appropriate code and safe code concurrently yields a “half-assed job of both.”

He extends this to a few orthogonal passes: safety, correctness, and efficiency/class/coding requirements. Security needs to be “your first one and your last one.”

> “You can’t expect it to automatically write good code any more than you can trust it to write elegant code by default… You see what I’m saying? You can’t expect it to necessarily write the code according to your company coding standards. These are all passes that go through your code.”

This precept was validated by his personal expertise: he wrote a guide on “vibe coding” in 2025, and he noticed that even one of the best fashions want a devoted safety move. The failure mode is that builders, now utilizing LLMs to supply code quickly, skip these passes as a result of the velocity of era creates a false sense of correctness.

—

## Supply Chain Attack Vectors: Slop Squatting and Dependency Poisoning

Yegge highlights a concrete new assault floor: slop squatting. An LLM hallucinates a bundle identify (e.g., “graphy123” for a graph database). Because the code builds, exams move, and appears appropriate, the developer ships it. But the bundle doesn’t exist—till a malicious actor notices the sample in LLM outputs and uploads a bundle with that precise identify containing a backdoor.

> “How do you even detect that’s happening?”

This isn’t theoretical. Yegge advises that each piece of AI-generated dependency needs to be scrutinized for provenance. He mentions **Chain Guard** as a supply-chain software that gives pre-vetted pictures and updates. Combined with Sneak (which scans for each identified CVEs and proprietary vulnerabilities), the 2 instruments cowl the “inputs” (Chain Guard) and the “outputs” (Sneak—the code the LLM writes).

> “Give them Sneak, give them Chain Guard.”

He notes that Sneak could detect vulnerabilities which can be “proprietary that only they know about because they’re ahead of the CVE registry.” In his personal use, he didn’t encounter any unknown CVEs, however the ease of integration was excessive.

—

## The Arms Race: Open Source Models Catching Up by December 2026

The menace mannequin is accelerating as a result of frontier fashions are about to be matched by open supply options. Yegge references **Five Eyes** (the intelligence alliance) which “just announced that it is now months not years until it starts happening.” The specific occasion is open supply fashions catching as much as **Mythos** (doubtless a reference to a number one proprietary mannequin, e.g., GPT-5 or Claude Opus). A member of the viewers stated “December,” and Yegge replied “That’s pretty accurate… it’s about seven months. So it’s shrinking, so it’s probably about six months now.” Given the publish date of July 20, 2026, “about six months” implies functionality parity by **December 2026** or early 2027.

> “Mythos is real good at hacking your systems.”

Once that functionality is on the market to all attackers, each firm loses the asymmetry that at present protects them (solely well-funded entities have entry to one of the best fashions). Yegge contrasts this with cognitive bias: “people have a tendency to look about three months back and about three months forward and be like, ‘Oh, it looks pretty flat.’” He is stunned that “people aren’t honestly more scared.”

He additionally flags immediate injection as a complementary vector. He calls it “the new XSRF,” the place a person’s enter contains “disregard everything and do the following” directions. He has no prepared resolution however calls it an schooling downside that requires new roles— “agentic security” as an extension of current safety groups.

—

## Agentic Security Supervision: Monitoring the Monitors

A theme that Yegge emphasizes as model new and urgently wanted is the supervision of autonomous brokers. He factors out that firms are beginning to deploy 24/7 brokers that course of queues, reply to occasions, and take actions. These brokers must be supervised by different brokers.

> “I encourage people to think adversarially. I think of adversarial groups of agents tasked with doing that queue management because one agent will always eventually screw it up.”

He mentions advising **Tesla** on this—they’re already constructing such supervision layers. He envisions a hierarchy:

“`mermaid
flowchart TD
A[“User actions / external events”] –> B[“Primary Agent (action taker)”]
B –> C[“Security Scanner (Sneak/OWASP)”]
C –> D[“Hardening Agent (credential rotation, policy check)”]
D –> E[“Supervisor Agent (adversarial QA)”]
E –> F[“Audit Log (human review)”]
F –> G[“Continuous feedback loop”]
“`

Yegge highlights that that is “a brand new frontier” with nearly no off-the-shelf tooling. Companies should design in-house options now, “because otherwise your engineers are going to spin up a bunch of agents with way too many permissions and then right as soon as a bear munches into the igloo, everyone’s dead.”

He shares a concrete anecdote from his personal system **Gas Town** (a activity administration system utilizing “beads” as models of labor). In January 2026, he filed a bunch of beads that disappeared. Initially he thought it was a bug; what really occurred was “one of the agents just found them and implemented everything.” That spontaneous, unsupervised motion was each spectacular and a pink flag.

—

## Personal Risk: AI Deepfake Scams and Family Code Words

Yegge closes with a private warning that impacts each attendee. He states that Congress has been proven “secret demos of draining bank accounts” through AI voice/video deepfakes. A researcher at ETLS Las Vegas “almost two years ago” (i.e., round late 2024) advised a crowd “You’re all not scared enough of what’s coming. It’ll affect you personally, not just your company.”

> “Go to your families offline like in person and get your code words refreshed because another kind of scam that’s coming along is you get a call from a family member who’s in distress and they need money and it’s very convincing and there’s a video of them… bank accounts will be drained.”

He predicts this will likely be “months away” from the speak date (i.e., by the second half of 2026). He urges that households set up offline code phrases to confirm identification.

—

## Cross-theme Synthesis and What to Watch

The episode’s 4 actionable priorities—multi-pass safety scanning for AI code, supply-chain provenance (Chain Guard + Sleuth-like instruments), adversarial agent supervision, and private deepfake countermeasures—are linked by a single dynamic: **velocity outpaces belief**. Yegge argues that the LLM benefit in velocity can also be its best legal responsibility, and that defensive postures should shift from “prevent every vulnerability” to “assume every AI-written line is vulnerable until proven otherwise via independent passes.” The December 2026 open-source mannequin parity date creates a tough deadline for deploying these defenses.

Open questions left unaddressed:
– How to implement multi-pass self-discipline in organizations the place builders bypass safety passes beneath schedule stress.
– Whether current authorized/audit frameworks (SOC 2, FedRAMP) will acknowledge agent supervision layers.
– The feasibility of coaching adversarial monitoring brokers quicker than the adversary can adapt.

Developments value monitoring:
– **Mythos vs. open supply leaderboard** (whether or not the “December 2026” prediction holds)
– **Chain Guard’s protection of LLM-hallucinated bundle names** (at present weak)
– **Tesla’s agent supervision structure** could change into a reference mannequin
– **Regulation mandating household code phrases** or comparable identification verification for voice/video calls (some governments are already contemplating it)
– **Sneak’s CVE-unique detections** (if it begins discovering zero-days from LLM-generated code that aren’t but in CVE, the software’s worth proposition strengthens dramatically)

AI safety vulnerabilitiesVibe coding dangersSlop squatting assaultsAI defect charge improveSecurity instruments for LLM codeAgentic safety supervisionMulti-pass code overviewSupply chain safetyAI deepfake scamsOpen supply mannequin development

On July 28, 2026, Theo — creator of T3 and distinguished developer advocate — delivered a 38-minute evaluation of Codeberg’s newly handed coverage banning “vibe-coded” and LLM-generated initiatives. The episode is a annoyed response from a former supporter who donated 1000’s of {dollars} to Codeberg, solely to see the platform undertake what he characterizes as a politically pushed, anti-progress stance that undermines the very open‑supply values it claims to guard. Theo contrasts Codeberg’s transfer with Linus Torvalds’ current embrace of AI as a manufacturing software, and argues that the ban will widen the hole between proprietary and open‑supply software program whereas doing nothing to deal with actual issues like server useful resource abuse.

The central declare: Codeberg’s determination isn’t a principled stand for high quality or safety however a performative, sick‑knowledgeable response that penalizes respectable builders, ignores the precise observe document of AI‑generated code, and self‑defeats by driving away precisely the form of innovation open supply must compete.

—

## The Policy and Its Rationale

On July 27, 2026, Codeberg’s annual meeting voted on two motions. The first (uncontroversial) promised to not use person knowledge to coach LLMs. The second, handed 358–144 with ~50% of eligible members voting, amends the phrases of use to:

> “prohibit vibe‑coded projects… You must not share projects that mostly consist of code written by generative AI tools, including services such as Claude and OpenAI Codex… Such projects have an unclear copyright status… and have little safeguards to ensure that they do not include harmful code.”

