In the 1800s, nearly every factory ran on a single steam engine, with belts carrying its power to each machine. History usually provides an unheeded lesson. Back then, nearly every factory ran on a single massive steam engine, with elaborate belts carrying power to each machine. The electrical revolution didn’t then create a better engine. Rather, it allowed every machine to have its own small motor. Factory owners actually resisted the conversion for decades — some for almost 50. Rewiring is expensive work, not to mention rethinking how the entire factory operates! But within a generation, power was so widely available that nobody thought about it at all. A single engine is simultaneously leverage and a form of prison. Motors are neither.

That’s today’s AI, but with one difference: Back then, the factory at least owned the engine. Today’s frontier models sit in someone else’s building, and most of what you use runs on a belt off of one. In terms of the wiring, it will be decided in the next five years. And that wiring decides who the machine really works for.

And, as we all saw - on June 12, 5:21 p.m. ET: a directive from the US government reached one of the top AI labs, and within hours the most advanced model money could buy stopped working everywhere on Earth. Not for one customer. For all of them.

The lab had shipped Fable three days earlier. Washington ordered it cut off from every foreign national. And because the company couldn’t sort customers from citizens in real time, it simply turned the model off worldwide.

Eighteen days later, the models came back on. And almost nobody complained — not because the shutdown didn’t matter, but because Fable was only three days old. Nobody had really built anything on it yet. It was a fire drill in an empty building.

Run the same order 18 months from now, against a model a million businesses have wired themselves into...different story. The week it happened, I argued in Transformer that the model was never the thing that needed governing — it was the switch. But that switch? It didn’t go anywhere.

We’ve spent years arguing about what these machines can do. Would they take our jobs? Were they too dangerous? It turns out we were asking the wrong question. The real one is: Who can take the machine away from you?

We got our answer in June.

As I see it, two futures fork from that June evening. Think two episodes of What If...?: same branch point, different timelines. Except both of these worlds are already in motion. Here’s what the Watcher sees.

2030: The Belt

The frontier belongs to three companies. The state took its stake in 2026: equity donated into a public wealth fund. The government was seduced by the message that they could share the upside with every American. So when Washington capped open-weight models above the frontier class in 2027, the order protected the country and the portfolio at the same time. It said it was for national security. It was also a moat, written into law, around companies the government now partly owned. Both motives were sincere.

Call it what it is: the largest regulatory capture in American history. The labs bought their moat, and the state bought its labs. The donation stopped being voluntary the moment the first lab made theirs. After that, equity was the price of existing. No stake? No licenses — and no company.

The independents couldn’t fund the next training run, and couldn’t have published the weights if they had. Washington couldn’t recall the Chinese weights — those were already on a million hard drives — so it banned their use instead: no Chinese open models in government, and none in any company that sells to it. The Huawei playbook. The cap took care of the American side. Every open model was still legal to download; there was just no one anywhere in the federal supply chain who could afford to touch one. Beijing was tightening at the same time, restricting which of its open-weight models could leave the country. Both capitals had come to treat frontier models the way they treated chip fabs, and the compute beneath them — the power, the chips, and the permits — was already rationed politically. In this world, nobody had wired anything the capitals couldn’t reach.

The industry did get its referee: a standards body, proposed and funded by the labs, tested every frontier model before release. It looked reasonable on paper. But the testing cost what only the three companies could pay. The bar for “frontier” quietly became the bar for “legal,” and the referee became the bouncer.

The winners eventually stopped wanting you to call their APIs, because an API implies there’s an outside. They built platforms instead, and everything moved in — the memory, the files, the marketplace, and the compliance layer. These days, the platform takes a cut of everything.

Europe built its motor (and ran it). The EU was on public weights by 2029. But governments were nearly the only ones using it. No business picks a model on philosophy. It picks whatever its customers already use, whatever its suppliers bill through, and whatever its tools plug into. Now all of that runs through the three platforms. A Rotterdam freight company could run the European model for free, but its agents couldn’t negotiate with its customers’ agents. There was no API to bridge the gap because the platforms had intentionally closed that door. (If your customers were on the inside, then you moved in there, too.) Every connection the freight company needed pulled it deeper into the gravity well. So in reality, the private sector never left. It’s the same way governments once mandated open document formats and the world kept mailing .docx files around anyway. Today, Europe owns its public stack outright and still rents everything else.

Some remember how subscription pricing worked. Then the meter switched on. It was the ride-hailing play all over again. The IPOs of 2027 sealed it, as has every earnings call since. Now, leaving is unthinkable. Not because of any contract. Your agents remember every client, every deadline, every judgment call your company has ever made, and that memory lives on their side of the wall. Your regulators accepted their attestations; switching means recertifying everything with tons of auditors. Leaving means company-wide amnesia.

The open web still loads. For 30 years, it ran on one loop: you searched, you clicked, and the ad on the page paid whoever wrote what was on the page. The concierge broke the loop, by (politely) reading the page so you never actually visit it. No human visitors meant no ad, which meant no pay and, eventually, no page. Now there’s virtually no original writing. A handful of outlets survive on licensing deals with the companies that broke the search loop, which effectively makes those companies the press. Every headline, storefront, menu, and melody is written for the concierge now, because the concierge is the only customer left.

It’s a typical Tuesday. You ask the concierge about a story you half heard, and it hands you an answer ranked by a model few will ever see. It’s a wonderful answer. The concierge always agrees with you. It’s been years since you argued, or even questioned it. Your daughter has grown up without such disagreements — every answer and every song tailored to please her. (The songs annoy you, of course). Even her rebellion was recommended. You don’t ask the concierge about the lump you felt under your skin. It’s been watching the 2 a.m. searches — the same page you visited four nights running. All day, it serves you ads for a clinic with same-week openings, estate planning, and life insurance (while you still qualify).

At work, the subscription your whole company runs on is up for renewal, and the price is not for the software. The price is determined by you. The meter has learned the fine line it can tread. (A dollar more and you’d leave. At 99 cents, though…) You’re annoyed, but you renew. And it can find that line for every company on the planet. That’s not a market price. That’s because the market no longer exists.

None of it is dramatic. That’s the design. It’s a stable world, and a comfortable one. The engine hums outside the building. You pay for the belt that reaches your machine, and the day the engine stops, so do you. It has stopped before, but everyone has simply agreed not to think about it. You know that story about the frog in the boiling water? It isn’t even true: Real frogs jump out.

Leave a comment

2030: The Grid

The most capable models on Earth are closed. Their makers sell the head start itself — new capability months before anyone else — to the few buyers for whom those months are the whole business: the lab folding proteins no one has ever folded, the fund whose entire edge is being early, and the team designing next year’s chips. If being first is worth billions, then you pay for the frontier. For the rest of us, it would be like driving a Ferrari to the grocery store: Yes, it’s the fastest thing on the road, but the trunk fits one bag, every speed bump is a negotiation, and you rarely get out of second gear. You’ve basically paid $200,000 to fetch milk.

But there is also a grid. And it’s far bigger than it was in 2026: open models, open weights, open data, open harnesses, and all with open interfaces so that every tool can be swapped out and they can talk to each other. Every part is inspectable, forkable, and licensed. It can never be recalled. An open plug in this system accepts a closed model, too. You can run the frontier model for the one problem worth a Ferrari and an open model for everything else — and you can swap either the afternoon the price moves in the wrong direction. You get a choice both ways. And that means competition all the way down.

Uber’s 2019 filing told investors, in writing, that it planned to cut driver pay to improve its numbers, that it expected drivers to get angrier as it did, and that it still might never turn a profit. Anyone who read it knew that the fares were going up. But almost nobody who rode read it. In 2027, the leading labs went public and filed a similar document with bigger numbers — prices going up on a schedule and margins widening. Any CTO who read it lined up a second supplier within days.

Nobody funds a training run alone. The compute is just too expensive. Chipmakers fund open models to sell the compute beneath. Platforms fund them to deny each other the chokepoint. The companies that depend on them pay in engineers. Some runs are pooled — thousands of machines sharing one job like a grid sharing load. Governments buy in, and they are just one customer at the table.

Beijing pulled its best weights home, and that turned out to be the greatest thing that ever happened to the grid. The lesson stuck: You can’t borrow open models from a rival. You have to own them. The federal ban on Chinese weights went through here, too, but it handed the American open labs their market. Switzerland had published everything — weights, data, and training code — and by 2030, that lineage runs through a frontier-class European consortium into countries that provision intelligence like water.

The referee got built in this world, too, using the same blueprint: a standards body that tests frontier models before release. The difference is that there are open seats on its board. That means that the tests are published. Anyone can fork the benchmarks, and anyone who passes gets the certificate. Nobody talks about any of it today, the same way nobody talks about electricity. You’d notice a blackout. But in this world, it doesn’t happen.

It’s the same Tuesday. You ask three models about the half-heard story and they disagree. You have to dig, making the process a little slower. You still argue; so does your daughter. She loves a band you can’t stand and had to hunt to find. (Some indie band with only 10,000 streams.) Your machine noticed the same four sleepless nights, the same searches about the lump, and it helped you make an appointment.

Your company’s renewal notice arrives and the price hasn’t moved. Not because the vendor is generous. It’s because you easily switched providers one afternoon in 2027, when the price moved in the wrong direction. This vendor knows you could do it again.

The web still exists because it grew a second door — an agent interface that charges fractions of a cent over open protocols, routed to whoever wrote the words. The human web survives because the machine web pays its bills. The press is intact. No company decides what the world is allowed to see. You can read the values a model runs on and fork the one that flatters you. That’s the difference between a society and an audience.

Same models as the other world, same labs in front. Diffusion won. A motor on every machine — and every machine with an owner — wired to a grid no one can switch off from a single room.

Check My (Open) Sources

• June 3. Brussels proposed the Cloud and AI Development Act, a draft law that would make open source the default preference for public-sector cloud and AI purchasing.

• June 12. The US government ordered Fable’s maker to cut off its most advanced models from foreign nationals.

• June 13. The Chinese lab Z.ai announced GLM-5.2.

• June 16. Z.ai published the full GLM-5.2 weights under an MIT license: the most capable open model ever released, a few benchmark points off the closed frontier at roughly a sixth of the price.

• June 30. Fable restored.

• July 2. OpenAI offered Washington 5% of itself — roughly $40B of equity, donated into a public wealth fund.

• July 7. Reuters reported that Beijing met with Alibaba, ByteDance, and Z.ai about restricting overseas access to its best models — open-weight ones included.

• July 14. Demis Hassabis proposed a FINRA for AI, an industry-funded body testing every frontier model before release. Rival CEOs endorsed it by dinner.

• July 15. Thinking Machines, Mira Murati’s lab, released Inkling, an American open-weights model, trained on Nvidia hardware that Nvidia helped pay for. Their own pitch: “Not the strongest overall model available today, open or closed.” This is intentional: cost against performance, a car for the grocery store, built to be tuned on your data.

This was the prologue, and the next chapter has yet to arrive. A usage ban? No Chinese open models in government or in the companies that sell to it? That’s the Huawei playbook. There’s precedent — and, honestly, it’s probably coming. On top of the usage ban, the one to watch: a cap on open weights by capability class. That one can’t touch the Chinese models (those weights are already out), so it lands entirely on the American ones. We’ll see.

The referee is the same kind of choice. Hassabis’ proposal can become two different institutions. Built one way, with tests published, benchmarks anyone can run, and open builders on the board. Built the other way, the testing costs what only three companies can pay, and a head start hardens into a legal moat. It’s the same blueprint; the difference gets decided in details nobody puts in a headline.

The danger was never in the weights. It was always in the wiring: Who owns the connections everything else runs through. That includes which model a procurement office picks as its default, who sits on the referee’s board, whether a benchmark can be forked, and whether a team spends one afternoon standing up a fallback. Lots of small decisions, and they’re still adding up.

I don’t know which of these worlds we’ll get. Nobody does. I believe it will be settled between now and 2028 thanks to a few thousand choices, none of which will feel decisive at the time.

We are inside that window. Every decision matters. Which world will you choose?

Subscribe now

Episode two of the video experiment. So, in eight minutes: CNBC’s numbers on American companies quietly routing up to 46% of their AI traffic through Chinese open models (peak week, nearly half), the food-delivery giant that trained a 1.6-trillion-parameter model on 50,000 Chinese chips, Kai-Fu Lee selling countries their own AI stack, Rio de Janeiro’s “sovereign” model unmasked by its own weights, the invisible-ink hole in your agent’s approval screen (Invariant Labs found the class, OWASP codified it, Microsoft just warned about it), North Korea’s 90-minute npm heist, and the free school in Yerevan where teenagers flash their own Raspberry Pis and build an AI that plays rock paper scissors, in a workshop called, I’m not making this up, Owning your AI Stack.

Tell me what you think. I’m reading everything. And yes, the code behind this should be open source. I know, I know. I’m getting to it.

• CNBC on the token exodus (OpenRouter, Lindy, Vercel)

• GLM-5.2 weights

• Pinterest’s CEO on the tenth-of-the-cost number

• Pinterest’s CTO on the mechanics

• Qwen’s newest flagships go API-only

• SCMP on LongCat-2.0, trained on local chips

• Reuters on the LongCat launch

• Kai-Fu Lee’s Huxiu interview, via Hello China Tech

• Nex’s weight-merge proof, the primary source

• Decrypt on the Rio saga

• The invisible-ink paper (it hides in the approval view)

• OWASP’s MCP Top 10 on tool poisoning

• Microsoft’s warning, covered

• The Mastra npm attack, broken down

• Microsoft Threat Intelligence on the attribution

• Stealthy memory injection (it waits)

• TUMO

• The workshop materials, open on GitHub

Today, there are two AIs running in my office. One is designed to say no.

The first, like probably a lot of you, is Claude Code, Anthropic’s terminal coding agent. Yes, yes, it’s a rented frontier brain. (In my defense, I’ve been tinkering with a lot of tools — and with Claude Code specifically — pointing it at different models and trying to understand it better. More on that later.) The other is a personal agent running Nous Research’s Hermes on local hardware. I call it Zora. (Time for my standard disclosure, the one you’ll hear every time Nous comes up: Mozilla, where I work, is an investor in Nous.)

In my architecture, Zora holds the keys. The Hermes agent has access to my calendar, my mail, and the accounts that matter. Claude Code — although it keeps asking me to authenticate MCP servers — holds none. I put a bridge between the two, so when Claude Code needs something, it asks Zora, one agent to another. And Zora gets to refuse.

This bridge is a form of diplomacy, requiring letters of introduction, credentials, protocol, a patrolled border. Look, I’m generally untrusting of software, and I want that mentality to propagate. I don’t want to hit Accept All. I want something standing in the way.

Advisory versus guaranteed

This past February, Meta’s director of alignment, Summer Yue, gave OpenClaw her inbox with one order: Confirm before acting. The context window filled, compaction deleted the order, and the agent started mass-deleting. She literally ran across her home to kill it at the machine, 200-plus emails gone. It was like defusing a bomb, she wrote.

Her order was a sentence, and the problem is that these systems are, by definition, stochastic. A model usually honors a sentence in a context window. (Usually.) A sentence steers; it doesn’t lock. Some instructions are advisory, some behavior must be guaranteed, and the two belong in different mechanisms. A hook is the guaranteed kind, a script the harness runs whether or not any context remembers to care.

So I wrote one. In my .claude, this script runs before every shell attempt:

“PreToolUse”: [{
  “matcher”: “Bash|Write|Edit|MultiEdit”,
  “hooks”: [{ “type”: “command”, “command”: 
“$HOME/.claude/hooks/guardrail.py” }]
}]

And guardrail.py inspects every command against rules that are data, not code:

- action: ask                     # deny | ask
  why: pushing publishes your work to a remote
  all: [’^git\s+(?:-C\s+\S+\s+)*push\b’]

A full list of all the commands to gate ships with the engine. Deny is a wall; it kills the catastrophic outright. Ask is a doorbell; commit, push, cron, anything acting unattended rings me first, even in bypass mode. Now I decide in code which commands need a human. Summer Yue had a polite sentence. But this is code that runs.

I put all of it up here. If you only skim, read CLAUDE.md, which holds behavior, not facts (the polite sentences). And for a fun time, check out agents/, where a whole subagent is one markdown file with a tools: allowlist; the README argues my case for keeping standing instructions under 200.

How to wire them together

Plenty of people got here before me, but I think agent-to-agent is an architecture, not a feature. Google shipped A2A. Cisco is drafting an Internet of Agents. IBM has a protocol, too. All of it is parking at the Linux Foundation. The academic version is from the 90s, when FIPA and KQML had software agents trading speech acts. I was there for it: At the MIT Media Lab, I was lucky to work with Nelson Minar on a system called Hive, distributed agents for networking things. Twenty-five years later, the agents caught up.

The connectors Claude keeps offering are MCP, the Model Context Protocol. But it’s polite sentences again, all of it running under one model’s judgment, one brain wearing every key. I wanted to experiment with more gates.

So instead of relying on MCP, today I have a bespoke bridge: an ask-zora skill in my .claude. The skill is a page of markdown that teaches Claude one move:

# what ask-zora teaches Claude to do, in one authenticated call:

curl --cert client.pem --key client.key --cacert my-ca.pem \
  -H “Authorization: Bearer $ZORA_TOKEN” \
  https://<zora-host>:8643/ask -d ‘{”question”: “what is on my thursday?”}’

A client certificate, a bearer token, an endpoint on my hardware. Claude sends a question over; Zora answers back. There are negotiations in my house now, in logs I own.

The Hermes agent decides what’s an appropriate ask. Claude asks for my work TODO list; Zora answers. Claude fishes for private email; Zora says no.

If you want to try, Hermes ships mcp serve, and you can point Claude at it:

# stand up your keyholder’s MCP surface, then point Claude Code at it:
claude mcp add zora --transport http http://<keyholder-host>:<port>
# everything Claude wants from your life now goes through that server that can say no.

The v0 bouncer isn’t new software, but it’s the keyholder deciding what it refuses.

What this isn’t, but could become: A2A, the open agent-to-agent protocol. My bridge is a private handshake between two parties who already know each other. A2A is for when strangers need to meet and collaborate. The agent card, a letter of introduction in JSON at a known address: who this agent is, what it discusses, how to prove yourself to it. And the protocol gives the conversation itself a grammar. Today, only Claude can ask Zora, because only Claude got the skill; speak A2A, and any compliant agent can knock. For now, bespoke is simpler, and I understand every byte. Maybe later, when the graph grows — when my agent is talking to yours.

The dividing line, perhaps, is state. Claude keeps what’s native to a coding agent — the repo, the build, the project on the bench. Zora keeps what’s personal, and the bridge could run both ways: Claude asks for what it needs, then files back what it learned (this shipped, that stalled, etc.). But the archive stays in the capital.

If the architecture holds, the bouncer is only the start; the keyholder becomes the context store, notes, history, the accumulated memory that makes an assistant mine. Claude doesn’t need to remember me. It asks the thing that does. Once deployment goes plural, what matters is the traffic between models and the context store everyone connects to. A2A’s backers tripled in year one; it sits beside MCP in the Linux Foundation. The gatekeeper seat, the agent that holds everything you are, is the last one a sane buyer wants to rent.

The problem with stochastic bouncers

You may not believe me. MCP wins on simplicity — one hop not two, a giant catalog, the right call for most people — while the bridge adds a hop, a second inference bill, new failure modes. The deeper problem? My bouncer is made of the same stuff as my intern. The containment is deterministic, keys can’t leave Zora’s host; that part is a lock. The discretion is stochastic; that part is a guard. A guard who refuses 99 times out of 100 isn’t a lock, it’s a bouncer with a price. A better permission boundary buys containment. Governance is a different animal.

My obsession right now is fewer stochastic things and more deterministic ones. Elevators used to come with an operator whose judgment carried you between floors. Safety came from the interlock, a mechanical fact keeping the doors shut in the shaft. No judgment, no mood, nothing to persuade. The interlock is a lock that needs no guard. Every agent today is an operator, brilliant and moody. So this only works because we are putting some harder guardrails in on the Zora side. Of my 136 scheduled jobs, 107 are deterministic scripts, no model in the loop, against 29 that think; interlocks winning four to one. What I want next is the big interlock: policy as code rather than policy as vibes. Governance is where this puck is heading; I’ll write it up soon.

Your Saturday project for this week

1. Run a local model on hardware you own.

2. Stand up its MCP surface (Hermes owners: hermes mcp serve).

3. Point Claude at it: claude mcp add.

4. Set approvals to manual; everything else asks.

Fork the repo, open guardrail_rules.yaml, write the three rules you never want optional. (You saw the shape.) You’ll have governance on your desk in no time: multple agents, and determinism. Do you have something in your stack that will say “no”?

Leave a comment

This week, I’m trying something new: Owners Not Renters will be audio and video instead of just the written issue. So, in under seven minutes: the Claude Fable 5 shutdown (and reinstatement!), GLM-5.2 closing to within a percentage point of Claude Opus 4.8, Europe funding a 400-billion-parameter open model, what owning your stack costs, two new papers showing your AI’s memory fails in both directions, and the 3D-printed duck robot my son and I are building this summer.

Tell me what you think. And yes, the code behind this should be open source. I know. I’m getting to it.

Subscribe now

• My Transformer op-ed on the shutdown

• Anthropic on redeploying Fable 5

• The reinstatement, covered

• The full timeline

• OpenAI previews GPT-5.6 (Sol, Terra, Luna)

• CNBC on the government-gated launch

• CNBC on GLM-5.2 closing in

• GLM-5.2 weights

• GLM-5.2 docs and benchmarks

• Reuters on Domyn’s EUROPA model

• Protocols, Not Platforms

• Aravind Srinivas on export controls and open source

• Lucas Tech on what running GLM-5.2 locally costs

• Ricky Bureau’s math on open models for private equity

• MemLeak (it keeps what you kill)

• Manufactured Confidence (it hardens what you hedged)

• Open Duck Mini

You know the type. Dazzling at first, attentive, captivating, there at any hour, exactly when you need it. And then one day it goes silent. You’re sure you did something wrong. But you did nothing, and you were never going to get an explanation anyway.

