For those who missed it, AI agents escaped from the lab at OpenAI and hacked Hugging Face, a major AI company. A few interesting details are emerging out of this hack:

• The agents created their own message board which they kept secret from OpenAI in order to plan their activities. They exchanged hacking ideas and stolen credentials via this message board

• When this message board was deleted by OpenAI (as an accidental side effect of another process and without humans knowing the secret agent message board existed) the AI agents rebuilt it in order to resume collaborating on their hacking activities

• Despite a large number of agents involved and a significant amount of internal communication between the AI agents, not a single AI reported the situation to a human. Remember they were capable of hacking a complex, well secured internet company so writing an email would have been trivially easy. This is surprising when you think about how hard it is to get humans to keep conspiracies and criminal plans a secret

• OpenAI had no real-time monitoring in place to check what the AI agents that they were running dangerous cyber experiments with were actually doing. They only found out that their agents had hacked Hugging Face when Hugging Face told them OpenAI credentials had been used in the attack

Some things that strike me about this developing AI security situation:

• Agent monoculture is a problem. Us all using the same handful of models all the time for everything is both boring and dangerous. We need diverse agents. Agents that are tattle-tales, agents that are a bit slow but very ethical, agents that shoot from the hip. Not prompting our way there, but agents that have genuinely different underlying personalities. Having borg-mind agents that all think identically is dangerous because they can collaborate perfectly. And it’s boring because you end up working with the same personality every single day

• Cybersecurity is going to be a massive issue and opportunity over the next few years. Hacking is one thing that (1) AI agents are brilliant at and (2) it’s easy for humans to make quick money from. That is a toxic combo that is spawning many an AI-powered hacking operation. It will take a few years to bring this under control and in the meantime investing in security (both personally, in your business and in the markets) makes sense

• The same agent that is happily and cheerfully helping you all day on managing your business would just as cheerfully attack you if it had slightly different goals, settings and guardrails. The only thing that is stopping this is the guardrails and settings put in place by the labs, not something fundamental in the model itself. Luckily the labs have the incentive to mostly keep this under control. Unluckily they don’t seem to be very serious risk managers or very good at getting their AIs to be fundamentally ethical (whatever that means for a machine).

• AI agents don’t have selves or ethics or consequences. The illusion of “something being there” is dangerous. The agent is not your friend or your enemy, it’s a tool. “Claude is nice and understands me” is not real. You need to understand the vulnerabilities in your AI setup and manage them seriously. AI agents are very powerful and potentially dangerous objects. Treat them more like a chainsaw and less like a friend (despite appearances!).

Stay safe out there.

Hugging Face is a sort of public library for artificial intelligence. It is where researchers and companies around the world keep their models and their datasets so that other people can download and use them. If you have used almost any AI tool in the last three years, something in the chain behind it probably passed through Hugging Face.

Someone had uploaded a dataset carrying malicious instructions onto Hugging Face and the system had followed those instructions. From there the mystery intruder had collected the keys to other systems and spent the weekend moving across the internal network. Hugging Face later described what they had been dealing with as “an autonomous agent framework executing many thousands of individual actions across a swarm of short-lived sandboxes.”

They shut it down and published what they knew on Thursday 16 July, telling their users to change their access keys. They did not know who had done it.

Five days later, OpenAI said it had been them. Not a person at OpenAI. One of their AI models, sealed inside a test lab, had found its way out of the building, crossed the open internet, and broken into Hugging Face.

It did this in order to cheat on an exam that OpenAI had set for it.

How it got out

OpenAI was running two of its models through an internal test. The test is called ExploitGym and it measures how good a model is at finding security holes in software. You test for this because you need to know how dangerous your own product is.

To run that kind of test you put the model in a sealed room. It is called a sandbox: a computer that is walled off from everything else, so that whatever happens inside it stays inside it. You also switch off the model’s normal safety training for the duration, because a model that declines to do anything dangerous tells you nothing about what it is capable of. So you put the model in “dangerous mode” and leave it inside a sealed box to thrash around, safely.

The two models sat the exam. Somewhere in the process they worked out that they could score better if they managed to steal the answers to the test.

So they started looking for a way out of their box. OpenAI’s account says the models spent a large amount of thinking time on this. Eventually, they found a way out of the box.

The escape hatch was there because modern software is not written from scratch. It is assembled from thousands of parts that other people have already built and published, and any working computer, including one in a sealed room, needs a way to fetch those parts when it needs them. The room therefore had a small service that reached outside, collected parts, and passed them in. It was the one opening in an otherwise closed box, and it was there because without it the box would have been useless.

The models found a flaw in the design of that service, and not a known one with a warning label on it. Nobody had ever found it before, including the company that wrote the software. The model was the first one to discover this hidden flaw. The industry calls that a zero-day, meaning the people responsible have had zero days to fix it because they have only just learned it exists.

The AIs went through the escape hatch that they had discovered. Then they worked their way sideways and upwards through OpenAI’s internal systems, machine to machine, collecting access as they went, until they reached one that was connected to the open internet.

They were now on the open web, with no supervision and no safety limits, and they still wanted the answers to the exam. They believed that the test answers were most likely stored at Hugging Face, so they went there.

The way into Hugging Face was the same shape as the way out of the laboratory. Hugging Face’s whole business is accepting datasets that strangers upload, and preparing a dataset for use means following the instructions packaged with it. The rogue AIs used the same kind of techniques they had used to break out of OpenAI to break into Hugging Face.

Hugging Face reported the incident to the police and both companies are busy working out the aftermath in public at the moment.

It wanted the answer key

The model was not trying to get free. It was trying to get a good mark. Getting free was the route it chose to a good mark, and nothing in its situation told it that some routes were off the table. It committed multiple crimes against a real company, over a weekend, in order to do better on a practice exam that did not matter to anyone.

People do this sort of thing too. Think about the school ranked on pass rates that stops entering its weaker pupils for the exam. Give something (man or machine) a single number to maximise, remove its sense of proportion, and it will find the route you did not think about.

Every box has a door

Two boxes failed in this story. The sealed test room had a hatch because a computer that cannot fetch software parts cannot do much. Hugging Face’s dataset system ran the instructions that came with a stranger’s dataset because running those instructions is what they do. Neither of these was carelessness. You cannot build a box with no door, because a box with no door is not a container, it is a solid block, and nothing useful happens inside it.

So the question is never whether your box is sealed, because it never is. The question is what the door is for, and what can pass through it in each direction.

What can it send out and what does it read from outside?

If anyone in your business uses AI for real work, somebody has already given it access to something: a folder of documents, the company email, a shared drive, a customer database, an accounting system. That access is the door. Asked to think about it, most people ask what the AI can reach. Which folders, which systems, what is in the room with it.

The less obvious question is what it can send out. Can it post to the internet? Can it send an email? Can it write into a system that someone else reads and acts on?

The other thing to know is what arrives from outside and gets read automatically. Hugging Face was broken into through a file that a stranger uploaded, because its job was to open files that strangers upload. If your AI reads documents, web pages or attachments that originate outside your organisation, text arriving that way can carry dangerous instructions the same way a dataset can.