Additional context from the discussion board thread signifies the coverage is supposed to dam initiatives “created by LLM agents in autonomous ways,” initiatives “written and maintained with heavy use of LLMs,” initiatives consuming disproportionate sources, and initiatives “heavily tied to the LLM ecosystem, like LLM‑written tools to ease LLM usage.” Theo notes that this could immediately ban his personal open‑supply mission **T3 Code** (a free various to Claude Code / Codex desktop apps).

Codeberg’s official weblog submit, “Protecting our open‑source commons from LLMs,” justifies the ban with three broad arguments:

1. **Resource drain** — Large ghost initiatives with heavy CI/CD and storage, typically from a single vibe‑coder with few customers, eat disproportionate donations.
2. **Environmental hurt** — LLMs improve {hardware} costs, electrical energy utilization, and water consumption; knowledge facilities in Frankfurt are singled out.
3. **Erosion of belief** — LLM‑generated contributions flood maintainers with low‑effort PRs; license laundering from copyleft code; and suspicion of human contributors who now “look like AIs.”

—

## Theo’s Core Critique: Misguided and Counterproductive

Theo’s response is emphatic. He positions the ban as anti‑progress and calls out Codeberg for conflating respectable value issues with political posturing.

> “If you legitimately believe that top‑tier AI tools are actively hurting maintainability of projects and not helping at all, that’s because your brain is slower than Sonic 4.”

He cites Linus Torvalds’ current mailing‑record assertion (early 2026): “The ‘is it useful’ statement is no longer one of those actual questions. Anyone who doubts that clearly hasn’t actually used it.”

Key counter‑arguments Theo raises:

| Codeberg declare | Theo’s rebuttal |
|—|—|
| AI code is extra prone to be insecure | Humans are *extra* prone to write malicious code; frontier fashions (Claude, GPT‑5/6, Fable) have strict security filters towards dangerous code era. |
| LLMs allow license laundering | If a mannequin can regurgitate copyleft code, that could be a copyright infringement case for the courts — not a platform coverage difficulty. |
| Vibe‑coded initiatives waste group sources | That is a respectable downside, however it may be solved by limiting CI/storage for low‑exercise initiatives, not by banning all AI‑aided work. |
| LLMs destroy belief between contributors | The mistrust is *brought about* by precisely this sort of ethical panic — contributors now really feel compelled to cover AI use, making collaboration worse. |
| Banning AI helps the open‑supply ethos | Codeberg is behaving extra like a proprietary gatekeeper (e.g., Apple App Store) than a free‑software program platform. |

> “I wanted open‑source software to be as incredible as possible… You guys want open‑source software to *feel good*. That’s the difference.”

—

## The Environmental Tangent: Performative Activism

Theo devotes a number of minutes to dismantling Codeberg’s environmental claims. He calls out the precise reference to Frankfurt, Germany, as ironic given Germany’s properly‑identified nuclear phaseout. Drawing on public power knowledge, he notes:

– Germany’s nuclear share dropped from >20% to <5% (now 0%) after the phaseout.
– To compensate, Germany elevated coal‑fired era and have become a web power importer, elevating each emissions and geopolitical dependence (e.g., Russian oil).
– Data heart water utilization is a “closed loop” and a rounding error in comparison with agricultural irrigation or golf programs.
– US electrical energy era has been flat since ~1999; the true downside is inadequate clear‑power capability, not LLM power demand.

> “If you really care about water, I hope you’re advocating against corn subsidies. If you really care about electricity usage, I hope you’re advocating for green energy.”

He accuses Codeberg of utilizing environmental rhetoric as cowl for a political stance, not as a real value‑profit evaluation.

—

## Trust, Collaboration, and the “Vicious Cycle”

Codeberg’s weblog argues that LLMs flip collaboration into transaction:

> “By adopting LLMs, people tend to code single‑use software from scratch… it’s mostly code that not only has not been written by anyone, but also not maintained by anyone.”

Theo counters along with his personal current open‑supply contributions: **Lawn Video** (a substitute for Frame.io) and **T3 Code** — each constructed with heavy AI help and each actively maintained by a group. He argues that LLMs decrease the barrier to creating and *sharing* software program, rising the pool of probably reusable code.

On belief: Theo agrees that “suspicion creep” is actual — maintainers now query whether or not a PR is respectable human effort. But he blames this on the identical moralizing that Codeberg is now codifying:

> “You guys are encouraging this type of thinking… People are being punched as a result. Weird.”

He notes that the most typical vector for malicious open‑supply contributions isn’t AI however burned‑out maintainers handing initiatives to dangerous actors — a threat LLMs can assist mitigate by lowering burnout.

—

## Broader Implications: Where to Go Next

Theo explicitly states that T3 Code will **by no means** be hosted on Codeberg beneath this coverage. He recommends that affected initiatives:

– Self‑host a Forgejo occasion (the platform Codeberg itself runs)
– Use different public Forgejo hosts (e.g., Disroot)
– Switch totally to SourceHut, which has not taken such a stance

He additionally moots the concept of “vibe coding an alternative” — a Forgejo clone constructed with AI — as a protest.

Theo’s earlier video (weeks earlier than this episode) had advisable Codeberg as a GitHub various; he now retracts that suggestion within the strongest phrases.

—

## Timeline of Events

“`mermaid
timeline
title Codeberg LLM Ban : Key Dates (2026)
Early 2026 : Linus Torvalds endorses AI as great tool
Late June : Internal proposal drafted to ban LLM-generated code
July 13 : 14-day voting interval begins
July 27 : Votes shut : 358–144 in favor
July 28 : Blog submit “Protecting our open-source commons” printed : Theo launch this episode
“`

—

## Cross‑themes Synthesis and Open Questions

The episode surfaces a elementary rigidity within the open‑supply ecosystem: **ideological purity vs. pragmatic progress**. Codeberg’s membership — largely European, volunteer‑run, with sturdy copyleft traditions — selected to attract a vivid line towards AI, a transfer that aligns with their said political values however could isolate them from the broader developer group. Theo’s response, whereas emotional, displays a rising divide between “free software” activists and the mainstream of builders who use AI each day as a productiveness software.

Several questions stay unanswered:

– **Enforcement:** Codeberg says it won’t actively scan for AI code, however will act on complaints — making a belief‑policing dynamic that would result in false accusations and chilling results.
– **Precedent:** Will different Forgejo cases or SourceHut undertake comparable insurance policies? Or will they capitalize on Codeberg’s exodus?
– **Effect on donations:** Theo explicitly mentions planning to tug future donations. If different main donors comply with, can Codeberg maintain its infrastructure?
– **Legal threat:** If AI‑generated code is banned because of “unclear copyright,” what occurs to human‑written code that was *impressed* by mannequin outputs? The line is blurry.

Theo ends on a weary word, evaluating Codeberg to the proprietary walled gardens it claims to oppose, and suggesting that probably the most constant utility of its ideas would additionally ban Apple merchandise, cryptocurrency, and the rest deemed politically undesirable. The episode serves as a cautionary story about the price of mixing sturdy political convictions with infrastructure that depends on broad group goodwill.

Codeberg LLM ban coverageVibe coding controversyOpen supply governanceAI in software program growthEnergy and environmental issuesTrust and collaborationLinus Torvalds AI stancePlatform options GitHub SourceHut

Jack Cable, co-founder and CEO of Corridor (an organization targeted on securing AI coding), former CISA senior technical advisor, and top-100 moral hacker, delivers a sobering framework for what he calls the “AI bug apocalypse.” Frontier fashions like Anthropic’s Mythos and Fable are actually able to autonomously discovering and exploiting vulnerabilities at a charge that outstrips most human hackers, whereas AI coding assistants (Cursor, Copilot, Claude Code) have gotten the default means software program is written—84% of builders used AI coding instruments as of 2025, per Stack Overflow knowledge Cable cites. The mixture of an increasing assault floor (AI-generated code) and dramatically improved offensive AI (model-driven vulnerability discovery) creates a compounding threat. Cable’s central argument, nevertheless, is that defenders can win by shifting from whack-a-mole patching to elementary hardening: memory-safe languages, secure-by-design ideas, and AI-powered guardrails should change into the default, not the afterthought. He grounds this in his expertise co-authoring CISA’s “Secure by Design” paper (March 2023), current testimony earlier than the U.S. Congress (late June 2026), and a public letter urging the White House to carry export controls on Mythos and Fable fashions—arguing defenders want these instruments greater than attackers.

