{"version":2,"model":{"id":"Xenova/all-MiniLM-L6-v2","revision":"751bff37182d3f1213fa05d7196b954e230abad9","dtype":"q8"},"quantization":"int8","posts":[{"slug":"agent-pinball-learning","title":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","description":"Agent Pinball began as Space Cadet nostalgia and a way to unwind. Then I got busy building it, so I taught an AI to play it instead, which was harder than it sounds.","date":"2026-09-10","url":"https://mashprime.dev/blog/agent-pinball-learning/","vector":"J9gQ5wvmASoYFc8f6Qjn8Sf62vzyrirp4iESJ8WzChof68n91/ca9fD3KQYVJ+nfFBK8D0PZTCUpIPTtEub83CDn8g5U+RAh9OgcCt/8GwcCvdz03utCODkOASEd5FYz8NDaMyYiCuIy9SceDu4HDxgg7SfCJfNTP/35Fho95wAE+ev+/O8e//MC6evHBynWsB3vKgbO5c3vS/jaH/IB9dHhH/IA5ALtzg0D8+XR38u29B4NJ8Tm0SIB5RhU7L8n4mT6HSf05/T22wcDGxP1qA35sOb39vTPzRTRCeAd/ADH58E2JBnk3grJ2gf8FgbSFg0gBkY88PPxMvkKEvxCCRkP4h0z8fUMJ/HeFgMh7fDiG+0Exb/nBAHYIg/M9PoLCEjx+u38yzkMGCRByjEQ8a709v86RfsK0RwRGy4G/ADbLwspJQ3eE/POI/L7EDgp4xjJSi3l5/Xg7fAv5vUr9DkH7xAF6w4v0fjH5w7l2MP39AYm3Sx/MgvuARYNC7Af"},{"slug":"a-prompt-is-not-a-permission-system","title":"A prompt is not a permission system","description":"OpenAI's investigation into an agent-driven intrusion at Hugging Face shows why capable agents need hard boundaries, not better-behaved prompts.","date":"2026-08-29","url":"https://mashprime.dev/blog/a-prompt-is-not-a-permission-system/","vector":"+RXT4zjYHxMvFhEGIgQU907EzPv+KyUNtv0E2fbhFAk4CxkSFwIF7vvs6wHu1A/T9Ojj0CAL+fIpA/Le2efZCA4q2/AR8BkI7u8bF+cgDsgI/woizQUoDFsUJP83DCYD5s7kM/D38Nb1/igO+fj13iPsXAXcMvvuUuUjAkUwBQANK/YtNgQSBRH4BxgL3zQGASYUAhnqByso7OMAZA35JRE44jnGyCX97/XwBPnD1PPVMvQ5Munv4xrp/g4mHwsw+9X59CT8tg3o5b/LAvgq5wfY+ALj+scH2z38DOV2CAAH4LkF++za3Bjw0P4cDOu2Mfbi3go4vugVMNsTEfcD8AY67A4XC+4cIgD59eMFEwPn6QcKMAjUDSPKDucSDQET/O0SEyvoO9nW/koWrrS5A+UB9SL1JST8FSjd8Pok6gDp3yYJPNjv7wMXFPzo8w0b8NbCwhvL1PX62+E2tijlxhMY4TUg0yDl6xEMCvnuxMkJy+nc+n8i/S8A80EbIefp"},{"slug":"skill-isnt-prompting-its-management","title":"The skill isn't prompting. It's management.","description":"A working note on what building with AI agents has reinforced: the scarce skill is not magic prompts, it is managing work.","date":"2026-07-07","url":"https://mashprime.dev/blog/skill-isnt-prompting-its-management/","vector":"EPn+A/raGTQZ7d0bAAf7DB/H2dPd/kPxmwwRsRX2GQ8yMw0o60476djO8ukV3/oB9O2Dvx3B+CliMgO+1PG3GR0s0fL/ARQS9elAC9P7JtT+E/hF2/4jKGThM8fX50F9/debIPbn48fkGlYNG8H8KhEcSSfZPPoaMf4MKUYWDAASQiQ4CuosDh/4F+jfEvjb6A7XHzjbFPH//QQcMQ7eAssksjzn2jUT6wIWE/bi+MuuUPgrQtsaEkLv8RItD7VyB/UoRF/wxPzO6+zUCsAxxj8IyeIo5/P/DF8JIdZ/8gA2wcQ6DuPvpfvR3fbrEfLEBgEsxRNfqfDYJsNMBO/3+yUl8krw5dhd+dDTz9no/PvyFv0O2ti5BhXPIA7gES3yDNoHKiYHE+C1/D4en7bMs8kOzTTKWv0Z6QXw1RgmwwDTFzELSKbpHAnyMMYHL0/5CgS8uF/lvOYQ2dNVpTzx6g8WAysjuRHa+TwQ+c/f9NUot+jx8SlOGin320HvRtbu"},{"slug":"one-folder-to-autonomy","title":"One folder to autonomy","description":"The companion to my Claude Community lightning talk in Perth. The terminal is not as scary as it looks, and a single folder can climb a surprisingly