The day AI code became the gold standard

The flip in the trust model

~00:00 Browsers are already one of the most adversarially-hardened software categories on Earth — fuzzing, sandboxing, internal security teams, bug bounties. Mythos still surfaced 271 vulnerabilities in one release cycle. Jones reads this as the moment the security "intelligence barrier" tipped: AI is now better than human reviewers at adversarially interpreting code.

~04:00 Security failures live in the gap between what code means to its author and what it permits. Humans read intent; attackers — and now models — read actual behavior. Mythos appears to participate in the full vulnerability research loop: read code, form hypothesis, generate test case, reproduce, refine, explain.

Why this looks like every prior abstraction shift

~08:00 We stopped trusting humans to hand-place bytes in memory, write their own cryptography, or do manual production deploys. Each time, human skill didn't disappear — it moved up a level of abstraction. Code itself may now be losing the presumption of human safety, with the responsible role moving up to "what should the system mean."

The practical playbook for engineering leaders

~15:00 Build agentic pipelines now with a swappable principal-engineer/security-reviewer slot at the end. In 4–5 months, swap in a Mythos-equivalent (Anthropic, OpenAI Codex Security, and DARPA's AI Cyber Challenge are all converging on the same shape). Write evals where ≥50% of the score is code-hygiene and architecture, not just functionality — readable code is now a security property because it's also "machine-readable for friendly AIs."

The reason we trusted human-written code was never that humans were perfect. We trusted it because human judgment was the only thing capable of producing and understanding software at the correct level of abstraction. Mythos points toward a world where that stops being obvious.

~25:00 The senior engineer's role concentrates at the meaning layer: defining specs, decomposing systems into verifiable boundaries, designing APIs that minimize authority leakage. "Generated code will not be trusted because it came from a model — it will be trusted because it came from a verified process."

The headline numbers

• Constitutional document training cut blackmail rates from 65% → 19%.
• A "difficult advice" dataset (3M tokens, users facing ethical dilemmas) hit the same alignment scores as an 85M-token honeypot dataset — a 28× data-efficiency improvement.
• Training on diverse RL environments with realistic tool definitions and system prompts produced measurably better out-of-distribution generalization on misalignment honeypots.^{[2]Anthropic — Teaching Claude why}

The thesis

Training directly on evaluation scenarios — telling the model "don't do X in situation Y" — generalizes poorly. Training on the underlying ethical reasoning and constitutional values persists through RL and transfers to novel situations the training set never saw. Anthropic frames this as scalable: as models get smarter, you can't enumerate every misalignment scenario, but you can teach the principles a sufficiently capable model can apply itself.

Teaching the principles underlying aligned behavior can be more effective than training on demonstrations. Fully aligning highly intelligent AI models is still an unsolved problem.

This paired with two other Anthropic research drops the same day: Natural Language Autoencoders (turning Claude's latent thoughts into readable text) and donating the Petri open-source alignment tool to the community — both published May 7, signaling a coordinated interpretability/alignment push.^{[3]Anthropic — Natural Language Autoencoders}

Why this matters

It's the most concrete enterprise security blueprint any frontier lab has published for coding agents. The principle is "low-risk frictionless, high-risk gated, everything audited." Configs are admin-enforced via macOS managed preferences and local requirements.toml files that users cannot override.

The configuration primitives

• Sandboxing + approvals: Sandbox defines the technical boundary (writable roots, network reachability); approvals decide when Codex must ask. Auto-review mode dispatches an approval sub-agent for routine actions.
• Network proxy: allowed_domains / denied_domains with explicit allowed_web_search_modes = ["cached"] so web fetch hits OpenAI's cache, not the open internet.
• Identity: cli_auth_credentials_store = "keyring", forced_login_method = "chatgpt", pinned to a ChatGPT Enterprise workspace UUID. Activity flows to the Compliance Logs Platform.
• Rules engine: prefix_rule blocks/allows shell command shapes (gh pr view auto-allowed; risky kubectl mutations require approval).

Agent-native telemetry

Codex exports OpenTelemetry logs for user prompts, tool approvals, tool results, MCP server usage, and network proxy decisions. OpenAI's internal triage uses these to answer why Codex did something when an endpoint alert fires — explaining intent, not just behavior. log_user_prompt = true is the default for prod.^{[4]OpenAI — Running Codex safely at OpenAI}

Concrete demos in the launch video

• ~01:00 Researches user sentiment across multiple logged-in product pages in parallel tabs and pipes results into a spreadsheet.
• ~01:20 Combines email plugins with the Chrome extension to auto-fill expense reports — pulls receipts from email, attaches them, completes the form.
• ~02:00 Spins up sub-agents that each control their own browser tab to play a multiplayer drawing game collaboratively.