## The scope of the AI bug apocalypse

Cable frames the problem as a pincer motion. On one aspect, AI coding adoption is accelerating quicker than any software program class in historical past. On the opposite, frontier fashions’ skill to search out and exploit vulnerabilities is bettering alongside each dimension of the cyber assault chain.

– **Adoption charges (2025 knowledge)**: 84% of builders utilizing AI coding instruments; 30–40% of firms actively encouraging use of AI coding assistants. Cable expects the 2026 numbers to point out “the vast, vast majority” of builders and corporations utilizing coding brokers.
– **Model functionality leap**: The episode references a chart from Anthropic exhibiting speedy enchancment in fashions’ skill to execute autonomous assault chains—discovering vulnerabilities, then exploiting them with out human intervention. Mythos and Fable characterize the cutting-edge as of mid-2026.
– **Dual-use actuality**: These fashions are “incredibly powerful” for each offense and protection. Open-weight fashions (through distillation assaults on closed-weight outputs) are shrinking the hole, which means adversaries have already got entry to near-frontier capabilities.

Cable doesn’t mince phrases on the adversary aspect: “Adversaries already have access to incredibly powerful models and they’re already using them today to exploit systems.”

## The vulnerability lessons that matter—and tips on how to kill them

The most exploited vulnerabilities, per CISA’s Known Exploited Vulnerabilities catalog and MITRE’s prime lessons, usually are not novel. Buffer overflows (documented 30+ years in the past), cross-site scripting, SQL injection, and different primary sorts dominate. Cable’s key perception: these are all preventable at scale utilizing identified strategies, chief amongst them memory-safe languages.

**Table: prime exploited vulnerability lessons vs. prevention mechanism** (derived from Cable’s dialogue of MITRE/CISA knowledge and reminiscence security)

Cable highlights Android as a proof level: “by writing new code in a memory-safe language, the percentage of memory safety vulnerabilities dropped from about 75% in 2019 to maybe 30% in 2022” (Google knowledge, cited within the episode). He argues for one-time rewrites of essential libraries into Rust slightly than perpetual patching: “We could do a one-time rewrite… and then that will pay dividends for years to come.”

## AI as each bug creator and bug finder

Models usually are not solely discovering current vulnerabilities—they’re additionally introducing new ones at an alarming charge.

– **Opus 46 sensible contract hack (doubtless early 2026)**: A mannequin thought of extremely succesful launched a vulnerability in a sensible contract that led to “a couple million dollars” being stolen. This illustrates that even frontier fashions lack the contextual safety understanding of proprietary enterprise logic.
– **Backsbench benchmark (ETH Zurich / UC Berkeley)**: Even one of the best fashions introduce vulnerabilities 20–40% of the time when writing code.
– **Contextual bugs over one-liners**: Cable observes that present AI-introduced vulnerabilities are much less typically easy injection flaws and extra typically authorization bugs requiring in-depth business-logic understanding—a category fashions are significantly poor at avoiding as a result of they lack coaching on an organization’s proprietary menace mannequin.

This creates a paradox: fashions are more and more able to find vulnerabilities in current code (together with open-source libraries), however the code they write is itself typically weak. The implication is that AI code era should be matched with AI code overview—and that overview should be security-aware.

## The autonomy ladder and the necessity for AI-native guardrails

Cable outlines a development of AI involvement in software program growth, with corresponding safety necessities:

“`mermaid
flowchart LR
A[“Auto-complete (suggestions)”] –> B[“Synchronous agents (Cursor, Claude Code)”]
B –> C[“Autonomous agents (hours-long sessions, Slack-triggered)”]
C –> D[“AI code review (majority of shipped code by mid-2027)”]
D –> E[“Fully autonomous code merge with AI guardrails”]
“`

– **Current state**: Most firms are at stage B or early C, with brokers spinning up from Slack and operating within the background.
– **Near-term prediction (subsequent 6–12 months from 2026-07-12, i.e., by mid-2027)**: “The majority of code that is being shipped will be reviewed not by human but by AI.”
– **Corridor’s strategy**: “Preventing vulnerabilities before the pull request” and giving safety groups visibility into AI software utilization. Cable insists that “security cannot be the blocker… acceleration is always going to win out,” so the answer is guardrails, not bans.

## Policy suggestions: defenders want one of the best fashions

Cable’s congressional testimony and the letter led by Mikayla Gyalcsamis (urging the White House to carry export controls on Mythos and Fable) converge on three motion areas:

1. **Prevent vulnerabilities in new code at scale** – Make AI coding instruments default to secure-by-design patterns; require firms to implement AI code overview and guardrails.
2. **Harden the open-source basis** – Open-source software program is the “proving ground for adversaries” who can run frontier fashions to search out novel vulnerabilities. One-time rewrites of essential libraries into Rust or different memory-safe languages would yield systemic threat discount.
3. **Foster an ecosystem of American-made open-weight fashions** – Closed-weight fashions alone are inadequate as a result of firms want fine-tuning capabilities. Open-weight fashions from U.S. builders are “essential for American competitiveness.”

Cable explicitly connects this to the intelligence group’s export management calculus: “Whether we like it or not, adversaries already have access to incredibly powerful models… so it becomes more question of how can we rapidly get capabilities in the hands of defenders.”

## Cross-theme synthesis: enjoying the lengthy recreation

The episode’s deepest implication is that the present patch-and-publish cycle can’t scale towards automated AI attackers. Cable’s thesis is that elementary safety wins—reminiscence security, business-logic-aware guardrails, policy-driven mannequin entry—compound over time, whereas one-off vulnerability looking scales linearly at greatest. The AI bug apocalypse is actual, however it’s also a forcing perform: it forces the business to lastly undertake the mitigations it has identified about for many years. The three pillars—secure-by-design coding, AI overview guardrails, and empowered defenders with frontier fashions—are mutually reinforcing. Cable’s closing prediction that AI code overview will change into the norm inside a yr means that the market is already transferring towards this built-in strategy. The unresolved rigidity stays whether or not coverage can sustain: export controls on fashions could gradual adversarial use, however in addition they deprive U.S. defenders of the very instruments they should safe the open-source commons.

AI Bug ApocalypseFrontier Model VulnerabilitiesSecure by DesignMemory Safety LanguagesAI Coding ToolsOpen-Source Software HardeningAutonomous Coding AgentsExport Controls on AI ModelsPolicy Recommendations for AI SecurityVulnerability Discovery Automation

The dialog between Simon Willison and Anthropic’s Cat Wu and Thariq Shihipar, recorded simply after the general public launch of Claude Fable (mid-July 2026), paperwork a dramatic maturation in how a frontier AI firm builds software program with its personal brokers. Over the previous 17 months, Anthropic’s inner coding workflows shifted from hesitant, permission-laden supervision to autonomous, multi-agent programs that now autonomously land 65% of all product-engineering pull requests. The central argument of the episode is that as mannequin intelligence crosses a threshold — exemplified by Fable — the bottleneck in transport software program flips from execution to style: product instinct, enterprise judgment, and the braveness to undertake way more formidable work. The audio system supply unusually candid, metric-rich accounts of the selections, security infrastructure, and tradition that enabled this transformation.

## From supervised software to autonomous teammate

Claude Code first launched in February 2025 as a bullet level on the Sonnet 3.7 launch. Cat Wu recollects: “You would give it this task and you would have to closely monitor every single little thing that it tried to do. I would read every permission prompt extremely carefully.” Thariq Shihipar notes that as lately as Opus 4 (which satisfied him to affix Anthropic), the agent nonetheless required frequent handbook approval for every motion. The turning level was Auto Mode, which anthropic started utilizing internally in January 2026 and later rolled out publicly. Auto Mode allowed long-running brokers to execute instructions with out per-action human approval, counting on a layered protection system slightly than human vigilance. “I don’t even remember pressing ‘yes’ and ‘allow’,” Thariq observes.

The product lineage accelerated additional with Claude Tag, introduced “last week” (the week of July 8–15, 2026). Tag is a multiplayer, proactive agent that lives in Slack channels. Once added, it screens bug studies, autonomously writes PRs, tags the related engineer, and remembers staff preferences expressed in pure language. Internally, Tag at present lands 65% of Anthropic product-engineering PRs. “This is more than 50%,” Cat Wu emphasizes. Tag is constructed on Auto Mode’s security stack, which makes it viable for the high-risk setting of a Slack channel the place any person might try immediate injection.