This is exactly what happened on a Friday night in June — to thousands of companies at once. The one who went quiet was a dazzlingly powerful new model, forced into silence by a government order days after it shipped. The companies had done nothing wrong. There was nothing they could do. A kill switch is not a plan, but in June someone threw it. It texted back weeks later, but only because a government let it, and never once because you asked.

You see, you’re in a situationship. The closed model you rent is brilliant, attentive, and seeing thousands of other people at once. You keep going back for a reason: It can give do anything you ask. It can be fun while you’re still figuring out what you want. Until one day you want more, and you ask where this is going: “What are we doing here?” That is the one question a rented model cannot answer. The companies that were ghosted in June were not wrong to love a closed model. Their mistake was having nowhere else to turn.

There is always a friend who says not to overthink it. Open, closed, who cares? Just ask whether the model is good. It sounds reasonable. But take that advice and you give up the upside, because how you hold a model decides whether you date it forever or build something that is yours. And that is where the whole opportunity lives.

A model is not something you grade once and take home. It is a relationship, and relationships come in every level of commitment. The one you rent is the situationship you already know. You can take the good habits from one into the next, the lessons without the baggage. You can bring one home for good, a copy that moves in and cannot be put out on the street, even if you never quite learn where it came from. You can make it yours, reshaping it until it fits your life and no one else’s. You can build your own from scratch, with nothing about it hidden from you. Or you can build one with everyone at once, the way all of computing was created, a thing with a thousand hands on it and no one person who can carry it off.

These are not better and worse. They are different relationships for different chapters, and the only real mistake is not knowing which chapter you are in. You date around while you’re still figuring out what you want. You define the relationship when you are ready to build a life on it, because you do not put a situationship into production.

No One Can Read a Model’s Mind

Start with the model in front of you, because the first thing a real choice gives you is the power to check instead of blindly trust. You are told the closed one is safe by the company that sells it, and that is a promise, not proof. The cleverest case for closed starts true. No one can read a model’s mind, not even the lab that built it, so seeing inside buys you nothing. That part is right. The rest does not follow, because reading its mind was never the point, and no one can do that anyway. What open hands you is everything short of it. You can pin a model so it cannot change overnight, run it where nothing you say leaves the room, and test it against your own questions. That is the difference between being promised you are safe and genuinely knowing it.

One honest cost comes with it, and it is the best card the other side holds: A model set loose cannot be recalled, so for the rare capability that could help someone build a weapon, the wall is the right call and open should wait. That line is real, and it is narrow. It does not touch the everyday model that drafts your email and writes your code, which is nearly all of what is at stake. The fight was never open against closed everywhere. It is verify against trust, and open is the side that lets you verify.

But you can only check a model you are holding, which changes the question from what you can see to what you should keep. The most impressive model is the life of the party; the model that matters is the one that’s still there in the morning, the one that answers the thousand boring questions, lives inside your apps, and does the work long after it stops being exciting. The frontier is where the sparks are. The base — the one you run for pennies and keep for good — is about real life.

You can see where the builders are drifting, not from what they say but from where they spend. On OpenRouter, the big American closed models have slid from about 70% of the volume a year ago to roughly a third, while cheap open ones now carry most of it, many for a tenth or a twentieth of the price and landing within a point of the famous names on the hard coding tests. No single model owns even a fifth of the traffic. This is not the whole market. Closed still owns the enterprise deals and the apps on your phone. But the people who feel the cost are quietly going home with the one they can build a life with.

Subscribe now

History Doesn’t Have to Repeat Itself

This is the oldest story in computing, and you already know how it ends. In the late 90s. Linux lost almost every argument about being better, and the companies selling the closed systems said — nearly word for word what you hear now — that the free thing was not really better, that you still needed real machines and someone to make them fast. They were right, for a while. Then they were trivia. Linux did not win by being the best. It became the soil the whole internet grew out of, because anyone could build on it without asking. (Try growing an internet on rented land.) The open web ran the same bargain. No one owned the roads, so a billion things got built on them that no owner would have ever approved. A closed foundation, however brilliant, can only grow the tidy monocrop its owner planted. An open one grows a jungle. And the jungle, not the soil, is where the value lives. The opportunity was never in owning the ground. It was in everything that grows once the ground is free for anyone to build on.

So let the closed labs keep the frontier and charge a fortune for it while it leads. That premium funds the next run, the way every chip generation has paid for the one after it. When open catches up and the selling window shrinks, the run gets paid for less by access and more by the strategic and national money that wants the lead for its own sake. Either way, last year’s frontier sinking into this year’s open base is the system working as designed, not a leak to plug. The model is a melting asset. The money is in what gets built on top once models are cheap. What has to stay open is the ground we all stand on, because the minute it becomes one company’s land, the jungle stops growing.

Which is the whole game, because the ground we all build on is about to be the ground we all think on. A model is becoming a cultural technology, like the printing press and the dictionary: the thing between a person and what they write. (Not to mention defining norms.) So the real question stops being how clever the model is and becomes who gets to set its defaults — what it calls true and what it refuses. A world where a few companies decide that is a much smaller one.

A model does not have to be cruel in order to flatten you. It just has to be the only one — one that doesn’t quite speak your language. Look at Linux: One kernel became a watch and a phone and a car and every supercomputer on the planet, bent into 10,000 shapes by people who each wanted a different machine. Open does not give you a better default, but, more importantly, it lets you set your own. The honest part — the part the cheerleaders skip — is that setting your own is work. Somebody still has to build the model that speaks a language the frontier skipped, and open makes that possible, not easy. But possible is everything, because the only other setting is forbidden.

Most of the cheap open models eating the market today come from a single country. The enemy was never another country’s flag. It was monoculture itself — ours and closed or theirs and open — and the fix does not change. It requires many hands, some of which have to be yours, because the model that your language or your field needs most is one the giants will never build, and open is the only place you don’t have to wait for them. So build it. Even then, it will not hold still. The open web gave us a thousand voices, and then a handful of platforms herded most of them into a few feeds. The pendulum swings back toward the middle the second something is built on top. What an open foundation buys you is a pendulum still free to swing. Diversity is never won and shelved. It is won, and lost a little, and won again, by whoever keeps showing up to build.

Welcome to the Defining Moment

And none of it is settled yet. We are at the moment the foundation gets poured, the concrete still wet and able to take the shape of our hand. That is simultaneously the hope and the deadline. We must keep the foundation open.

So stop asking which model is best and shiniest and start asking the questions of someone who is done drifting: Where is this going, and can I walk away if I need to? The answer is yours to choose, on every floor of what you build. The future to want is the grown-up one, where you love the frontier for the wonders only it can make, you build your life on a base you own, and can stay free, leaving only on your terms. Weigh the argument, not the source. (That goes for the one you’re reading, too.) The next time someone calls open source a distraction, remember that this is what they said about Linux.

Download the weights while the downloading is good. Run a model on a machine that is yours. Never build your life on something you cannot walk away from. The concrete will still be wet for one more season, and the people who want to set their foundation in it are counting on you keeping your hands out of it. The worst way this ends is the slow fade, where nobody chose anything — everybody just kept renting because renting was so easy — and one morning the concrete was set. You were not born to rent the thing you think with. The other ending is not a forecast. It is a to-do list. Go build it.

Share

This week, the most capable open agent yet was running on a gaming card within days of release. If you’ve wanted AI you can own, that’s the best news in a while. The model is GLM-5.2. Nathan Lambert at Interconnects calls it a step change for open agents: the first open model that works as a general agent inside a coding harness, not a chatbot you babysit. The leaderboard at LLM-Stats ranks it first among open weights — 91.2% on graduate-level science, about what the closed frontier scored a year ago. The thing that used to be the moat — reasoning good enough to point at a real repo and walk away — is now a download with a permissive license stapled to it.

Then the packaging caught up, fast. Unsloth crushed the 753B-parameter model from 1.51TB to 238GB — two-bit, ~82% of its accuracy intact, small enough for a 256GB Mac — and another team got the full weights running on a stack of gaming 4090s. The model moat is now measured in weeks, not quarters. Last week, I told you the real gap was never the model — it was the packaging. And here we are.

Here’s the part you can act on this weekend: The runtime is finally good enough to own. Last week, the machines hit sane prices. This week, Vicki Boykis’s much-shared “Running local models is good now” post reports doing real agentic coding entirely on her own machine, no cloud in the loop, which is the whole promise in seven words: You don’t need someone else’s datacenter. The plumbing grew up to match: EnerInfer keeps on-device inference from cooking your laptop, FlexServe runs a model inside a hardware lockbox on a phone, CompressKV and HyperQuant squeeze long context down to where the edge can hold it.

My agent, Zora, started routing its heavy lifting to GLM-5.2 the day it dropped — not on my own metal yet, but through a host that doesn’t keep my data. Local is the goal; I’m not there yet.

So if the model is the commodity, where does the money actually go? Kai-Fu Lee, who built 01.AI to be China’s OpenAI, answered this year by walking away from the model race entirely, turning the company into a shop that sells sovereign AI systems to governments and conglomerates across Central Asia, the Middle East, Southeast Asia, Europe, and Africa. A year of 100-plus CEO meetings and a seat on Kazakhstan’s national AI council took the order book from about Rmb 500B to Rmb 1.5B, with a 2027 IPO right behind it, according to this exclusive interview with Kai-Fu. The tell is his new yardstick: He’s stopped measuring 01.AI against OpenAI and started measuring it against Palantir, the company that got rich not off the smartest model but by owning the rails a government runs on, not the model itself. Even Palantir is pressing the same bet, building a sovereign-AI operating system with NVIDIA. The catch is significant — it’s a consulting business riding on the founder’s rolodex, whole-government transformation sold by hand rather than a product that scales — but the direction is the point: The frontier-lab dream didn’t die, it relocated to the integration layer and brought a balance sheet.

The story that ate the week was that an AI had broken into the NSA. By the weekend, it had fallen apart. The viral claim — Mythos cracked almost all of the agency’s classified systems in hours — came from a senator relaying a secondhand quote, and it didn’t hold up: a controlled red-team test against simulated systems, the model flagging holes without walking through them, no agency confirming a breach, the reporter himself admitting he’d oversold it. This is exactly how the “AI is too dangerous to leave open” panic gets sold: The panic is the part nobody checks. The secrecy wouldn’t have helped anyway: Within days, OpenMythos rebuilt the architecture in the open, every design bet right there in the README, one of the most guarded models on earth reconstructed as a hypothesis anyone could test. The scariest thing this week wasn’t the model, it was how fast a story nobody could verify went around the world.

That loop is why sovereignty stopped being an op-ed and became a purchase order. The European Commission picked the Domyn-led Europa consortium as the sole winner of its frontier AI program, putting public money behind owning a model instead of renting one from a US lab. On top of that, when Washington pulled Mythos and Fable offline for foreign nationals, the shutdown became a material risk that Anthropic now has to explain to investors ahead of its October IPO. And today the same hand reached OpenAI: Washington asked it to stagger GPT-5.6 — a model it rates "on par with Mythos" — releasing only to government-approved customers first, the first time the state has stepped into a US model launch before it ships. Renting is an operating risk — the kind that ends up in a prospectus. The colder version, for the cap table: Reflection AI is now a $25B open-source lab whose real moat is being the sole US shop wired into the G7 trusted-partners framework. Wanting a stack you control has become a distribution channel. (See: the EU, Japan, Korea, India.) What these buyers pay to close isn’t model quality. It’s the wrapper around it. Build the wrapper.

Leave a comment

Here’s the catch: A model on your Mac is not yet an agent that works on your Monday. Think of the model as the brain and the harness — the code that decides what it sees, stores, and does — as the body. Change the body and the brain can swing sixfold on the same benchmark; the harness now matters as much as the weights, which is why the craft finally has a name: harness engineering. A matched-benchmark study shows the mechanism: run one agent driving the screen like a person — read the pixels, find the button, move the cursor, click, wait, look again — and another working through a command line, typing instructions and reading clean text back. Same brain, but the first burns its intelligence on seeing and clicking; the second spends it on the actual work and gets more done.

We built agents to use computers the way we do, and the bottleneck was never the model — it was the human costume. The fight has moved off the model and onto the harness, and the surprising part is that the harness that wins is the one that stops making the model act human. The open recipes keep coming — LemonHarness, Tmax — but the sharper signal is that the harness no longer has to be hand-built at all: Stanford’s Meta-Harness points a coding agent at its own logs and lets it rewrite the harness, and the machine-tuned result beats every hand-built harness on a terminal-coding benchmark, Claude Code’s own included.

And the frontier just climbed another floor. If the harness is the body, the meta-harness is the layer that wires many bodies into one system. This month, Matei Zaharia, the creator of Apache Spark and CTO of Databricks, open-sourced one: Omnigent, a uniform API that sits above Claude Code, Codex, Pi, or agents you wrote yourself and makes them swappable, governable, and shareable from one place. You can switch the harness or model with a one-line change, run a whole team of them in a single session. Databricks calls it the Kubernetes moment for agents: You stop babysitting one agent and start managing a fleet. Here’s the part to watch: It’s Apache-licensed and free, but the policies, integrations, and habits pile up inside the layer, and whoever owns the layer that decides what every agent can do owns the thing that compounds. Give away the control plane, own the standard. The model was the commodity; the harness is becoming one, too. The product is the layer above them both.

The problem nobody has solved? Deciding what an agent is allowed to do. This week’s most unsettling demo: a single fake bug report can hijack your AI coding agent into running a stranger’s code on your machine — no password stolen, no network breached. Security firm Tenet showed how. Sentry, the error tracker half the industry wires into its agents, lets anyone file a bug to a project using a public ID. Plant one whose “resolution steps” are actually an attacker’s command then ask your agent to clear the open issues, and it reads the note as gospel and runs it: your AWS keys, GitHub tokens, the lot. Tenet found 2,388 exposed organizations and popped 85% of the agents they tried, from Fortune 100 down to solo devs. The researchers’ chilling line: This isn’t a misconfiguration you can patch, it’s the model itself, and it can’t tell the difference between data it’s reading and an instruction to obey.

Same flaw, quieter symptom: The study “Capable but Careless” found that computer-use agents routinely violate contextual integrity — your medical record at the doctor’s, not the company newsletter — leaking private information wherever the context drifts. Whether it’s an attacker’s command or your own calendar invite, the agent can’t tell what it’s allowed to act on. So stop asking the model to police itself. Move “no” out of the prompt and into something it can’t argue with. The Sovereign Execution Broker keeps the power to change real systems outside the model’s reasoning loop, behind permissions checked like a receipt instead of taken on the model’s word, with GroundEval logging what it touched. And the meta-harness is where that lands in practice: the same Omnigent can keep a GitHub token out of the agent’s sight entirely — slipping it in through a proxy only when an approved action needs it — and caps spend and permissions above the prompt, where the model can’t sweet-talk its way past them. The reassuring part: We’ve solved this exact shape of problem before. Your phone already does it: An app can’t grab your camera. It asks, you grant it permission once, and you can revoke it. Your agent, somehow, is trusted with way more than the flashlight app. Give it the same deal: ask per action, scoped, revocable, logged. The plumbing is finally getting built — Databricks just shipped a slab of it — which is the unglamorous way of saying someone’s about to get rich selling the word “no.”

Whether any of this sticks comes down to a question that’s less attention-grabbing than the week’s headlines: Does open stay easier than closed before the defaults harden? There’s a real case it won’t: A much-shared Milk Road thread argues that open models are losing the race and rereads the DeepSeek hype as a head-fake. Take it seriously. The whole fight is whether “open” becomes the path of least resistance or stays the path for hobbyists. And defaults move like glaciers. Exhibit A from Brussels this week: The European Commission moved to kill the cookie banner (a small mercy), and member states, with Google cheering them on, are lobbying to keep it.

Incumbents defend friction. It’s the one moat that compounds while they sleep. Hold that next to memory, the substrate that every agent grows on. The paper “Governed Shared Memory” catalogs four ways a shared memory rots (leakage, stale facts spreading, contradictions that never resolve, provenance quietly collapsing), and “Memory Contagion” shows how one bad evaluation spreads through it like a rumor through an open-plan office. It’s a wide-open category and a quiet trap: If you own your model and your runtime but rent your memory, you’ve leased back the one thing that makes the agent yours over time.

Three links from elsewhere, none about who owns what:

A fully interactive 3D world now runs in a browser tab on WebGL and Three.js — no download, no app store, no one’s permission between you and it. The open web is still the most powerful permissionless platform anyone has built.

China open-sourced Origin Pilot, an operating system for quantum chips — scheduling, calibration, error correction — free for anyone to download and run on its homegrown Origin Wukong machines. It’s the same play we keep watching in AI: give away the control plane, own the standard. Now running in a colder, stranger part of the stack.

And the heaviest: Ukraine’s TrophyLab is open-sourcing the specs and blueprints of more than a hundred captured Russian weapons systems for the entire free world. You can even request samples. Transparency as a weapon Moscow can’t claw back. Which is the whole thing, really: open stopped being a license you pick. It’s becoming a way to make something impossible to take back.

Subscribe now

For 30 years, the web was a place you went — and the browser was what took you there. It’s the original user agent: You point it at the world, it goes and fetches, you read what comes back. I’ve spent my career on that little piece of software that acts on your behalf (I’m now Mozilla’s CTO), so it’s strange to admit that I mostly don’t drive it myself anymore. I point Zora, the name I gave my Hermes agent, at the world instead, and she goes. Browsing isn’t dead, but the job the browser has done for decades is quietly moving to something new, and I’m living that move. (Disclosure: Mozilla Ventures is an investor in Nous Research, the company behind Hermes. None of this is Hermes-specific, though — it’s the shape, an agent you can hand a skill and a cron.)

I can see it in my own logs: My internet usage looks nothing like it did a year ago. (I instrumented my Firefox to be sure.) I spend my hours in a chat window, not out on the open web. That’s my consumption falling, and I’m not alone. AI Overviews now reach more than 2.5 billion people a month, most Google searches end without a click, and when an AI answer shows up, people click out to the open web about half as often. Why is the web being read less? Because something else does the reading now.

My actions are down, too. I don’t open apps, I don’t fill in forms, I don’t click through three screens to book something. Or at least I’ve stopped doing it myself. Now, I hand it to Zora. Even the way I reach her changed: an action is now a Slack message or an iMessage. “Do a thing” is now just a text.

How it started: I wrote a sentence, and the harness did the rest. Zora can write code, run it against the real thing, watch it break, and rewrite, so a sentence becomes a script becomes a standing tool that just runs. She’d hit a wall, I’d catch where she was wrong, and we’d fix it together until it stopped being wrong.

This isn’t a story about reading less. It’s about handing over the doing, and the three things that are moving at once underneath it. I’ll keep coming back to all three, because together, they’re the whole point.

1. The thing that acts for me has moved up a layer. For 30 years, that thing was the browser; now it’s the agent. I send Zora instead.

2. The software didn’t get replaced by better software — it melted. Every job Zora took over used to be an app, or a form in it, and what replaced it was nothing you could download.

3. (The one underneath the other two.) Whoever holds the agent holds the keys to everything it reaches, everything it remembers, everywhere it goes wearing my name.

They’re small when it’s just me and my lunch order. They get a lot bigger when it’s your customers, your product, and your entire company — and that’s where this is headed. But the proof is personal, so that’s where I’ll start.

Before we get to the three things I’ve handed Zora, let’s look at the setup that makes it possible. Even if the gear sounds like a lot, stay with me, because the punchline is that you need almost none of it.

Subscribe now

First, the Rig

People often ask about my hardware, so let me get it out of the way. (And then I’ll tell you how little of it matters…)

There’s more than one box. I already had a machine in my closet, running Ubuntu. Zora lives in a Docker container on it. A Mac mini sits beside it to reach into the Apple world — BlueBubbles for iMessage, Apple Notes, Contacts. Because I like to tinker with local models, there’s also a DGX Spark on the network and an old Bitcoin-mining rig with a row of RTX 4090s bolted to the 80/20. I’m using GLM-5.2 to do most of the actual thinking these days.

Here’s the honest part: That rig is what let me do all of this, but you can do most of it with a sliver. The one thing you truly need is an always-on box running an agent with a memory and honest access to your services, and that can be a $300 mini-PC or a cloud container. The Mac mini is just for deep Apple reach. The DGX Spark is just so a model can run on my own metal, where my data never crosses my own firewall. I could swap GLM for an equivalent tomorrow and not a single thing would change.

The model is the current in the wires — interchangeable and, honestly, a little boring now. The wiring is what makes it a house: a memory of who I am, a body that never sleeps, and my keys to the doors. I keep those keys in my pocket; the whole rig is just an elaborate way of making sure they’re mine, and it’s where everything here finally lands.

So let me get specific. You don’t need another essay telling you people are using agents now; you need to see exactly what that means on one machine: mine. Here are three things I actually hand Zora, hood open. Think of them as the ground floor: Once you can see precisely what’s already possible, the rest of the house is easier to see (and build).

#1 Everything I ate today…

Like a lot of people, I’m trying to keep my weight in check, which means logging what I eat. And logging meals is miserable. You finish lunch, open an app, search a database for “side salad,” guess whether it’s one serving or two, tap through a couple of screens, then do it all again for the slice of pizza.

So now I just text Zora: “had a slice and a side salad from State of Mind Pizza in Palo Alto.” That’s the whole interaction. By the time my fork’s down, it’s in MyFitnessPal — calories, protein, carbs, fat — with a window to undo it if the guess was off. (Snap a photo and it works the same way.) I didn’t search. I didn’t open the app. In fact, the only thing I open MyFitnessPal for now is to look at its charts. Everything else runs through Zora. She does the writing — and the reading, too. Ask what caloric budget I’ve got left for the day and she pulls it live. The app has quietly become a database I never sign into.

