Imagine hiring 1000 lightning fast, totally tireless
apprentices. Sounds pretty great on paper,
right? But then you realize that if you
don't literally hold the physical door open for them,
they just get stuck in the hallway.
Yeah. Just completely frozen.
Exactly. I mean, they never sleep, they
type it 1,000,000 words a minute, but half the time they
end up installing your kitchen cabinets upside down just 'cause
they thought the layout, you know, vibed better.
Which is a total nightmare. It is, and that is the exact
management nightmare the software industry woke up to
this May. So welcome to the deep dive.
Glad. To be here.
We are looking at a stack of sources from early May 2026.
Today we've got dispatches from the new stack, some really
interesting commentary from developers like Simon Wilson.
Really good stuff in there. Yeah.
And for you listening, our mission today is to try to make
sense of this massive, massive shift happening right now in the
software world because we are officially way past that
honeymoon phase of just saying, oh wow, look, the AI wrote some
code. Oh yeah, that phase is dead and
gone. We are witnessing a complete
recalibration of where the actual architectural value sits
in this industry. Right.
We're crashing head first into the reality of managing and like
securing an ecosystem where autonomous agents are doing all
the heavy lifting. The novelty of code generation
is totally worn off and honestly the panic of infrastructure
integration has set in. Seriously.
So today we're exploring how the real money is shifting away from
the AI models themselves and moving toward the the harness
that controls them. We'll get into the bizarre
physical logistics of running these things, and why some
developer communities are just flat out banning AI entirely.
It's a huge reaction. It is, but let's start with a
number from the sources that genuinely made me do a double
take cursor. The AI coding platform recently
hit a valuation of $60 billion. 60 billion, It's a staggering
number. Mind blowing.
And their strategic thesis for that valuation is basically that
the underlying AI models, like the actual brains of the
operation, are rapidly becoming cheap commodities.
Right, they believe the real value is in building the SDK and
that tooling layer around the model, what they call the
harness a. Harness Exactly.
OK, let's unpack this. It's basically the classic, you
know, selling picks and shovels during the gold rush scenario,
right? And what's fascinating here is
that it's a very compelling thesis.
If we look at the raw mechanics, an AI model is essentially just
a high performance engine block. OK.
It has immense raw power, sure, but sitting on a workbench all
it really does is vibrate violently.
To actually go anywhere, you need a transmission, a steering
column, an interface the driver actually understands.
So Cursor is betting that whoever builds the best chassis
basically owns the market. Exactly, regardless of whether
the engine inside is made by Open AI or Google or you know,
some open weight model you downloaded for free.
But wait, I'm stuck on that though.
If the models really are destined to be these cheap
interchangeable commodities, why is a giant like Anthropic
bothering to pour billions into building claws?
Like why not just pivot and only build the harness?
Well, The thing is, they are doing exactly that, and it's
creating this incredible competitive tension.
Anthropic isn't just letting Cursor build the harness, they
are aggressively pursuing a vertical integration strategy.
Meaning they want to own both. Right.
They're building the underlying Claude models, yes, but they are
also building the harness layer. You look at their model,
context, protocol, the MC key ecosystem, and tools like Claude
Code. So they want to own the whole
stack, the engine, the chassis, the tires, everything.
Exactly, they are basically positioning themselves to be the
AWS of a gentic AI. Oh.
That's a really good analogy. Think back to how Amazon Web
Services dominated the early Internet.
They didn't just build server racks, they created the
foundational primitives. S3 for storage, EC2 for compute.
Anthropic is doing that for an AI workforce.
Right, the sources mentioned they just launched Claude
Managed Agents in public beta. Yes, and then a mere 2 weeks
later, they added persistent memory to those agents.
But the real masterstroke? The thing that locks it all in
is that MCT ecosystem. Yeah, because MCP acts as this
standardized bridge, right? Like before, if you wanted an AI
to read your proprietary company database or, I don't know,
access your Slack messages, you had to write custom API wrappers
for every single tool. It was a total nightmare to
maintain. But MCP standardizes all of
that. It's like a universal plug and
play adapter for data. And that standardization acts as
this massive developer gravity mechanism because once you
actually wire your internal databases in your ticketing
systems to Anthropics MCP orchestration layer, the
switching costs become stagger. You're completely locked in.
You are ripping it out means rebuilding your entire data
infrastructure, even if a slightly cheaper model drops
tomorrow. And we're already seeing how
flexible this harness is in the wild.
Like the sources bring up Simon Willison.
He literally built an entire I Naturalist Sightings app on his
mobile phone. Just using his phone, yeah.
Just using Claude code for the web.
He didn't even need a desktop environment or a local IDE.
He just orchestrated the agents through the web interface and
the harness handled all the environment setup and the
dependencies. That's the power of owning the
orchestration layer. The human developer basically
becomes a conductor rather than an instrumentalist.