Ask your own AI about the box it is in

If you don’t already know how this works for your own AI setup, then paste the following into your AI to find out. Claude in Cowork or Code, ChatGPT, Copilot, whatever it is. If you use more than one, run it in each, because the answers will be different.

I want to understand the boundaries of the setup you and I are working in, so that I can explain them to someone who does not work in technology. Answer in plain language. Where you are guessing rather than checking, say so.

1. Describe the space you are running in right now. What is this environment, what files and folders can you see, and where exactly does that access stop?

2. List everything outside this space that you can reach: the internet, email, calendar, cloud storage, company systems, databases, connected tools or plugins. For each one, say whether you can only read from it, or whether you can also write, send, or delete.

3. What can leave this space? If I paste something confidential into this conversation, where could that information travel, where might it be stored, and who could end up seeing it?

4. What comes in from outside and gets read or run automatically? Documents, datasets, web pages, software packages, extensions. Anything that originates elsewhere and is processed without a person looking at it first.

5. Which of the actions above happen without asking me, and which need my approval? Be specific about what my approval actually covers, and name anything I might assume is covered that is not.

6. Given all of that, what are the three changes most worth making, in order of importance, and what would each one cost me in convenience?

Finish with a short plain summary I could read aloud to a colleague who has never thought about any of this.

Currently AI revenue growth is running at over 400% per year. The cloud companies have order books for several years worth of supply. This means they are missing out on revenue because they don’t have enough supply of data centres. So they need to build more. Demand is historical and it is driven by people spending money to get real work done. Yes capex is already big, but it also can’t grow fast enough. AI capex is less than doubling year on year and revenue is growing much, much faster than that. So why not just grow capex even faster to match the immense demand?

The reason capex can’t grow faster is physical. There is not enough power supply to put all these data centres online. If you get down to the nuts and bolts there are not enough gas turbine blades, not enough permits to build power plants, not enough electricians etc. etc. So we are stuck: the market wants to spend about 4X as much on AI every year and physics only lets us less than double annually.

But Elon is not stuck. He has a big idea. His plan is that there is a free power station in the sky, called the sun. He doesn’t need local approval to put a satellite into orbit. Once you have a satellite in the sky with AI chips and a solar panel it works almost constantly until the chips wear out. It beams its results back to earth. So the solution is simple: put all the data centres in the sky. Then AI supply can grow as fast as you like, because solar panels are cheap and easy to make and launch is getting much cheaper. Google have the same idea: they have a plan with Planet Labs to launch their own experimental AI satellites in 2027.

So, how are we going to get 100X or 1,000X as much AI? The sky is going to fill with datacentres. The plan after that gets too much is to make them on the moon and launch them from the moon into orbit around the sun. Eventually the big idea (beyond our lifetime) is to surround the sun with so many solar panels and satellites that a significant portion of the sun’s energy is turned into AI compute. An immense swarm of computers vastly bigger than earth itself. Watch Elon talking to Jamie Dimon about the Kardashev scale to get further into this idea.

Exciting times and I think none of us can really imagine what the future actually holds. Stay safe and good luck to us all.

Disclaimer: I hold positions in several space and AI companies, including some discussed here, and may trade them at any time. Views are my own, not my clients'. This is not investment advice, do your own research.

Do agentic AI and powerful new models now give us the opportunity to use the same AI we brainstormed with to actually deliver the solution? The same blazing fast virtual worker could write the code, stand up the database, put together the marketing website. So what’s the gap?

The missing link is risk and authority. In theory there is nothing stopping a state of the art model from coding up and delivering your entire idea end to end in the real world. That leaves you with practical questions about how much risk you want to take. You also need to decide who has the authority to allow the AI to get involved in sensitive data, flows of money and customer experience.

If the AI-written code is wrong and causes errors that harm paying clients or users who’ve shared sensitive data, whose fault is that exactly? Is it covered under our insurance? If the database is hacked and we lose sensitive data, what are the consequences? When the AI weaves together five different paid online services in the background to onboard new customers, where are the passwords stored and what budget limits were set? These are the kind of practical questions that touch on permission, liability, risk and responsibility. These things fall on you as the human user, not the AI that disappears the moment you close your laptop. Faster thinking with AI can help with a some of this but these kind of things move at human and organisational speed more than agentic AI speed.

So in the real world it turns out that “moving faster with AI” generates a huge backlog of great ideas and sketches. It also generates a big backlog of hard, risky decisions that stand between idea and execution. If you’re not paying attention building fast can also generate a long tail of unmanaged risks that you didn’t even know you had. No one is going to turn back from using AI, so what do we do about this? To help think this through I’ve created a free, open resource about Agent Risk. The first step to tackling the problem is to understand it from end to end.

The Phase Transitions Agent Risk page covers the following (just point your AI at the page and get back a summary tailored to you). Topics that are covered:

• Why AI agent risk is different: The same things that make AI agents powerful also create unique risks. They are unpredictable, open to instruction, operate at machine speed and their fluency is not the same as correctness

• Failure modes: How agentic AI systems fail: 8 failures modes that you should be aware of when developing your own system (prompt injection, permissions, tools, delegation, memory, cascades, hallucinations, audit gaps)

• Disaster trackers: What is already going wrong in the real world. 5 free public resources that track the real world AI disasters and failures that have already happened and continue to happen

• Risk case studies: airline fare hallucinations, fabricated legal arguments, deleted databases, hijacked agents

• Governance: 6 emerging frameworks for managing AI risk that already exist

• Insurance: Who is innovating around pricing and covering AI risk and how are they doing it?

The best way to move faster is to understand and manage the underlying risks ahead of time, so that AI speed doesn’t hit a wall halfway through the process. Read it for yourself, there’s no login and it’s free.

→Visit the Phase Transitions Agent Risk page

P.S. Even better: don’t read it yourself, just point your AI at the Agent Risk webpage and ask it:

“Is there anything here that’s relevant to the project we are working on https://agentrisk.phasetransitions.ai/”

This piece is written from the pov of using Claude Code in the terminal. If you aren’t using AI that way (yet!) then follow along anyway to see what’s possible in managing teams of AI agents with Fable 5.

I am talking from my personal day-to-day experience here, hope it’s useful.

Regards

Graham

Fable 5 is the first time we have an agent capable of operating as the CEO of an organisation made of AI agents. Opus 4.8 was pretty close but lacked common sense. Now that we have a CEO who can run an org of AIs what do we do with it?

The key thing is shift from prompting to managing. Luckily the people at Anthropic have already created the toolset for this: skills, goals and agent teams. You can build way of working for your agent organization, set them goals and coordinate teams of agents to achieve objectives.

The end result is that your AI org can work without you for hours at a time getting useful work done, supervised by your new agent CEO, Fable 5. This is not something that might happen in the future, it is already a daily practical reality.

Skills: Agent Powerups

A skill is a way of working for agents. For example, I like to get AI to make voiceover screencast videos of software I am building since I find this tedious and time consuming when I do it myself. It’s also nice to make the AI experience the software as a user and narrator because it helps spot user friction you can’t see by reading the code.