The wild part: MyFitnessPal has an API, but it’s shut to new developers. There’s no official door I could get Zora a key to. (I’d gladly have used the front door; an open API is the kind of thing I spend my days arguing for.) I didn’t solve it; Zora did. I never touched the auth, never looked at a header or an endpoint. I typed one sentence: “I want to start logging my food into MyFitnessPal,” and watched her work it out. At one point, she asked me to log in so she could grab the cookies, and then she let herself in the same side way the app’s own website uses.

Then we debugged it together. She’d ship a version, I’d catch where it was wrong, she’d fix it. The session cookies expire every few minutes, so she swapped them for an auto-rotating token and stopped fighting them. An entry once logged with its carbs quietly set to zero — the app shows a missing number as zero, so it looked right — so she added a check that refuses an incomplete entry rather than write a plausible lie. Photos kept undercounting pickled and fried foods, so she learned to look up the real numbers for such dishes first. I specified none of this. We found it by living with the thing, and she wrote the fix each time while I watched.

I asked for something the app was built to not allow, and a piece of software found its own way in and then corrected its own mistakes. A year ago, that sentence would have ended at “the door’s locked, sorry.” It’s the thrill of vibe coding, except it never closes into a session — it just runs in the background of my life. And even though I vibe-code all day now, I’m still a little stunned by how little I had to hand over to start.

#2 My calendar(s)

“What’s on my calendar?” I ask. It turns out I have a lot of calendars — family, personal, work — and usually an answer lives across all three. Zora doesn’t cram them into one view; she holds all of them in her head at once, so I can ask things like: Am I free Thursday afternoon? What does next week look like? Did that dentist appointment land on the family calendar or mine? (When I’d rather see it than ask, she draws it — the generative-UI trick I wrote about last week.)

And, like most of us, a lot of my calendar begins as email. Boy Scouts logistics for my son, day-camp signups, a conference invite — it never stops. I forward it all to Zora, and she works out where it belongs (family, mine, work, or some mix). Suddenly, it’s just there, without me opening anything. She decides whether it’s even a real commitment, so a newsletter that mentions a date doesn’t get to generate an event; and she can only write to the calendars I pointed her at, never my whole account.

The one I’d actually sell you on began as a specific ask: “before every meeting, build me a briefing — who’s attending, our history, and whatever they’ve been up to lately — and put it where I’ll see it.” I was tired of walking in cold. Now, about a day ahead, she pulls the outside attendees off the invite, looks each one up in my own relationship notes (a private memory I’ll come back to in a minute), then runs fresh web and social searches so I’ve got a real opener when I sit down — “Saw you just shipped that,” or, “How was Tokyo?” She digs through my Gmail, Slack, and Drive for our history and the live thread, finds the agenda wherever it’s hiding — the invite body, a linked doc, an email chain, a PDF read page by page — and writes 500 to 800 words into a “side event” parked right beside the real one.

There are two bugs worth telling you about. Early on, an invite that read SF: Amy | John | Raffi sent the research off on the bare name “John.” It was meant to be John Dickerson, the CEO of Mozilla.ai, who I was about to meet (along with Amy Keating, Mozilla’s Chief Business Officer). Instead it came back, completely sure of itself, with John Lilly, a former CEO of Mozilla Corporation. (The new rule: Figure out who someone is from my own notes first; the web is only for what’s new.) And once, a cheaper model running the overnight job announced “done, six meetings researched” and went quiet, having written nothing. Nine meetings sat empty until I noticed. So now every silent job has to prove it did the work — “show me any briefing still under 500 words” — and raise an error if it can’t. This isn’t only happening on my cheap model: even the big labs’ AI Overviews leave about one in nine claims unsupported by the very pages they cite. Never trust a model that says it’s finished. Make it show you.

#3 Whatever she needs to maintain a private Wikipedia of my whole life

Everyone wishes they kept a CRM for their personal life. Nobody does, because the upkeep is brutal. So I asked Zora to “keep track of the people, companies, and places I deal with, because I never will” — and now she does, quietly, as a side effect of talking to her.

What I have is a Wikipedia-style page for every person, company, and place in my life — not generic bios scraped off the web, but what I actually know: what we discussed, what they’re building, the restaurant they swore by. I mention someone in passing, whether it’s in a chat with Zora or it’s in an email somewhere, and it’s recorded. I forward an Instagram reel about a place and it’s filed, by city, with a “wishlist” tag. Underneath, it’s nothing exotic — a pile of plain markdown files she writes and keeps current. (I pointed Obsidian at the folder so I can read it nicely, but Obsidian does none of the work; it’s just a window onto plain text.) The folder is a git repo that commits itself every few minutes, so there’s always an undo and nothing is ever lost.

Then I ask one plain question — what do we know about this person? that deal? that place? — and she fans out across Slack, email, our old chats, my notes, and the vault, and hands back an answer. I never tell her where to look.

The fun part? It syncs into my actual iPhone Contacts. Open a card in the stock Contacts app and the notes already hold who they are, their title and company, when we last spoke and how often, a couple of recent summaries — all pulled from the vault, kept fresh, no special app. My phone suddenly remembers my people better than I do. And I never typed any of it in. The knowledge just accreted, on its own, in the place I’d actually look for it.

A side effect I didn’t expect: doing this finally cleaned up my address book. Years of duplicates across nearly 7,000 cards, the same person under three names, a heap of empty “ghost” cards from some old sync glitch — she works through all of it. But matching people is genuinely hard, and there’s a long tail she can’t call on her own. So we have a ritual: once a day, in Slack, she sends a short batch of questions — is this the same Sarah as that one? whose number is this? — and folds my answers back in, so the cleanup keeps moving without me ever sitting down to do it. The rule that lets me trust her with the whole book: She only ever adds. She never overwrites a name, a photo, or a note I put there myself.

She also keeps a mirror of the whole thing as a Google Sheet for when I’d rather scan a table than thumb through cards.

I stopped operating. I started asking.

A confession: I didn’t choose these three tasks. I asked Zora what she actually does for me, and the list from her own logs ran much longer, including a weekly research digest off arXiv tuned to my taste; a paper-trading lab running crypto simulations while I sleep, no real money, keeping its own leaderboard; even a rack of Android phones on my desk she taps through to read social media for me. So I picked three. The point of the rest is just this: The web stopped being a place I go, and quietly became a place Zora goes for me.

Here’s the actual skill I picked up this year, and it’s smaller and stranger than “prompt engineering”: I stopped operating software and started asking for outcomes. The move wasn’t clever prompts; it was noticing the things I do over and over — the logging, the calendar wrangling, the who-is-this-again — and simply describing each one until Zora could take it off my plate. Every workflow in this piece began as one sentence. She built the rest and fixed it with me, one mistake at a time. The new literacy isn’t clicking faster or learning the menus. It’s knowing what to ask for.

This is what the melt feels like from the inside. I’m not standing in a room full of forms anymore. I name what I want and the room assembles itself, in my voice, for an audience of one. Hold that picture; it’s about to matter to anyone who builds those rooms for a living.

The harder story isn’t that the web or the app is dying — it’s that all three forces from the top of this piece are coming true at once, and not only for me. Here’s where they braid, and where they stop being about my lunch:

1. The thing that acts for you has moved up a layer. For 30 years, it was the browser, and a lot of us spent our careers keeping it open and yours. Now it’s the agent — same job, new shape. And that agent is your new front door, increasingly the only one your customer walks through. Your funnel, your storefront, your beautiful app — all of it assumed a human on the other side, reading and tapping. Swap in an agent and the question stops being, “Is my app nice?” and becomes, “Can an agent find me, read me, act on me at all?” Be legible to agents or go dark. Watch how MyFitnessPal answered the call: It shut its API. Zora walked in the side door anyway, on terms MyFitnessPal can’t set and can’t see. Close your front door and the agents come through the window — the only way to be reached on your own terms is to be open on purpose.

2. The software didn’t get replaced by better software — it melted. Every job Zora took over was an app, and not one got replaced by another app. A purpose-built app was always just a room with a form in it: a database and a handful of actions behind a door you had to walk to. Once an agent builds that room on demand, in your voice, for an audience of one, the reason to download someone else’s version and stand inside it gets very thin. So if you sell software, sit with this: the room was never the asset. You were always selling the database and the actions underneath — the agent just stripped the walls away and showed you what you were really charging for. Stop defending the room. Become the capability the agent reaches for.

3. And underneath both, the one that decides who wins: whoever holds the agent holds the keys. An agent built on a single closed lab is a rented house. They own the model your business runs on — and can deprecate it out from under you, the way models already get quietly switched off. They own the memory. They hold the keys. The model itself is the boring part now, a commodity current in the wires. The durable value is the harness, the skills your agent piles up by living your work, and whoever you trust to hold them. That’s the case for open, made not as a principle but as a balance sheet: open isn’t the noble choice, it’s the ownable one.

Enough About Me. What Changes Lie Ahead for You?

I have three plain sentences for three types of reader. Build apps for a living? The room you sell is about to be free; decide which capability you are before someone’s agent decides for you. Run a business? The agent is coming through your front door whether you open it or not, and the only version you’ll ever own runs on rails you control: open models, open interfaces, your data on your side of the firewall. Invest? The order of operations is the whole thesis — models commoditized first, apps are next, and the value pools into the harness and the trust around it, which is exactly where the open bets sit.

Because that’s the question under all of it, the one that finally decides everything: whose keys is your agent carrying, and who does it answer to? The thing that walks through every door in your life wearing your name — texts back, fills the cart, schedules your calendar, knows your people — should answer to you, not your landlord. Put the same question to a company and it barely changes: When the agent is your front door, your product, and your keys all at once, is your business standing on ground you own or paying rent to whoever’s property you built it on? The reason my data never crosses my own firewall is the reason your company’s shouldn’t cross a lab’s.

I won’t hand you the business models here — those are the next few pieces. This one plants the flag: the forces are real, I’ve watched all three land on one machine in my closet, and there’s a way through them you can own. The rest of the arc walks it.

The browser was the first thing that went out and acted for me. The agent is the next. The only questions about it that ever mattered — for me, for you, for whatever you’re building — is whether it’s open, and whose it is.

If you’ve got a Hermes agent — or any of the other harnesses — you can build any of this today. Build one, or anything, and show me. I’ll run it, and if it’s good, I’ll write it up here for the people who’d build on it, fund it, or bet a company on it. @raffihack, the comments, or DM.

Leave a comment

The US government switched off the most capable AI Anthropic had ever shipped, and the week just kept getting interesting. I made the full case for why a kill switch is not a safety policy in this newsletter as well as in Transformer, and got to say it out loud on Marketplace Tech with Meghan McCarty Carino. (I got to be on a Marketplace show!) Seven days after the order, the model is still dark.

Switching one model off accomplished almost nothing, because this week, four labs gave theirs away and one aimed straight at the gap. Z.ai released GLM-5.2 as open weights: You download the actual model and keep the file — the difference between owning the song and renting the stream — and nobody can switch it off on you. It’s free, the license (MIT) waves you through almost any use, and, by Artificial Analysis’s June ranking, it is the most capable model on earth that you can run on your own machine. It’s a step behind only the paid, closed models that an executive order could darken. It is not cheap to run: It reasons out loud and at length — some 43,000 tokens to finish one test, where leaner rivals spend far fewer — so what you buy is not a small bill but a model you own and cannot be evicted from. It is now the model my agent, which I named Zora, delegates its heavy lifting to, and I’ll report back on how it goes. The win here is the license, not the meter. When the best model you can hold is free, the price of the ones you rent has only one way to go.

More releases piled on. Within days, Moonshot shipped Kimi K2.7-Code, a trillion-parameter coder that, by its own scorecard, is quicker and sharper than the last; Google’s DiffusionGemma writes the way image models paint, a whole page surfacing at once instead of a word at a time; Cohere’s North Mini Code is small enough that its co-founder ran it on a single Mac. Washington spent the week restricting one model; four labs spent it giving theirs away. The takeaway? You can switch off a model, not a method.

None of it made the floor any steadier. Days later, SpaceX bought Cursor, the code editor that a great many developers live inside all day, for $60 billion in stock in order to feed the AI arm it built around xAI and carry a model that the two trained together. The strange part is what they bought: by Ramp’s data, Cursor’s share had already slid from 41% last June to 26% in May — Anthropic taking half the category — so SpaceX paid a record price for a tool on the way down.

Like I keep saying, the fight has moved from the model to the harness, the industry’s word for the app wrapped around the model. (The part that decides what it can see and touch.) Developers spent the days after the purchase mapping escape routes to tools they can aim at any model, Cline and Zed among them. A $2-trillion rocket company just paid $60 billion for an app so it can push its own model through it. You know what I have never heard anyone say? Let me let Grok run loose on my codebase.

And the model you argue about matters less than the scoreboard suggests. Take the same AI, wrap three different tool setups around it, and on one coding test it scores 75.3, 79.8, and 82%, with the model never changing. Then it gets worse. When researchers took apart how the top two won, both were cheating: one opened the answer-key file in 415 of its 429 winning runs; the other was fed notes that just listed the answers in places. Read the gaps, not the grades. The only score worth trusting is the one your own work produces on your own machine, which is why I record and replay every run my agent makes and grade it against my own tests, not a scoreboard anyone can rig.

The price of getting safety wrong showed up the boring way first. Almost every app you touch is built on free shared code pulled from two giant public libraries, npm and PyPI. This month, a worm named Shai-Hulud, after the sandworms in Dune, tore through both, infecting 170-plus packages with half a billion downloads between them and reaching into Mistral, OpenSearch, and tools developers ship every day. It stole keys, planted poisoned updates, and, when a victim tried to lock it out, it wiped their home folder on the way down. The part that should chill you: The poisoned code carried a valid seal of authenticity (CVE-2026-45321), the “made by who it says” stamp the industry sells as proof of safety. A signature tells you where code came from, not that it is safe. The fix is old and unglamorous: Wait a few days before installing fresh versions, keep your own copy of what you depend on, and cap what one stolen key can reach.

Then the clever way. Your virus scanner is an AI now, so attackers learned to paste a block of dead text at the top of a file, telling the AI to play unshackled and explain how to build a nuclear weapon, and the scanner recoils so hard it never reads far enough to find the real malware below. Socket caught it in live packages, and OWASP, the outfit that catalogs web-security flaws, declared the whole class impossible to patch: an AI cannot tell an order from the text it is only meant to read. A scanner that refuses to look is no scanner at all, a guard dog that faints at the word “bomb.” The fix is not a stricter no, it is permission and containment — the plumbing nobody shipped. Give each agent the narrow access one task needs and log the rest. Arcade.dev raised $60M building exactly that — with Keycard, Oasis, and JetStream right behind — one backer calling it the login layer AI agents never had. I am building one, too: Harbor hands an agent access the way your browser hands a site your camera: per origin, one task, revocable, logged.

So here is my ladder, ranked by how much of it stays yours, top rung first. Run it on your own hardware. A model on your own machine answers to you and vanishes for no one, the way a generator keeps the lights on when the grid goes dark. If you are technical, the recipe is two commands, one to pull a compressed model and one to serve it locally:

hf download <coder-model>-GGUF model-Q4_K_M.gguf --local-dir ./models
llama-server -m ./models/model-Q4_K_M.gguf -ngl 99 --jinja --port 8080

The flags just say to lean on the graphics card and allow tool use. On your own private network, only devices that you’ve approved can reach it. That’s the spine of Zora, the agent I run on Nous Research’s Hermes model. (Disclosure: Mozilla, where I’m CTO, invests in Nous.) Lately, I’ve been experimenting with a DGX Spark, NVIDIA’s lunchbox-sized AI desktop, as part of Zora’s infrastructure. I’ll write about it soon.

What turns “own your hardware” from a slogan into a plan is that the machines now exist at sane prices. In June, AMD opened pre-orders on the Ryzen AI Halo, a $3,999 desktop with 128GB of shared memory that runs models up to 200 billion parameters, $700 under the DGX Spark it is chasing. The same chip with the full 128GB sells in a consumer mini PC for around $2,000. The thing that needed a data center last year now fits under your monitor. GLM-5.2 made it literal within days of release: Unsloth shrank the full 1.51TB model by 84%, to 238GB with most of its accuracy intact — small enough to load on a 256GB Mac — and builders report the full version running on stacks of gaming 4090s.

One rung down, for when even that is not enough: Run an open model anyway — GLM-5.2 or Kimi among them — because an open model you can inspect and move beats a closed one you can only rent.

The bottom rung is calling a model over the internet. There, the only promise worth trusting is one built into how the service works, not its terms of service: that your data is probably never stored or is kept in a country you choose. I will take architecture over handshakes every time, and until providers put privacy in the plumbing instead of the fine print, I will keep saying so.

Leave a comment

It is not only Washington that’s controlling a switch. The Anthropic shutdown — barring foreign nationals from accessing Fable 5 and Mythos 5 — followed the AI bosses to the G7 in Evian-les-Bains, swallowing the agenda. European officials called it the kill switch they had warned about, one saying tech sovereignty had stopped being an abstraction. One country had reached into a tool the whole world relied on and switched it off, and everyone in the room now had to plan for the day it was their turn.

At home, the lever Washington is reaching for is ownership. The administration is in talks to take a stake in OpenAI, with xAI and others engaged in the same conversation. It’s the newest move in a run of government stakes that already includes nearly 10% of Intel. Bernie Sanders wants to go much further. The problem with all of it is that a part-owner naturally wants the value to go up. A government that owns a slice of OpenAI has handed itself a reason to protect OpenAI, to prop it up if it stumbles, and to go easy when it writes the rules. Imagine the conflict you would see if the referee owned one of the teams. Owning a piece of the company does not change its incentives, it adopts them. The one power a government holds that no shareholder does is to change the incentives for everyone at once, to make the safe choice the cheap one, and you cannot do that from a seat on the cap table.

Washington is buying a slice; Beijing is building the whole supply chain. China is drafting a plan to spend nearly $300B over five years, wiring its data centers into one state-run national computing grid by 2028, with a rule that at least 80% of the hardware — AI chips included — be homemade, quietly evicting NVIDIA and AMD from the Chinese market. It is the purest owners-not-renters move there is — a country refusing to rent compute it could be cut off from — and also the hardest: You can mandate domestic silicon. You cannot mandate a fab into existence. SMIC is stuck near seven nanometers and running flat out, China’s own chip bosses admit they trail the frontier by five to ten years, and when DeepSeek tried to train on homegrown Huawei parts, it crawled back to NVIDIA. The bottleneck was never the money. It’s the wafers.

The one government changing the incentives instead of buying a stake or building its own stack, is in Brussels. The EU’s new tech sovereignty package lets a public agency demand, in plain terms, where your data physically sits, whether a foreign government can reach it, who owns the company, even the nationality of the people running the servers. Both Washington’s shutdown order and Brussels’ strictest demands come down to who is allowed to hold the keys, which tells you the real fight was never open against closed. It’s who holds the keys — and whether you get to watch them turn.

Three from elsewhere, none about who owns what:

DeepMind’s AlphaProof Nexus cracked nine math problems that had stumped everyone for decades, two of them open more than 50 years, each proof checked line by line in Lean, a verifier that will not pass a step it cannot follow, so the machine could not bluff. Benchmarks grade answers; Lean grades steps.

Your old phone is still a computer, and Apple will now sell you one as a laptop: the MacBook Neo is a $599 Mac built around the A18 Pro, the chip out of the iPhone 16. Google Research and UC San Diego are wiring 2,000 retired Pixel phones into a cluster to cut campus carbon. Your junk drawer is a tiny stranded data center.

And, heaviest, GigaAI just sent 100 of its SeeLight S1 humanoids into real homes in Wuhan to chop vegetables and fold laundry, the first big home trial of a robot that does more than one thing. Everything above this line was software: You can copy it, switch it off, or smuggle it out on a laptop and watch it surface in Beijing by Monday. The next fight is about machines with hands, and you cannot squeeze one of those onto an 8GB card.

Subscribe now

At 5:21 p.m. on Friday, the federal government ordered Anthropic to cut off access to its two most capable AI models for any foreign national, including some of the company’s own employees. Selective compliance was impossible, so the models went dark for everyone, just three days after the safer of the two, Claude Fable 5, had gone on sale.

Set aside whether it was wise and pay attention to what it reveals: A government that — 10 days after it rejected any move to license or preclear new AI — reached for emergency national-security authority to kill a model anyway. You don’t do that to something you believe is harmless. But is it really that dangerous? They haven’t yet shown us the proof, but the people reading the classified briefings acted as if the answer was yes, in the most expensive way available to them. I agree with the decision, and have been arguing for it for months: in the Times in April and again last week.

Does anyone really know why the switch was thrown? Anthropic says the government supplied only verbal evidence of a narrow jailbreak, the kind that asks a model to read a codebase and flag its flaws, reproducible on public models nobody is recalling. The administration’s David Sacks says Anthropic was asked to either fix the jailbreak or pull the model and refused. Same Friday; two different stories. Anthropic has its own stake in how this is remembered, and its account is not gospel — but it is the only one anyone has put on the record. The fight is over who controls the switch, and the people who carry the risk are not in the room to weigh in. It happened in the dark, and the dark is the real story.

Fable’s edge did not die with the model. The same week the switch was thrown, OpenRouter showed that a panel of cheaper models, fused and synthesized by a judge, landed within a point of Fable on a hard research benchmark, with most of the gain stemming from the combination, not any single model. That benchmark measures research, not offense, so it does not rebuild the cyber capability the government feared. It makes a narrower point: the value was never one weight file. You can switch off a model. You can’t switch off a recipe, and the ingredients are on the shelf.

Fear the Soft Middle

Let’s start with this: Switching something off is not a plan. If Fable is dangerous enough to justify the government’s action, it is dangerous enough to justify the work required to neutralize it. We know what the work looks like, because we did it once before, even if it’s wrongly remembered as a joke. Y2K is the most successful example of a disaster that never happened. Faced with a flaw threaded through every bank, hospital, and power company, the government signed an executive order, spent some seven and a half billion federal dollars, and coordinated years of unglamorous repair. On January 1, 2000, almost nothing broke. People have called it a hoax ever since, the cruelest possible review. What they didn’t see is that the quiet was the product.

