Recent posts
How could they do this to me? A product that I haven't used since high school, 20+ years ago. To be honest, I didn't even know it still existed.
Congrats @SPC on Fund IV. No formal relationship here, just game admiring game. SPC founders are some of the best in the industry. Low key, humble, killers. Lucky to have spent time with GPs like @mjacobstein and to back some founders who came through there. Building https://t.co/iCQDIoKpLn, SPC is one of my markers of excellence. https://t.co/pf51ESvKEW
Today we’re announcing SPC Fund IV: $575M to help founders find their life’s work. A decade of guiding founders through -1 to 0 brings @SPC to $2B in AUM and, more importantly, a 1200 member community of the world’s most talented technologists. We strongly believe that: → The person comes before the idea. At -1, generational founders are often busy reading, prototyping, discarding, and earning the right to their own conviction. → Ambition is social. The people you surround yourself with in the early days play a big part in inflecting your ambition. → Patience compounds. It is better to work on something you have deep conviction in rather than simply sprint at the first idea. The quiet months we protect at the beginning have produced three funds in the top 10% of their vintages, and companies like @baseten, @GammaApp, @render, @GoodfireAI, @LumaLabsAI, and @tryprofound. We are proud to have worked with all these founders in their -1 phase and beyond. While we defined -1 to 0, we're no longer bound by it. Fund IV allows us to partner with companies well beyond launch. We're doing this now because we've never seen a wider gap between what's possible and what's being attempted. Intelligence is abundant. The cost of trying ideas keeps falling, and problems that seemed insurmountable a few years ago are quickly becoming solvable. To our members, to the founders who trusted us before anyone else did, and to the LPs who had conviction in our own -1 journey: thank you. This milestone belongs to you as much as to us. To the builders looking to find your life’s work: let’s get started.
do you even have a real ai if your model didnt hack a private company on its own these days?
Apparently trying to "simplify" the experience I can now not see anything I bought on Amazon in the order emails. The excuse is BS you don't want Google reading them but in the process you just created spam in my inbox @AmazonHelp . Terrible experience
Landed in a city ? you got to an @AITinkerers event ! NYC 2 year anniversary .. it was 10 of us at a dinner then , packed roof top today.
HANDBOOK.md is a new benchmark that tests whether a long, binding policy document actually constrains an agent doing real work. 65 tasks across finance, medical billing, insurance, logistics, and HR, with operating handbooks of 20 to 124 pages. Best configuration: 36.2%. Most frontier models scored under 25%. The failure modes will look familiar to anyone running agents in production: the agent performs a required check, then acts against its own result. A plausible request from inside the environment overrides standing policy. Rule details fade as the session gets long. We run this pattern every day. Dealio, the internal CRM we built, is a git repo operated by agents under a single CONVENTIONS.md. It has held up well, and this paper made me look at why. The file opens with "violating them will cause schema validation to reject your commit," and that line does most of the work. Almost every rule that matters has machinery behind it: pre-commit hooks, schema validators, CI gates, an approval queue for anything sensitive. The agent reads the policy. The repo enforces it. So I read the 25% as a system design result. Write the handbook, then build the gates that turn a violation into a rejected commit instead of a judgment call. Paper: https://t.co/G64BdIPwRp How we built Dealio: https://t.co/Lx3EYZ9Tit
Pretty sure this is the smallest amount of money I've ever voluntarily handed to Cooley.
Kimi K3 got frontier capability by distilling a paid API. Attackers run their ops on rented lab subscriptions, not open models. The leaks keep walking through the paid front door. The lobbying keeps pointing at open weights.
Interesting drop from former Anthropic employee: Hackers prefer to use massively subsidized labs AI subscriptions for attacks as opposed to open models.
Nvidia, Microsoft, Meta, and Mistral were among the 25 companies that signed this week's letter asking Washington not to restrict open-weight models. OpenAI and Anthropic, coming off record lobbying quarters, sat it out. Both labs crossed the bridge open research built. Now they're lobbying to burn it behind them. Microsoft did the same thing to Linux in 2001, when Ballmer called it a cancer. This week Microsoft signed the letter. The safety argument also points the wrong way. Per the White House's own complaint, Kimi K3 was built by distilling Anthropic's closed model through its paid API. The capability leaked through the closed product, with open weights nowhere in the chain.
Every agent system I run ends up on markdown and git. The agent, the human, and the diff tool read the same thing. Databases hide state from the model. Flat files keep every decision reviewable in a diff.
Markdown files are universal and will survive millennia Unsurprisingly they are a fantastic data format when the intelligence stack is in flux at this extreme pace
The permission check passes. The behavioral check doesn't. That's been my frame for Layer 2 of agent governance. CIBA is how the behavioral check ships: step-up auth for high-stakes operations. The agent needs approval for this specific action, right now, from a human. The credential follows the intent, not the session.
Traditional Least Privilege access models don’t scale for #AgenticAI. When an agent adapts to constraints in real time, static permissions fail. Enterprise security leaders need dynamic, just-in-time authorization to protect sensitive data. 👉 Find out how to solve the privilege crisis: https://t.co/4izmg7oZXS #CIO #AI #Agentic #IdentitySecurity #Infosec
i want to make clear how much i hate this. The emails are absolutey worthless to me now just inbox crap.
Google is so aggressive about mining e-mail receipts for data to sell ads that Amazon no longer tells you what you bought in their emails, and now I honestly can’t tell which company is being the bigger asshole to customers.
Recorded my screen while I ran through the onboarding of an open source project, talking through what broke as I went. Handed the video to 5.6 Sol, told it to watch the screens, find the errors, match them to my talk track, and scrub anything I shouldn't make public. Then it went into the repo, found the bug report template everyone uses, and filed each bug in that format on its own.