long way.","date":"2026-06-29","url":"https://mashprime.dev/blog/one-folder-to-autonomy/","vector":"5s/oAg3IJT0HDAoXFwoMLQjl0t3p/Rf01jr9sQXiNCNEGRxaKxsZAOYL/Of7wcrYI/io49Tw/0glFf68TQjcEy4ZATIb0b3T3Bow1//0I8bzKR0+vf8hPSgEHcMbATZD/ugCKdzn877NIDjW693J597nSjATViVJKuklIh0NAQAfQQ5/PuEsH8cePj/T+wrA2RYR7Sn17gVkDSnzK/jKKboq7S7E7R0csvsgtQ4LF+cHF9z+Fwbpv/HrOgItG8RJIObZ7W3tqCUB5+APyb24CMcY3QI++e7v6gjn8/Qj/wBa2+ANJhPXv+z8qQEaBhLuDtv18OksufoCCdUqGyfh9P3Z3CHZ6fIRDtDQ0wTd9QGt7BL76bLdKi39//vh+RUJv9XrH9cF++P/90brDMr55/IFAiwEQf4HCPDcAyU86ADM9jIz+vT8JQMrFtHmQR0uHwTi6lDX/xsQ2hUcwzL6/esQ8eAV2/vzFx0G7wbt06zy28z59EVbMyYeC0rTVNfg"},{"slug":"what-does-computer-mean-in-the-modern-age","title":"What does computer mean in the modern age?","description":"From a job title held by women doing calculations, to room-sized machines, to the personal computer, and now to always-on agents. A reflection on where computing is heading and what to build for it.","date":"2026-06-28","url":"https://mashprime.dev/blog/what-does-computer-mean-in-the-modern-age/","vector":"6wAc0u/bDEIbE+kcIOcy9wqe1Qj84sbr5Cnuq/IU1UNYHt4vNPb/wNW/+x0sBguv2v209T4H6w5VDffY48gBDwDu9AAl9rzt/AHxugzkT/NFIuIhsB7fJiSQ4//sE0zqCekDLPoTOungH/pADtWu5cnvLfTdSV03Bwzj/E8GAQD8DQRLGvQPHADiIkAHMGnE5uA/2CLyGPQwz+TdM/bxJsDpBgH2wj0VyDApy+37PSLc+ekjEgrg9BXuDB8eIAwM/wc0VQou1ebt7CU13bu5FPMOu/1ZFP/d/xzb8e1cvwDt1scjDdwnrNnV0fwxDfvz3N/L5xUWiq4YGe/4DyK72/EeKTgZ4Q3jKf37/gsoiRu//mEUArDV9Pbr7R/3yQMb6iAYLcjNHO++/vUeH93JC/QbCdTgAegA37PW4L0owwDt9UIEOetO8wgoJuojH39tEbLb9lvU4EEO5e0g1ScA8fj1HNcC4xsD4f/wEEDzrgnwAPEXNiVA+Q/sC0YaAOPr"},{"slug":"agent-stack-i-keep-coming-back-to","title":"The agent stack I keep coming back to","description":"The parts of an agent system that actually matter once the novelty wears off: memory, tools, workflow, approvals, audit, and escalation. Now with the real examples behind each layer.","date":"2026-06-20","url":"https://mashprime.dev/blog/agent-stack-i-keep-coming-back-to/","vector":"8OrwDyng/f0wA/UsFvEO/kn1xgjp9eoQpfz84OiqIxbcFFQz7wgsERbhzBLtywLm/OSr0iEW+vcwHNvNFfnUFyg+5/oj7dbT1+gjAt/dLt7z8vNO3fVEEkzxHgRGB21c4drqRPv7AfQD2CcE98/o9CwRbQD7Vd4GUQRA9Uo/LQASQf1GIPYE/QAvHDnlEf3m2UMEChbXDfEPG98iGgj1Pwo7sjeryTndqyMc9BHZ4dXz90A+Rgr28C7d/jE+A9Y3Iu3zHAj26R3V6+Ky8tvw2gX22xIK7d7x3GjdBAZhEQDjp7sg58PE0iYK1vr7D+ejLLEhzDo5ng8cQu0gHcoF6xkiADPeGuj6GunL1wfy+Rf4/+cN8vTPPS0I+wvZIwYW5QcR8iXrNOWN7U0Mmr7l88oQ8goPJ+kBJw3o3OUKugDxE1brLqUaFekAPrrwKVYZDfKmtPLy7vX35/5I5lr67DASujoexSDl7PwgAQbcstA9tM7M3X9V6jvqODD4EO3j"},{"slug":"a-warning-shot-for-ai-sovereignty","title":"A warning shot for AI sovereignty","description":"Fable 5 arrived, unblocked weeks of hard engineering, and was pulled almost immediately. For builders outside the US, that is the shape of the next problem: 'just use the best model' is not a