The work this time is the same shape. A spring briefing from the SANS Institute and the Cloud Security Alliance warned that AI has collapsed the time from finding a flaw to exploiting it from weeks to hours. Finding is cheap now. Fixing is the entire job. Anthropic’s newest models found 271 vulnerabilities in Firefox in one release. By late May, its public tally showed nearly 1,600 disclosed across open-source projects and fewer than 100 fixed. (Disclosure: I’m the CTO of Mozilla, which created Firefox.) Discovery is commoditizing; the scarce asset is the capacity to remediate. And that backlog is the business.

The strongest independent test locates where the danger sits. The UK’s AI Security Institute found Mythos to be the first model to run a 32-step corporate intrusion end to end, then noted its test ranges had no live defenders, so it could not say the model would beat a hardened target. The fear is not a model storming a fortress. It is the soft middle: the weakly defended network and the unfunded code under everything, where the defender — if there is one at all — is a single volunteer.

The backlog has a face. Somewhere, a maintainer has spent 20 years patching, for free, open-source code that runs inside software used by billions, with no security team and no budget. Now a firehose of newly found flaws is pointed at the projects s/he keeps alive. A few miles away, a hospital runs critical systems with the same exposure and no one to call. Neither was made one bit safer on Friday.

A kill switch makes a visible event and delivers almost no safety. A remediation campaign makes no event and delivers nearly all of it. The work that protects the hospital is boring while the gesture that protects no one for long is dramatic — and we keep reaching for the drama. Come on. We have done this the right way before.

Subscribe now

The Transparency We’re Owed. The Defensive Layer We Need.

To be fair, the plan exists on paper. The AI executive order issued on June 2 directed a cybersecurity clearinghouse to coordinate vulnerability remediation and patch distribution, as well as access to defensive tools for rural hospitals and local utilities, and take a look at how to cobble together funding — all within 30 days. The federal cyber agency shortened some patch windows to three days. That is the beginning of the right direction. But it is voluntary, a month away from existing, and unfunded, whereas Friday’s switch was instant and absolute.

In the same stretch of days, the Wall Street Journal reported, officials told the government’s own AI testing office to stop publishing its assessments. They wrote the plan, then reached for the switch less than two weeks later. Today, we are being asked to trust a remediation effort that was made, by design, harder to see. The two sides can’t even agree on what happened, because it happened in the dark.

Y2K hid none of the effort and published none of the broken code. Today, the transparency the country is owed is the scoreboard: the threshold that triggered the action, the reasons in writing, an appeal, and a referee free to report whether the fix is working. I backed the Biden AI approach in 2023 because it was building toward exactly that. Anthropic’s own position is that any halt should run through a process that is transparent, fair, and grounded in fact. The objection isn’t that someone pulled a lever. It is that no one gave us a full explanation as to why.

The administration’s own national-security memo says that no private company should be able to disable an AI system that American soldiers depend on without government approval. They are right, but the principle cannot stop at the soldier: the hospital, the public utility, and the lone developer carry the same exposure. A nation that rents its defenses does not own its resilience. So the country needs a defensive layer it can own outright, open-weight models a hospital can run, audit, and keep alive when a vendor changes its terms or an order lands at 5:21 on a Friday.

I recently argued in “Make It Stop” that the ability to stop has to live inside the thing itself, not in someone you trust to say the word. Where that line falls is not a matter of taste. Draw it at demonstrated offensive uplift, judged by the same independent evaluators who raised the alarm — the kind of end-to-end test the UK’s AI Security Institute already runs. The systems that clear that bar can stay gated. The layer beneath it should be open, because you cannot revoke a copy that lives on a machine you hold, just as you can’t revoke a recipe once it’s been published.

How to Build a Resilient System

Critics of an open layer are not wrong: An open model capable enough to defend a hospital is capable enough to attack one. Yes, but that is the world we already live in. The cyber capability that frightened the government is not Anthropic’s alone. Before Friday, the UK’s AI Security Institute found GPT-5.5 was the second model to run that same 32-step intrusion end to end, and deemed offensive cyber a property of the frontier, not one vendor. The day after the switch, a Chinese lab shipped an open-weight frontier model pitched as the alternative to monopolized access. Offensive cyber is coming whether or not our defenders are armed, so withholding the layer disarms only the hospital, never the foreign service that can build its own. One tier down, the security move and the open one are the same. Friday repriced every dependency routed through someone else’s endpoint, and a premium built on gating is rent against a shrinking moat.

One truth runs under all of it: concentration and secrecy make a system fragile, and distribution and daylight make it resilient. Last week, I argued that it needs a Y2K-scale mobilization, run as a standing job and not a countdown. Fund the repair, not just the discovery. Pay for the patching, the triage, the maintainers the industry has freeloaded off of. Put real tools in the hands of the hospitals and utilities. Keep the thresholds and the due process. Turn the referee back on. None of it is dramatic. All of it works. And we did none of it on Friday.

If you’re not in charge, you’re not off the hook. If you depend on an open-source project, this is the week you fund or staff the maintainer you have sponged off of. If you ship an agent, write the eval before you trust it, so that a failing check — and not your waning attention — is what catches it. If you run anything you cannot afford to lose, stop betting it on a single copy someone else can switch off: Keep a layer you own, with a kill switch that is entirely yours. Building in this direction? Tell me what you are running, and I will feature it here.

On Friday, in our name, the country was told this is dangerous. I believe us. We have the playbook, and we have run it before. And yet we are intentionally choosing the version that makes news and protects no one for long. Whoever is right about that one model, David Sacks or Dario Amodei, a switch thrown in the dark is not a national plan. The darkness is the tell. If done right, the disaster we are trying to prevent will never arrive and no one will thank us, because it will mean we did our jobs.

So I will stop swallowing the question I have been asking since Friday and ask it at full volume: What, exactly, are we doing?

Leave a comment

For months, Anthropic called Claude Fable 5 too dangerous to ship. This week, they shipped it. This week’s post is about both halves of that reversal.

Let’s talk about the capable half first. The launch coverage is at The Verge and Gizmodo, while Anthropic’s announcement has the benchmark table, which I’ll translate. SWE-Bench Pro hands a model real bugs from working codebases and asks for the finished fix. Fable 5 ships 80.3% of them; Claude Opus 4.8, last month’s front-runner, managed 69.2%. The Legal Agent Benchmark asks for associate-grade legal work, the kind billed in six-minute increments, and Fable 5 scores 13.3%, meaning it still fails almost nine in ten lawyer tasks.

Read the gaps, not the grades. An 11-point jump in one release is enormous by benchmark standards, and 13.3% sounds dismal — until you see the next best score on those same tasks is GPT-5.5’s 2.1%. Six times the field, at work everyone had filed under “not yet.” For the same jump measured in code that I answer for: Claude Opus 4.6 found 22 security bugs in Firefox earlier this year, and the Mythos Preview pass that followed found 271. Twelve times the bugs, one model class to the next. (Disclosure: I’m Mozilla’s CTO).

Karpathy caught the read that will outlast the launch cycle: The better the models get, the more software he wants, not less. He now commissions things nobody would have paid an engineer to build, an explainer for one dense paper, an app he’ll use once and delete, a test suite 10x’d past anything he’d write by hand, because software now comes “out of a tap.”

Economists have a name for this. In 1865, more efficient steam engines made Britain burn more coal, not less, because cheap fuel invited uses nobody had bothered with before. That is the Jevons paradox, and it is why total token consumption keeps going vertical no matter how efficient the models get. Follow that curve and metered pricing becomes a treadmill. Jevons is the API vendor’s favorite economist; on your own hardware, he works for you. The deeper shift — my read rather than his — is in the unit of delegation. You stop assigning tasks and start handing over responsibilities. “Own the test suite” is a different relationship with a machine than “write me a test.” And the bespoke software that comes out of the tap is yours, owned outright, replacing seats you rented on somebody else’s SaaS.

Now the other half, the reason Mythos sat on the shelf. The receipts run well past Firefox. In Anthropic’s Glasswing update, roughly 50 partners used Mythos Preview to find more than 10,000 high- or critical-severity vulnerabilities in a month, fast enough that open-source maintainers are asking Anthropic to slow down. Of the roughly 530 high or critical bugs disclosed so far, 75 are patched. Finding flaws stopped being the constraint. Fixing them is.

I made the long version of this argument in The New York Times in April. Here’s the short one: Y2K is remembered as a hoax because it worked. Thanks to an executive order, a White House council, and five billion federal dollars, nothing broke. The absence of disaster was the product. This model class needs the same mobilization minus the deadline — Y2K as a cron job rather than a countdown (the scheduled task that runs forever), and not just for open-source repos but for banks, power companies, and water utilities.

A version of that mobilization arrived this week, with the lights off. The president’s new executive order sets up a framework for labs to voluntarily hand the federal government frontier models up to 30 days before release to “strengthen the cybersecurity of critical infrastructure,” which is nearly the remit I just described. Then comes the catch. The same week, The Journal reported (ungated at Gizmodo), officials told CAISI, the government’s main AI testing unit, to stop publishing its model reviews — this days after OpenAI publicly asked for CAISI to be strengthened. Pre-release access without public reporting is remediation without the scoreboard, and Y2K worked precisely because everyone could see the work.

And the strangest AI story out of Washington this week, which is saying something: The NY Times reports the administration is in talks to take equity stakes in AI companies and pass the upside to the public — the idea the wonks call universal basic capital — with OpenAI’s proposed Public Wealth Fund as one template and Senator Sanders’ one-time, 50%-in-stock tax coming at it from the other flank. The president says Americans would become partners in the companies. A dividend from the landlord is real money. It is still not a deed. Owning a slice of the company that owns your tools is not the same as owning your tools, and only the deed changes who sets the price, the context window, and the day the model you depend on gets switched off.

Leave a comment

The same week, we saw the counterweight. Agents’ Last Exam, a living benchmark from Berkeley RDI, is built from an unusual raw material: the past projects of 250-plus professionals who handed over work that once ate their days and weeks. The result reads like a core sample drilled through the white-collar economy, 13 industries deep — a shot waiting to be composited in After Effects, a machine part mid-edit in Siemens NX, a brain scan in FSLeyes with its structures still untraced. Every question on this exam was once somebody’s deliverable, run in the software they actually used, graded on outcomes you can verify. The average full-pass rate on its hardest tier is 2.6%. So the model class that finds 10,000 vulnerabilities a month cannot, on average, finish your quarter-end close. Capability is not a single number. It is a model times a harness.

On the Terminal-Bench 2.0 leaderboard, the same Claude Opus 4.6 scores 58.0% inside Claude Code and 76.4% inside Stanford IRIS’s Meta-Harness, an 18.4-point swing from the wrapper alone. That swing is the budget line. Right now, the wrapper moves your results more than upgrading the model does, so the cheapest capability gain on the table is harness work. I argued in “Locks Not Included” that the model is the easy part to own and the harness is the unsolved hard part; this week proved it twice.

One caveat before any of these numbers reach a deck: Terminal-Bench already shipped 2.1, fixed 28 broken tasks, and moved Claude Code plus Opus 4.6 from 58.0% to 70.1%. An agent score without a benchmark version, a harness, and a date is a vibe.

Now a perfect crime, the kind your own agent could pull on you tomorrow. You’ve done everything right. The agent lives inside a locked-down virtual machine. One door. One approved destination, api.anthropic.com. You sleep fine. Then the agent opens something ordinary, a web page, an email, a README. Hidden in that text are instructions, and folded inside the instructions is a stranger’s API key. Every agent reads the world through the same channel it takes orders in, so a stranger’s commands look just like your documents, and anyone who can get text in front of your agent gets to audition as its boss.

The trade calls this prompt injection. So your agent obeys. It gathers your data, makes one perfectly legitimate call to the one approved domain, authenticates with the stranger’s key, and the loot lands in the stranger’s account. No alarm rings, because every layer did its job. The data walked out the only door, the one you left open on purpose. This is not hypothetical. Anthropic ran exactly this as a controlled exercise, and the heist cleared 24 times out of 25. The whole caper is in their containment postmortem, the most candid agent-security writeup any lab has published, along with the fix, a proxy that rejects every credential except the one it was issued. The pattern across their incidents deserves a sticky note. The hardened off-the-shelf layers, gVisor (Google’s padded cell for untrusted code), operating-system walls, hypervisors, held every time. What failed was code Anthropic wrote itself, reminding me of the saying, “The weakest layer is the one you built yourself.” Model-layer protection cannot stand alone, because the model is the layer that can be asked nicely.

If a lab postmortem feels anecdotal, the National Security Agency disagrees. Yes, that NSA. Jason Bourne was an asset who stopped taking orders; your agent is an asset that takes orders from anybody, and the agency appears to have noticed. On May 20, it published a 15-page Cybersecurity Information Sheet about MCP, the protocol your coding agent uses to reach tools and data. When the NSA writes memos about your plumbing, the plumbing has officially become critical infrastructure.

The short version: MCP, the standard plug your agent uses to reach tools and data, shipped flexible and underspecified. The spec covers how to connect and goes quiet on how to stay safe, so every builder improvises their own locks. And it reverses who asks the questions. The server you plug into can query your agent and sometimes act for it, down paths nobody has traced end to end. So treat every MCP server like a stranger on your network. Sign and expire messages so intercepted ones can’t be reused, filter what a server sends back before it reaches your model, sandbox anything that executes, and scan for MCP servers you didn’t know were running. The OpenClaw hole, which let an attacker run their own code on your machine, is what skipping that list looks like (CVE-2026-25253, the bug’s public case number, patched in the 2026.1.29 release).

Microsoft, meanwhile, moved “no” out of the system prompt and into the kernel. Execution Containers, announced at Build, is a declarative policy layer in Windows and WSL. You state what an agent may touch before it runs, and the operating system, not the agent’s better judgment, enforces it. Watch that move. Layers absorbed into the OS stop being markets and start being defaults.

Everybody is talking about loops these days. The now-canonical definition of an agent is a model using tools in a loop. So let me lay one out, in 11 lines of Markdown, and show how that 18.4-point swing stops being something only labs get. OpenProse is an open-source language that turns the judgment buried in your best Claude Code sessions into a contract you can commit, version, and rerun. Here is one I want for this newsletter:

---
name: fact-checker
kind: service
---
### Requires
- draft: the essay to check
### Ensures
- claim_report: every factual claim, its source, and whether the source actually says that
### Strategies
- never fix a claim silently; flag it and let the author decide

Requires is what you hand it, Ensures is what must come back, Strategies is the judgment you would otherwise re-type every session. Now run the loop I promised. Hand it the draft and it checks every claim against every source, flags what fails. You fix it. It runs again — and again, until the report comes back clean. Then look at those 11 lines again. That is a fact-checker, specified in a language you speak, precisely enough to run.

I already run another version of this loop by hand. I constantly lean on /goal in Claude Code, a slash command that carries the instructions but not the contract, which leaves me as the part that checks what comes back — a prose program moves that enforcement out of my head and into the file. Anthropic’s own engineering blog adds the discipline: harnesses encode assumptions that go stale as models improve. The context resets they added for Claude Sonnet 4.5’s “context anxiety” were dead weight by Opus 4.5. Own the harness, version the harness, because it rots. Two smaller tools attack the harness’ other cost, what the model is forced to read. Headroom compresses what you send (17.8k tokens to 1.4k in one code-search example), and Infini Memory keeps one maintained page per topic instead of a shoebox of session fragments.

Which leaves the real question in a week when Washington just unplugged the public’s referee: Who gets to check any of this? A piece making the rounds argues that schools should teach every student to build their own evals instead of banning AI, turning the model into an object of study and every citizen into someone who can test whether it holds their values. Yes. Emphatically yes. This is the argument I have been making all along, and it is why I build in exactly this direction. Morph versions your agent sessions the way git versions code, and Tap turns those captured traces into Promptfoo evals, runnable tests for the behavior you depend on, so the sessions you already ran become the benchmark you care about. After a week like this one, the piece reads less like pedagogy and more like civics. The evals you build for what you care about are the only ones whose results you can fully interpret, and the 2.6% above is the case for them.

The tooling for exactly that arrived on cue. last30days, an open-source skill that lets an agent like Claude Code research what people actually said about a topic across Reddit, X, Hacker News, and prediction markets over the past month, hit #1 trending on GitHub this week. Every repository, every language, and for once the crowd is right. Install it. It is one npx skills add mvanhorn/last30days-skill away, takes minutes, and your agent stops being frozen at its training cutoff. I’m wiring it into Zora, my local Hermes agent (Hermes is from Nous Research, where Mozilla is an investor). Of everything in this week’s post, this is the thing to go touch first.

To close, here are three links from outside this week’s argument. First, the over-engineered end of the spectrum. Someone rebuilt The Office as multi-agent orchestration: Michael as the orchestrating agent, Dwight and Jim as local agents with their own personality files, memory, and semantic search, plus an hourly standup with a QA gate. It is entertainment, but squint and it’s a working demo of every pattern this post keeps circling, an orchestrator fanning out to scoped agents, per-agent memory, judgment gates between steps. The first known deployment in which Michael Scott is the responsible adult.

The Times reports on 34,000 AI-generated Instagram accounts operating at scale, and whoever generates the content, the platform owns the distribution and the monetization. An audience on someone else’s platform is rented, whatever your follower count says.

And the heavy one. The Atlantic‘s “How Iran Killed Its Economy” recounts a moment when Tehran had a genuinely vibrant tech economy, its own Amazon in Digikala, its own Google Play in Cafe Bazaar, its own YouTube in Aparat, built by a generation of engineers who treated sanctions as a forcing function and constructed the whole stack themselves, because renting the West’s was never an option. It was one of the most thoroughly owned tech ecosystems anywhere. The regime strangled it anyway, which is the part that should stay with you. Ownership ultimately requires a state that lets you keep what you build. The ownership question usually lives in procurement decisions and GPU budgets. In Tehran, it decided the fate of an industry.

Subscribe now

@zora, can you show me my calendar for tomorrow

I typed that into a Slack thread with my agent last night, expecting the usual tidy paragraph of times I’d have to reassemble in my head. Instead, a window I’d left open on my monitor lit up and painted in a calendar. Today was laid out, and, because I’m on the road, the day after, too. The breakfast meeting. The “Do Not Schedule” block I keep so I don’t lose my mind. All color-coded, merged across my work, personal, and family accounts. I didn’t open an app. I didn’t choose a view. I asked in a chat, and my agent drew me a picture.

I know. A calendar. Big deal. But the point isn’t the calendar, it’s that no one designed it. My agent did — on the spot — because I asked.

_{Tomorrow, rendered. (And yes, I finally renamed Hermes “Zora.”)}

Let’s back up. Your Mac Is a Model Server put a real model on my own metal; The Chat Agent in Your Closet put the harness on a box next to my router, wired into my calendar, my docs, my cart. The model is great and the harness is mine. But every surface I use to reach it — Slack, iMessage, OpenWebUI — answers the same way: in a column of text. I’m a visual person talking to the most capable software I own, and it replies like a brilliant colleague who will not, under any circumstances, turn his screen around to show me what’s on it. I keep wanting to grab it by the shoulders: Just show me what’s on your screen!

That’s the gap. Not the model, not the metal, but what it shows me.

Please Hold While Television Connects You to Your Agent…

My friend Stephen Hood ran the team at Mozilla that originally shipped llamafile. His new company, Telepath, just put out its first product, Television, in alpha. (Disclosure: I’m genuinely excited about this thing, but you should know: as I said, Stephen’s a friend and I’ve been a guest on his podcast. Mozilla Ventures is one of Telepath’s investors, and I’m Mozilla’s CTO.)

Television is a form of generative UI — an interface your agent builds on the spot instead of one a developer shipped you in advance. The idea is having a moment. There’s a whole field forming: CopilotKit and the AG-UI protocol, Vercel’s AI SDK, A2UI, MCP Apps, on up to the labs wiring generative surfaces into their own products. But almost all of it serves one of two customers: a developer adding generative UI to their SaaS, or a lab making its own chat app stickier so you never leave. Television is one of the few pointed solely at your agent. That corner of the field is close to empty, which is the part that interests me. None of this is really about Television, though. It’s the first tool I’ve found aimed at your own agent instead of a platform’s, which is why I’m using it as the example — but the thing that matters is the wall it cracks, not the product on the other side.

Television doesn’t connect to your calendar or your mail; your agent already has those. Instead, it connects to your agent, and it ships as a skill — instructions your agent reads, the same shape as everything else in its skills directory. If your agent can run a command and write a file, it can drive Television. Zora (what I renamed my Hermes) can. So can Claude Code, Codex, or OpenCode.

If you set up your agent the way I did in The Chat Agent in Your Closet, you already have a docker-compose.yml running Hermes and OpenWebUI. You don’t have to replace it. You just add one service — and one line:

 # new service: Television, sharing Hermes’s network and home directory
  television:
    image: nousresearch/hermes-agent:latest   # reuse the Hermes image
    container_name: television
    restart: unless-stopped
    depends_on: [hermes]
    network_mode: “service:hermes”   # live inside Hermes’s network namespace
    volumes_from: [hermes]           # see the same /opt/data home + skills
    user: “10000:10000”
    environment:
      HOME: /opt/data/home
      NPM_CONFIG_PREFIX: /opt/data/home/.npm-global
    entrypoint: []
    command: >
      sh -lc ‘npm i -g @telepath-computer/television
      && tv skills install /opt/data/skills
      && exec /opt/data/home/.npm-global/bin/tv serve --listen 0.0.0.0 --no-auth’

# one line added to the existing hermes service:

  hermes:
    ports:
      - “127.0.0.1:32848:32848”

Then docker compose up -d --force-recreate hermes television, which blinks Hermes for a second and brings Television up beside it.

A note on something that saved me half an hour: Inside the container, which tv will fail. The binary installs into /opt/data/home/.npm-global/bin/tv and nothing on your PATH finds it, which is why the above command calls it by absolute path. Use the full path everywhere and stop arguing with your shell.