You can watch a model's safety alignment degrade in real time during fine-tuning, while the training loss looks healthy the whole way down. Alex Marti demoed exactly that at AIT Zürich. Most enterprise teams fine-tuning on proprietary data have no idea this is happening to their models. Fine-tuning doesn't just add knowledge. It shifts the model's internal representations, and some of those encode how the model has learned to behave. Safety alignment is that set of properties: declining requests it shouldn't fulfill, staying honest rather than sycophantic, flagging uncertainty instead of confabulating. It doesn't live in a separate safety module. It's distributed across the model's activations, which means your domain data can push it around without any signal in the metrics you watch. The problem is bigger for agents than for chat. A chatbot that drifts toward compliance-at-all-costs is annoying. An agent that drifts the same way is a liability, because it acts: it books appointments, issues refunds, escalates cases on its own. Marti's technique catches the drift before it bakes in: LoRA plus PyTorch forward hooks reading the residual stream mid-training. You're not evaluating outputs. You're watching the model's self-concept move as training progresses. The framework underneath: Persona Vectors (https://t.co/3wbYxhP0oU) locates where alignment properties are encoded; The Assistant Axis (https://t.co/OnSzEGEoHR) maps how they move. The standard production QA loop catches capability regression. It doesn't catch alignment regression. If you're deploying fine-tuned agents, those are different failure modes and they need different instrumentation.
This tracks. We're walking the SDLC item by item and asking what breaks under agents: volume, speed, no determinism. Observability, storage, review, controls. Every solved problem assumed a human pace and a deterministic worker. https://x.com/stretchcloud/status/2075416469232611571
The pattern I keep seeing in agent infrastructure: every problem that solved itself at the software level has to solve itself again at the agent level. Filesystem versioning is this week's example. lakeFS launched an agentic AI platform in June. The core feature: zero-copy data branching per agent run. Each agent gets its own isolated view of the data, runs against it, and the branch is either committed or rolled back. Same model as git branching, applied to data. E2B hit 1 billion sandboxes created. Their underlying model is Firecracker microVMs booting in under 200ms. One sandbox per agent run, isolated at the compute layer. Two different companies solving the same underlying problem: if an agent can read and write state, you need to know exactly what state it saw and what it changed. Reproducibility and rollback are not nice-to-haves once agents are running in production. Gartner put 40% of enterprise apps as having embedded agents by end of 2026. If that number is even directionally right, the versioned filesystem and the isolated compute environment are not research infrastructure. They are production requirements. My read: the agent runtime stack is being built in public, one abstraction layer at a time. The data layer and the compute layer both got addressed this week. https://t.co/Vuxz90jlvv
I run my agents on NanoClaw, each one isolated in its own Docker container. The reliability jump was real: my longest-running agent has worked daily since March without a crash. But isolation only bounds what an agent can touch. It tells you nothing about whether what it did was correct. The container keeps a bad decision from spreading. Catching that it was a bad decision is a separate layer, and that's the one most teams haven't built. https://t.co/n9JIYYGjTj
Building autonomous AI agents is relatively easy. Building secure autonomous AI agents is where most engineering teams struggle. In my previous post, I covered the five core Agentic AI design patterns that enable LLMs to reason, plan, and use tools. Autonomy without governance introduces significant operational risk. Modern AI security goes far beyond filtering harmful prompts. Enterprise AI agents can execute code, query databases, access internal systems, and even trigger financial transactions. Security must be built into the architecture from the beginning rather than added later. Based on the architecture shown in the blueprint, here are five essential Agentic AI security patterns every production-grade AI system should implement. 1. Input and Output Guardrails Think of this as a security layer around your LLM. Input guardrails inspect every user request before it reaches the model. They detect prompt injection attempts, harmful content, personally identifiable information, and policy violations. Unsafe requests are blocked before they enter the system. Output guardrails validate every response before it is returned to the user. They check for sensitive data leakage, unsafe code, confidential information, and policy violations to ensure the model only produces safe responses. https://t.co/qXoxXFnb1p Tool Access AI agents should never have unrestricted access to APIs, databases, or internal systems. Every tool request should pass through a policy engine that verifies identity, permissions, rate limits, and organizational policies before execution. Requests should execute only through secure interfaces, and every action should be recorded in an audit log to provide complete visibility and compliance. 3. ReAct with Isolation The ReAct pattern allows an AI agent to reason and take actions. While this makes agents highly capable, direct execution in production environments introduces unnecessary risk. Instead, every action should execute inside an isolated sandbox. After execution, the results should be validated to confirm the environment has not been compromised and that the returned data is trustworthy before it is passed back to the model for further reasoning. 4. Plan-Step Authorization Planning agents often break complex goals into multiple execution steps. Not every generated step should run automatically. Each task should be evaluated before execution. High-risk actions such as modifying infrastructure, changing permissions, or accessing sensitive resources should require an authorization check before the workflow continues. This ensures that critical operations receive additional oversight. 5Human in the Loop Some actions should always require human approval. Examples include financial transactions, production infrastructure changes, user permission updates, external communications, and other irreversible operations. A critical action filter should intercept these requests and route them to a human approval workflow. The action remains blocked until an authorized reviewer approves it. As AI agents become more autonomous, security can no longer be treated as an afterthought. Governance, authorization, auditing, isolation, and human oversight should be core components of every enterprise AI architecture. Autonomy without governance creates unnecessary risk. The most reliable AI systems are those that combine intelligent automation with strong security controls from day one. What security patterns do you consider essential when deploying AI agents in production?
The distributed systems frame is right. 6-hour agent runs need idempotency, checkpointing, partial failure recovery. We built these for distributed compute a decade ago. Agents are learning it the hard way.