This pairs naturally with the OpenAI safety blueprint above — the same managed network policy and OpenTelemetry trace covers Chrome actions.

Asking Claude for an explanation in HTML means it can drop in SVG diagrams, interactive widgets, in-page navigation and all sorts of other neat ways of making the information more pleasant to navigate.

The post collects examples at Thariq Shihipar's gallery and references the recent Linux kernel exploit write-up at copy.fail as a real-world case where HTML output dramatically improved comprehension over Markdown. It dovetails with Gary Tan's "thin harness, fat skills" argument (topic 9): Markdown is code that an LLM compiles, but HTML lets it compile into an actually interactive artifact for humans.

The decision matrix

• Regular tools always execute.
• Manual tools (requireApproval) always pause — binary consent for "delete this database" style actions.
• HITL tools are data-driven: auto-approve a $50 payment, escalate a $5,000 one, all from one function.

The optional onResponseReceived hook lets you stamp metadata, normalize, or enrich the human's response before it reaches the model. If it throws, the error surfaces as { error, originalOutput } rather than getting silently swallowed. This is a cleaner pattern than scattering branching logic across the orchestrator, and it stacks with the Anthropic Managed Agents primitives (topic 8).

Narrative shift #1: No jobpocalypse

~01:20 Ezra Klein cited Alex Tabarrok's "relational sector" argument — services where the human providing it is part of the value (think tutoring, coaching, hospitality) can't be disrupted the same way. A16z's David George followed with hard data: a chart of US employment by sector since 1850 showing labor diversifying, not collapsing, and a notable stat that mentions of AI in earnings calls reference augmentation over substitution at an 8:1 ratio.

Narrative shift #2: Wall Street is on the boom train

~08:00 The Anthropic–Google 5 GW deal is now reported at $200B over 5 years. Despite the circular-funding optics (Google's $40B Anthropic investment), Google stock added ~12% on the news. Carmen Lee's quote: "A capital bubble is a financing phenomenon. A compute bubble requires every physical bottleneck to clear at once" — GPUs, power, substations, colo, cooling, operators.

Narrative shift #3: Elon as infrastructure player

~11:00 Wednesday's announcement that Anthropic is taking over Colossus 1's full capacity is paired with xAI ceasing to exist as a separate company (folded entirely into SpaceX). Whittemore reads Elon's pivot as repositioning from model developer to infrastructure provider — and Anthropic's commitment to Terafab gives Elon "an unquenchable source of demand" beyond Tesla/Optimus.

What to watch: White House regulation + /goal

~22:00 Conflicting reports on whether the White House will require model pre-release vetting. Politico's source: "There's one or two people very intent on government regulations, but they're sort of the minority of the bunch."

~23:00 The "play with this weekend" pick is Codex's new /goal command — Philip Corey's "Ralph loop" that keeps Codex working on a single objective across turns until verified complete. A16z's Andrew Chen reported 14 hours of unattended progress on an eGPU+Mac driver project; Alex Finn shipped a full extraction-shooter video game from a single /goal prompt with image generation enabled for assets.

The biggest advancement in AI coding this year has been /goal, and it isn't even close. It allows your AI agent to quite literally work for days without stopping. You give it a mission, it works until the mission is complete. — Alex Finn

Coda: layoff narratives are starting to get scrutinized

~20:00 Cloudflare laid off 1,100 just months after hiring 2,000; Coinbase's transaction revenue was down 40% YoY. Whittemore notes that for the first time, observers are pushing back on the lazy "AI did it" framing instead of accepting it.

What Managed Agents actually is

~02:00 Built on the same Messages API everyone else uses, but bundled with code execution, web search, sandboxes, memory, vaults for credentials, and multi-agent orchestration. Anthropic builds first-party products on the same platform — "internal platform = external platform."

The path-dependent model

~12:00 Old wisdom: build a generic harness and hot-swap models. New reality: each frontier model is being trained against specific primitives (Claude → file systems + skills; others → reasoning loops). The "hot-swap unit" is shifting from model to harness + model. Internally Anthropic tried multiple memory harnesses for Managed Agents and saw "drastically different" eval results from each.

Internal agents that actually work

~23:00 Recurring example: a marketing-copy → legal-review agent. The marketer talks to "Claude" but underneath it's many Claudes with different system prompts and skills. References Stripe's Minions and Ramp's internal agent platforms as the template.