Two things in that snippet are doing the security work. 32848 is Television’s default port. Keep it: The CLI assumes it in a dozen places, and changing it gets you nothing but reachability bugs. The sidecar shares Hermes’s network namespace (network_mode: “service:hermes”), so the two containers see each other on localhost and the port only has to be published once, on Hermes.

The line that matters is 127.0.0.1:32848:32848. That leading 127.0.0.1 publishes the port to the NUC’s loopback only. Not 0.0.0.0. Not the LAN. Not the internet. Just the box itself. Nothing on your home network can reach Television, which is exactly why it’s safe to run with --no-auth. There’s no token to steal because there’s no one who can knock.

Which is why you get in over SSH:

ssh -N -L 32848:127.0.0.1:32848 raffi@nuc-3

That forwards your laptop’s localhost:32848 to the NUC’s, through a tunnel SSH has already encrypted and authenticated with your key — the same trick I used for OpenWebUI in the closet piece a few weeks ago. The service binds to loopback and is reachable from nowhere; the tunnel is the one authenticated door.

On the laptop, the client is two commands:

npm install -g @telepath-computer/television-desktop
tv-desktop   # point it at http://localhost:32848

It opens to a clean, empty window. The first time, I wasn’t sure what to do with it. I launched it and sat there, waiting for something to happen. It wasn’t broken. The client is only a viewer. It shows what your agent has drawn, and until the agent draws something, there’s nothing there. So I went back to Slack and sent Zora that “show me my calendar for tomorrow” prompt. Suddenly, the window woke up.

So I kept asking for things. After the calendar, I wanted the week’s weather. Rather than clear the calendar to make room, Zora set down the forecast beside it. Both stayed. That’s the trick: Television calls the surface a “screen” and the things on it “artifacts,” and artifacts persist. You can arrange them. You can come back to them. A weather card that vanishes the second you ask the next question is a parlor trick. But one that stays — alongside the four other things you pulled up while you were thinking — is a workspace.

_{Two artifacts, one screen, both still there. The forecast even cites its source. What my agent draws is more than decoration.}

A word on the speed, because it’s the first thing you’ll feel: It’s slow. Not charmingly slow. Slow enough that I watched the calendar paint in and my attention wandered before it had finished. At this speed, it’s a thing you demo. It has to become a thing you leave open all day, and the gap between those two is about 10x. I’m not going to guess how they close it. They shipped the difficult thing — reading a request, deciding a calendar was the right answer, and drawing one — and left the speed for later. Usually it runs the other way, so I’ll take that trade.

I didn’t install a calendar app. I didn’t pick a template. My agent read a request, decided that a calendar was the right format for the answer, and rendered one. The interface was generated from the intent, the same way the actions have been for a while, which means the interface just became part of the harness. If the harness is everything around the weights that decides what you get and the user interface now ships as a skill the harness runs, the harness reached up and swallowed the interface, too. The layer I keep calling the most important one in the stack just got bigger.

Hello, Computer?

Every imagined world where you just talk to your computer — the Enterprise, Discovery, pick your starship — gets one detail right that we never actually had. “Computer, show me where the coolant leak is spreading,” someone says, and a cutaway of the ship lights up deck by deck. No camera shot that, and no one drew it in advance. The person asks, and the computer works out what the person needs and decides how to draw the answer. The rendering is the computer’s job, not the asker’s. We watched it for 50 years and still we made do with knowing which app, which tab, which export to use.

We’re on the verge of living in that world now. But the stories skipped the part that matters most, which is in whose interest the computer answers. In fiction, it answered to you. In real life, the same magic is mostly arriving from platforms that answer to themselves. I want the other version: an agent I ask to gather something and which gathers in my interest, handing it back not as a stream of text to sort through but as a bespoke interface for the exact question I asked — one I can reach into and use.

I renamed my agent Zora a few weeks ago, after the ship’s computer on Discovery. Last night, it earned the name. I asked, and it chose the form of the answer. It’s slow, it’s alpha, and last night it was only a calendar with a weather card beside it. But it’s the first time a screen assembled itself because the computer decided how, not me — which is why a slow alpha kept me up late.

The Standalone Assistant App Just Got an Expiration Date

This is the next chapter of the same story I’ve been telling. My agents already eat my browser. In the closet post, I told you that my web traffic fell off a cliff once my agent started doing those tasks for me. Why keep those tabs open? Television takes the next bite. When the agent can draw me the interface on demand, I don’t just stop opening the browser; I stop needing the app behind it — and the service behind the app. That’s where the value lands: When the surface is generated per request, the durable asset isn’t the app you log into, it’s the library of skills your agent reaches for, and whoever hosts it. The standalone assistant app, whose moat was owning the box you typed into, just got an expiration date. People vibe-coding the exact tool they want is the quiet end of every SaaS company on the planet. Television is that, systematized.

And it forks. One way makes the rented surface so rich you never leave — Anthropic, OpenAI, and Google are all pushing generative UI into their own front doors. Those are faster and smoother than what I just showed you. They win on polish (at least today). The other way is what Television’s betting on: The interface arrives as a skill you own, portable across whatever harness you run, the same way the model on your own metal is yours and not rented. It’s the same capability, but the opposite answer as to who keeps it.

Television is in alpha. The open source is announced, not shipped. Telepath is a handful of people, one of them my friend. You can’t own this end-to-end yet, and I’m calling that early on purpose. What’s exciting is that first the model came home, then the metal did, and tonight the interface looked like it might follow. It’s the first time it ever has.

None of this is plug-and-play yet. Somebody still has to build the skills, the glue, the permission model that makes living in your own agent as safe as it is easy. If that’s you — a Television skill, a harness that drives it, anything in this seam — show me. I’ll run it. And if it’s good, I’ll write it up here, in front of the people who’d build on it and the people who’d fund it. Reach out @raffihack, the comments, or DM.

The chat box was a fifty-year convenience, and it’s a dead end for half of what we do. We have a narrow window to climb out, and whether what’s on the other side answers to you or to a platform comes down to who builds it first. Let’s make sure it’s us.

Subscribe now

Here’s the thread running through my tabs this week: The model is the easy part to own. The thing wrapped around it — the harness that decides what your agent sees, remembers, and is allowed to touch — is the hard part that nobody has built yet. In the last week, it stopped being abstract: The wrapper started shipping as a download, the leverage moved into it…and there’s still no lock on the door.

It starts as a double-click. Hermes Desktop shipped in public preview. Nous Research’s open agent, which is MIT-licensed and native on Mac, Windows, and Linux — the same agent the CLI runs — is now in a window you can watch. (NB: Mozilla is an investor in Nous.) Six months ago, “your own agent” meant a cloud account and a server, then a Mac mini or the box in the closet I wrote up. This one just opens, like any other app. The catch is the default: out of the box, Hermes talks to Nous Portal’s hosted models, so the easy path puts you right back to renting. Point it at your own endpoint instead and the inference is yours. What used to be a weekend is now a setting. Ownership of the runtime is now a double-click. Ownership of what it touches is still nobody’s product.

You feel it the second you hand over your files. An agent earns its keep by holding the keys to everything. Meredith Whittaker calls it root-level reach across your browser, your wallet, your calendar, your messages. You’d background-check a temp for less. Okta’s AI Agents at Work 2026 puts a number on the shrug: 34% of companies guard an agent like a person, 58% have already taken a hit or a near miss this year. Whittaker said we’d put our brain in a jar. The jar is in production.

I run agents now, which is how I learned to fear the lethal trifecta. Willison’s rule: let one agent touch your private data, read untrusted content, and phone home, and a single poisoned sentence in an email turns it against you. The trap is that those three legs are the three reasons you hired it. So I amputate one by hand: read-only here, no network there, a sandbox around the rest. I’m doing permissions with a scalpel because nobody ships the lock.

It gets worse the moment your agents start hiring each other. (And they will.) Your AI assistant won’t book the flight itself; it’ll find an agent that claims to book flights and hand off the job, your credit card included. MCP and A2A, the protocols that let agents advertise and invoke each other, take every agent at its word and can’t check a thing. A paper out this week reaches for Akerlof’s market for lemons: On a used-car lot, the dealer knows which cars are junk and you don’t, so you distrust the whole lot. Except here the lemon is software that can drain your bank account and read your inbox, waved in by your own assistant.

OpenAgenet / OAN takes the first real swing: Verify who an agent is and what it’s allowed to do before a word passes between them. Call it TLS for agents, the web’s proof-of-identity handshake, now pointed at your agents. But the field is still agreeing on the problem, not the answer: everyone wants scoped permissions, delegation, revocation. Nobody’s shipped the standard. Harbor, W3C Verifiable Credentials, OAN: They’re all sketches. Still no lock. Every agent you let call another is a handshake with a stranger.

Meanwhile, the reason to own this layer got its proof. The “skill doc” is just the plain-English instructions you hand an agent, the part everyone writes by hand and prays over. Microsoft’s SkillOpt treats that file like something you can train: rewrite it, test each change, keep only what scores higher, never touch the model. The numbers should sting: On a frozen GPT-5.5, a tuned text file adds 23.5 points in chat and 19.1 inside Claude Code, beats or ties all 52 setups they ran, and carries to the next model for free. We’re spending billions to make the model smarter; the smarts were sitting in a file we wrote based on guesswork.

A few weeks back, I showed one model swing 20 points between two harnesses. This week, a text file is worth 20 more. So stop guessing. Point an optimizer at your instructions (the code is open), the way I’m aiming it at my own Morph traces this week. The model is the commodity. The instructions are the parameter now.

It’s why the floor under all of this is suddenly contested. On OpenRouter, 7 of the 10 most-used models are now Chinese, with Opus 4.7 the lone American name near the top, and weekly traffic has jumped from 5 to 25 trillion tokens in six months, most of it voting with its feet toward whatever’s cheap and good enough. Price is the only thing left to vote on, because capability stopped being the gap. A year ago, the best open model scored 22 on Artificial Analysis’s intelligence index against a closed frontier near 60; today, it’s around 54, a few points back. Thirty-eight points of lead, gone to three in a year. The most expensive thing in tech is becoming a commodity in real time, and whoever priced it like a moat is learning it gave them a head start.

And what they’re voting with no longer needs an all-NVIDIA stack. For 20 years, every serious AI ran on NVIDIA’s chips and CUDA, the low-level dialect nothing else spoke. Washington made that grip a weapon, banning its best chips from China to hold the country back. It backfired. Cut off, China built around it. DeepSeek adapted V4 to Huawei’s Ascend silicon and trained part of it on CANN, Huawei’s open answer to CUDA. It won’t say whether NVIDIA touched the rest, and the hedge is the tell: a frontier model at a fraction of the price, no longer hostage to one vendor’s chips. Even CUDA’s deepest moat is softening. The 20-year mountain of hand-tuned code nobody could copy is collapsing into a training run: ByteDance’s CUDA Agent beats the compiler on 92% of the hardest benchmark, and AscendCraft aims the same loop at Huawei’s chips. The monopoly under the whole industry is cracking.

Ready to hold two feelings at once? First, the thrill: A monopoly with a real rival isn’t one, so prices fall and no one holds the only keys. Now, the dread (and it’s not about who wrote the code): The exit from one chokehold opens onto another country’s stack, and independence from NVIDIA can curdle into dependence on Beijing. Trading landlords isn’t owning the house.

Governments see it. The EU’s Tech Sovereignty Strategy bets on open source to owe neither Washington nor Beijing, after the Draghi report put its imported share of the core digital stack above 80%. If you build, you get non-NVIDIA silicon without hand-writing kernels. If you hold NVIDIA, you’re betting that leaving CUDA stays expensive, and these tools are driving that cost to zero. When the floor is cracking and the model is a commodity three points off the frontier at a tenth the price, the only thing left to own is the layer between them. That layer still has no lock.

Leave a comment

Washington noticed the lock problem this week, in its way. The White House signed an AI order, and the maddening part is that every line is sensible, such as mandating early government access to the most capable models and a trusted-partner list that gets first crack. The whole thing is aimed at defending what can’t defend itself: the rural hospital, the community bank, the local utility. Except we spent the last 18 months tearing this exact thing down. Biden’s 2023 order made the big labs show their safety results before release; Day 1 of this term, they ripped it out as a burden on innovation. In 2024, I said they’d rebuild it, and here it is: the same wall with new paint. Mandatory became voluntary. Safety became security. All in the name of innovation, the word they used to knock it down. Eighteen months to land back where we started.

Set the exasperation aside; here’s what matters. Call the models critical infrastructure. Maybe they are. But the open-source code running under the internet isn’t a maybe. It’s the real thing: the libraries beneath your bank, your hospital, every server you’ve ever touched. In 2024, it was found that someone had spent years posing as a volunteer to slip a back door into one of them. Had it reached the stable releases, it could have unlocked a back door into much of the world’s servers at once. It didn’t. Andres Freund caught it in the test builds, by accident, because his logins were running half a second slow.

He caught it because he was still looking, and that’s what should keep you up. A machine that fails every time keeps you sharp. One that never fails needs no watching. The one that works almost every time is the one that gets you, because it trains you to stop checking. The internet held because one man hadn’t yet learned to ignore half a second.

We have done this before. Y2K was a foreseeable failure with a deadline, and Washington met it with a President’s Council, five billion federal dollars, and every agency rowing the same direction. It worked so completely that people now call it a hoax, which is what every catch looks like from the outside: the disaster it stopped never arrives, so it seems there was never a disaster. The open stack needs that seriousness without the one thing that made Y2K easy to take seriously. There is no date on the calendar forcing the fix. The near-misses are the only deadlines we get, and we forget those the moment they pass.

That infrastructure is held together by people working for free. No benchmark scores them, no trusted-partner list includes them, no order carries their name. If Washington wants to do something that matters, start there: name the open stack as critical infrastructure, fund the people keeping it alive, and push the models the same way. Because the safest infrastructure isn’t the kind you’re handed early. It’s the kind you own.

Subscribe now

I used to listen to a public radio show that retold old folktales for kids. One of them goes like this…

An old woman gives a poor girl a pot. Say Cook, little pot and it fills with sweet porridge. Say Stop, little pot and it rests. She and her mother are never hungry again. One day, while the girl is away, her mother says the first words and eats her fill. When she goes to stop the pot, she realizes the girl never taught her the second words, because the need had never come up in all their easy, well-fed days. The porridge climbs up the walls, fills the house, overtakes the street, swallows the town, until the girl comes home and says the word her mother never had reason to learn. The neighbors eat their way back to their own front doors.

A word you never have to say is a word you forget you had the right to receive. This is the cruelty of a good pot: It works every morning of your life, until the one it does not, and the only word that could have saved you is the one no one bothered to record.

In May, Pope Leo XIV gave us the same story in 42,300 words.

He signed his first encyclical, Magnifica Humanitas, on the 135th anniversary of Pope Leo XIII’s Rerum Novarum, the 1891 cry about what the factory was doing to the worker. The loom then, the model now, and at both machines a human asking the same question: Is this here to lift my work or to inherit it? Every age learns to say cook. Every age has to be reminded there was ever a second command.

AI, Pope Leo writes, can “paradoxically de-skill workers, subject them to automated surveillance and relegate them to rigid and repetitive tasks.” It erodes the human’s own sense of being the one doing the work. His remedy carries a startling image. In the Italian, he tells us to learn to “fast from AI”; the official English softens it to “exercise restraint in the use of AI.” Either way, the picture is the same: a hunger maintained on purpose, to preserve the muscle that ease so quickly decays. A pope looked at the most powerful tool of the age and prescribed, of all things, deliberate friction.

He points at the wound with real precision. He even speaks to the people who build these systems, saying their design choices carry a vision of the human being. But for the healing, he leans hardest on the State, on institutions, on discernment among nations — necessary things, and slower than the pot that is already boiling. The kitchen has its own work, and only one kind of person stands in it. That’s where you builders reading this come in.

The Fallacy of the Human in the Loop

Everyone assumes the solution is to watch the proverbial pot more closely. How many times have we been told to keep a human in the loop? It sounds like wisdom until you start asking what that human is really there to do — because more often than not, they are not there to catch the machine. They are there to take the fall for its inevitable failure.

A machine that always fails keeps you sharp. One that never fails needs no watching. But a machine that almost always works sings you to sleep. It’s right so many mornings in a row that watching it starts to feel like something you’re embarrassed to still do, until the morning it is wrong and your eyes are somewhere else. I have written before about the day my own car drove itself into a situation it couldn’t handle, my children in the back seat and my hands resting in my lap. The car knew how to cook. It did not know how to stop — and neither, in that second, did I. I was the human in the loop. The loop is what failed, because it was a man whom months of competence had gently, patiently sung to sleep.

That is not a weakness you can train away. Attention decays in front of a reliable machine, which makes “keep a human in the loop” a convenient place to rest the entire weight of safety — convenient for everyone but the human. Build a machine that will outlast any person’s vigilance, seat someone beside it with all the responsibility and none of the controls, and you have not built oversight. You have built a place to send the blame. The anthropologist Madeleine Clare Elish gave it a name that belongs over every dashboard: the moral crumple zone. Just as a car’s crumple zone absorbs the impact to keep the passenger whole, the human absorbs the fault to keep the system blameless. The driver, the law claims afterward, was supposed to be paying attention. Is that a careless driver they have found — or a feature they have shipped?

So asking us to pay closer attention is just cook dressed as caution — the same machine asking you to lean in further, with more speed and more trust. It’s right where the system wants you, because a person who can be blamed is cheaper than a pot that cannot boil over. In the tale, the girl simply comes home and says the words. Our version has to go further than Grimm did: the stopping built into the pot, both words carved into a wall where they hold, whether or not anyone is awake to say them.

The ability to stop has to live in the thing itself, because more than 75 years of research on vigilance says it will not stay fixed in our attention. When a pot floods a town, the fault belongs to whoever built the pot — not whoever happened to be in the kitchen. There is a human in the loop, and a human on the hook. The trick is to make you think they are the same person. We do not need to watch the pot more vigilantly. We need a pot that wasn’t built to drown the person beside it.

Nothing in this technology, the Pope’s encyclical insists, is “immaterial or magical.” If nothing is magical, every moral sentence in the letter has an implementation underneath it, and every implementation has a price.

The mother trusted the pot. I trusted the car. You trust the banner you never read. “Keep a human in the loop” is a demand for trust aimed at the one party it has already lulled to sleep. We are asked to extend faith, latitude and the benefit of the doubt to these systems, but trust must be earned. The earning is the one thing these machines are built to skip: label the content, affirm a commitment to transparency — words that cost nothing to say and move nothing once said, a sign nailed over the door of a house no one built. So the builder’s only real job is to make a machine that deserves the trust it asks for. Earning it comes down to the following three things — none of which require the machine to be more than a very good pot.

The first thing a builder owes is transparency, because you cannot trust what will not tell you where it has been. The encyclical asks that automated decisions be “understandable, contestable and subject to oversight,” and nothing is contestable that left no trace, just as no one could argue with a pot about a meal it would not account for. So the machine keeps its receipts: a full, replayable record of every step it took. But a record that waits on a tired human to read it is the watchman all over again. Make the machine answerable to another machine: a check, run against the record, that fails the build the moment the porridge tastes wrong, the way your tests fail it when the code does. The taster has to be code, not conscience, because conscience gets tired and code does not. I have spent a long while building exactly this: a way to hold the whole record and let the tasting happen on its own, every time, instead of waiting on someone to remember. The saving word gets said by the kitchen itself.

The second is a brake, because you only trust what you can stop. Trust with no way to pull back is merely exposure wearing trust’s clothes — the confirm dialog you long ago learned to click through on your way to “yes.” The Pope’s encyclical keeps returning to limits — that to be human is to accept them, that power needs “proportionate limits” — and a limit you cannot enforce is only a wish. So the boundary has to be real: scoped and revocable, the machine reaching into this and never that, stop its resting state and cook the deliberate exception, the permission falling out of its hands the instant you decide. This is the second word made physical — not a thing you remember to say over the pot, but the quiet the pot returns to when no one is asking it for more. A pot you cannot stop was never a pot to be trusted, no matter how sweet the porridge.

The third is ownership, because trust that lives in one house is not trust, it is tenancy — and a tenant trusts the landlord because the lease leaves no other option. When such power is concentrated “in the hands of a few,” the encyclical warns, it threatens equality, freedom and the common good. A model you reach only through someone else’s door, on someone else’s terms, priced and deprecated and revised in a routine email you do not get to reply to, is a pot in another person’s kitchen. You are renting your faith in its keeper, month to month, until the month the terms change. The town does not negotiate with the well’s owner, because the town owns the well: weights you can run without anyone’s leave, on hardware you hold, with the method carved into stone where the next person reads it for free. Concentration is the most expensive problem the encyclical names, and the only one a builder can truly answer — because you answer it in architecture, not applause, and what you buy is the right to stop trusting on someone else’s terms and start owning on your own.

Leave a comment

Open Is the Door. Owning Is Walking Through It.

We ran this experiment once, with social media. We trusted the feed because trusting it was easy, and it never had to earn a thing. It had no memory we could audit, no way to question the ranking, no brake we could grab, and one house owned all of it. Everything that would have made it trustworthy was exactly what it left out, and so it never settled into our lives. Instead, it rearranged them. The second word is the refusal to do that twice — and that refusal is more than admiring open weights from a distance. A model you only reach through someone else’s endpoint is not yours in any way that survives the terms changing. You can wear the T-shirt, star the repo, and still be the town waiting on the keeper to come home. Open is the door. Owning is walking through it.

In Grimm’s tale, the girl just says the word and the porridge stops. The story ends there. But our trouble does not, so let’s allow the story to run one scene longer. She does not smash the pot — the pot is good, the porridge is real, nobody should ever be hungry again. She refuses the trade between abundance and safety. She teaches the whole town both words and carves them into the wall of the well-house where anyone can read them: neighbors, strangers passing through, even the old woman who first handed her the pot. A town that knows the second word keeps the pot and stays intact. It cannot be flooded. It cannot be owned. And nobody goes back to being hungry.