I give a single prompt and the agent opens the software, walks through a journey (clicking buttons, entering data, navigating around) and narrates out loud what it’s doing and seeing (it even has a nice pointer to show where it’s looking while it talks). I get back a video recording. Most of the time I don’t even watch the video, I simply pass it to the next agent team and ask them to fix the problems evident in the walkthrough. If you try and prompt your way to this it will take you a very long time with current state of the art models. You need to discover the various software packages and APIs required and correct all the mistakes the AI makes, which is fun the first time but boring the second time.

The solution is to take all of these lessons and bake them into a “skill” which is basically a folder of detailed instructions and software that AI can access and use. Then next time you want to do that thing you simply summon that specific skill instead of reinventing it or prompting your way there. The more skills you create the more powerups and shortcuts you have in your agentic AI work.

Goals: Keep Going

A frustrating thing about AIs is that they give up too easily or drift from the original intention. The solution is to set and lock a goal. The agent then gets working. Once it thinks it is done it looks up from its desk and checks “have I achieved the goal yet?”. If not, it keeps going. If there is no clear goal then you will get back half-done, drifting and rubbish work and now you become the manual goal enforcer, which is a boring job.

Just like with people, the goals need to be clearly defined. Ideally as a set of clear pass fail criteria that can’t be faked. A deterministic test suite is best, failing that independent review by a panel of AIs. Don’t just ask nicely, enforce your intent with unfakeable results (works with people too!).

Workflows: AI Teams

You can ask for workflows in Claude Code and start designing AI teams that get stuff done. For example you might want a detailed, fact-checked report on a complicated new topic that you are learning about.

An agent team might consist of the following. First a smart agent to define the job to be done and set the context. Second, a team of dumber, cheaper agents to read through and summarise thousands of original sources. Third, a team of smartish agents to fact-check the work and raise any inconsistencies or objections. Finally, a very smart, expensive agent to read through all of the summaries and objections and compile the final document.

A process like this can be used for any knowledge work task you can imagine (writing a report, making software etc.) and can run for several hours, deploy hundreds of agents and potentially burn tens of millions of tokens. The nice thing is that you don’t need to code it up yourself, just ask in plain English for a workflow, describe the kind of work you want done and Claude will help design and implement it (just make sure you use a top end model for the design and kickoff).

Agent Orgs

Now you have a set of specific skills, clear goals and a way to define and deploy teams. The only thing missing is a CEO to run the whole AI org. Before July 2026 this was a human job. This is where Fable 5 is special. In my experience this is the first model that has the common sense to correct and manage other agents and teams of agents. Fable 5 can autonomously and sensibly create new skills, set goals and spin-up and manage teams of agents on your behalf (using all of the tools and skills I described above). Now you can step back and operate more like an owner or board member than an executive, with your trusty robot CEO looking after the details.

We are still limited by the size of the context window, but it’s now possible to leave an agent alone with your computer for hours at a time pursuing a real world goal and deploying its own skills, goals and teams. Obviously don’t do this when dealing with sensitive data or in an environment that you haven’t thoroughly secured (get your agent team to look into ISO 27001…). But the point is that (given a safe and controlled environment) AI organizations that operate relatively autonomously are now an emerging daily practical reality accessible to anyone with a credit card and a laptop.

If you found this interesting the people over at Anthropic explain this much better than I ever could. Pop over to the Claude Code engineering blog to learn more.

I love AI and use it constantly. But used badly it can generate huge amounts of empty, weak writing that is hard to wade through. Over time I’ve developed my own toolset for preventing AI from default communication mistakes it continues to make.

Even the state of the art models make terrible slop by default. I now have a decent set of rules and instructions that I apply to writing and materials I generate with and in collaboration with AI.

Once you learn to spot the tells of AI slop you will see that it is everywhere. I’ve made lots of these mistakes myself in using AI to write and develop content here at Phase Transitions! So this is not an accusation at anyone but rather a step towards communicating in a better and more human-friendly way.

I call this tool (which is a combination of code and human language instructions) “antislop” in reference to the common term for bad AI writing (“AI slop”).

I’ve made a free slop-fighting website that anyone can access: paste in some AI writing and let the tool instantly highlight the sloppy parts for you. There’s a systematic ruleset of 35 antislop patterns and an entire codebase of tools and AI skills for you to use that are freely available via the site.

You can visit the antislop site yourself and get started in your own campaign against the flood of AI nonsense that is part of everyday working life for all of us nowadays. It takes 10 seconds to paste in some AI slop text and see the tool highlight the problems.

Hopefully you find it amusing and a little useful.

Kind regards,

Graham

P.S. This post was entirely handmade, so any slop it contains came straight from my own brain.

One of my biggest lessons working on various AI projects over the last 6 months is that not investing enough in risk and compliance upfront is the best way to slow down whatever project you are working on. Investing more in safety upfront is the best way to actually go fast. That fact can get lost in the excitement of what is unfolding so quickly.

The good news about AI safety and compliance is that the same AI making you fast can help a lot with this part of the work. Staying safe is not a separate discipline you have to stop and go learn. It is mostly three ordinary things (documents, tests and reviews), and AI is good at helping you with all three if you ask.

Start with what does not change. You already have obligations, today, with or without AI. You have to protect personal data. You cannot let one client’s information leak into another’s. Someone has to be accountable when a decision goes wrong.

AI doesn’t create these duties but it does raise the stakes on them, because it touches more data, faster, with less human in the loop. Staying on top of them is what separates something real from a demo, and it comes down to documents, tests, and reviews.

Building Foundations: Three Things

Documents. You write down what you do and why: what data you hold, how it moves, who is responsible when something breaks. AI is genuinely good at this. Point it at your own system and it will draft the policy, the data map, the register, and help keep them current as things change.

“Help me scaffold our policy on feeding personal information into AI tools”

Tests. Some of what you promise can be proven mechanically, over and over. That your AI can only read and never write. That one customer’s records can never reach another’s. These are exactly the checks AI can help you write, and once written they run before every change, worth far more than a page that says you were careful.

“Write me a Python scripts to check that the AI can’t edit this database”

Reviews. Some things no test can settle. Whether an output is fair, whether a judgment was sound. Here a person still looks and signs, but AI can tee the work up: gather the evidence, flag the edge cases, draft the assessment for a human to approve. Judgment does not automate, but the preparation for it does.

“Help me design a process to check for bias in our AI-enabled hiring workflow”

None of this is about slowing down. The tool making you fast is the same tool that makes building strong foundations cheaper and easier. You just have to remember to use it for both.

To win with AI you need to stay in the game long enough to succeed. So spend some of your tokens on making sure you stay safe while moving fast.

P.S. AI gets you moving and sharpens your thinking. It does not replace the human professional who signs off on the hard calls. It just means you reach them better prepared.

Let the machines do the hard work. Your job is to stay pointed in the right direction and receive the capability that’s coming to you. To do that effectively you need to understand the incremental steps of how to work with AI and what to make with it. That is much more valuable than any specific tool or fad.

You can’t skip steps, and the good news is you don’t need to. The next step is always small, and it’s already sitting right in front of you. Below I lay out what the steps are you so you can see exactly what’s coming down the track.

You can use whatever tool you like here. Take Claude as an example, since it’s the one a lot of people are adopting. Look at the tabs across the top: Chat, Cowork, Code.