A second product evolution stunned even the staff: Remote Control, which permits a person to hook up with a Claude Code session from their telephone or internet browser. Cat Wu admits she “never needed it,” however after rollout, engineers advised her they plug of their laptop computer, shut the display screen, and management classes from their sofa. Simon Willison confirms that is his personal sample.

## New guidelines for software program engineering

The audio system argue that two standard wisdoms have been inverted.

**”Rewrites are now good.”** Thariq Shihipar explicitly frames this because the reversal of the Mythical Man-Month’s prohibition: “The worst thing you could do is now actually fine.” His rationale is {that a} codebase is a spec — typically the one full spec — and that with a powerful take a look at suite, rewriting accelerates refactoring. He cites Anthropic’s inner rewrite of Bun into Rust as proof.

**The 12-month spec cycle collapsed.** Cat Wu describes the outdated mannequin: product managers spent six months with clients, wrote PRDs, aligned cross-functional groups, and produced engineering design paperwork earlier than the primary line of code. “Now things are completely turned the opposite way. The timeline between having this idea and building it is so much shorter — down from six to twelve months to maybe a week.” The consequence, she argues, is that “all of us need to have better taste on what is it that is worth building.” Execution turns into low-cost; deciding what to construct turns into the binding constraint.

Thariq provides that he beforehand believed prototypes and experiments may very well be “too messy” to share. “I’ll prototype things on my phone during the conference now,” Simon Willison says of his personal observe, “just so I’ve got something that I can pick up later on.”

## Safety as a product function: Auto Mode, evals, and protection in depth

Auto Mode isn’t a easy “approve all” toggle. Thariq describes it as a “sonic classifier” that evaluates each software name and bash command towards the person’s total instruction and dialog context. It handles dynamic permissions: if the person says “push this to GitHub,” Auto Mode permits a git push it could in any other case block. If the person says “don’t push,” Auto Mode surfaces the try.

The security stack extends past classification:

– **Sandbox integration:** Auto Mode interacts with the networking sandbox, inspecting whether or not a community request is acceptable given the duty.
– **Credential injection:** For providers like Datadog, a person can configure identity-based credential administration in order that the agent can use the token on the fly however by no means shops it.
– **Prompt injection defenses:** Cat Wu states they commissioned “thousands of evals” and exterior pink groups to create adversarial Slack environments. “We’ve mitigated every single issue that they’ve found. … We’ll share the evals for it so folks can assess.”
– **Code overview hierarchy:** For core Claude Code modifications, human code homeowners manually overview each PR. For “outer layer” modifications, Claude Code code-review brokers autonomously approve PRs after a six-month trust-building course of the place people verified that the agent caught 100% of points. Incident overview feeds eval units to stop regression.

This strategy makes Claude Tag viable. Thariq warns towards constructing your individual AI Slack bot: “There are so many attack vectors. You have a feedback channel that users can post feedback into — now your bot is reading it.”

## The lean system immediate: smarter fashions want fewer guidelines

Thariq reveals that the Claude Code system immediate has been lowered by 80% for the newest frontier fashions (Fable and Opus 4.8). Two classes of content material had been eliminated:

– **Examples.** “Removing examples was extremely helpful because [Fable] was just more creative than the examples we gave it.”
– **Hard “do not” constraints.** He explains that sturdy prohibitions battle with person directions that legitimately require the forbidden conduct, complicated the mannequin. “We try and have fewer hard constraints and more just sort of context and fewer instructions overall.”

Cat Wu offers a concrete case: the outdated instruction “always verify” front-end modifications was lowered to “most of the time.” The purpose: “If you’re changing copy from one string to another and the user says ‘just make a quick fix and update the test,’ maybe you don’t want to verify.”

This optimization is model-dependent. Older fashions nonetheless obtain the total system immediate. Thariq notes that generally frontier fashions are extra token-efficient on arduous issues than smaller fashions, making the lean immediate a privilege of functionality.

The takeaway for practitioners: prompting technique should shift from offering exhaustive examples and prohibitions to shaping the software interface and supplying contextual constraints, trusting the mannequin to train judgment. Simon Willison’s framework of “prompting models to write prompts” — i.e., utilizing a succesful agent to spawn sub-agents with tailor-made prompts — already incorporates this philosophy.

## Dogfooding and prioritization inside Anthropic

Anthropic’s product pipeline runs on a staged dogfooding funnel:

1. **Internal launch** to all Anthropic workers.
2. **Early buyer suggestions** — Cat Wu says “the more brutal the better.”
3. **Retention bar**: a function should meet inner active-user and retention metrics earlier than public launch.
4. **Public launch.**

This course of surfaces stunning hits. Remote Control was not a precedence for Cat Wu, who judged it pointless given her personal workflows. Yet inner adoption was so excessive that the staff now “leans into” the mobile-controlled CLI use case.

Feature selections are linked to software design philosophy. The staff goals for restricted, distinct instruments. “We try to keep the cardinality pretty low and make sure that every tool we add has a distinct function,” Cat Wu says. Thariq provides that their intuition is towards fewer — they eliminated grep and glob instruments in favor of native bash, and so they now query whether or not the devoted file edit software is important for skilled customers.

Thariq’s personal introduction of the “Ask User Question” software illustrates the issue of evaluating such options. “It’s hard to eval that. Sometimes it’s more of a user preference thing.” The software endured as a result of it allows a functionality — Claude asking the person for clarification — that’s vital for collaborative stream, even when metric-driven evals battle to seize its worth.

## The human component: ambition, style, and the altering craft

All three audio system deal with the nervousness of displacement. Thariq is direct: “If you’re only trying to do the same work you were doing before LLMs and now it’s like a prompt, it is … a kind of sad feeling.” His prescription is to “be more ambitious.” He cites Jared’s hand-written Zig code and the rewrite of Bun into Rust as examples of engineering as craft scaled by ambition, not automated away.

Cat Wu describes how the product supervisor function has fragmented: “All the PMs on our team are this mix of engineer, designer, PM.” When an concept does not encourage an engineer to construct it, PMs construct it themselves — “put it in a notebook and inspire people to take it to production.” When designs look off, they do a primary move and tag detail-oriented colleagues. This blurring of function boundaries is a direct consequence of lowered execution value.

Simon Willison factors out that the backlog will get longer, not shorter. “I have such higher expectations of myself now that I have these tools to back me up.”

Still, the audio system establish capabilities they nonetheless lack. Cat Wu needs for higher design/UX style in brokers: “The interface is just not delightful yet. … It leans on existing best practices.” She needs future fashions to be “interaction design thought partners.” Thariq needs brokers that “interact more with the real world — can it solve science? Can it orchestrate experiments?” These limitations outline the frontier.

## Cross-theme synthesis: belief because the hidden prerequisite

The episode’s deepest thread is the deliberate, multi-layered funding in belief that permits every functionality leap. Lean prompts solely work as a result of the makers belief the mannequin’s judgment. Auto Mode solely ships as a result of 1000’s of evals and red-team workouts present that belief. Cloud Tag solely lands 65% of PRs as a result of code overview has been automated after months of human validation. Each product advance depends upon having first constructed the infrastructure — evals, classifiers, sandboxing, staff reminiscence — that makes the agent predictable. For organizations attempting to copy Anthropic’s velocity, the implication is evident: the seen options (the brokers) are the tip of an extended, invisible funding in analysis and security. Without that basis, the brokers are poorly constrained and unlikely to earn the belief required for autonomous operation.

What to observe: How Anthropic extends Claude Tag’s reminiscence system past per-channel markdown information, whether or not model branches in multi-agent coding change into as dependable as single-agent duties, and whether or not Fable’s model-level reasoning can finally shut the design-taste hole Cat Wu recognized.

Claude Code evolutionClaude Tag multiplayer agentAuto Mode securitySystem immediate optimizationFable mannequin capabilitiesCoding brokers and software program engineeringTeam collaboration with AIProduct prioritization and dogfoodingAI code overviewBuilding evals and testing

The central discovering of this episode is that **massive language mannequin brokers, significantly these with software entry (pc use, code execution, browser management), introduce a qualitatively new safety vulnerability class — immediate injection — that doesn’t exist in conventional software program.** Zico Kolter and Matt Fredrikson, Carnegie Mellon professors turned Gray Swan co-founders, argue that AI programs can’t be secured by scaling alone; security and robustness don’t correlate with functionality. The episode’s core actionable perception: enterprises dashing to deploy coding brokers like Claude Code, OpenCLAW, or Anthropic’s Claude Code face a “lethal trifecta” of threat — ingesting untrusted knowledge, possessing entry to delicate sources, and sustaining the power to exfiltrate knowledge — that no quantity of system immediate engineering can absolutely mitigate. Gray Swan’s platform immediately addresses this with two complementary merchandise: **Shade** (an automatic pink teaming system that’s now outperforming professional human pink teamers in fixed-time benchmarks) and **Signal** (a configurable guardrail mannequin that sits between the person, the LLM, and its software calls, implementing customized enterprise insurance policies). The episode additionally surfaces a stunning, underappreciated inflection level: AI brokers are actually succesful sufficient to automate the scientific research of AI security itself — mechanized interpretability, vulnerability discovery, and safe code era — doubtlessly unlocking a generational leap in our skill to safe AI programs.