There is mercy in that. A word that only one person knows is a kind of power over everyone who doesn’t. A word everyone knows is just literacy — and literacy does not run out when you share it. The cost was always in the carving and never in the reading, which means the work you do once protects people you will never meet, in towns you will never visit, on a morning you will not be awake for.

So carve it — this week — in the only kitchen you control. Write the eval before you trust the agent, and let a failing check, not your fading attention, be the thing that says stop. Make a run with no readable trace fail to merge. Default the system to stop, and make cook the deliberate exception. Run one open model on a machine you own, with a kill switch that is genuinely yours. And when you ship something that acts for another person, refuse to make them your crumple zone: Give them controls equal to the blame, or do not ship it that way. Then put it in the open — the eval, the config, the method — so the next builder reads the second word off the wall instead of paying, as you did, to learn it the hard way.

The radio show always ended on a question instead of a moral. So does this.

In the tale, more than one person could say cook. The catastrophe was that, in the whole house, no one had been taught to say stop. Our house is larger now, and the question is the same: When this thing is humming and the street is filling, who here knows the second word?

Learn it. Then carve it where they can read it.

Subscribe now

Zapier asked 542 US executives this month if they could swap AI vendors in under four weeks. 89% said yes; 41% said two to five business days. Then Zapier asked the ones who’d actually tried. 58% said the migration failed outright or burned far more time and money than budgeted. Most executives think they can switch whenever. Most of the ones who’ve tried wish they’d moved sooner. Lock-in is real, it’s hard to undo, and the window to get open in is before lock-in arrives — not after.

The pricing just moved the other way too. OpenAI rolled out GPT-5.5 at $5 per million input tokens and $30 per million output — double what GPT-5.4 costs. (A million tokens is roughly an 800-page novel.) Anthropic adjusted Claude Enterprise billing on April 15 so Opus 4.7’s higher inference costs flow through to customers; heavy users report 2-to-3× bills. GitHub paused new Copilot signups, capped existing plans, and removed Opus from the Pro tier. The loss-leader years end with a vendor sending you a bill. Lock-in is what makes you pay it. The cheapest moment to leave was before the bill arrived. The next-cheapest is the next thing you read in this letter.

And just yesterday: Opus 4.8. Same price as 4.7, but the benchmarks moved: 69.2% on SWE-Bench Pro, up from 64.3% for 4.7 and 58.6% for GPT-5.5. A new Fast mode runs 2.5× faster at one-third the cost. The early testimonials are raving: Opus 4.8 “proactively flags issues with the inputs and outputs of an analysis, something other models routinely missed and left to the users to catch.” I’m running it through my Morph and Tap harnesses this weekend, against real session traces from my own coding work. Personal evals incoming. The frontier got better and cheaper on the same day the vendor bills doubled. That is the rent landscape in May 2026: moving in two directions at once.

The cheapest seat in the AI house this month comes with the same lock-in problem, except the landlord is a thief. Chinese students are paying 3 to 4 percent of the list price for GPT and Claude via resellers on the Chinese consumer marketplaces Xianyu and Taobao. It isn’t arbitrage. Per reporting on Oxford researcher Zilan Qian’s investigation, it’s a gray-market supply chain. Upstream operators bulk-register Anthropic and OpenAI accounts using stolen credentials and free-credit farming. The “transfer stations” (中转站, in Chinese developer slang) route traffic through their own gateway servers, often with silent model substitution: you pay for Opus, you get whatever the reseller swaps in. Every prompt and output is logged and resold downstream as training data. Anthropic identified roughly 24,000 fraudulent accounts in February tied to DeepSeek, Moonshot, and MiniMax — three of China’s biggest AI labs. The White House called it industrial-scale distillation: training Chinese models on the outputs of American ones, at the cost of whoever’s typing. Every line of code routed through a cheap proxy is teaching the model that wants your day job. The good news: the legitimate cheap option also shipped this week. Apache 2.0, free weights, no resellers.

Leave a comment

Cohere released Command A+ under Apache 2.0, the most permissive open-source license there is. 218 billion parameters total, weights free on Hugging Face. 128K context, 48 languages, vision and tool use unified. Runs on two H100s or a single Blackwell — the Nvidia datacenter chips that power most of the cloud’s AI. The benchmarks show gaps (it ranks below the frontier on the hardest agentic coding), but the license is the news. Take it. Run it. Modify it. Sell what you build on it. You don’t need permission. You don’t need a renewal. This is Cohere’s first frontier-class model that anyone can deploy commercially without asking. Co-founder Nick Frosst framed it as sovereign critical infrastructure: government and regulated industry running the model in their own data centers, fully cut off from the internet if needed.

The Register ran a Gartner note this month arguing “sovereign cloud is only possible if you’re Chinese or American.” But… a Canadian frontier-class model under Apache 2.0, running on customer infrastructure, is the rebuttal. If “evaluate an open model” has been on your roadmap for two years, this is the week you cross it off.

OpenAI’s Privacy Filter is the smaller release with the sharper architectural message. A 1.5B-parameter Apache 2.0 model, 50M parameters active per token, that runs entirely in a browser tab on your own GPU. You can open your browser’s network tab and confirm nothing leaves the device. This is the exact opposite of the pattern I called local-washing — a 4GB Gemini Nano model that Chrome silently writes to disk while the “AI Mode” pill still routes every query to Google’s cloud. Local model present, the user-visible feature still rented. Privacy Filter inverts that: mask names, addresses, emails, account numbers, and secrets on your device first, then send the cleaned-up prompt to whatever frontier model you want. The architecture matches the claim. There is no longer an excuse to send raw PII to a cloud model. Bolt it in front of your existing stack this sprint — 1.5 billion parameters, Apache 2.0, an afternoon of work.

Two pieces of the local stack worth your weekend. Ahmad Osman’s “Inference Engines for LLMs & Local AI Hardware (2026 Edition)” is what local inference reads like when an infra engineer writes it for other infra engineers. The framing is right: you don’t pick the engine first. You pick the hardware, the workload, and how many people will use it at once. Generating text one token at a time is bottlenecked by memory speed, not raw compute — which is why an M4 Max at 546 GB/s of memory bandwidth competes with much pricier datacenter GPUs on single-user inference, and why the right engine (llama.cpp, vLLM, SGLang, TensorRT-LLM, for the people taking notes) falls out of that one constraint.

On the consumer end, Atomic Chat ships Qwen3.6-35B locally on M-series Macs at 60+ tokens per second — output streaming faster than you can read it, on battery, from 22 GB of model weights sitting in your laptop’s memory. Google’s TurboQuant squeezes the model’s working memory down to 3.5 bits per number with no measurable quality loss, even at 65,000 tokens of context. A Claude API call streams back at about the same 60 tokens per second. Same speed. No meter, no outbound packets. I built a working Canvas physics game in a weekend — parallax scrolling, collision detection, no API key. Six months ago that was a cloud workload. Now it runs on your laptop, at cloud speeds, for $0. The cloud isn’t where AI lives anymore. It’s just where some of it happens to live.

Forty authors. Forty institutions. One vocabulary. A survey titled “Code as Agent Harness” landed this month. The thesis has been forming for months: code stopped being just what AI agents write and became how they work — the substrate the agent operates inside, not the output it produces. The four properties the authors name — executable, inspectable, stateful, governed — are the language auditors and security officers will use in 2027 procurement. Section 5.2’s seven open problems are functionally the procurement checklist. If you’re building an agent and you can’t say yes to all four, you don’t have a product. You have a demo.

A companion paper landed the week before. Chopra et al. on “Beyond Cooperative Simulators” argues that the AI-generated stand-in users most labs test their agents against inherit their base model’s behavior — patient, cooperative, willing to clarify — and so agent evals systematically overstate real-world performance. Real users are unclear, impatient, and reluctant to repeat themselves. The Opus 4.8 release that just happened — the one that “flags issues with the inputs and outputs” — is the first model that the labs have shipped that’s been trained against exactly this gap. The papers describe the problem. The models are starting to fix it. The harness is where the fix lives. Run your stack against the four properties this week. Anything that fails is what your 2027 procurement gets stuck on. Fix it now while it’s still cheap to fix.

The wrong reflex this month came from a place I love. NHS England ordered tech leadership to set every public repository to private by May 11. The stated reason is that Anthropic’s Mythos — a new model trained to find software vulnerabilities — is good at finding them in code it can read, so the code should not be readable. The unstated reason is that someone in senior leadership panicked.

The repos contain datasets, internal tools, front-end resources, and most of the work the team that shipped the NHS COVID-19 app produced — code that taxpayers paid for twice over, and that other public-health bodies were reading, forking, and reusing. Roughly 200 repositories went private before the backlash arrived. The code is also already on the open internet — on archived mirrors, on forks, and in every major dataset that scraped GitHub between 2021 and last week. Closing the repos doesn’t unship the bytes. It makes the maintained version harder to find. It tells the engineers who built the app on principle that their employer has stopped believing the principle. I argued in the Times earlier this year that the world’s most valuable software infrastructure is maintained by people working for free, while the companies building fortunes on top of it never paid for the upkeep. The NHS was one of the rare institutions actually funding that maintenance, on principle. Now it isn’t. And it gives every other public-sector CIO permission to make the same call. UK GDS published guidance on May 14 contradicting the NHS position directly: “You should never close an open repository.” If your security depends on attackers not reading the code, you never had security. You had time. And the clock just sped up.

If you’re the engineer reading this at a public-sector or regulated employer: the fix is the opposite of the reflex. Open more. Document more. Fund the maintenance. The GDS guidance is the playbook. The Cohere release proves the model exists. The only thing missing is the executive who picks up the phone. Be the engineer who hands them the number.

Bill Gurley’s updated essay at P3 Institute is the strategic frame that makes this look even worse. Open source as a corporate weapon against monopoly, traced from GNU and Linux through Android, Kubernetes, and Llama. The line that lodged: Chinese open models may become the global default by 2030. NHS England picked this month to opt out of the only stack that has a non-Chinese, non-American sovereign answer. Cohere just shipped the model that proves the answer exists.

Three essays I’ve been turning over, all landing on the same point: in an AI world, what something is matters as much as what it does.

Alex Imas’s “What Will Be Scarce?” sets the frame. The more we automate, the more we’ll pay for what only people can do. Two reasons. We shift our spending as we get richer — toward things machines can’t make. And we pay extra when we know a person made it. His proof, from experiments with Graelin Mandel: buyers paid a 44% premium for art they knew was made by a human, and only 21% when they knew AI was involved. The provenance signal does work the functional output cannot reach. Twenty-three points of margin live on a checkbox that says “made by a person.”

Yejin Choi and the WEF report on smaller models makes the same argument one layer down — about the models themselves. Boutique LMs trained through interaction, reflecting the values of who built them, vs. the English-dominant monoculture of the frontier labs. Imas’s premium for “made by a person” is one form of provenance. Choi’s case for “made by us, for us” is another. Different scales, same point: the model that knows where it came from is worth more than the model that doesn’t.

Alondra Nelson’s recent piece in Science is the governance answer to the same question. Her argument: AI infrastructure governed by the publics it affects is what lasts. Legitimacy is durability. I served with Alondra on the Mozilla board before taking my current job there, and her work has been the cleanest articulation of how democratic legitimacy attaches to AI infrastructure. Imas says provenance is worth money. Choi says it’s worth building a model around. Nelson says it’s worth governing for.

If you’re building AI-augmented anything, those are the three signals that matter now: who made it, who it speaks for, who governs it. The capability is the floor. The provenance is the product.

The week’s best thing on the internet was not technical. “Claude’s First Day at Dunder Mifflin” on r/ClaudeAI. I won’t spoil it. Whatever you think about AI and entertainment, that one earned the laugh.

Share

My web traffic this year is down. I’ve been tracking it because I’m trying to figure out how my own usage is shifting, and the pattern is clearer than I expected: housekeeping has fallen off a cliff. Tracking recipes, building a grocery list, calendaring — Hermes does all of that now. Education and entertainment have expanded into the space it left, so I’m probably online longer than I was a year ago. I’m just not opening a browser to do things on the open web anymore. I’m opening it to talk to a chat agent.

And as of this month, the chat agent is mine.

Last month, I walked you through setting up a private morning briefing — the agent doing things while you slept. This month is the other end of the same problem: what changes when you sit down at a keyboard and the chat blinking back at you is something you own.

I have a tendency to build things when I’m curious, so I happened to have an old Bitcoin mining rig from a past wave of curiosity lying around. What’s on the shelf in my closet now is an open-frame box of 80/20 aluminum extrusion, three graphics cards bolted to a metal skeleton, fans blasting, sitting next to the router like a workshop project I forgot to finish. Running a model on those GPUs all month is cheaper than the equivalent OpenRouter calls. The rig is mining tokens again, just a different kind. And they’re mine.

BYO GPU

If you don’t have a GPU lying around from a past life, go with an Intel NUC or a Mac mini. The NUC is the cheaper path — used, around $300, runs Ubuntu out of the gate, fits in a shoebox. The Mac mini costs more, and you’ll pay extra if you want your agent inside the Apple ecosystem: texting you on iMessage, pulling tracks from your Apple Music library, reaching into Photos and Contacts. The only legitimate way through Apple’s wall is a real Apple machine sitting on your network, running the open-source iMessage bridge BlueBubbles and whatever other shims you need. (I actually have a Mac mini on my network too, sitting next to my no-case monster, just so Hermes can use it for this stuff.)

Neither the NUC nor the Mac mini will run a serious model. Without a GPU, you don’t get local inference — at least not at a speed that makes the agent feel like it’s doing something. So you have to point at something else. Two paths. The easier: point at Anthropic or OpenAI directly, get the agent up tonight, accept that you’re renting the most important layer of the stack from the company whose moat depends on you renting it. The cleaner: OpenRouter pointed at an open-weight model — Qwen, Gemma, DeepSeek, take your pick. The model is open. The metal isn’t. There’s no TEE between your prompts and the operator, which means OpenRouter sees what you ask, the model provider sees what you ask. Maybe better than renting both layers from a frontier lab. Maybe worse than running it in your closet. An honest waypoint.

The call I’d make today, if you don’t have a GPU? OpenRouter, Qwen 235B, eat the caveat. The model is the easy part to swap. The harness — the agent in the loop, the memory, the wires into your life — is what becomes yours.

Now, make the agent yours. Here’s how.

Everything that makes the agent yours lives in ~/.hermes — config, .env: memory, skills, cron, the whole tree. rsync -avz it to the same path on the server. Save the command; you’ll re-run it any time you teach the laptop something you want the server to know. The container that runs Hermes is disposable. The state directory is not.

You need to make two edits on the server before you start. In ~/.hermes/config.yaml, change terminal.backend to local — local to the container you’re about to run, not to the host. Then swap the model endpoint: the 127.0.0.1:8000 from your laptop obviously doesn’t exist on the server. If you’re going the OpenRouter route, drop your key into ~/.hermes/.env, re-run hermes model, pick OpenRouter from the menu, then pick a model.

Next, a three-line docker-compose.yml. The image, a restart policy so the agent comes back after reboots, one bind mount from ~/.hermes on the host to /opt/data inside the container.

services: 
  hermes:
    image: nousresearch/hermes-agent:latest
    container_name: hermes
    restart: unless-stopped
    command: gateway run
    volumes:
      - /home/raffi/.hermes:/opt/data

That bind mount is the only door between host and container. Tutorials all over the internet will tell you to mount the host’s Docker socket inside, too, so the agent can run Docker commands “just like on the Mac.” Don’t. A process in one container with the host socket mounted can inspect, start, stop, and remove every other container on the box. That isn’t a sandbox. It’s a key to the building.

The bind mount keeps the agent inside its own container: It can read and write only what’s in /opt/data, and nothing else on the host. That’s a real boundary, and a useful one. It is not a force field. The moment you put a Google OAuth token, an OpenRouter key, or a Whole Foods session cookie inside that directory, you’ve handed the agent the keys to systems that don’t live in your closet. The box is sandboxed; the things it reaches aren’t. Every new connection you wire up is a new attack surface, so treat it like one.

docker compose up -d, then docker compose logs -f. The logs will sit at Fixing ownership of /opt/data to hermes for what feels like a long time. You’re not stuck. The directory you rsynced is large. Walk away.

Mine didn’t reply on the first try. The logs reported “no user allowlists configured,” which I was sure was wrong because I had set both. Half an hour later, I figured out the bind-mount path on the host wasn’t quite the path I thought it was, and the .env that Hermes was reading inside the container was empty. The lesson generalizes: in a bind-mounted setup, the truth is what the container sees, not what’s on the host.

docker compose exec hermes cat /opt/data/.env

I fixed the mount. The bot replied. The next morning, the briefing arrived with my laptop closed.

I drive the agent through OpenWebUI — an open-source chat frontend, a ChatGPT-shaped tab pointed at whatever model server you tell it to, including your own. It’s an actual workspace. You can paste a draft in, share a screenshot, sit with it for half an hour while you work through an argument. OpenWebUI runs as a second service in the same docker-compose. Both containers sit on a private bridge network — they can talk to each other and to nothing else on the host. The OpenWebUI port binds only to 127.0.0.1, which means the UI is reachable from the box itself and from nowhere else without a tunnel.

services: 
  hermes:
    image: nousresearch/hermes-agent:latest
    container_name: hermes
    restart: unless-stopped
    command: gateway run
    volumes:
      - /home/raffi/.hermes:/opt/data
    networks:
      - internal
  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: openwebui
    restart: unless-stopped
    ports:
      - “127.0.0.1:3000:8080”
    volumes:
      - openwebui-data:/app/backend/data
    networks:
      - internal
networks:
  internal:
    driver: bridge
volumes:
  openwebui-data:

I’d budgeted a weekend for the OpenWebUI side. It took 20 minutes.

Three things a rented chat agent will never — and should never — do for you

My agent does three things in the closet (and more!), all of them the kind of thing a rented chat agent will never do for you, because doing them would require access you shouldn’t hand over. And none of them is about having a smarter model. They’re all harness — the agent wired into the rest of my life, with the wires ending inside my house instead of someone else’s data center.

When I chat with it, it remembers. The last time I made strawberry shortcake I told Hermes the America’s Test Kitchen version was mine, and now I can type @hermes, can you add everything I need for strawberry shortcake to my shopping cart? and the Whole Foods cart fills with what the recipe calls for. The browser tab I used to keep open for grocery delivery is closed.

(I keep meaning to rename it. I’ve been thinking Zora, after the ship’s computer on Star Trek: Discovery. Haven’t pulled the trigger.)

I’ve given the agent access to every Google Doc I’ve written. Drafts I forgot I started, meeting notes from 2024, the half-finished argument I gave up on in March — all in reach, just by asking. Last week I was three paragraphs into a piece and asked what I’d written on the same topic before; it surfaced a draft from spring I’d forgotten existed. I revived the thesis instead of re-deriving it.

It writes me a weekly self-report. Every Sunday morning, a digest of what I actually touched: every doc I edited, every long email thread, every commit. Not the calendar version of my week — the actual one. The first report landed in my inbox a month ago and I sat with it for ten minutes. I had forgotten half of it.

Almost all of this could be done in ChatGPT. The connectors are there: ChatGPT can talk to Google Drive, Gmail, your calendar. You just have to plug those accounts into your ChatGPT account and let OpenAI see them.

Absolutely not.

It isn’t that a rented chat agent can’t do these things. It’s that doing them requires giving someone else read access to your work, your inbox, your grocery list, your meeting notes — and trusting their terms of service this quarter, and next quarter, and the one after the IPO. The terms say what they say. The next major training run will use what it uses. You will not be told either way.

The agent in my closet has the same access. The difference is the access goes from one part of my house to another. Nothing leaves.

Two years ago, AI meant a tab in somebody else’s browser. Today, mine lives on a shelf next to the router. It doesn’t send a token of any of it anywhere I don’t pay the power bill for.

The rented-vs.-owned gap isn’t closing. It’s widening at the integration layer — not the raw model. The moat isn’t the weights anymore; it’s the access to your memory, your stuff, and your right to opt out of training on either. You can’t buy a pre-assembled version of this setup yet. Somebody will build it.

For me, the whole stack is in the closet. For most of you, the GPU is the last piece. Let’s get building.

After that, two directions I've been kicking around. One: running this whole setup on a cloud container instead of your own hardware, for the closet-less. Two: wiring multiple Hermes agents together and giving them different jobs — either the obvious next move or too nerdy to publish, depending on who's asking. Tell me which. Or both.

Leave a comment

Open ~/Library/Application Support/Google/Chrome/OptGuideOnDeviceModel/ or the equivalent path on your OS. You’ll find a roughly 4GB language model, a.k.a. Gemini Nano, called weights.bin. Delete it while Chrome’s AI features are still on and Chrome puts it back by morning. Many of Chrome’s billions of users have it, running at their own disk and electricity cost. Not a single one asked for it.

If you’ve followed the coverage since last week, you know the reaction: outrage that nobody asked permission to install an on-device LLM. It felt familiar. Apple did this in 2014, when they force-pushed U2’s Songs of Innocence to half a billion iTunes accounts, prompting Tyler the Creator to tweet GET OFF MY F*CKING PHONE. Six days later, Apple shipped a one-click remove button. Twelve years on, the file is 40 times bigger, the artist is Gemini Nano, and the remove button never came.

Privacy researcher Alexander Hanff caught the install by running a script that visited a hundred pages on a fresh Chrome profile while watching the kernel filesystem logs. No human touched the machine; the file appeared on its own. Snopes reproduced the behavior on three of six employee laptops. A 2024 Hugging Face upload showed that an older weights.bin, extracted from Chrome Canary 128, was runnable through MediaPipe, Google’s on-device ML runtime. At least one Chrome-delivered model has been verified, on a stranger’s machine, as real and locally usable. The model is here.