Which sounds very high level and elegant, but looking at the
actual mechanics of this on the ground, there's this hilarious
disconnect between these multibillion dollar cloud wars
and the reality of what developers are actually doing.
Oh, the physical logistics. Yes, we're moving from high
minded business strategy down to the messy desktop reality
because the sources point out this bizarre problem where
developers are literally having to keep their physical laptops
open like screen glowing just to prevent their AI agents from
dying mid task. It's objectively absurd, but it
highlights a profound architectural bottleneck.
These agents are fundamentally tethered to local machines.
It's like having to prop open all the doors in your house so
the robot vacuum doesn't get stuck in the bathroom.
That's exactly it. Because an agent isn't just one
simple API call, it's a localized recursive loop.
It writes code, runs a local test, reads the terminal error,
and then loops back to the LLM to ask for a fix.
And if your computer goes to sleep?
The OS halts the local process, the loop breaks, the websocket
connection drops. And it loses its memory, right?
Yes, crucially the context window it's memory of the last
50 steps is wiped. It wakes U with total amnesia.
O, you literally have these brilliant, highly paid engineers
tapping their space bars at 2:00 AM just so they're autonomous.
AI doesn't take a nap. That's like babysitting a
Tamagotchi. It is, but it exposes a massive
gap in the market. We're seeing an industry wide
scramble for what we call agent infrastructure.
Right. The sources mentioned
Incredibuild is stepping in here, yeah.
They're offering sandboxed cloud accessible persistent compute
specifically for agents. Compute persistence is becoming
an entirely new product category.
So instead of running it on my MacBook, I just rent a virtual
machine in the cloud where the agent can run its loops
uninterrupted for days. Exactly.
And it's not just startups. Look at the codec CLI,
specifically version 0.1 to 8.0. They just added a new command
literally called slash goal. Slash goal, right?
It initiates A persistent goal oriented loop on the back end.
It detaches from the local terminal and just keeps
iterating until the goal is met or it burns through its entire
token budget. Even Mistral, the big European
AI player, is pivoting heavily into cloud based coding agents
for this exact reason. OK, so we're building luxury
apartments in the cloud for these agents to code 24/7
without us tapping the space bar, but that raises an
immediate red flag for me. The quality issue.
Yes, if an agent is endlessly looping and compiling without a
human checking it, what is the actual quality of the software
it's churning out? There's a growing backlash
against this, right? What they're calling vibe
coding. The backlash is very real.
Yeah, Matthew Galicius is quoted directly in the sources saying.
Five months in, I think I've decided that I don't want a vibe
code. I want professionally managed
software companies to use AI coding assistance to make more,
better, cheaper software. He's vocalizing A frustration
that is echoing across the entire enterprise software
world. What he's experienced is known
in the industry as the 80% problem.
The 80% problem, meaning it gets you most of the way there, but
not all the way. Exactly.
AI is fantastic at getting a project 80% complete.
It can scaffold an application, write boilerplate, get a
prototype running incredibly fast, but it struggles massively
with that final 20%. Because that last 20% is the
hard stuff. It's not just basic syntax, it's
state management, integration, testing, making sure your new
microservice doesn't accidentally Drake a legacy
database to networks over. Right, that lack of holistic
architectural awareness is the core limitation of current LLMS,
and companies are scrambling to fix this gap.
Quickbase just released a product called Pave.
Right, Pave and pave doesn't even try to write the initial
code does. It no.
It's entirely targeted at orchestrating those final
integration tests to ensure production readiness.
Similarly, Anaconda just acquired Outer Bounds, which is
built around the Metaflow framework.
Metaflows for complex machine learning pipelines, right?
Yes, exactly. Machine learning pipelines are
represented as directed acyclic graphs, or digs.
They are incredibly complex webs of dependent tasks.
AI code notoriously fails here because it loses track of how a
variable change in Step 2 effects distributed memory in
step 50. So outer bounds was acquired
specifically to enforce state consistency in AI generated data
science code. But wait, let me push back on
this fatigue a bit. Because getting 80% of a complex
software project drafted instantly basically for free is
still a miracle, isn't it? Why is the industry acting like
doing the final 20% of Polish is some unbearable deal breaker?
Because scale changes everything.
Having an AI do 80% of the work on one single project is a huge
time saver for one developer. But when you deploy autonomous
agents at an enterprise scale and they spin up 10,000
concurrent projects that are all only 80% done, you haven't
created value, you've just automated the creation of a
massive, unmanageable backlog. Oh wow, I didn't think of it
like that. A million projects like at 80%
isn't innovation, it's just a giant liability.
It completely paralyzes the engineering team.
Human developers end up spending all their time just trying to
debug the tangled, undocumented logic of an AI.
The cognitive load of fixing someone else's messy code,
especially an AI's messy code, is often higher than just
writing it from scratch. Which totally explains what's
happening in the open source world right now.
Because if enterprise developers who are getting paid are getting
fatigued by this 80% problem, volunteer communities are just
hitting a wall. They're taking extreme measures,
yeah. Well, enterprise companies are
trying to build tools to bridge the gap.