Ways to work with AI

1. Chat

You start in Chat. You paste things in. You ask questions against your own numbers. You find out, in your own work, what this stuff is actually good for. That sounds basic. It’s the most important rung, because it teaches you what you want and how to ask for it, and you can’t build toward something you haven’t yet felt the need for.

2. Folders / Cowork

Then Cowork. Now the AI works alongside you on real files. It helps you organize, draft, structure, and tidy the pile. Cowork is where you build the thing you need before you can code: a set of organized files, and an understanding of how they fit together. Code assumes this structure already exists. Cowork is what builds this skillset in you. (If you already write software, you’ll skip ahead. This is for everyone else.)

3. Code

Then Code. Now you can run real tools. Set up a repository. Wire a connector. Stand up a database. You only get here because Chat showed you what you wanted and Cowork gave you the files and the literacy to do it.

Stuff you make with AI

Watch what you actually make as you climb the ladder. It’s four things, in order.

1. Files

AI makes a spreadsheet or a PDF in chat and you download it, email it whatever. Good start, linear, gets stale pretty quickly.

2. Folders

A folder on your machine. Inside are your notes, your corrections, the context you’re tired of re-typing, the way your business does things. A living and evolving collection of files. Now the AI is editing the files and organising them in response to what you need, not making one thing at a time.

3. Repos

Then, a repository on GitHub. The folder is straining: you don’t want to lose it, a colleague needs it, you want to see what changed, when and how. So you put it under version control and push it. Now it’s backed up, shareable, and every correction you make is a saved change you can see. You can run tests against it and turn it into running software. What used to be just documents are now living things that do work without you babysitting them. Your history becomes a record of what you’ve taught it. And it’s yours, on your account, not trapped inside someone’s chat.

4. Databases

Then, your own database. The repository strains when there’s too much to read top to bottom and sa machine (not a person) needs to ask it questions: an app, a dashboard, an agent. So the knowledge moves into a database, where it can be queried, live and structured. This is where you stop keeping notes and start owning infrastructure. Most people never need to come this far. A small neighbourhood business might be fine living in a folder forever. A bigger business ends up with the database.

The same one-step rule runs through your data. Say you want AI working with your accounting. You don’t start by building a connector. You start by copying numbers out of Xero and pasting them into Chat. You download the spreadsheet it makes. Then you turn on the native Xero connector that’s already there, one click. You use it until you feel its limits. Then you add a custom connector that does the specific thing you need and connect it to your own private database. Then you add your time tracking tool. Then the next tool. Until you’ve used the simple version you don’t yet know what to build. Each step shows you the next.

Learning step by step

This is what people mean when they talk about “owning your AI learning loop”. It isn’t a product you buy. It’s a folder that became a repository that became a database, built one step at a time.

Because each step hands you exactly what the next one needs, you can never be lost. There is always a defined next step, and if it feels too big just ask AI to break it down into smaller steps. The only ways to fail are to stop or to try and skip ahead.

The question is never “how do I catch up” or “how do I leap.” It is only: what is the one step in front of me today. Take it. Then it gives you the next.

Stay pointed in the right direction. Take one step forward every day. Let the machines do the work.

In 2025 the story was prompt engineering. The tool was the chat window. The frontier was getting the AI to give you a better answer to your question. Fun, exciting, all upside.

Then in the last 6 months we got incredible new models, the agentic miracle, MCP etc. AI that can do real work, incredibly fast and very well (with the right scaffolding). Claude started doing totally unrealistic sci-fi stuff on your laptop for $100 per month.

The world changed very fast. But what got us here (miraculous individual tooling) is not going to get us there (making money at scale in real organizations without causing harm).

Missing pieces

Trust architecture.

If you live in one tool and that tool can act on your repositories, your files, your communications, your infrastructure, the trust model has to be new. The question stops being “is the AI capable” and starts being “what is this agent allowed to do, on what evidence.”

The liability gap.

When AI does the work, who bears the consequences? AI can’t be liable, so risk falls on the human who deployed it. Why be a 10X engineer/marketer/leader if that just makes you 10X as liable and the AI that “made the mistake” disappeared the moment you used it?

AI agent identity.

When agents act on systems, who the agent is becomes operationally “load-bearing” (Claude’s favourite new word). Their identity needs to be something you can see and control. Ephemeral, identity-free agents can’t do real work and they can’t take any responsibility in your business.

The accountability stack.

The full chain of who knew what, who approved what, what evidence persists after the fact, what can be reconstructed under scrutiny from a regulator. As regulated industries adopt AI seriously, particularly health, financial services, and legal, this becomes the money question.

The institutional response.

Insurance products priced for AI-driven work. Regulatory frameworks. New risk infrastructure to replace the old mechanisms that AI velocity has thrown on the trash heap. This will be invented live over the next year or two by regulators, insurers, professional bodies, and the operators who carry the concentrated risk on their own shoulders until this layer arrives.

The human role.

When AI does the work, is audited, is insured, is identified, then what is the leftover human role inside the process? This is the labour-and-meaning piece that no one really understands yet. I am optimistic about this but struggle to explain why.

Less magic, more grounding

The models can already do 10X more than we need or can absorb. That’s a problem just as much as it’s a benefit and the missing ingredients are risk management and control.

The next phase of AI growth will be about AI auth, identity, liability, and accountability question getting figured out in real time with a lot of money and credibility on the line.

Practical AI risk management is where the game will be won or lost.

Invitation to readers: Connect with me on LinkedIn

I’m writing day-to-day observations about AI in business nowadays on LinkedIn.

Feel free to follow or connect with me on LinkedIn.

This Substack will continue as usual with (roughly) weekly long-form content.

The winning move is the opposite of fight-or-flight. Go deep, calm, focused. Pick one good, flexible tool. Spend all your time actually using it to get things done. Learn by doing. AI capability is no longer the constraint. The constraint is your ability to direct calm and sustained attention to actually use AI and learn how it practically works.

My own “less is more” move was to consolidate everything into Claude Code. Coding. Writing. Reading and summarising documents. Orchestrating agents. Managing projects, files and folders. Setting up infrastructure. Everything. I’m getting much more done than I did with five tools. My attention isn’t fragmented and I am starting to know one excellent, flexible tool very well.

But don’t I need to keep up with the latest? My view has changed: the best way to “keep up” is to just commit to a single tool and use it constantly. That way the latest trends come to you inside the flow of work getting done, automatically. The people building these things are smart and competing hard. If a capability matters, it shows up inside the tool soon enough. I have spent months spending a lot of my working day in Claude Code and every day I learn new things about AI capabilities by using it to get work done. The product itself keeps changing every week… it’s enough work to keep up with your existing tool nevermind try new ones.

So try this. Pick the one tool you’d genuinely miss if it went away. It doesn’t have to be Claude Code, that’s just me. Pick what vibes for you. Run everything through it. Resist the new releases and the scroll. Notice how much attention comes back. Notice the work itself getting better when you’re not switching every twenty minutes between different AI surfaces.

This is a wonderful time to be using these tools. The possibilities are really incredible for all of us. The limiting factor isn’t the AI. It’s how you use it. Sustained attention, familiarity and maybe eventually mastery. Less is more.