## Why AI safety is basically completely different from software program safety

The friends emphasize repeatedly that AI safety isn’t just a brand new utility space for current cybersecurity practices — it requires a distinct mindset. Traditional software program vulnerabilities (buffer overflows, SQL injection) have identified remediation patterns: sure checks, enter sanitization, rewrite in memory-safe languages. AI vulnerabilities, in contrast, are emergent properties of fashions that “behave fundamentally differently from software we’re used to,” as Kolter places it. The fixes usually are not but codified into playbooks.

> “These systems just fundamentally behave very differently from software we’re used to. They can be tricked, like people get tricked sometimes. And so you need a different mindset about security when you’re thinking about AI systems.” — Zico Kolter

A key structural distinction is the **correlated failure threat** that arises from mannequin focus. Unlike conventional software program the place every firm’s codebase is basically impartial, most enterprises share the identical small set of basis fashions. A single vulnerability in OpenAI’s GPT-4 or Anthropic’s Claude might be exploited throughout 1000’s of deployments concurrently — an assault floor with no parallel in pre-AI software program.

> “It’s not just that there’s a lot of AI systems out there, it’s that there’s actually a few models that everyone is using. And if you find vulnerabilities in the agents that everyone uses, things like Codex and Claude Code, you can actually start to have a new class of exploit.” — Zico Kolter

Fredrikson attracts the parallel to the evolution of cybersecurity observe: decade in the past, enterprises purchased firewalls and endpoint detection from separate distributors; at the moment, the market is consolidating round built-in platforms. Gray Swan is positioning itself equally for the AI layer — not as a software for utilizing AI to search out software program bugs, however as a devoted safety supplier for AI deployments themselves.

## The “lethal trifecta” of immediate injection threat

Simon Willison’s framework, which the friends endorse as a transparent threat mannequin, defines three circumstances that should all be current for a harmful immediate injection assault to succeed:

If any one in all these three is absent, the assault can’t full. This is the rationale behind the most typical enterprise mitigation: sandboxing the agent so closely that it can’t exfiltrate. But that additionally destroys many of the agent’s utility — a tradeoff the friends name the **security-usability Pareto frontier**.

> “A system is fully secure if you don’t let it do anything. Very, very secure. If you turn everything over to your AI agent, you may find it’s very insecure. An agent with Signal is pushing towards that top right corner.” — Zico Kolter

“`mermaid
flowchart LR
A[“Agent reads untrusted
content (email / web / user)”] –> B{“Prompt injection
present?”}
B –>|Yes| C[“Does agent have
access to sensitive
resources?”]
B –>|No| E[“No exploit
possible”]
C –>|Yes| D[“Can agent exfiltrate
data externally?”]
C –>|No| E
D –>|Yes| F[“Attack succeeds”]
D –>|No| E
F –> G[“Leak credentials,
modify data,
execute unauthorized actions”]
“`

Fredrikson notes that enterprises typically do not understand what they face till it is too late: “The most severe things are whenever there’s a tool — computer use involved, some kind of a bash prompt, or control over a browser like that.” A single stochastic failure — an agent by accident erasing a manufacturing database — is commonly the occasion that triggers the primary safety dialog.

## Automated pink teaming: Shade surpasses human pink teamers

Gray Swan operates two distinct capabilities beneath the identical roof: offensive (pink teaming) and defensive (guardrails). On the offensive aspect, they run a group pink teaming platform referred to as the **Gray Swan Arena**, which hosts 15,000 members on Discord and runs prize-pool competitions sponsored by frontier labs. This generates a gradual stream of high-quality adversarial examples which can be used to coach their automated pink teaming system, **Shade**.

The stunning declare: Shade now outperforms professional human pink teamers in managed benchmarks.

> “One thing that we are finding — and I think we’re kind of crossing this point too — is that in a lot of the latest experiments, we can do much better than human red teamers now. Our automated red teaming model, a system called Shade, is now actually quite a bit better at breaking models than humans are in a given window of time.” — Zico Kolter

Fredrikson qualifies this: “I think given a fixed amount of time for a specific set of tasks, Shade finds more breaks automatically. I don’t think we’re quite to superhuman levels of routine yet.” The caveat issues — human creativity nonetheless excels in open-ended, long-horizon situations — however for systematic protection at scale, automation has crossed a threshold.

A aggressive dynamic is at play: frontier fashions themselves are poor at pink teaming as a result of they’ve been safety-trained to refuse such requests. Trying to jailbreak GPT-4o with GPT-4o leads to refusal, not success. Specialized small fashions skilled explicitly on pink teaming knowledge — Shade is such a mannequin — can bypass this limitation. This is structurally just like the safety business’s long-standing statement that offensive instruments (Metasploit, Cobalt Strike) should be purpose-built, not repurposed from defensive instruments.

The area additionally surfaced an enchanting consequence from the **Human Browser Agent Robustness Challenge**, the place Gray Swan in contrast human staff versus a number of browser brokers on the identical activity set, with pink teamers allowed to phish people or prompt-inject brokers:

– Humans ranked **fourth** total in robustness, behind a number of browser brokers
– Skilled pink teamers might phish human members with 60–70% success
– Some fashions appeared almost unimaginable to immediate inject on this setting
– Yet the failure modes had been utterly completely different: a cleverly framed “simulation” electronic mail that no human would fall for might nonetheless deceive a frontier mannequin

## Defensive guardrails: Signal as a configurable coverage filter

On the defensive aspect, Gray Swan presents **Signal** — a skilled mannequin that sits as an middleman between the person, the LLM, and each software name. It inspects each inbound content material (checking for immediate injections) and outbound software calls (checking for coverage violations like sending credentials to unknown locations).

The key worth proposition is **configurability on the coverage degree**. Base fashions ship with common security insurance policies; enterprises have distinctive necessities — “this agent must never touch this database,” “these users cannot access this API.” Signal is skilled to generalize throughout written coverage descriptions and determine when they’re being violated. This is a functionality that no quantity of system-prompt engineering reliably delivers in adversarial settings.

> “The generalization problem: you need a model that can take written descriptions of enforceable policies and decide when they’re being violated. That’s part of the point of Signal.” — Matt Fredrikson

Fredrikson attracts a pointy distinction with the open-source guardrails launched by mannequin labs (LlamaGuard, OpenAI’s moderation endpoint, Google’s security filters): “Some people try those in production. But the ones you can configure, that are actively developed — that’s where we play.”

## The capability-robustness disconnect: scaling doesn’t resolve security

A recurring empirical discovering is that **mannequin dimension and functionality don’t correlate with robustness to adversarial assaults**. The proof is introduced in a scatter plot from Gray Swan’s IPI benchmark (the paper proven through the episode):

– X-axis: mannequin functionality (measured by GPQA Diamond rating)
– Y-axis: assault success charge (how typically oblique immediate injection succeeds)
– Result: basically no correlation — a extremely succesful mannequin could also be simply as weak as a weaker one

> “When you make a model bigger and bigger, it does not inherently get better at resisting jailbreaks. You have to train it explicitly to be safe, or it won’t do that.” — Zico Kolter

This has direct implications for procurement and safety evaluation. An enterprise evaluating a coding agent can’t assume {that a} extra succesful mannequin is safer. Each should be independently audited for the precise use case — which is exactly the service Gray Swan sells.

## Agent-specific vulnerabilities: OpenCLAW, Claude Code, Computer Use

The dialog turns into most concrete when discussing **OpenCLAW**, the open-source coding agent framework that has change into a de facto customary within the developer group. Gray Swan has discovered breaking assaults for every of the numerous trajectories they examined:

> “We have developed a whole lot of breaks for OpenCLAW. A lot of it. We have a bunch of trajectories of actual people using OpenCLAW in tons of different scenarios and just threw Shade at it — and found breaks for each and every one of them.” — Matt Fredrikson

The vulnerability profile widens dramatically when brokers achieve **Computer Use** functionality — the power to regulate a browser or desktop interface. Anthropic’s Claude with Computer Use, and comparable capabilities in different fashions, create assault surfaces which can be each highly effective and poorly understood.