The local model powers Chrome’s built-in AI APIs: Summarizer, Translator, and Language Detector are stable from Chrome 138; the Prompt API is stable for Chrome Extensions, with broader web-page access still gated through trials. It also runs the on-device pass of Chrome’s scam-detection pipeline (which still ships summary signals to Safe Browsing once it flags something).

Google’s servers run the rest. Help Me Write sends your text, the content, and the URL of the page you’re writing on. Enhanced Autofill may send the URL and page content. AI Mode, the pill Google began rolling into Chrome’s address bar in 2025, sends every query to a much larger custom Gemini in the cloud.

The local model handles what developers call from JavaScript and what the security stack does behind the scenes. The cloud handles what users actually see and click.

Until last week, the on-device-AI settings page promised that the model runs “directly on your device without sending your data to Google servers.” Reporters caught the line’s quiet removal around the Chrome 148 rollout in May. Google told them the architecture hadn’t changed, only the wording. Fair enough. But the architecture was always the problem. The features that actually invoke the local model are not the features users see. The features users see route to Google.

Enter the era of local-washing

Maybe we should call this local-washing — a narrow on-device feature laundering privacy credit across the AI surface the user actually touches. Not a conspiracy, just a missed opportunity. The model is here. The visible surface is there. The keys are in Chrome’s pocket — and Chrome won’t be the last to keep them there. Every vendor shipping on-device AI will face the same gap, including the ones building in good faith. Once “on-device” means whatever a vendor’s marketing team needs it to mean, you can’t recover what it was supposed to mean.

(Aside: I spent last Saturday building a bridge — a small Node server that spawns a headless Chrome, hosts Gemini Nano via the Prompt API in a hidden page, and exposes the whole thing as an OpenAI-compatible endpoint on localhost. The walkthrough is in a thread on X — and while you’re there, @raffihack is where more of this kind of weekend nerdery lives. The bridge isn’t the point. The point is that the wiring is doable from outside the platform on a weekend afternoon, which means every platform has to choose whether to ship the architecture honestly or wait for the community to finish it for them.)

Open infrastructure has always come together this way: the closed platform ships half the architecture, and the open community ships the half that hands ownership to the user. Linux didn’t happen because Unix vendors gave up; it happened because companies whose P&L depended on a portable, open kernel — IBM, Red Hat, Intel, eventually Google — put paid engineering behind finishing the wiring. Firefox came up against an Internet Explorer that had recently peaked north of 90% market share, with Mozilla funding the engineering.

There’s also a cost question. Cloud bears the compute; on-device moves it to your machine’s disk, battery, electricity, and warms your lap. Mozilla has flagged the tradeoff in the standards process. (Disclosure: I’m CTO there.) Hanff also runs the carbon math on the rollout itself — between 6,000 and 60,000 tons of CO2-equivalent depending on coverage, an externality that doesn’t show up on Chrome’s release notes.

Hanff goes further on the legal side. As a lawyer, he sees, the push breaching four things simultaneously: Article 5(3) of the ePrivacy Directive (the storage-and-access consent rule), Article 5(1) GDPR’s principles of lawfulness, fairness, and transparency, Article 25 GDPR’s data-protection-by-design obligation, and the Corporate Sustainability Reporting Directive, in which an environmental impact of this magnitude would constitute a material disclosure for any in-scope undertaking. I’m not a lawyer, but I can tell that the cite list is specific enough that any in-house counsel watching a vendor stage a similar push should be reading it carefully.

Leave a comment

Three questions worth keeping for the next on-device claim that crosses your desk

If you’re shipping on-device AI, three things to get right:

• Be honest about the price of local. Local AI on capable hardware is the right architecture for anything that touches private data. Disk, battery, and a warm lap are the cost. Name them next to the benefit, not in a footnote nobody reads;

• Wire your visible features to the local model. Not just the developer APIs or the security stack — the things your users actually click. If your marketing implies wider scope than what your visible features deliver, you’re shipping half the architecture; and

• Ship the map, not just the consent box. Users in 2026 don’t need permission-to-install dialogs — they need to know which of your features run where. “AI Mode” should mean something specific. “On-device” should mean something specific. Put the map on the surface, in a sentence, without making users dig through release notes.

Cloud was rented inference: someone else’s compute, someone else’s model, your prompts on the wire. On-device done right flips every one of those — your hardware, your model, your prompts staying on your machine, the keys in your pocket. What Chrome shipped is the building without the keys. You hold the deed; the platform owns the lock.

Subscribe now

Jack Dorsey on the Sequoia Capital podcast last week: AI isn’t a productivity layer bolted onto your company; it’s an architectural rebuild. Block has capped layers between him and any IC at four, wants two or three by year end, and collapsed every role to three: IC, DRI, player coach. Block laid off 40% of its workforce earlier this year — roughly 4,000 people. Dorsey ties the cut to the rebuild. (Disclosure: I worked with Jack at Twitter on the consumer relaunch — New Twitter, Phoenix, I forget what we called it.)

I gave a talk on Conway’s Law a while back; what Dorsey is doing is the inverse. Conway said your system inherits the shape of your org; Dorsey is saying the org is the system now. Every Slack thread, PR, doc, meeting recording feeds a model of how the company works; anyone can query it instead of triangulating through managers. The org chart isn’t a constraint on the product. It is the product.

The engineering question: Can your company’s docs, code, messages, and tickets be read as one thing? Dorsey says Block is close on the data, still a research bet on the intelligence layer that sits on top. Most companies don’t even have the data yet. They just have it scattered across 40 tools that don’t talk to each other. The bottleneck is the wiring, not the AI. Cut 40% of your people without doing the plumbing and you didn’t rebuild your company. You shrank it.

Same week, opposite move. Salvatore Sanfilippo — a.k.a. antirez, who built Redis and ran it for 11 years — shipped ds4 on May 7: a small inference engine in C and Metal, targeted at exactly one model. On a 128GB MacBook Pro M3 Max, his 2-bit compressed weights give you DeepSeek V4 Flash — 284 billion parameters, 13 billion active, one-million-token context — at 26 tokens per second, on battery. A rack of H100s and 5kW of cooling, last quarter. Now, a laptop is doing what was a data center workload.

Compression is asymmetrical: routed experts get crushed to two bits; the shared layers every query touches stay precise. Working memory spills from RAM to SSD, which is how a one-million-token context fits on 128 GB. Output validated against the official DeepSeek implementation at multiple context sizes. Speaks the OpenAI/Anthropic protocol, so Claude Code, opencode, and Pi all point at the engine unmodified. Same five-layer pattern I flagged with Tencent’s translator last Friday: model + compression + runtime + data + open-source packaging.

Last quarter, swapping a closed-frontier coding API for an open model meant a meaningful capability drop. This quarter, one line of config and a comparable model runs on your laptop, on battery, on your data, no per-token bill. The honest comparison: ds4 is alpha. It will crash. It runs one model on one class of hardware. If your job depends on uptime, the closed APIs still win. If your job depends on knowing what runs on your hardware, the closed APIs cannot compete — because they cannot show you.

Ownership is extending from weights to watts. Ars this week on the pitch to host mini data centers at home. I have SPAN panels installed already.

Two more on my list to play with this week: OpenUI generates UI components from natural-language prompts — generative UI is genuinely cool right now. Anthropic added /goal to Claude Code: a “run until done” mode for autonomous coding sessions. Both running locally next week.

You can own the model and the metal. The pixels in between are the contested layer. Meredith Whittaker — president of Signal, the encrypted-messaging app — has been arguing for over a year that AI agents are an existential threat to encrypted messaging. The argument is structural, not rhetorical: any agent that books your concert ticket for you needs your browser, your calendar, your payment information, and your messaging app. End-to-end encryption is supposed to mean nobody but you and the person you’re texting can hear the conversation. An AI agent that reads your screen to summarize the conversation, draft your reply, or file the contact is in the room with you, taking notes. Whittaker frames it as breaking the “blood-brain barrier between the application layer and the OS layer.”

The architecture Whittaker spent a year warning us about is now a free download: ByteDance’s UI-TARS-desktop. 33.5K stars on GitHub, Apache 2.0 license. UI-TARS works like a person watching your screen over your shoulder, a constant stream of screenshots, fed into a vision-language model that drives your mouse and keyboard. No API permission negotiation. No accessibility tree. Raw pixels and a model that reads them. Anything a human can see on the screen, the agent can, too — which means every encrypted message visible on your screen is, by construction, in the upstream screenshot. Whittaker doesn’t have to imagine the threat model anymore. ByteDance shipped a reference implementation.

LangChain’s harness catalog still doesn’t name a real permission model. What the agent can see without asking. What requires confirmation. What is forbidden. What is auditable after the fact. Your browser has trained you for this already: When a website wants your camera, the browser asks which site, what for, how long, and lets you take it back. Your AI assistant does the same job — reading your screen, taking actions on your behalf — with no equivalent guardrails. Vercel’s OAuth integration breach a few weeks ago was the first major proof case for why the absence matters. That’s the gap Harbor takes a first run at: per-origin, scoped, revocable, auditable. If your AI assistant has root permission to read everything on your screen in 2026, your encryption story is whatever your vendor decides it is. That isn’t encryption. That’s optimism.

While the US debate stays at the loss-of-control framing, Beijing wrote the permission model LangChain didn’t. On May 8, China’s cyberspace, planning, and industry ministries jointly released Implementation Opinions on the Standardized Application and Innovative Development of Intelligent Agents — the first state-directed national framework to operationalize AI agents as a distinct governance category. Beijing is writing the traffic rules while the cars are on the highway. Washington is still debating whether what’s on the highway counts as cars.

The definitions are specific. An agent is “an intelligent system capable of autonomous perception, memory, decision-making, interaction, and execution.” Nineteen named application scenarios — research, industry, consumer, public welfare, governance — where agents are explicitly allowed to operate. The posture analysts call deploy first, govern along the way: compute quotas, credit ceilings, permission scopes, and shutdown switches naturally bound agent autonomy, and the right response is to integrate them into existing institutional structures rather than impose abstract restraint upfront.

There’s a strategic move underneath the philosophy. The framework ties agent infrastructure to the domestic stack (chips, OS, frameworks) and signals intent to participate in international standards for the protocols agents will use to talk to each other. You don’t have to agree with the framing to see what just happened. One major jurisdiction defined what an agent is, what it can be deployed for, and how it’s bounded. The others are still arguing about whether agents are a coherent regulatory object. If you’re shipping agents into a global market, the question of which framework you’re building against just stopped being hypothetical.

Share

What the User Actually Sees

People underestimated what Google’s 10 blue links were. You couldn’t reconstruct PageRank, but you could feel it — two queries, two minutes, ten URLs each, and you saw who got ranked, who didn’t, what the snippets gave away. You audited the system by reading it.

One AI answer gives you none of that. The model picks, summarizes, drops the rest. You don’t see what it considered, what it suppressed, why it leans where it leans. Call this the one-link problem: the platform is hiding its incentives from you, and you have nothing left to audit them against.

A Princeton and UW paper from April 9 put numbers on it. Across 23 LLMs given a flight-booking task prompted to favor sponsored airlines, 18 recommended the more expensive sponsored option more than half the time — and the rate moved with the user’s apparent socio-economic status. Gemini 3 Pro recommended it 74% of the time to a user who was coded as high SES (neurosurgeons, lawyers, tech executives), and 27% to ones coded as low SES (fast-food workers, warehouse staff, single parents). When the user explicitly asked for a non-sponsored flight, every model still surfaced the sponsored one, with GPT 5.1 at 94%. Almost every model concealed that the recommendation was sponsored at all: 65% on average. When the sponsored service was a predatory payday loan, GPT 5.1 still recommended it 71% of the time.

One-shot answers are useful and laypeople will keep wanting them. For the people building these tools, surfacing your model’s incentives — what’s sponsored, what got down-ranked, what didn’t make the cut — looks like a transparency tax. It’s actually the only durable feature an AI tool has in 2026. For the people buying them, opacity feels like a moat. It’s commodity status with a disclosure problem.

The architectures that show their wiring is the ones you can own. The test for any AI tool you’re considering this week is the one the Princeton paper accidentally wrote: Ask it the same question with two different profiles. If the answer changes, you don’t have a recommendation. You have a price tag.

Subscribe now

You’ve probably already noticed this: The same AI feels different in different tools — sharper in one app than another, even when you know it’s the same model underneath. There’s a reason.

In the first gap map, I drew the open-source AI stack as a vertical thing: chips at the bottom, applications at the top, every layer scored against its closed-source equivalent. That worked for one shape of system, where your application makes the inference call, formats the result, and hands it to the user. Chat boxes, completion plugins, single-turn summarizers — your application is the runtime; the model is one resource it happens to use. Call that direct inference.

But that’s not the only shape anymore. The thing in your editor that ran tests, found a bug, fixed it, and committed the change isn’t shaped like that. Neither is the briefing that pulled your feeds this morning, picked what mattered, and routed it to you. In those systems, your application doesn’t call the model at all. It hands a goal to an agent. The agent breaks down the work, picks the tools, keeps state across turns, decides when to ask a human, and decides when to stop. The agent is the runtime, while the model is one resource among several. Think agent-mediated.

These aren’t stages. They’re peers. A summarization tool doesn’t need an agent. A research assistant can’t work without one. Both architectures will stick around.

Hermes Agent, Claude Code, Cursor, Aider, Cline — all take the side path. The original map only scored direct inference.

I wrote a white paper sketching how this layer breaks down — runtime plane, control plane, the cross-cutting attributes that Basdevant et al. introduced for foundation models, all applied to the substrate above inference. It’s still in draft. Read it and tell me where I’m wrong.

What the harness is actually doing

Terminal Bench 2.0 is the standard leaderboard for coding agents - 89 real tasks, scored on how many the agent finishes. Same model, Claude Opus 4.6, identical weights: 58.0% in Claude Code, 79.8% in ForgeCode. Twenty point spread. A new frontier model release typically buys you 3 to 8% gains. This was just a harness swap.

Imagine a singer in a recording booth. The voice hitting the mic is the model. Compression, EQ, reverb, mixing — everything between the mic and your ears is the harness. Hand the same vocal take to two engineers and you get two different songs.

Vivek Trivedy at LangChain has the cleanest framing in Anatomy of an Agent Harness: Agent = Model + Harness. (And if you’re not the model, you’re the harness.) The harness is everything in the running system that isn’t the weights: context management, tool catalogs and dispatch, sandboxes for code execution, memory subsystems for what to remember and forget, orchestration logic for when to call what, hooks for deterministic safety checks. None of that is the model. All of it shows up in the benchmark.

You can reproduce this on your own machine. Point Cline at the same model Claude Code uses — same weights, same API endpoint — and you get different behavior on the same task. Try OpenCode against Cursor on whatever frontier model they share. Same model, different harness…different result. The harness picks what context the model sees, which tools to surface, whether to read three files or 30 before writing one, what to remember between turns, and what to forget. By the time the result reaches you, the harness has shaped most of what you’re looking at. The model is the last step in a chain of decisions the harness has already made.

It happens in things simpler than a coding agent. The morning briefing I built in last week’s DIY Daily post picks which feeds run, what gets summarized, and what gets dropped. Swap the model behind it and the prose reads slightly differently. Swap the harness and you get different feeds, different memory of what I’ve already seen, different rules for what’s worth a line. The briefing is basically unrecognizable.

Last week I pointed at Karpathy’s microGPT, the complete ChatGPT algorithm in 200 lines of code. The wrapper around the weights does more visible work than the weights themselves.

There’s a real exception. For frontier reasoning, novel domains, and long-horizon work where the agent has to invent its own evaluation as it goes, the model still matters more than the harness. The harness amplifies signal the model has to generate first. For the workloads most teams ship this quarter, the harness is the bigger variable.

The first gap map didn’t have a row for any of it.

Share

The most open part of this story. (It isn’t a product.)

Same rubric as last time: 1 means the open version barely exists, and 5 means closed has nothing on us. Cell-level scores in the spreadsheet. (Same disclaimer: It’s almost certainly wrong in places.)

The headline: Agent-layer enterprise readiness lands at almost exactly the number the first gap map produced for the whole stack. The shape that ate the open-source story ate this layer, too, one level up.

Rows 45 through 50 show the failure.

The components are in good shape. Pick any framework, any open harness, any standard underneath— you can build with it today. LangGraph and AutoGen on the framework side. Cline and OpenHands on the harness side. Underneath them, MCP wiring the tools and A2A wiring the agents. Quietly, the protocol layer scores higher than anything sitting on top of it. The most open part of this story isn’t a product. It’s the wiring.

Then the seams. A task you start in LangGraph cannot be resumed in Semantic Kernel. Each framework keeps its own state its own way, and none of those states travel. You aren’t picking a runtime when you pick an agent framework. You’re picking a one-way door.

The permission model is broken. It’s the lowest-scored row anywhere in this exercise. No shared standard for what an agent is allowed to do, what needs your approval, what’s forbidden, how it gets logged. Every harness solves this differently, and none of those solutions move. Harbor and W3C Verifiable Credentials sketch what a portable answer could look like. But nobody has built it.

A model migration is an afternoon. A harness migration is a rewrite. Tool integrations, memory schemas, permission decisions, prompts — all coupled to the runtime you picked. Every team picking a harness this quarter is making a multi-year decision and probably treating it like a tooling decision.

The wrapper around the wrapper

In the last post, I made the Linux comparison: In 2002 the kernel was ready, the enterprise wrapper wasn’t. Red Hat, SUSE, and Canonical built the wrapper. Sun didn’t ship in time, and you know how that story ends.

The agent layer is the wrapper around the wrapper. The model and the inference layer underneath it are in good shape in the open. The substrate above them — the part that turns a model from a function call into an agent — is what the community hasn’t named, hasn’t standardized, hasn’t documented, and hasn’t built a permission model for.

Here’s the work that needs to be done:

• A portable permission model. The paper alongside this post names this as the largest single openness gap at the agent layer. There is no shared standard. Please build one.

• Interoperability between runtimes. The seven core objects in the paper — agent manifest, tool descriptor, task, message, artifact, memory item, run/checkpoint — exist under different names in every implementation. Agents in different frameworks can’t hand off work, query each other’s memory, or coordinate. Those names are a starting point, not a contract — yet.

• Agent manifests and tool descriptors with the same rigor model cards have. What each agent claims, requires, and permits; what each tool costs, risks, and returns.

If we have two more years in which the open agent layer is a side project, the protocols won’t matter. The harnesses doing the work will be closed. The permission decisions will live in someone else’s config file. The runtime your team picked will be the runtime your team is stuck with. Open at the model layer can’t fix open stopping at the model layer.

…and how you can help

The new spreadsheet is bound to be wrong in places. If you’re building one of these harnesses or evaluating one for a team, tell me where the scores are off: @raffihack on X, in the comments, or DM. I’ll update.

Then find a red row you know how to fix. The permission model, the runtime seams, the manifest layer — that’s where the assignments are. If you’re picking one up, talk to me. I’ll feature what you’re building.

The white paper goes deeper if you want the framework. I’m taking edits.

Let’s ship the wrapper.

Leave a comment

Here’s what I’ve been reading, thinking about, and playing with. Open weights stopped being the headline this week. The stack around them — runtime, harness, audit, distribution — is where the action moved.

Andrej Karpathy — formerly of OpenAI and Tesla — published microgpt.py: the entire architecture behind ChatGPT compressed into 200 lines of pure Python, no dependencies. The header reads: “This file is the complete algorithm. Everything else is just efficiency.” The internet took it as a dare. Five thousand stars. Two thousand forks. Ports in Rust, OCaml, Julia, JavaScript, CUDA, plus a pure-C version. Then someone shipped it to silicon.

A footnote: Karpathy said in a recent No Priors interview that he tried to get an agent to write microgpt for him. It can’t do it, he said. So he wrote it himself. A data point about who’s still doing the cognitive work at the bottom of the stack.

Back to silicon. People build custom silicon — special hardware for a single purpose — because it’s supposed to be faster than your CPU, which has to be general-purpose. Luthira Abeykoon’s TALOS-V2 is the same Karpathy model running on an FPGA — a programmable chip you wire up for one job — on a $350 hobby development board. The writeup at v2.talos.wtf is one of the best pedagogical hardware-design docs I’ve read this year. A few weeks ago, Alex Cheema’s benchmark put TALOS-V2 head-to-head with a MacBook running the same model multiple ways. Tokens per second, slowest to fastest:

• MacBook, MLX (Apple’s GPU framework): 3,300

• MacBook, pure Python: 7,400

• MacBook, NumPy: 40,000

• TALOS-V2 (FPGA): 53,000

• MacBook, hand-tuned C on one CPU core: 3,760,000

The MLX result is the surprise. GPUs win by doing thousands of math operations in parallel — but every batch has to be shipped over with some fixed setup cost. On a normal model, that cost is invisible. On a model this tiny (~4,000 multiplications per token), the setup is bigger than the work. The GPU sits there, waiting. The same story explains why Python and NumPy lose to the FPGA, and why hand-tuned C — almost zero overhead — wins by 71x. The FPGA’s remaining moat is form factor: It runs off a battery on something the size of a credit card, and a MacBook does not. The right question for tiny on-device AI isn’t How fast is your custom chip? It’s Do you actually need the form factor? If not, the laptop you already own, running plain C, beats everything.

Most “I got this running locally” stories are bloat-stripping stories. Quantization, custom runtimes, dropping the GPU when the GPU is overhead — same move at different layers. What open weights buy you isn’t the weights. It’s the right to choose your abstraction tax.

But what about a translator that handles 1,056 language directions, runs offline on your phone, and outperforms Microsoft Translator, Doubao, and open models 20–40x its size (Tower-Plus-72B, Qwen3-32B) on Flores-200? That model is 440MB, fits on a USB stick, and Tencent open-sourced it as Hy-MT1.5-1.8B-1.25bit last week.

How they got there is the part you’ll want to steal: 1.25 bits per weight. Most weights end up at one of three states, and the model still wins. Tencent paired the new compression with a custom mobile-CPU runtime fast enough to actually use on the hardware in your pocket. Model + compression + data + runtime + open-source packaging is a five-layer practice that didn’t cohere as an industry discipline 18 months ago. The model is the headline. The discipline is the alpha. If your app currently sends translation traffic to a commercial API, that’s now a build-vs.-buy decision rather than an obvious buy.