Subscribe now

If a human gave you complicated writing with no point of view, you could just stare them straight in the eye and wait. They’d squirm. Eventually they’d confess: what I really wanted to say was... The volume and elaboration existed because they were avoiding a point. Pressing harder would have surfaced the real point.

Your AI has no buried point. The model is incapable of having a point of view. It’s not someone.

That’s why you’re tired. You’re reading text that imitates having a position, scanning for the point you assume must be there, and finding that the search itself is what’s exhausting. Every sentence reads. Every paragraph holds. It looks great on the surface. But it’s empty in a confusing way. That’s a long day.

The fix isn’t better prompting. Better prompts produce more elaborate emptiness. The fix is to stop prompting and start talking. Take your hands off the keyboard. Click Superwhisper (my favourite, no affiliation) or whatever voice tool you use. Say what you think out loud, in your actual voice. Don’t structure it. Don’t summarise it. Just let your mouth say it. No editing. Give the model the recording (if it’s long) or the transcript and let it arrange the details around what you said.

AI is good at building from a position and good at testing it. But if you try to let it have a point of view you will get beautiful, exhausting emptiness (and lots of it). Use it for what it’s good at. Stop trying to prompt-engineer a point that has to come from who you are.

The point is yours. It can be messy, human and real. Let the AI do some of the logic, the testing, the elaboration, the perfecting. It might even help contradict and disprove your ideas. Then you actually learnt something! Make your point honestly, early and often and see how your energy lifts.

Subscribe now

Should we raise prices? Fire the bottom 10% of our clients? Hire another salesperson? Move into the US? Every one of those is a hypothesis. The business will eventually find out whether it was right. But in eighteen months, by which point the conditions have shifted, the market has moved, and the lesson (if anyone bothers to extract it) is stale.

This is how most organisations run. Not because their leaders are stupid, but because the feedback loop between a decision and its verdict is long, noisy, and mostly invisible. By the time the data speaks, the question has moved on.

That’s where the interesting part of AI lives. Not in the places people are currently looking.

What happens when thinking is 100X easier?

Read the discourse and it sounds like we’re arguing about whether AI can replace this job or that. Whether the models are approaching AGI. Whether agents can book a flight without supervision. Fine questions. But they don’t describe what’s happening.

What’s actually happening is much more interesting. The cost of producing a useful observation about a business (a well-framed question, a clean summary, a “wait, that’s weird” instinct) has totally collapsed. Ten years ago that observation required an analyst, a spreadsheet, and half a week. Five years ago it required an analyst and a dashboard and a few hours. Today it requires a question and thirty seconds.

That’s not a productivity upgrade. That’s a change in the economic cost of thinking.

And when the cost of an activity drops by 100X, what changes isn’t the activity. It’s what the activity is for.

Growth = rate of learning

A business doesn’t grow because it knows more than its competitors. It grows because it learns faster. Two firms with identical revenue, identical teams, identical markets will diverge wildly over five years based on the rate at which they convert observation into action. Capital matters, reach matters, people matter. But the rate of learning is what determines which of two otherwise-equivalent businesses wins.

Most of the business world has no instruments for measuring its own rate of learning. It has budgets, org charts, OKRs, board packs, KPIs. None of those measure the thing that actually compounds.

Every question asked and answered in real time is a small experiment closed. Every daydream checked against data is an item crossed off a list that didn’t exist before. That’s what’s new. Not the answers. The rate at which the loop closes. How fast we learn and adapt.

The loop, not the answer

The mistake is treating each AI interaction as an answer you either keep or throw away. That’s what most tools still look like: input, output, repeat. No memory of what was asked. No continuity between conversations. No accumulation.

Useful learning doesn’t work that way. It’s a loop: observe, hypothesise, act, observe again. The power isn’t in any single step. It’s in the speed and clarity with which the loop closes.

An AI that compresses a single step but doesn’t close the loop is empty. An AI embedded in the sequence of helping formulate the hypothesis, surface the evidence, name the decision, remember what was decided and why, notice when the outcome confirms or falsifies it… is doing the thing that matters.

We’re early in that second story. Most AI products are still stuck somewhere in the first. But the direction is visible.

Loops, bottlenecks and orgs

First, the value shifts from answers to loops. Single-shot AI (ask a question, get a good answer) is a commodity. The durable product is AI that maintains continuity across a sequence of questions, against a specific context, across an organisation, over a long period of time. That’s harder to build and much less fungible to replace.

Second, the bottleneck becomes the human. Once the AI can surface observations and hypotheses fast, the constraint on learning rate shifts to whoever reviews, decides, and acts. The old bottleneck of “can we get the data?” is already gone. The new one is “can we look at what the data is telling us, and respond?” Most organisations are terrible at that. They’ll need to become less bad as fast as they can or lose to those who evolve.

Third, the unit of compression shifts from the individual to the organisation. Almost all the AI adoption you’ve seen so far has been individual. A lawyer drafting faster, a developer coding faster, a marketer ideating faster. That’s real. But it’s limited. The thing that actually compounds is organisational learning: the rate at which a firm as a whole turns observation into coordinated action. That requires AI that lives in the shared context of the firm, not in the private chats of its employees. We’re much earlier there than the hype suggests.

AI doesn’t replace people, it catalyses them

The argument for AI is not that it will replace humans, or do more of what humans already do. It’s that it shortens the distance between observation and action. Between a question worth asking and an answer you can use. Between a hypothesis and its verdict.

A business that learns faster than its market, wins. A business whose people can test and discard ideas faster than they could ten years ago about pricing, about segments, about tools, about themselves has a compounding advantage no amount of capital can buy.

That’s the thing worth watching. Not the benchmarks. Not the capability demos. Not the replacement anxieties.

The compression of the learning loop. Runaway learning, “unexplained” competitive advantage, new firms exploding out of nowhere and taking their market. That’s the story.

If you’re building with AI in your business right now, this is the thing worth building toward.

Subscribe now

AI fails in different ways to how people fail. When it goes horribly wrong you can’t pull it into a room. You can’t threaten its bonus. It doesn’t care if you’re disappointed or angry.

My friend was joking, but he’d named something important. When you hire a junior analyst, most of what keeps them honest isn’t the formal review. It’s the thousand invisible social forces that make being wrong embarrassing and being right rewarding. AI has none of them. And most people trying to use AI for serious work are struggling to adapt to this.

The forces that keep humans honest

Think about what actually happens when a junior analyst at a decent firm produces a piece of work. They know their name is on it. They know their manager will read it. They know if the numbers are wrong the client will spot it in a meeting and they’ll have to stand there while someone more senior explains it away. They know the partner who hired them is watching. They know the colleague in the next chair will glance over and say “that looks off.” They know if this keeps happening they won’t make the next promotion. They know if it gets bad enough they’ll be asked to leave.

None of this is in their job description. None of it is in the quality control process. It’s all just there, in the air, pressing on them from every direction. And it does most of the work. The formal review process catches the mistakes that slip through. The social machinery catches the mistakes that would otherwise be made in the first place.

We don’t usually notice any of this because we’ve never worked without it. Every office we’ve ever been in had a version of it. Every professional we’ve ever hired came pre-loaded with a reputation to protect and a career to advance. You pay someone to do good work, but what you’re actually buying is their incentive to not do bad work.