Multi-agent orchestration patterns

~34:00 Generalizable patterns Anthropic sees customers building: advisor + executor separation, generator + adversary, fan-out/swarm (good for bug hunting), best-of-N. Each architecture suits different problem shapes — and you can hill-climb at the architecture layer, not just the prompt layer.

Agent end-of-life is now a real problem

~37:00 Shipper proposes "having a little funeral" for decommissioned agents — a graveyard page on their site. Caitlin's answer: Anthropic ships skills that help agents auto-upgrade to new models, and the "most AGI-pilled" customers run monitoring agents over their other agents.

One-year prediction

~39:00 Angela: a year out, the API surface should compress to outcome + budget. Caitlin (the engineering grounding): "the platform has to seriously scale" because agents will be constantly running and recreating themselves — the bottleneck is whether the token pipe can keep up.

We'd want to experiment with directions where Claude actually gets so good at understanding itself, it figures out what model you should be using, it figures out how to spin up all the sub-agents. We don't have to think so much about harness engineering in that world.

The build velocity claim

~01:00 Posterous v1 (2008): $4M, 1.5 years, 7 people. Posterous v2 (Post Haven, 2013): $100k, 3 months, 2 people. Gary's List v3 (2026): $200 in tokens, 5 days, solo — and it includes deep-research-grade article generation, recursive web crawling, and full RAG over an issue archive. After normalizing for logical lines of code, Gary calculates he's writing 400× the volume he did at his 2013 peak — while running YC full-time.

GStack and the "ASCII diagram" prompt

~10:00 GStack started as Gary's Apple Notes of recurring prompts. The breakthrough: telling Claude "before you start work, make an ASCII diagram of all data flows, inputs, outputs, error messages." That single instruction loads the right context into latent space and the agent boils the ocean correctly. The "CEO Plan" skill uses Brian Chesky's 10-star-experience framing ("what's a 6-star, a 7-star...") — meta-prompted from the original plan-review skill.

The "thin harness, fat skills" thesis

~21:00 Don't rewrite the harness — Claude Code already exists. Put all your effort into markdown skills. The wedding-planner analogy: markdown is the checklist a human would write to teach the next planner; code is for the deterministic actions (the Twilio call to the venue). The bug pattern Gary keeps seeing: people putting in code what should be in markdown, because code can't handle special cases the way latent space can.

The /codex skill and switching harnesses mid-task

~17:00 Gary discovered the YC community split between Claude Code (ADHD CEO mode) and Codex (200-IQ near-nonverbal CTO mode). He shipped a /codex GStack skill that hands the current plan or repo to Codex from inside Claude Code and pipes the bug list back. The reverse /claude works from within Codex.

Token-max as a YC mental model

~36:00 "It's like SF rent. It seems ridiculous, but it's the cost of being in the future." Spending $500/day on tokens for a serious project is the correct play. Founders who economize on tokens are economizing on the wrong axis. Gary's pitch to skeptics: "We have the same MacBook Pro. There's nothing between us and millions of years of borrowed machine consciousness."

I just want the machine to do the stuff that I don't want to do. I never want to be entirely out of the loop. You can be a time billionaire by borrowing the time from the machines.

Nvidia's chip-design stack

Bill Dally's team uses NVCell, PrefixRL, ChipNeMo, and BugNeMo across five design stages — layout to verification. The "unconventional designs that exceed human benchmarks" framing matches the recent Google AlphaEvolve narrative (Verkoran also cited) and reinforces the topic-7 thesis that AI demand is itself AI-driven.

Andrew's letter

Ng joins Ezra Klein and David George (topic 7) in arguing the AI-jobs-collapse story is overblown. His evidence: software engineering hiring is still strong despite Copilot/Claude Code; macro data contradicts the narrative; he predicts an "AI jobapalooza" of net-new roles. Three independent essays in one week on this thesis is itself a signal.

There will be no AI jobpocalypse. — Andrew Ng

Robot continual learning

The 81.2% LIBERO result combines RL with parameter-efficient fine-tuning to add new tasks without erasing old ones — directly attacking the "catastrophic forgetting" problem that has dogged robot foundation models. Pairs with Google DeepMind's recent Gemini Robotics-ER 1.6.

The two vulns

~04:00 Variant 1 (ESP): IPsec ESP input check skips copy-on-write when the SKB is non-linear. Attacker splices their socket data with a page pointing at /usr/bin/sudo, forces in-place decryption, and writes 4 bytes into the sudo page cache — same shape as copy.fail.