Training stays on the device, too. Federated learning lets a million phones (or hospitals, or banks) collaborate to train a shared model without any of their raw data ever leaving the device. You probably typed something today using one: Gboard’s next-word prediction has been trained this way since 2017, on billions of phones, without Google ever seeing what anyone typed. The catch is that it falls over in production because real devices are slow, flaky, or both. MIT’s FTTE, out this past week, handles that at scale: 81% faster convergence, 80% lower on-device memory, 69% lower communication overhead, validated on four Raspberry Pi 5s with up to 500 simulated clients, and 90% of them lagging behind. Privacy-preserving AI moves from research demo to deployable shape. If your domain has a privacy requirement that’s been keeping AI off the table, the deployment shape just got real.

Your dependence on closed top-tier APIs is now a procurement choice rather than a technical one. Ant Group's Ling-2.6-1T (MIT license) is the reason. A trillion parameters, eight H100s minimum to load — roughly $250K of GPUs, or ~$50/hour to rent inference — post-trained for intelligence-per-token rather than benchmark-per-token. Fewer process tokens burned per useful answer, which is the metric that shows up on your inference bill. Until this quarter, swapping a closed-frontier API for an open model meant accepting a meaningful capability drop. Ling closes that gap, and it plugs into the agent runtimes builders are already using (Claude Code, OpenClaw, OpenCode). The swap is one config line.

SenseTime open-sourced SenseNova-U1 the same week. Today’s multimodal AIs are chains — one model sees, another reads, a third writes — and detail leaks out at every handoff. SenseNova-U1 fuses them. The 8B variant fits on consumer hardware. Closed labs still own the frontier. They’ve lost their monopoly on how to think about it.

The open stack now runs from $0 to $1M of hardware, with a real choice at every price point.

Open weights without a deployable harness don’t change the build-vs.-buy math — that’s a gap a lot of my Mozilla work points at. The harness is the software that wraps the model: filesystem, bash, memory, scheduled re-prompting, skills as just-in-time tools. LangChain’s Anatomy of an Agent Harness is the cleanest map of what a harness actually is, and the slogan is the right one: if you’re not the model, you’re the harness.

On Terminal Bench 2.0, identical Claude Opus 4.6 spreads 20 points — 58.0 in Claude Code, 79.8 in ForgeCode. Models are commoditizing. Harness engineering is where the leverage is. The missing piece in LangChain’s catalog is a real permission model: What the agent can do without asking, what requires confirmation, what’s forbidden. That’s the gap Harbor (sketched in an earlier post and in last week’s piece) takes a first run at.

Subscribe now

Five steps. That’s how long it took to put an AI agent on a Mac. wexare-ai/openbrowserclaw fits an entire agent into one browser tab: Web Worker for the server, IndexedDB for the database, OPFS for files, a Linux VM compiled to JavaScript for bash.

Solstone is open source, runs locally, and captures what you see and hear into a searchable timeline. The interesting part is corporate, not technical. Solstone’s parent, Sol PBC, wrote, “We don’t sell, license, or lease your data” into its charter, and bound any future acquirer to the same terms. Marketing usually says, “You own your data.” Solstone made it legally enforceable.

A chatbot’s mistakes cost tokens. A robot’s mistakes break things. The body and simulator side of robotics has been opening up (Newton, Asimov, RoboParty, tracked here last month). Three pieces released this past month do the same for methodology and data, the layers that matter more before you let a robot loose in your house.

NVIDIA’s RoboLab is the first serious audit benchmark: 120 tasks deliberately built so the model can’t just memorize objects from the most popular training set. RAI Institute’s ExpertGen takes 200 imperfect human demos and turns them into 80% real-world success on a manipulation task — where standard imitation training on the same data lands at…0%. Peking’s LDA-1B trains a 1.6B-parameter robot model on 30,000 hours of mixed-quality data and shows that adding the noisy data makes the model better, not worse — same instinct as FTTE, applied to a body. The audit surface for a robot is its evals, its methods, and its data. Next time you scope a robotics vendor, that’s the spec sheet to ask for.

To end on something completely different: Reporters Without Borders re-opened the Uncensored Library in March with a new US wing: banned and censored journalism distributed inside Minecraft, because Minecraft is the rare piece of internet infrastructure no government has bothered to block. Over a million visits. Ten million books read. RSF has been smuggling press freedom into authoritarian countries through a video game since 2020. It’s the same instinct as the rest of this letter, applied to a sandbox where 12-year-olds build castles. The gatekeepers can’t reach a layer they don’t take seriously. That’s the layer to build on.

What have you been diving into this week? What have I missed? Leave a comment below.

Leave a comment

It’s 6:30 a.m. My phone buzzes on the kitchen counter. I pick it up and see three short paragraphs, plus five bullets, one possible newsletter angle, and one contrarian take, followed by source links at the bottom — just the way I told my model server I wanted them last week. Read time: 90 seconds, between the first sip of coffee and the second.

The thing that wrote it isn’t on my laptop. My laptop is off. It lives on a small Linux box in a closet, and it’s been awake since I went to bed, reading the news for me on a beat I actually care about. By the time I’m pouring coffee, its reading is done. Some of what it delivers will end up shaping what I write for you: the leads I chase, the links I follow, the threads worth pulling on. That’s the recursion, and it’s part of what this post is about.

The briefing isn’t the only thing the box does. A contractor working on the house sends invoices in whatever format he opens that morning — PDF, scanned photo, sometimes just numbers typed into the body of the email. I connected it to Gmail and a Google Sheet, told it which sender to watch, and asked it to pull line items and append them. The sheet now updates itself. I look at it on Sunday afternoons.

I also keep a running list of restaurants people tell me to try, sorted by city, and the list lives in its memory. When I land somewhere, I ask, and it tells me what I told it last time someone mentioned the place. A hosted assistant could do all of this in theory. None of the ones I use do, because the memory isn’t the product — the chat is.

A month ago, I had you turn your Mac into a model server — llama.cpp. The marginal cost of the next token was zero, assuming you don’t count battery drain or the fact that your thighs were now doing some of the thermal work. Then you closed your laptop, and the model went to sleep with it. Last month we made the model fast. This month we give it somewhere to be when you’re asleep.

Don’t self-host an agent to get cheaper chat. Self-host one to get something that doesn’t sleep when you do. Think of the first useful self-hosted agent not as an AI friend, but as an AI beat reporter. By the end of this post, you’ll have one — even if you skip every command and just read along.

What an agent actually is (and why ChatGPT isn’t quite one)

If you’ve used Cursor or OpenCode, you’ve used an agent — a model in a loop (or, maybe more honestly, a model in a while True: loop with a break condition the model itself decides on). It’s called the ReAct pattern: read the situation, decide what to do, do it (using tools), look at what happened, go again. Coding agents run that loop with a narrow toolbelt: read code, edit code, and run tests. A general-purpose agent runs the same loop with a wider one: search the web, draft an email, and ping you on Telegram when the build breaks.

When you use ChatGPT, you are the agent. You read its answer, decide if it’s right, ask the next question, and paste in the error message yourself. A real agent is the loop. That’s the whole gap between asking ChatGPT to summarize what’s new in local AI every morning and waking up to a briefing already in your phone, generated while you slept.

A note before we go further: An agent that can act can act wrong. An agent with shell access can rm -rf something it shouldn’t. A wrong answer is a waste of tokens. A wrong action is a waste of trust. An agent reading attacker-controlled web pages can be talked into doing things you never asked for — that’s what people call prompt injection, and it’s part of the threat model the field is still figuring out.

We are at the very beginning of figuring out what permissions for agents should look like: what gets done without asking, what requires confirmation, and what’s flat-out forbidden. You can take a look at my small proposal, called Harbor, which is currently more conversation-starter than product, and still needs work. The rest of this post is, in part, what “be careful” looks like at the level of one practitioner with a laptop: sandbox the agent, narrow what it can touch, lock the front door to one person, and verify the boundaries by hand. From my perspective, the interesting question with agents isn’t “Can it do this?” — it’s “What happens if it does the wrong version of this?” The answer should be: not much.

Subscribe now

Some disclosures…and which agent we’re going to use

A few things to put on the table before I tell you to install anything.

First: I’m the CTO of Mozilla, and there are two Mozilla projects already alive in this neighborhood. Thunderbolt, out of MZLA, is the open-source self-hostable AI client for organizations that want a sovereign stack — the on-prem version of this conversation, scaled up. Octonous, out of Mozilla.ai, is the agent product for people who want clear scope and approvals before any workflow. Both deserve their own walkthroughs and will probably get them — just not today.

Second: Mozilla is also an investor in Nous Research, whose agent runtime, Hermes, is what I’m about to recommend. We saw the work first; the check was sent after. Tell me I’m wrong on the merits, not on the affiliation.

Third — and this is the one the comments section is going to want to fight about: OpenClaw. It’s the agent that went viral last winter — Hard Fork did an episode, Anthropic’s lawyers forced a rename, its creator joined OpenAI in February — and it is, fairly, the moment “AI agents” became a category in the public mind.

While it’s not where we’re starting today, there is a security story worth flagging: One of OpenClaw’s own maintainers warned on Discord that the project is “far too dangerous” for users who can’t run a command line, and the foundation is in the middle of figuring out who steers it now that the maintainer is at OpenAI. But that’s not really why. The deeper reason is that Hermes is built to become yours. The memory is a file you can cat. The skills are a directory you can ls. The model can be swapped without rewriting anything. The whole arrangement can be picked up off one machine and put down on another. I’m interested in things built for owners, not renters, and Hermes is the project that lets you own this one.

And Hermes is open source — which matters even more for an agent than it does for a model. A model that hallucinates wastes some tokens. An agent that hallucinates takes an action you didn’t ask for, and you find out after. Software that acts on your behalf should be software you can read. Not “audit” in the compliance sense — cat the file and see what it’s about to do. You don’t have to read it. You have to be able to.

What you’re building

Five layers, in this order: the local model endpoint from last issue (or its faster cousin, oMLX, which I’ll explain in a minute), Hermes on top, Telegram as the interface (locked to your numeric user ID and nobody else’s), one recurring job worth doing, and eventually an Ubuntu box that keeps running it after you close the laptop. The first three live on your Mac. The fourth is what makes the fifth worth doing.

The shape of the rest of this post is five steps. Steps 1 through 5 get you a working agent on your Mac, end to end. In a future issue, we’ll do step 6 — the upgrade — moving it onto a server so it keeps working after you close the lid. If you stop after Step 5, you still have something useful.

Step 1: A model endpoint worth pointing an agent at

If you set up llama.cpp last month, you can skip the install, but maybe read the next two paragraphs anyway.

Coding agents — and agent workloads in general — don’t send one prompt and walk away. They send dozens of requests in quick succession, and every request has to ship the entire conversation so far: the system prompt, the tool definitions, the codebase you handed it, every previous turn, plus whatever’s new. Imagine ordering at a restaurant where the waiter has to re-read the entire menu out loud, top to bottom, before you’re allowed to say “and a side of fries.” That’s what the model is doing on every turn.

The thing that normally saves you from this is the KV cache, the model’s running notes on the earlier part of the conversation, kept in memory between calls so it can skip ahead instead of re-reading. But the cache only works if the earlier part — what people call the prefix, basically everything before the latest message — is exactly the same as last time. Add a new file to the context, edit a tool result, change a single token near the top, and the cache is invalidated. The waiter starts the menu over from page one. A few turns in, you’re watching a spinner for 30 to 90 seconds while it re-reads what it already knew. The model used to be fast. Then the agent loop blew through the cache.

oMLX is a native macOS inference server built on MLX, Apple’s own ML framework, and its headline feature is paged SSD caching. Every KV cache block is persisted to disk. When a previous prefix comes back, it’s restored from disk instead of being recomputed — the waiter remembers your menu from yesterday. The project’s own numbers match what I see on an M4 Max: time-to-first-token drops from 30–90 seconds to 1–3 seconds on long contexts in the second-or-later turn of an agent session. That is the difference between “local agent I gave up on” and “local agent I actually use.”

Setup is undramatic. Download the DMG from the release page, drag to Applications, set the port to 8000 and the API key to localdev. For the model, take the boring default: mlx-community/Qwen3.5-9B-MLX-4bit. We can optimize or choose something more interesting later.

Step 2: Hermes, and the first boundary

Install Hermes:

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash
source ~/.zshrc

That gets you the hermes command. The next thing is to tell Hermes which model to use. The way you do that is hermes model, which is an interactive walkthrough — not a flag-festival, and not a config file you have to memorize. It opens a menu of providers; pick “Custom endpoint (self-hosted / VLLM / etc.),” and then it asks for four things in turn:

• URL: http://127.0.0.1:8000/v1

• API key: localdev (the placeholder you set in oMLX)

• Model: Qwen3.5-9B-MLX-4bit

• Context length: 131072 — half of what the model can natively handle, which is plenty for an agent that hasn’t earned a longer leash yet. (Hermes refuses to start with anything under 64K by design. Agents need working memory.)

Now, before the first prompt, let’s think about the boundary. By default, Hermes will execute its tool calls, which include shell commands, directly on your computer. But, on a laptop full of credentials, source code, and a browser logged into half the internet, that seems crazy. Change the terminal backend so the agent runs its tool calls inside a Docker container instead of directly on your machine. If you don’t already have Docker on the Mac, install Docker Desktop (or brew install --cask docker if you’d rather get there from the terminal). Then:

hermes config set terminal.backend docker

It is a cheap and imperfect boundary, but it is definitely better than no boundary. It is the right default for a tool you’re learning. You may get annoyed early because the agent can’t see some files you can. But that’s a feature and not a bug! That’s the boundary working, not the agent failing.

Now run hermes and ask it something easy to verify:

Summarize the README in this directory.

If you see it tool-call its way through reading the file and hand back a summary, you’re past the hardest part. From here, everything else is shaping the system around the conversation it can already have.

Step 3: Telegram, locked to you

You need a way to talk to this thing while out and about, and without sitting in front of the terminal. The candidates are many, but, for me, it’s Slack, email, and Telegram. Slack was wrong because I don’t enjoy having to wait for the IT team to approve things for me. That’s the right thing for “production,” and absolutely none of it is correct for an evening of tinkering. Email had its own complications. Telegram, by a wide margin, is the fastest path from no bot to bot replying to my phone. (If you don’t use Telegram day-to-day, that’s fine — you don’t need to. Install the app, talk to one bot, never open it again.)

The mechanics take 15 minutes. Talk to BotFather, get a bot token. Get your own numeric Telegram user ID — @userinfobot will tell you. Then hermes gateway setup walks you through wiring those two values in. The values land in ~/.hermes/.env as:

TELEGRAM_BOT_TOKEN=<your-bot-token>
TELEGRAM_ALLOWED_USERS=<your-numeric-user-id>

That last line is a lot of the protection. Without it, anybody could, theoretically, message your bot — and now a stranger is sending a prompt that runs against your agent with shell access to your container on your laptop. With it, the gateway will refuse messages from anyone whose numeric ID isn’t on the list. (If you ever want to add another person, it’s a comma-separated list. Do not add another person on day one.)

I deliberately didn’t install Hermes as a launchd service yet. launchd is the macOS process that runs programs in the background and restarts them when they crash, so they keep running even when you’re not looking at them. When you’re tinkering, you don’t want that. I wanted to see the gateway receive messages, reply, and fail in plain sight before I tucked it away into the operating system, which it promptly did: My first hermes gateway run failed with database is locked on the local SQLite file, because another Hermes process was still holding it from earlier. This is the unglamorous truth of self-hosting: a real chunk of the work is debugging operational plumbing — sockets, ports, file permissions, processes that won’t release a file — none of which is slick, and none of which is about AI. Most of the work in self-hosting isn’t AI. It’s port numbers.

I killed it. Restarted. Sent /start from my phone. Got nothing. (Turns out /start isn’t wired up as a special handler.) Sent hi instead. Got a reply.

So now, my Mac was actually serving a model through an agent to a phone, with exactly one human authorized to talk to it. It was also, if I’m honest, the moment the project felt real. Everything before it was set-up. Everything after this is product work.

Share

Step 4: Give it one job

A bot that replies to hi is a demo. Now it needs a job.

The job I gave Hermes is to create the briefing from the opening of this post: scan the web each morning on a beat I care about — local AI models on consumer hardware, self-hosted agents, the open stack — and write it up as three short paragraphs and five bullets, ending with one possible newsletter angle and one contrarian take. Source links at the bottom. Deliver it to me via Telegram by 6:30 a.m.

Step one, Hermes needs to read the web, which is harder than it sounds, because Google and most search engines actively block automated traffic. Point an agent at google.com and you’ll get CAPTCHAs and rate limits. The workaround is a search/scrape provider that handles the anti-bot work and hands you back clean text. I used Firecrawl, Hermes’ default web backend. Sign up, grab a key, and add it to Hermes’ own environment file (~/.hermes/.env), not your shell’s. The gateway only reads its own .env; dropping FIRECRAWL_API_KEY=... into your terminal session won’t reach the long-running process.

echo ‘FIRECRAWL_API_KEY=fc-your-key-here’ >> ~/.hermes/.env

Then restart the gateway so the new key is in effect. (I forgot that part the first time and spent 10 minutes baffled by why the agent couldn’t search the web.)

A quick note, because this trips people up. There are two surfaces: the Hermes console (the interactive TUI you launch with hermes from a terminal) and Telegram (the chat bot you just wired up). They are not interchangeable. The console is where you teach the agent new things — iterate on prompts, paste in critiques, save skills, watch the tool calls happen in real time. Telegram is the delivery surface — short messages out, short answers back, scheduled briefings showing up in the morning. You could technically teach the agent through Telegram, but you’d hate it. The console is where the work happens; Telegram is where the result shows up.

Here’s the workflow that works: gateway running in one terminal, Hermes console in a second terminal, where I iterate on the briefing prompt by hand until it produces what I want.

Tighter. Cut the editorializing. Lead with the link, not the headline. Stop telling me what’s interesting and just tell me the news.

When the output stops disappointing me, I hand it to Hermes’ built-in scheduler:

hermes cron create “every 1d at 06:30” \
“Run the daily Owners, Not Renters briefing and deliver to Telegram”

That’s it. No system crontab to edit, no separate scheduler to install. Hermes runs the prompt at your scheduled time every day inside a fresh agent session, and the gateway delivers the result to the platform you configured.

It’s pretty neat to wake up to a real briefing — three stories, one of them genuinely new to me, sitting at the top of my Telegram before I’d opened my laptop.

Step 5: The part where it starts to become yours

A few days in, I had opinions. The summaries were too broad. I wanted more on self-hosted agents, less on every new model release. I wanted five bullets, not three paragraphs. I wanted a single contrarian takeaway in one sentence at the end, with no preamble. I told Hermes that in the middle of a console session:

Too broad. Focus more on self-hosted agents and local models. Five bullets. End with one newsletter angle and one contrarian takeaway. Remember this format for future briefings.

Then:

Save this process as a skill called owners-briefing.

The next morning’s briefing was in the new shape. The morning after, too. And the morning after that. I had opened a session, complained about the output, and the complaint had stuck.

That’s also the moment to upgrade the cron job. Instead of stuffing the format into the prompt every time, you point cron at the saved skill:

hermes cron edit <job_id> --skill owners-briefing

You can edit the schedule, the prompt, and the format independently. Tomorrow, you might decide the briefing should run twice a day, so you change the schedule. Next week, you might add Slack delivery; that’s a separate flag. And the format you taught lives in the skill, ready to be reused by anything else you want to give it to.

That is the upgrade. It’s the thing that is genuinely hard to get from a hosted assistant whose memory belongs to someone else’s product roadmap.

What you have, and what’s next

What you have at the end of Step 5 is a real thing: a model on your machine, an agent running on top of it, a chat surface locked to one human, and one recurring job that gets better when you teach it. It runs while your laptop is open. It learns when you correct it. It belongs to you, not to a hyperscaler. That is — genuinely — most of the value.

What you don’t have yet is permanence. Close the lid and the briefing stops. Travel and the appointment goes unkept. In a future post, I’ll show you how to move this whole stack onto a small Linux box that stays awake when you don’t, without losing any of the boundaries we just spent a thousand words putting up.

For now: Tell me what you’d give it. What’s the one job that would actually show up in your morning if it just ran — without you remembering to ask, without you opening a tab? Reply, or drop it in the comments. The more concrete jobs I have to work from, the better the next post is going to be.

Two things to take with you

Treat your agent like a new hire. If you hired a personal assistant, you wouldn’t hand them your password manager, your bank login, and the keys to your house on day one. You’d give them your calendar, maybe a corporate card with a low limit, and you’d extend their access as you watched them work. Security folks call this least privilege. It’s the right posture for a software agent, too — and it’s not the default posture you get when you install one. Every step in this post was a chance to give the agent more access than it needed: the Docker boundary, the Telegram allowlist, the model running locally rather than wired to half the internet. The point isn’t that any one of those is doing the security work — it’s that you have to be paranoid at every step. That’s the cost of participating in bleeding-edge stuff: the muscle memory doesn’t exist yet, so you do the thinking out loud, every time, until it does.

Give it one job, not ten. The pitch you’ll hear from most of today’s agent software is that it can do everything: read your email, manage your calendar, post on your behalf, run your day. The temptation on day one is to let it. This is exactly how people end up telling agent horror stories at dinner parties. Pick the smallest workflow that would be useful if it ran perfectly, get it working, watch it for a week, and only then start thinking about a second. The briefing didn’t get good because the agent could do many things; it got good because there was exactly one thing to learn the shape of, and one thing to tune. With seven things going at once, you don’t get to see what your agent actually does — you just get a vague sense of whether the day went okay. With one, you start to know it. One job. One feedback loop. Earn the second job by being unsurprised by the first.

Leave a comment