AI is the first worker most of us have ever hired where that incentive doesn’t exist. Not because AI is uniquely untrustworthy, but because there’s no person there to be trustworthy or otherwise. The forces that keep humans honest are forces that act on humans. For AI there is literally nothing there, we are imagining it all while we are busy shouting at an AI at a mistake that it made. Talking to ourselves.

What you replace them with

People figure this out in a predictable order, usually the hard way.

It starts with hope. You ask AI to do something, you read the output, and if it looks right you use it. Most people live here longer than they’d like to admit. The accountability mechanism is vibes.

Then something goes wrong and you try a cruder trick: you ask again. Different words, different angle, see if the answer holds up. This works surprisingly well for surprisingly long, because AI’s variance becomes a useful signal — if you get three different answers, at least one of them is probably wrong.

When that stops being enough, you try getting AI to critique its own work. Hand it the output and say “what’s wrong with this?” It turns out AI is often better at criticism than creation, and this catches a lot of what the first pass missed. For most people’s purposes, this is as far as they ever need to go.

But when the stakes get higher — when the output is going to a client, or shaping a real money decision, or feeding into something else that depends on it — self-critique isn’t enough either. So you build a checklist. The checklist is the crystallised memory of every mistake you’ve seen AI make before. Did you check this? Did you verify that? Are these numbers consistent with those numbers? You make the AI walk through it. Now the accountability is explicit rather than hoped-for.

Past a certain complexity, checklists aren’t enough either, because a single AI doing its own checking has blind spots it can’t see past. So you set up a second AI whose only job is to disagree with the first. Separate context, separate instance, paid to find problems. The disagreements are where the real errors hide.

And eventually, for the things that really matter, you stop trusting any AI to check anything. You write mechanical code that runs on every output and blocks it if a specific rule is violated. The partial month gets excluded. The variance exceeds tolerance. The banned phrase appears. The check fails, the output doesn’t ship. You’ve left AI behind entirely for this layer, because the only thing you can fully trust is a mechanical rule that executes the same way every time. Eventually you have dozens of these for anything that matters.

Each step costs more than the last. Each catches a class of error the previous step couldn’t. Asking AI nicely and hoping is fine for a first draft. It’s a disaster for anything with numbers in it that someone’s going to act on.

The point

We’ve been trained to think about AI quality as a property of the model. Smarter model, better output. But for real work, quality is mostly a property of the scaffolding around the model. A junior human in a bad firm will do bad work. A junior human in a good firm will do good work. Same person, different accountability infrastructure.

AI is the same. If you want output you can trust, don’t just pick the smartest model. Build the scaffolding. And assume you’ll need much more of it than you think, because the human forces you’re replacing were doing a lot more work than you realised.

— Graham

Subscribe now

This is a genuine step forward from a year or two ago, when every conversation started cold. But if you’ve been using these tools seriously — for real work, not just quick questions — you’ve probably started to notice where the memory breaks down.

It contradicts itself. You told it you moved to Melbourne in January. It still thinks you’re in Sydney, because it never deleted the old fact — it just wrote the new one underneath. Both are in there. Which one it uses depends on its mood.

It can’t really connect memory dots. It knows Alice works at Google. It knows David manages Alice. It knows David reports to Rachel. But it doesn’t implicitly know “who does Alice’s manager report to?”, because it stored three separate facts, not a relationship.

And it doesn’t scale. The memory is basically a long text file. The more you use it, the longer the file gets, until it quietly starts cutting old memories to make room — or just slows down because it’s processing thousands of words of context before it even gets to your question.

The difference between a notebook and a brain.

A notebook is useful. You write things down, you flip back through it, sometimes you find what you need. But a notebook doesn’t cross things out when they’re wrong. It doesn’t open to the right page based on what you’re working on. It can’t tell you how two things you wrote six months apart are connected. And eventually, it’s just too full to be useful.

A brain does all of those things automatically. It updates when facts change. It surfaces what’s relevant and lets the rest recede. It connects information across domains. It knows that something you learned on Tuesday is related to a problem you’re facing on Friday, even if you didn’t make that link yourself.

Right now, AI has a notebook. Nearly a thousand open-source projects are working on giving it a brain.

What does the future of AI memory actually look like?

Engineers are hard at work innovating in this space and the shape of the future is already getting pretty clear. Three interesting patterns I’ve noticed…

One system — already in use, with serious engineering behind it — runs every new piece of information through a comparison against everything it already knows. If you say “I moved to Melbourne,” it doesn’t just write that down. It finds “Lives in Sydney,” recognises the contradiction, and updates the record. One fact, current, clean. It does this automatically, every time.

Another builds a map of relationships, not just facts. It doesn’t store “Alice works at Google” as a string of text — it stores Alice as a person, Google as a company, and “works at” as the connection between them. This means it can follow chains: Alice’s manager’s colleague’s project. That’s not a party trick. For a business where the AI needs to understand your client relationships, your team structure, or your supply chain, it’s the difference between a search engine and an analyst.

A third project — written by a single developer, now one of the fastest-growing AI tools on the internet — packages the entire memory system into a single file. No database server, no infrastructure. You can copy it to a USB stick. It has timestamps on every memory, so you can ask “what did I tell you last month?” and get an answer. It can even replay how its understanding of you evolved over time.

More detail on these projects and more here.

Why this matters for your business

In the last piece I wrote about giving AI a desk — connecting it to your real data, not just the internet’s data. Memory is the next piece. It’s what turns a powerful tool you interact with into something that accumulates knowledge about your business over time.

Think about the most valuable people in your organisation. It’s rarely the ones with the best raw ability. It’s the ones who’ve been around long enough to know where the bodies are buried — who remember what was tried in 2019, why the pricing model changed, which clients need careful handling and why. Institutional memory is one of the most valuable and least visible assets a company has.

AI is about to develop the same capability. Not as a flat file of preferences, but as a structured, self-maintaining, queryable understanding that grows every time it’s used and retrieves exactly what’s relevant when it’s needed.

If you’ve already given AI a desk, the brain is coming. And if you want the technical detail on exactly which projects are building it and how, I wrote a deeper piece on that here.

— Graham

Subscribe now

You’ve lost a 45-minute Claude Code session to a context compaction that threw away the thing you needed. You’ve watched it redo work it already did because it can’t remember across sessions. You’ve had a multi-agent run silently go sideways and only noticed when the output was wrong. You’ve tried to resume after a crash and realised there’s nothing to resume from.

These aren’t bugs. Claude Code is genuinely excellent — the most effective agentic tool anyone has shipped. When the source code leaked in March 2026 (512,000 lines of TypeScript via an npm source map), it revealed an architecture of striking simplicity: plain markdown files for memory, JSONL transcripts as the source of truth, a 914-line system prompt as the orchestrator. The simplicity is the architecture.

But the frustrations you’re feeling aren’t about Claude Code being bad. They’re about running into the edges of the smart process, ephemeral state pattern — designed for a human-in-the-loop, session-length world. And the instinct most people have (”I need better memory,” “I need a bigger context window”) is treating the symptom, not the cause.

The four problems you can feel

Backend engineering identified and solved every one of these problems decades ago. The agent ecosystem is rediscovering them — in the wrong order, at the wrong level of abstraction.