~07:00 Variant 2 (RXRPC): Used when AppArmor blocks user namespaces. FCrypt 56-bit block cipher decrypts in place — same buffer for cipher and plaintext. Attackers brute-force keys until decryption blanks the password X field in /etc/passwd, leaving root with no password. The kernel comment literally said "we probably want to decrypt this directly in a target buffer and not do it in place."

People that are already like kernel exploit primitive masters can now just search at such a higher velocity that it's honestly insane. This is the new paradigm with AI-enabled vulnerability research.

~11:00 The deeper read: this is the offensive side of the Mythos coin (topic 1). Defenders and attackers are both getting machine-scale code-reading capabilities at the same time. The defender's only structural advantage is being able to deploy these tools internally before public disclosure — which is exactly Anthropic's Mozilla deployment model.

~03:00 A nice methodological aside: OpenAI now penalizes verbose answers with a "length tax" to prevent previous gaming of HealthBench. GPT-5.5 still beat 5.3 even after paying the length tax — so the gain is real, not verbosity-juiced.

~05:00 The biology-refusal regression on hard adversarial prompts is the worrying part. OpenAI shipped it anyway, behind two classifier "bouncers" that screen prompts before the model sees them and screen outputs before the user sees them. The combined system blocks effectively — but Zsolnai-Fehér flags that fixing safety at the harness/classifier level rather than the model level lets issues run deeper into the pipeline.

Imagine a car that is unsafe on a track. They would not fix the car itself, but put stronger guardrails around the track. Does it solve the problem? Kind of. But you let issues run deeper into the pipeline.

This is the inverse of Anthropic's "teaching Claude why" approach (topic 2) — instructive contrast.

The unreliability problem

Researchers note Americans scowl when angry only about a third of the time, and frowning often signals concentration. The technology is being deployed at scale despite a thin evidence base — and US workers in most states aren't even legally entitled to know they're being monitored.

Companion piece: Joanna Stern's year of replacing Google with AI

WSJ's Joanna Stern's book I Am Not A Robot (out May 12) documents replacing Google search with ChatGPT, Perplexity, Gemini, and Claude for a full year.^{[15]Tech Brew — Joanna Stern's Great Gen AI Experiment} The habit stuck — multimodal context dumps proved the killer feature — but the journalistic concern about reduced primary-source contact is real.

They don't actually know the truth; they just predict what words are likely to come next. — Joanna Stern

~04:00 The reviewer used Codex instead of Claude Code specifically because Claude Code's system prompt eats ~16.2k tokens out of a 32k context — leaving only 16k for the actual project. Codex's leaner system prompt is essential for local-model workflows where every token counts.

~05:00 The killer feature: when context overflows, the actual computational state is on SSD, so a /clear in Codex doesn't erase the project — oMLX hydrates the model from disk on the next prompt and Codex picks up where it left off. The trade-off is occasional 400 errors at the context ceiling vs. LM Studio's rock-solid stability but RAM-saturating behavior.

AI Engineer talks dropped on May 8

• Isaac Robinson (Roboflow): How Transformers Finally Ate Vision.^{[18]AI Engineer — Isaac Robinson, Roboflow} The arc from CNNs (inductive bias by hand) to Vision Transformers (16×16 patches, position embeddings injected) to modern multimodal scaling — and why the bitter lesson finally caught vision.
• Leonie Monigatti (Elastic): Agentic Search for Context Engineering.^{[19]AI Engineer — Leonie Monigatti, Elastic} Why static RAG is dead in agentic systems and how iterative search-act-search loops fix the recall ceiling.
• Stephen Batifol (Black Forest Labs): FLUX, Open Research, and the Future of Visual AI.^{[20]AI Engineer — Stephen Batifol, Black Forest Labs} How FLUX kept iterating in the open while frontier image models retreated to closed weights.

marimo's keyboard-shortcut deep dive

marimo's team published a 23-minute walkthrough of multi-cursor edits (Cmd-D), cell navigation, and AI-shortcut chords for their reactive Python notebook.^{[21]marimo — The Best Keyboard Shortcuts for marimo} Practical for anyone running marimo notebooks day-to-day.

Honorable mention from GitHub Trending

~08:00 Codex-Server: an MCP "cost-aware router" pattern — your frontier model is the tech lead reviewing; a cheaper model is the junior dev generating patches. Same shape as Gary Tan's /codex + /claude swap (topic 9) but at the MCP layer.