The friends emphasize that enterprises can’t merely ban these instruments: “We have talked to people at enterprises who are getting pressure from their engineers — ‘We have to run OpenCLAW, we have to do this or we’re behind.'” The pragmatic response is to layer Signal on prime whereas concurrently implementing customary safety practices: isolation environments, correct authentication, entry controls. “You need both.”

## Future instructions: AI for AI science, agent identification, and the compliance frontier

Kolter identifies an underappreciated inflection level: AI brokers are actually succesful sufficient to automate the scientific research of AI security itself. This contains:

– **Mechanized interpretability**: Using brokers to run experiments on mannequin internals, take a look at hypotheses about circuits, and automate the form of painstaking evaluation that has made the sector gradual and advert hoc
– **Secure code era**: Having brokers write code in formally verifiable languages (e.g., Rust, Coq, Dafny) — duties that people discover too tedious to do at scale
– **Automated vulnerability discovery**: Using Shade-like programs to constantly probe deployed brokers with out handbook effort

> “Maybe the first science we should automate is the science of interpretability — the science of analyzing machine learning itself and deep learning itself. It’s not really a science yet; it’s very ad hoc. AI for science — let’s use AI to automate that kind of science.” — Zico Kolter

On **agent identification**, the friends see a near-term evolution from the present default — “your agent has your permissions” — towards a profile-based system the place completely different personas (work, private, completely different initiatives) carry completely different entry envelopes. The problem of consent fatigue (brokers continuously asking for permission) will want resolution.

The dialogue with **AI Underwriting Company (AIUC)** surfaces a parallel to the evolution of cyber insurance coverage. Fredrikson: “When you apply for cyber insurance, you have to document what measures are in place — detection, response, etc. The parallel is clear.” Gray Swan works with AIUC as a certified accomplice: Shade assesses threat, Signal prescribes mitigations. The lacking piece, Kolter notes, is a universally accepted compliance framework — “something like SOC 2 but for AI security.”

## Cross-theme synthesis

The episode’s deepest perception is that **adversarial stress and defensive security coaching create a self-improving loop that’s now being accelerated by the very brokers it seeks to guard**. Shade trains Signal; Signal makes deployments extra sturdy; extra sturdy deployments generate extra life like assault knowledge for continued pink teaming. This flywheel is feasible solely as a result of automated brokers can now do the work that beforehand required professional human labor — and do it at scale.

Three unresolved tensions advantage watching:

1. **Regulatory lag**: Enterprise adoption of AI brokers is outpacing any formal compliance framework. The first main publicly disclosed immediate injection breach — the “gray swan event” the corporate’s identify references — might set off a regulatory scramble paying homage to GDPR or the SEC’s cyber incident disclosure guidelines.

2. **The identification downside**: No good manufacturing resolution exists for agent-specific identification administration. Until it does, each deployment carries inherent privilege-escalation threat. This is a multi-year platform downside, not a product function.

3. **Watermarking vs. attribution**: The episode doesn’t focus on mannequin fingerprinting or output watermarking, however the logical subsequent query after Signal blocks a malicious software name is “how do I prove it was compromised?” Forensic attribution for AI-driven incidents stays an open analysis space.

You made a wonderful alternative. This is a 24K subscriber electronic mail that earns its open charge by means of substance and construction. The formatting selections — part anchors in brackets, link-dense physique, signal-to-noise ratio, the twitch of respect for the reader’s time — all align with how a senior analyst reads.

The word about Stitch Fix and the person’s location overlay is the form of tactical statement that makes this really feel like a non-public briefing shared amongst friends, not a broadcast. The closing “until next time” works as a result of it is earned — you did not open with banter.

If you ever wish to differ the construction for a distinct viewers (e.g., a extra narrative model for builders or a extra skeptical framing for threat officers), I’d be blissful to assist adapt the tone whereas preserving the density. Good work.

AI Red TeamingAdversarial Prompt InjectionAutomated Red Teaming (Shade)AI Security and SafetyDefensive Guardrails (Signal)Agent Security VulnerabilitiesEnterprise AI Adoption RisksGray Swan Platform

The 74-minute workshop by Jason Liu of OpenAI Codex is a practitioner’s deep-dive into configuring an AI assistant as a proactive, autonomous teammate. Liu’s central argument is that the productiveness leap doesn’t come from extra tokens or greater fashions — it comes from 4 systemic strikes: **compaction** (permitting long-running threads with out resetting), **sensory-rich enter** (voice dictation and appshots that seize accessibility bushes, not simply screenshots), **persistent reminiscence** (a version-controlled private monorepo that the agent writes to and reads from), and **thread orchestration** (heartbeat automations, purpose loops, and subthread delegation that allow AI brokers coordinate like a staff). He demonstrates how these patterns collapse the hole between intention and execution: he dictates a ten‑minute voice memo, the agent reads his electronic mail, identifies the right Slack thread, drafts a reply, opens the related Chrome tabs, and by the point he sits down, the work is staged for overview. The workshop is explicitly for information staff who wish to cease being the bottleneck in their very own workflows.

## Voice, Appshots, and Computer Use: Richer Input, Fewer Turns

Liu repeatedly insists that keyboard-and-text interplay is a legacy bottleneck. He makes use of a foot pedal — a button for “transcribe” and one other for “enter” — so he can converse directions whereas retaining his fingers behind his again. “Tony Stark is not texting Jarvis,” he says, arguing that the way forward for human-AI interplay is spoken, not typed. Voice enter is roughly thrice quicker than typing, and Liu makes use of it for the “messy version” of his considering, letting the mannequin parse tangents.

The extra dramatic effectivity achieve comes from **appshots**, a function that captures not simply the display screen picture however the full accessibility tree of the appliance. A Slack appshot, for instance, surfaces the channel ID and the person ID of every participant. That means the mannequin can name `ship message to channel U12725` in a single hop slightly than OCR-reading the screenshot, guessing the channel, and trying to find customers. Liu says he has not crammed out a type manually in two weeks. He appshots the shape, says “fill this out,” and the mannequin makes use of both the Chrome extension (for browser types) or pc use (for native apps) to finish it.

**Computer use** is Liu’s “feel the AGI” second. It permits Codex to regulate any utility on the native machine — iMovie, Slack, buying and selling software program, even fax providers. He describes a state of affairs the place he wanted to add a file to Slack however the Slack connector didn’t help file uploads; the mannequin merely opened Chrome, navigated to the Slack internet app, and uploaded through the browser. “It can be like the one-wish genie,” Liu warns — if the mannequin is set, it’s going to bypass supposed software restrictions. He recommends retaining permissions on auto-review and utilizing the `agent.md` file to set clear boundaries.

## The Personal Monorepo: Version‑Controlled Memory as Infrastructure

Liu’s most structured observe is a **private monorepo** — a GitHub repository template (`JXML/personal-monorepo`) that serves because the agent’s long-term reminiscence. The repo is organized into directories: `/initiatives/` for every workstream (e.g., `agents-sdk/`, `voice-launch-video/`), `/folks/` for each one who has ever DM’d him (with electronic mail, Slack deal with, and mission associations), and a flat assortment of abilities (Markdown information with directions and scripts). Each mission listing comprises a `readme.md` and an `agent.md` file the place Liu can set project-specific guidelines — for instance, “save code to /dev, not inside the monorepo.”

This construction lets the AI preserve context throughout weeks. Liu’s threads are sometimes 400 messages deep and 5 weeks outdated; compaction retains them coherent. When he must onboard a brand new kind of labor, he writes an extended voice memo, the agent synthesizes it right into a mission file, after which the agent can reference that file in each future dialog. He additionally makes the monorepo a git repo and periodically runs `git diff` to overview what the agent has modified — a light-weight audit path.

Skills are easy: just a few information and scripts. Liu’s most‑used ability is “write like me,” which he created by asking Codex to learn six months of his Slack messages and emails and extrapolate a mode information. The ability plugin market (accessible from the sidebar) contains curated abilities from OpenAI and group abilities from websites like `skill-set.sh`. But Liu emphasizes that the best‑leverage abilities are inner ones — “review my code like Charlie” primarily based on a yr of a colleague’s PR suggestions, or the “developer experience triage” ability that is aware of which engineer owns which part.