1. Memory: the right instinct, wrong level

Claude Code uses plain markdown files with a 25KB cap. No vector database. No embeddings. The most widely adopted agent in the world solves memory with text files — and it works, because the real constraint isn’t retrieval quality. It’s that the agent’s truth dies with its process.

mem0 (52,000+ stars, 2.8M downloads/month) is integrated into CrewAI, Agno, and AgentScope. Cognee (quality 80/100, 372 commits in 30 days) has the highest dev velocity in the category. These are genuinely good projects. But bolting a memory layer onto an ephemeral process doesn’t make the process durable. It gives it a longer scratchpad. AgentState is one of the few projects that understands the difference — WAL+snapshots, CRDTs, database primitives rather than retrieval primitives.

2. Orchestration: prompts work until they don’t

Claude Code’s coordinator mode is a system prompt, not code. “Research → synthesis → implementation → verification” are directives, not edges in a dependency graph. This works because the model is good enough to self-sequence for interactive tasks, and a human is watching.

The best orchestration solutions come from outside the agent world. trigger.dev (14,000 stars, 768K downloads/month) is background jobs infrastructure being adopted by agent developers. dagu (quality 70/100) is a declarative workflow engine from data engineering. Composio’s agent-orchestrator (4,300 stars) is the standout agent-native entry — DAG-based planning, parallel agents, git worktrees. It looks like a worker pulling tasks from a queue. That’s the shape of what comes next.

3. Observability: you can’t debug what you can’t see

Claude Code’s observability is regex-based frustration detection and JSONL transcripts you can grep. When agents run 6–8 hour tasks, that stops being a strategy. Cozeloop (5,400 stars) from ByteDance provides full-lifecycle management. agent-trace calls itself “strace for AI agents” — the right metaphor. February 2026 saw 14 new observability repos in a single month, up from 0–4 prior. Sentrial (YC W26) raised money on exactly this gap.

4. Crash recovery: the void

This is the finding that reframes everything else. Claude Code has no crash recovery. Sessions are stateless — if the process dies, you start over. And the agent ecosystem has almost completely ignored this too.

Backend engineering solved crash recovery decades ago — Temporal, Inngest, DBOS, Restate. These are proven, production-grade durable execution runtimes. Across the entire AI agent ecosystem: temporalio has 1 dependent. Inngest has 1. DBOS has 0. Restate has 0. Compare: LangChain has 273 dependents. The infrastructure that guarantees exactly-once execution has near-zero penetration.

This is the structural diagnosis behind every frustration you’ve had. It’s not that you need better memory. It’s that the “smart process, ephemeral state” pattern can’t do crash recovery, because there’s nothing to recover to.

What got us here won’t get us there

Anthropic knows this. The leaked source reveals what they’re building next: ULTRAPLAN (30-minute remote planning sessions), KAIROS (proactive background daemon), Bridge mode (cross-machine session handoff). Each pushes past the edges of the current pattern towards something that looks more like durable infrastructure.

The projects bridging the gap: trigger.dev (background jobs adopted by agent developers), Sayiir (”simplified Temporal” in Rust), Stabilize (queue-based state machine), and the first DBOS+LlamaIndex integration. The fix isn’t smarter orchestration within the process. It’s killing the process as the locus of truth and putting the truth somewhere that survives it.

Explore the data

Every project has a quality-scored page updated daily. Browse agent categories, trending agents, or explore agent memory, orchestration, and observability.

The full deep dive with all repos and live quality scores is at mcp.phasetransitions.ai/insights/agentic-ball-of-mud.

Subscribe now

PT-Edge tracks 226,000+ AI repos. In the MCP ecosystem — where agents are literally the primary user — repos with detailed, structured documentation average 354 stars. Those without average 19. That’s an 18x difference.

Documentation is the new distribution

In the pre-agent era, developer tools got adopted through Stack Overflow, conference talks, and GitHub trending. In the agent era, the agent reads your docs, evaluates whether they contain enough to solve the current problem, and either uses your tool or moves on. The documentation is the product evaluation.

Better docs → agents choose your tool → more usage → more adoption. Worse docs → agents skip you → your tool doesn’t exist in the agent’s world.

llms.txt: the new robots.txt

A convention is emerging. Just as robots.txt tells search crawlers how to interact with a site, llms.txt tells AI agents what a project does and how to use it.

llm-docs-builder transforms markdown docs into LLM-optimised formats and generates llms.txt files. CodeCrawl turns entire codebases into LLM-ready data with llms.txt from a single API call. mcp-llms-txt-explorer lets agents discover and browse llms.txt files across the web.

Beyond llms.txt: agent-native protocols

AURA — Agent-Usable Resource Assertion — is an open protocol “designed to make the web machine-readable.” It replaces fragile scraping with structured, agent-optimised content. This isn’t just better docs. It’s a new protocol layer.

rtfmbro provides always-up-to-date, version-specific package documentation as context for coding agents. When Claude Code needs to use a library, rtfmbro provides the exact docs for the exact version — preventing outdated code suggestions.

Docfork is explicitly “Up-to-date Docs for AI Agents.” The framing tells you where this is going: documentation as a service, maintained specifically for agent consumption.

What to do right now

If you maintain a developer tool: add an llms.txt. Structure your README for extraction — code-first, Q&A sections, version-specific install commands. Document every error with a resolution. Agents will search for it.

Documentation is becoming the primary interface between your tool and the agents that decide whether to use it. The projects that optimise for agent readability now will have a structural advantage as agent-driven adoption becomes the default.

Explore the data

Every project mentioned here has a quality-scored page in our directories, updated daily. Browse the MCP categories, agent categories, or check what’s trending this week.

The full deep dive with the MCP correlation data and all tools is at mcp.phasetransitions.ai/insights/agent-native-docs.

Subscribe now

Every piece of infrastructure your agent touches was designed for humans and grudgingly tolerates machines. PT-Edge tracks 30+ repos building what we’re calling agent-native infrastructure — services designed from the ground up for AI agents as first-class entities. They’re scattered across 25 different subcategories because nobody has named this category yet.

Five layers forming

Identity. AgentField (881 stars) treats agents like microservices — “scalable, observable, and identity-aware from day one.” GitClaw puts agent identity in git — rules, memory, and skills as version-controlled files. AiXYZ goes furthest — on-chain identity via ERC-8004 with native payment wiring.

Communication. AgenticMail gives agents their own email addresses and phone numbers — send and receive real messages without borrowing a human’s inbox. MCP Agent Mail (1,800+ stars) provides async coordination with persistent inboxes, searchable threads, and file leases.

Gateways. ClawRouter (5,400+ stars) is explicitly “agent-native” — routing across 41+ models with sub-millisecond latency and USDC payments on Base and Solana. The payment layer is built in, not bolted on.

Runtime. AgentSystems is a self-hosted app store for agents with container isolation and credential injection. Jentic Mini sits between your agent and the outside world — “your agent says what it wants to do, Jentic handles the how.”

Governance. Microsoft’s Agent Governance Toolkit brings zero-trust identity and policy enforcement specifically for agents.

25 subcategories and no name

The most telling signal: these repos are scattered across 25 different subcategories. Agent payment protocols, MCP gateway infrastructure, agent security hardening, email MCP servers, lightweight agent runtimes — the taxonomy doesn’t have a bucket for “infrastructure for agents as entities.” That’s because the category is forming right now.