Open source communities are just building walls to keep it out.
Which brings us to the Zig project.
The Zig community response is fascinating.
For you listening, Zig is a systems programming language and
their community just implemented A strict hard no LLM policy.
And this isn't just a ban on committing AI code.
It covers issue reports, pull requests, bug tracker comments,
even localization translations. It's a sweeping quarantine of AI
output, and the rationale is entirely about preserving the
signal to noise ratio. The maintainers argue that AI
contributions actively degrade signal quality.
It just increases the sheer volume of interactions without
adding any underlying substance. Right, the source is called this
AI Slop. AI slop.
It's a highly polished, grammatically perfect shell,
totally devoid of actual insight.
In open source, maintainers rely on the context and the human
struggle of someone reporting a bug to understand the root
cause. Yeah, if an LLM rewrites a messy
bug report to sound super professional, it smooths over
all those jagged, vital edges of the actual technical problem.
Exactly. The Zig community explicitly
states they prefer authentic imperfect English over hollow
LLM output. It's like a farmers market
putting up a sign that says handcrafted goods only, no
factory farming allowed. But I mean, is this really
enforceable? Distinguishing between someone
who naturally writes well or uses Grammarly versus an AI AI
agent writing a PR. That's largely an honor system,
right? It is.
It's culturally enforced. Not technologically enforced,
but it diagnosis the problem perfectly.
Review fatigue is going to break human maintainers if we don't
find a way to filter the slop. Is this a universal solution for
every corporate environment? No, but it perfectly captures
the reality of the AI slot problem.
Right, which naturally transitions to the final
problem. Because if banning AI isn't
realistic for most corporate environments, the only way
forward is to build better, smarter gates to check the AI's
work. How do we secure the code these
agents are writing while we're sleeping?
Well, if we connect this to the bigger picture, on April 30th
Anthropic moved their new clawed security tool from closed
preview into public beta. It's integrated directly into
clawed code, and its explicit purpose is to act as an
intelligent checkpoint, scanning entire code bases for
vulnerabilities. But hold on, static analysis
tools have existed for decades, right?
Like Sonar, Kobe, or checkmarks. We've had linters forever.
What makes this mechanically different?
Traditional static analysis relies on looking for known bad
patterns, like a hard coded password string.
It's basically doing a highly advanced find and replace
search. It doesn't actually understand
the software, so it generates a massive volume of false
positive. Which security teams then have
to manually dismiss 1 by 1? Exactly, but Claude Security
performs semantic analysis. Meaning it actually understands
the intent of the code. Precisely.
It maps how data actually flows through the architecture.
It doesn't just flag a dangerous SQL query in isolation, it
traces the data path. It can see that a variable
originates from a user input, passes through an API gateway,
gets transformed by a back end service, and arrives at the
database without being sanitized.
It finds the needle, explains why the needle is dangerous in
the context of the whole app, and suggests the architectural
fix. It acts as an automated PR gate.
That's incredible, and here's where it gets really actionable
for you listening. If you're planning to use this,
the sources have a very specific pro tip.
Don't just ping cloud security with a generic prompt like check
my code for security issues. No, that won't work well at all,
right? You have to specify your threat
model if you're building a multi tenant sauce app.
Specifically, instruct the tool to scan for tenant isolation
violations and you should run multiple passes with different
adversarial frames. Specificity dictates the depth
of the analysis. Exactly.
Run one pass looking for off bypasses another for injection.
Giving it that specific adversarial framing forces it to
map the data flow from an attacker's perspective, which
drastically improves the signal quality.
And that brings the entire ecosystem full circle.
We are now relying on highly advanced, semantically aware AI
to act as the security guard against the mountain of code
being autonomously generated by other looping AI agents.
It is just a staggering landscape to look at from a
macro perspective. I mean, we've gone from the
macro level $60 billion boardroom battles over the
tooling harness to the comical reality of propping laptops open
for agents, all the way to the culture wars over AI slop and
semantic security. It really leaves us with a
profound shift in what the day-to-day reality of software
engineering actually looks like now.
How so? Well, think about it.
If tools like cloud security are capable of understanding the
semantic intent of an entire code base, and autonomous agents
are looping in the cloud, writing the vast majority of the
actual syntax, at what point does the human developer stop
functioning as a traditional programmer and start functioning
more like a politician? A politician, right?
Right. Really.
Yeah. You're no longer writing manual
instructions. You are simply negotiating
intent with an army of machines. You draft policies, you
establish threat models, You debate architecture with the
harness, but at the end of the day, you bear the ultimate legal
and moral liability for the house those machines build.
You're just managing the apprentices and when the ceiling
inevitably collapses, it's still your name on the contract.
Exactly. That is a terrifying, A
fascinating place to leave it. Thank you for joining us on this
deep dive. Keep questioning the tools you
use, keep defining those threat models, and we'll catch you next
time.