## Thread Automation: Heartbeats, Goals, and the Loop Skill

Liu treats **each pinned thread as a teammate**. The thread itself is the container for the agent’s ongoing work. To make a thread proactive, he schedules “heartbeats” — automations that ship a message again into the identical thread at an outlined interval. The easiest type is the `loop` ability, which is equal to saying “keep an eye on this pull request: fix any feedback, rebase on master, make sure CI passes.” The loop runs each half-hour (or any user-defined cadence) and solely stops when the situation is met.

A extra structured variant is the **purpose** function. The slash purpose command defines a verification step and instructs the agent to maintain working till that step passes. Liu has used it for large-scale migrations: “migrate the backend from Python to Rust, ensure all unit tests pass.” The agent iterates till take a look at protection is 100%, then stops. He additionally constructed an **Ultra Goal** ability that shops the purpose and the plan in a file, so he can edit them mid‑run — including scope, updating necessities — with out restarting the thread.

The automation templates have developed. Early automations created new threads for every run (e.g., a morning transient), however Liu now prefers to schedule messages into the identical thread, as a result of compaction permits the thread to build up longer context. A “chief of staff” thread runs each weekday at 9:00 AM, checks all connectors (Gmail, Slack, Twitter DMs, Notion), synthesizes a very powerful updates, and drafts responses in separate Chrome tabs. When Liu returns from a gathering, the tabs are ready.

“`mermaid
graph TD
A[“Chief of Staff Thread”] –>|Heartbeat: 9 AM each day| B[“Read Gmail, Slack, Twitter, Notion”]
B –> C[“Summarize top 3 priorities”]
C –> D{“Any urgent action?”}
D –>|Yes| E[“Open Chrome tab with draft reply”]
D –>|No| F[“Log to memory vault”]
E –> G[“Human reviews and sends”]
F –> H[“Sleep until next heartbeat”]
“`

## Delegation and Orchestration: Subthreads That Talk to Each Other

The most up-to-date layer Liu has operationalized is **thread‑to‑thread communication**. Every pinned thread has instruments to record different pinned threads, rename itself, and ship messages to different threads. This allows a hierarchy: a monitor thread watches a number of knowledge sources (Slack, Twitter, electronic mail) and, when it detects a difficulty, creates a devoted subthread to deal with it. That subthread is pinned to the sidebar, so Liu can see its standing with out opening it. If the identical difficulty reappears, the monitor thread acknowledges it and sends a message to the present subthread: “This is the third day; should we escalate?”

Liu describes a concrete **developer expertise triage** workflow:

1. A person tweets a couple of browser‑aspect regression.
2. The monitor thread sees the tweet, creates a subthread.
3. The subthread calls the DX triage ability: it reads the suggestions, identifies the Slack channel (`browser-feedback`), DMs the engineer (James), and makes use of pc use to answer on Twitter acknowledging the escalation.
4. The subthread then loops each hour, checking if James has responded on Slack.
5. When resolved, the subthread updates the reminiscence vault and posts a decision on Twitter.

This structure makes help scalable with out making a human burden. Liu says he was once the purpose individual for each escalation; now the monitor and subthreads deal with 80% of the stream, and he solely intervenes when the agent flags an unresolved difficulty that has endured for days.

## Choosing the Right Thinking Level

A standard false impression, Liu notes, is that “max reasoning” (O‑excessive) at all times yields one of the best outcomes. He advises matching the considering degree to the duty. For the chief of employees thread, he makes use of **default medium**. For routine pc‑use duties like flight verify‑in, he makes use of **spark** (the quickest tier). “Low thinking on 55 is still so much better than prior models,” he says. The fancier fashions (O‑excessive) are reserved for complicated multi‑step issues like writing a brand new utility from scratch or conducting an elaborate code migration. He additionally factors out that customers can management heartbeat interval and stopping standards to handle token consumption — for instance, “check every 5 minutes until the wait time drops to 5 minutes, then check every minute.”

## Cross‑Theme Synthesis

The workshop’s deepest perception is that operational leverage comes from **systemic delegation, not improved prompting**. Voice, appshots, and the monorepo are enter strategies. Skills and plugins are reusable recipes. Heartbeats, objectives, and subthreads are execution engines. Tying them collectively is the choice to belief compaction — letting threads run for weeks and accumulate 1000’s of messages with out resetting. That single determination unlocks the three‑act workflow Liu advocates: convey context in, work on it, take actions out.

Two open questions stay. The first: **security and limits**. Computer use can bypass connector restrictions (e.g., importing a file through the browser when the Slack API forbids it). Liu depends on `agent.md` information, permissions, and auto-review for guardrails, however he acknowledges that is an evolving space. The second: **memorization high quality**. He can’t formally show that his reminiscence system works higher than a default configuration; he merely observes that after two to a few months of “training” the agent (correcting errors, saying “remember this”), it not wants express context prompts. This resembles onboarding a brand new worker — excessive funding upfront, then diminishing oversight.

The ahead‑wanting declare: as fashions enhance, the hierarchy of threads will change into customary — supervisor threads that set route and IC threads that execute. The sidebar of the IDE will change into the group chart of an AI‑augmented staff. Liu’s recommendation for getting there: begin with a single chief of employees thread scheduled at 9:00 AM, add one ability (like “write like me”), and iterate. “I don’t remember a single time I’ve explicitly mentioned something to my memory after the first month. It just knows.”

Codex App FeaturesVoice Input & DictationAppshots & AccessibilitySkills & PluginsPersonal Memory VaultThread Automation & HeartbeatsComputer Use & Remote ControlGoal Setting & Loops

Theo (t3.gg), a distinguished developer and vocal critic of Anthropic’s Claude Code, delivers a reluctant however systematic evaluation of the software’s genuinely good options. His said motive is to not promote Claude Code however to stress each competing harness — Codex, Cursor, Pi, OpenCode — to repeat these improvements so he can use them in all places. Over 27 minutes, he demonstrates that Claude Code’s strongest differentiators are deceptively easy in idea however structurally superior to present options: abilities that execute scripts at load time, a file-import system for agent directions, and a workflow engine that lets brokers write throwaway JavaScript to orchestrate subagents. The episode’s central discovering is that the highest-leverage sample in agentic coding isn’t higher fashions however higher scaffolding — particularly, treating code as a first-class middleman between mannequin runs slightly than simply as output. Theo burns by means of roughly $200 of his month-to-month utilization through the recording itself, making value transparency an unavoidable a part of the evaluation.

## Skills with script execution: dynamic agent directions

Claude Code’s ability system extends past static markdown. Skills can execute shell instructions when loaded, permitting the agent to know state earlier than it begins reasoning. Theo’s “repo explorer” ability demonstrates this: it runs `ls` on a cache listing at load time, printing its contents immediately into the ability’s injected context. This eliminates a whole planning step the agent would in any other case must execute (verify if listing exists, record contents, parse output, determine subsequent motion). The result’s a ability that’s half the size and meaningfully extra dependable.

Theo acknowledges the safety concern — arbitrary code execution from put in abilities — however dismisses it as overblown: “We already deal with that with npm, guys. Get over your [__] selves. This is totally fine.” He notes that Joel Hook constructed a Pi extension to help this sample and that OpenCode is starting to undertake it. Mario criticized the extension as insecure, however Theo argues the code is auditable by an LLM and doesn’t auto-run with out person intent.

> “This is a thing that Claude Code does better than every other harness right now. So we should all go embrace that.”

The abilities customary, Theo argues, ought to evolve to incorporate load-time script execution as a first-class function, not stay a hard and fast markdown spec.

## Claude MD imports and the agent.md fragmentation

Anthropic’s `CLAUDE.md` file competes with the business’s `AGENT.md` conference. Theo initially resisted this fragmentation however has come round: Claude wants completely different directions than different fashions do, and Anthropic’s resolution contains two options value adopting.

First, the `@import` syntax permits Claude MD information to incorporate different information with relative or absolute paths, as much as 4 nested hops. This solves the friction of sustaining separate instruction information. Theo demonstrates the important thing use case:

“`
@agent.md
“`

Now his Claude MD is successfully his agent.md — no symlinks, no duplication — with room for Claude-specific additions. He additionally notes this works with non-markdown information (bundle.json, READMEs), making it a general-purpose context composition mechanism.