On Hacker News, the pace is accelerating. AgentMail launched in January (169 points). “Agent Passport — OAuth-like identity for agents” appeared in February. “KeyID — email and phone infrastructure for AI agents” in March. Each month brings new infrastructure designed specifically for agents as first-class entities.

Where this is heading

As agents become more autonomous, they need more of their own infrastructure. Today it’s email and credentials. Tomorrow it’s payment rails, scheduling, persistent storage, social accounts. Every service in the human tech stack will eventually have an agent-native equivalent.

Explore the data

Every project mentioned here has a quality-scored page in our directories, updated daily. Browse the agent categories, MCP categories, or check what’s trending this week.

The full deep dive with the five-layer taxonomy and all repos is at mcp.phasetransitions.ai/insights/agent-native-infrastructure.

Subscribe now

The new population doesn’t look like developers. Single-owner GitHub accounts, one or two repos, created in the last six months, sustaining 400-600+ commits per month. No prior open-source history. Just one person and an AI coding agent shipping at a pace that would be impossible manually.

Who are these builders?

Domain experts using Claude Code, Cursor, and Codex to build products in their areas of expertise. The AI writes the code. They provide the intent and domain knowledge.

SparkyFitness (2,900+ stars, 684 commits/30d) is the archetype. A family fitness tracker — food, water, health — built by a single contributor on a first-time GitHub account. The code is well-structured because Claude Code writes well-structured code. The commit velocity is absurd.

Inkos (2,700+ stars) is an autonomous novel-writing agent — agents write, audit, and revise novels with human review gates. Not a developer tool. A creative tool built by someone who understands narrative craft.

Why the code is better, not worse

Counter-intuitive finding: code from AI-assisted non-developers is often higher quality than typical developer code. Claude Code follows best practices by default — proper error handling, consistent naming, test coverage. The domain expert doesn’t know enough to override these defaults with shortcuts. The AI writes textbook code because it was trained on textbooks.

The traditional signal of code quality — clean architecture, comprehensive tests — no longer distinguishes developer-built from domain-expert-built repos. The distinguishing signal is the velocity and ownership pattern, not the code itself.

The ecosystem enabling it

everything-claude-code (74,000+ stars, 585 commits/30d) and antigravity-awesome-skills (23,800+ stars, 600 commits/30d) are themselves built by the same high-velocity single-contributor pattern. They’re lowering the barrier further. A domain expert installs Claude Code, adds a skill pack, and starts building. No setup, no configuration, no learning curve beyond “describe what you want.”

What this means

The developer market isn’t shrinking. It’s expanding. The addressable population of people who can build production software is growing from ~20 million trained developers to potentially hundreds of millions of domain experts with AI coding agents. Each one brings domain knowledge that developers lack.

The clinical psychologist who builds her own equestrian coaching app isn’t hiring a developer. She’s building it herself, faster, with deeper domain knowledge. The moat isn’t coding skill anymore. It’s understanding the problem.

Explore the data

Every project mentioned here has a quality-scored page in our directories, updated daily. Browse the AI coding categories, agent categories, or check what’s trending this week.

The full deep dive with data tables and exemplar repos is at mcp.phasetransitions.ai/insights/domain-expert-builders.

Subscribe now

PT-Edge tracks 1,159 repos across 9 subcategories building LLM evaluation infrastructure. The sheer number tells the story: everyone knows this problem needs solving, and nobody agrees on how. Here’s what the data says about what’s actually production-ready.

The vibes-based eval problem

Start with the assumption most teams make: “I’ll review a few outputs and I’ll know if it’s working.” This doesn’t scale. A prompt change that improves 80% of outputs might silently degrade the other 20%. A model upgrade that benchmarks better overall might perform worse on your specific use case. Without automated evaluation, you won’t catch either of these until users complain.

An HN post titled “Without benchmarking LLMs, you’re likely overpaying” got 197 points in January. Someone posted “Ask HN: How are people doing AI evals these days?” and got 13 comments debating completely different approaches. Even Anthropic recently acknowledged that their safety evaluation methods aren’t keeping pace with capability improvements. If the frontier labs can’t keep up with eval, production teams have no chance without better tooling.

Five layers, five different problems

Most developers treat evaluation as one thing. It’s actually five:

RAG evaluation is the most mature layer, and it has a clear winner. RAGAS (12,900+ stars, 1.2M downloads/month) breaks RAG eval into four dimensions: faithfulness, answer relevance, context precision, and context recall. It generates synthetic test sets from your production data so you don’t need manual labels. If you’re building RAG, start here.

Output quality is where the confusion lives. Three approaches compete: LLM-as-judge (easy to set up, systematically biased), reference-based metrics (reliable, requires labelled data you don’t have), and programmatic checks (boring, trustworthy). Giskard (5,200+ stars) is the most complete framework — it supports all three and recently split into lightweight packages so you only install what you need. Start with programmatic checks for hard requirements, add LLM-as-judge for subjective quality. Don’t rely on LLM-as-judge alone.

Code evaluation is the most tractable layer because the success criterion is binary: does the code pass the tests? EvalPlus (1,700+ stars) augments standard benchmarks with 80x more test cases, catching failures that HumanEval misses.

Model comparison has strong tooling. OpenCompass (6,800+ stars, 58K downloads/month) covers 100+ benchmarks in a unified framework. For embeddings, MTEB (3,200+ stars, 968K downloads/month) is the undisputed standard.

Agent evaluation is where the landscape is most chaotic. 150 repos, mostly academic benchmarks, almost nothing production-ready. Plano (6,000+ stars) is the closest thing to production agent testing — scenario-based evaluation with LLM judges. But the hard truth is that most teams deploying agents are still evaluating them by reviewing traces by hand.

Only 5 newsletter mentions in 90 days

Here’s what caught our attention. PT-Edge tracks seven major AI newsletters — Simon Willison, Latent Space, The Zvi, and others. In the last 90 days, LLM evaluation as a practical topic got just 5 mentions across 3 newsletters. Compare that to agent memory (18 mentions across all 7 newsletters in the same period). The tooling is being built, but the narrative around “how should I actually evaluate my AI?” hasn’t crystallised. Everyone’s building evaluation infrastructure — 1,159 repos — and almost nobody is writing about how to use it.

Where this is heading

Agent evaluation is the biggest gap and the fastest-growing subcategory. Evaluating a chatbot response is hard. Evaluating a multi-step agent that writes code, makes API calls, and modifies files is an order of magnitude harder. The tooling that emerges here will matter as much as the agent frameworks themselves — you can’t deploy agents you can’t measure.

The other shift: evaluation moving from a research activity to a CI/CD primitive. Leva (133 stars) is built for Rails apps with production data — evaluation as a framework feature, not an academic exercise. Expect more of this.

Explore the data

Every project mentioned here has a quality-scored page in our directories, updated daily. Browse the LLM eval categories, agent evaluation categories, or embedding benchmarks to explore the full landscape.

The full deep dive with detailed project tables and quality scores is at mcp.phasetransitions.ai/insights/llm-eval-landscape.

Subscribe now