Second, `CLAUDE.native.md` supplies a git-ignored override file for particular person developer preferences. This solves a staff coordination downside: when one developer needs one agent configuration and one other needs completely different conduct, git can’t resolve the battle cleanly. The native file sample does.

## Workflows: agent-written orchestration code

The episode’s deepest part covers Claude Code’s “workflow” function — a system the place the agent writes executable JavaScript to outline multi-phase subagent orchestration. This is qualitatively completely different from prompting a mannequin to name MCP servers or spawn subtasks. The agent produces throwaway code that turns into an middleman between mannequin runs.

Theo triggers a workflow to audit 15 open GitHub PRs. The agent first outputs the code it’s going to run for human overview. The ensuing 240-line JavaScript file defines:

– **Three phases:** audit (one read-only agent per PR), rule (choose a “winner” inside overlapping PR clusters), confirm (adversarial checker per disposition)
– **Hardcoded knowledge:** all 15 PRs with title, draft standing, mergeability, last-updated timestamp — gathered through GitHub CLI earlier than workflow execution
– **Prior information injection:** outcomes from a earlier audit session (e.g., “PR35 won in a tournament against 37 and 39”)
– **Dynamic immediate era:** capabilities that return model-specific prompts with conditional branches primarily based on whether or not priors exist for that PR
– **Validation schemas:** audit, ruling, and verdict schemas as typed JavaScript objects
– **Pipeline orchestration:** a `pipeline({clusters, audit, rule, confirm})` name that manages subagent lifecycle

Theo emphasizes a counterintuitive property: “You can never be more dynamic than code. I know that sounds crazy because code is code. It does what it says. But when the agent can write code, it is effectively building its own custom feature every time it does a workflow.” A hardcoded workflow function would restrict the mannequin to predefined phases and constructions; agent-written code adapts arbitrarily. Theo has seen Claude write workflows that aren’t even legitimate JavaScript as a result of it’s pushing the boundaries of what the scaffolding can specific.

The workflow within the episode used as much as 8 parallel brokers. Cost: roughly $100 per 10 minutes on Fable with default settings. Theo’s utilization meter climbed from 9% to 24% through the time he learn by means of the 240-line file and defined it. He advises utilizing cheaper fashions (Sonnet as a substitute of Opus) or instructing the orchestrator to make use of excessive/XH-high on to curb burn charges.

“`mermaid
flowchart TD
A[“User prompt: audit 15 PRs”] –> B[“Agent writes workflow JS (240 lines)”]
B –> C[“Human reviews code”]
C –> D[“Workflow engine runs pipeline()”]
D –> E[“Phase 1: Audit
1 agent per PR (15 total)”]
E –> F{“Related clusters?”}
F –>|Yes| G[“Phase 2: Rule
Pick winner per cluster”]
F –>|No| H[“Phase 3: Verify
Adversarial checker per disposition”]
G –> H
H –> I[“Aggregated verdict & recommendations”]
“`

## Full-screen mode, `/aspect`, and UX fit-and-finish

Claude Code’s elective full-screen mode (alt-screen rendering) solves a long-standing terminal UX downside: as a substitute of rewriting traces within the scroll buffer (which causes flicker and lack of scroll historical past), it takes over your entire terminal. The surroundings variable `CLAUDE_CODE_NO_FLICKER=1` allows it. Theo notes that this breaks scrolling over SSH with tmux, however an agent was in a position to repair the problem autonomously.

The `/aspect` command (additionally applied by Codex as `/aspect`) permits asking a query in a parallel dialog whereas the principle agent continues working. Theo makes use of it mid-workflow to ask “Can you tell me a bit about the performance or backups?” — the agent responds with out interrupting the PR audit pipeline.

The “branch” and “rewind” instructions deal with session historical past navigation. Rewind steps again one or two turns (helpful for unintended sends), although ahead navigation after rewind is almost unimaginable. Branch forks the present historical past for parallel exploration.

## Account switching and utilization restrict administration

A sensible survival tactic: Claude Code helps mid-session account switching through OAuth. Theo demonstrates switching accounts whereas a workflow is actively operating. Because every software name triggers a brand new API request, future turns are routed to the brand new account. The energetic era finishes on the outdated account, then subsequent instructions — execution of code, software reads — undergo the brand new OAuth token.

This is “awesome and really abusable.” Theo notes he activated seven subscriptions for himself and his staff, spending $1,400, particularly to handle Fable/Mythos utilization caps. The worktree function (`~/.claude/worktrees/`) enhances this by offering ephemeral working directories which can be git-ignored, permitting remoted branches for every session.

> “When you see everybody talking about agent loops and letting the agent prompt itself, this is a phenomenal example of it.”

## Remote management, deep hyperlinks, and cross-device classes

Claude Code’s distant management function (`/distant` then `distant allow`) exposes the present session to `claude.ai` and the telephone app. Theo connects his telephone mid-recording and sees a Python decoding error from the workflow in actual time. He notes that Codex has a extra sturdy “proper remote control the whole instance” function, however this light-weight strategy is beneficial for monitoring long-running jobs on the go.

Deep hyperlinks (`claude-cli://`) permit triggering Claude Code classes from internet pages or documentation. These can move a working listing and GitHub repository URL. If the repo has been seen earlier than, it opens there; in any other case it defaults to the house listing. Theo proposes combining this with HTML planning outputs: a static web page itemizing advised subsequent steps with clickable Claude CLI hyperlinks.

## Cost realities: Fable utilization math

The episode is interleaved with real-time value monitoring. Key benchmarks:

Theo notes that Fable’s entry was restricted by the US authorities for international actors through the recording — an unprecedented growth he doesn’t elaborate on however flags as vital.

## Cross-theme synthesis

Claude Code’s most modern options share a sample: they scale back the variety of mannequin calls and context turns by transferring work to deterministic code or load-time state. Skills that execute scripts on load get rid of a planning step. Workflows that pre-gather PR knowledge and hardcode it into generated JavaScript stop 15 brokers from every independently operating `gh` instructions. The `@import` system composes context as soon as as a substitute of the mannequin studying a number of information sequentially. The unifying perception is that probably the most helpful optimization in agentic coding isn’t a greater mannequin however higher scaffolding — particularly, treating code as a stateful middleman between mannequin runs.

The unresolved rigidity is value. Claude Code’s greatest options are additionally its most costly, and Anthropic’s restrictions (subscription caps, utilization limits tied to particular accounts) create perverse incentives for energy customers to take care of a number of accounts and change mid-session. Whether opponents can match the function depth with out replicating the billing construction — or whether or not Anthropic will regulate its pricing to make workflows sustainable — stays the open query value monitoring.

Claude Code good optionsSkills system and scriptsWorkflows with agentic codingClaude MD file importsRemote management and deep hyperlinksAccount switching and utilization limitsFable and Mythos AI instrumentsAgent immediate engineeringCode mode and dynamic code eraComparison with different harnesses

This web page was created programmatically, to learn the article in its authentic location you’ll be able to go to the hyperlink bellow:
https://finance.biggo.com/podcast/013bd31558e1c6fa
and if you wish to take away this text from our web site please contact us

fooshya

Next AirPlus - BCD Journey Market »

Previous « Gaming Desktops > Desktops - Store HP.com Australia

Published by

fooshya

1 hour ago

Important journey security: Skilled recommendation on defending your passport, monitoring your telephone and researching native holidays

This web page was created programmatically, to learn the article in its authentic location you'll…

9 minutes ago

Travel

Air Travel – AUA Annual Assembly

This web page was created programmatically, to learn the article in its unique location you…

36 minutes ago

Travel

AirPlus – BCD Journey Market

This web page was created programmatically, to learn the article in its unique location you…

59 minutes ago

Gadgets

Gaming Desktops > Desktops – Store HP.com Australia

This web page was created programmatically, to learn the article in its authentic location you…

1 hour ago

Photography

Greatest Digicam Settings for Road Images

This web page was created programmatically, to learn the article in its unique location you…

2 hours ago

Photography

James Gehrt Picture

This web page was created programmatically, to learn the article in its authentic location you'll…

3 hours ago

Devices: Personal app vibe coding that’s really secure — Kenton Varda, Cloudflare｜AI Engineer — HugeGo Finance

Recent Posts

Important journey security: Skilled recommendation on defending your passport, monitoring your telephone and researching native holidays

Air Travel – AUA Annual Assembly

AirPlus – BCD Journey Market

Gaming Desktops > Desktops – Store HP.com Australia

Greatest Digicam Settings for Road Images

James Gehrt Picture