strategy.","date":"2026-06-14","url":"https://mashprime.dev/blog/a-warning-shot-for-ai-sovereignty/","vector":"/cEK9jjoxOkYNrofAA8bEPbRyBYMCcUB09sH8fTc+AvW7QIyFPUU0i/s8esK+A/iBM33EPzCIxE63/z94wn56wz081DyIirS+eEs/Bf/aNYROBME0vf6Dn/TKcxKQnT7LPnJJQUM8Mz7I/sSIAX5GdrpJN7f1QgH0RkcDCc/0wDaHf8sAfEPENonCDfYA2jZ7OcZEST59N443frsASTTMQIpCQzV5PPu+APpAxPqCva8+wVEGsT/xP3fNMn8yflJ7i7oIAQL7uD45ez56RTl5QAY8Bk78QYFA/7g7xwV4AANzvnR9MUJ0PzKwR9BB/PdGOUgIREJpw0AE571D9TvwusJ2ST/8c//5u/jCPIT+Q3k7hweLeTN8UQkJkUNK+j4EwIFGAPt5t2rFzki5L3e/gzMNPIxEDjWFQy15u4T1wD9JiYJ5t/q5fgyJP7gD+sH+xbb4RU07uAh4dr7OV/WDAFGBh37GQbwJT8c+Bjr5dRaC/YI41pO4eL2+xYFvOgW"}],"chunks":[{"id":"agent-pinball-learning:0","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"","anchor":"","text":"Updated 28 September with round two: a rebuilt AI player that scores far more and flips far less. Skip to round two.\nIt started with a reasonable request: could we make a modern version of Space Cadet, the pinball game that came with old copies of Windows?\nThen the ball got stuck. Then it kept vanishing down the sides. Then the effects were too much. By the time those were fixed, I realised the table was a bit boring. So I kept going.\nSomewhere along the way it stopped being a remake and became Agent Pinball: a browser game with an agentic AI theme, a fork bomb that splits one ball into many, and a small model that plays it. You can play it here on the site, or sit back and watch the AI.\nThe scope has expanded slightly. The original idea was to have something to relax with. I have spent far more time building it than playing it, which is partly why it now has an AI to play it for me."},{"id":"agent-pinball-learning:1","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"Making it worth playing","anchor":"making-it-worth-playing","text":"I built the first version with Codex, mostly by playing it, complaining, and asking for another go. The useful feedback was blunt. The table needed more going on. The flippers felt hectic. There was too much text. Holding the launch button should actually pull the plunger back.\nThe agent theme gave the table its own identity. Tasks, forks and swarms became things the table could do, and one bonus could turn a single ball into a much less manageable situation.\nThat was fun, until it happened too often. If every moment is chaos, the big moment stops being big. Most of the iteration since has been about balance: better returns from the sides, calmer effects, a simpler layout, and making the exciting bits feel earned."},{"id":"agent-pinball-learning:2","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"Teaching something to play it","anchor":"teaching-something-to-play-it","text":"The next question was whether I could train a model on my own machine to play the game, and keep the footage and measurements as it learned. That turned into a second project inside the first.\nThe coding assistant and the player are different things. The assistant builds the game and the training setup. The player was a small reinforcement learning model trained with PPO. Thirty times a second, it read 76 numbers describing the game and chose one of four controls: left flipper, right flipper, both, or neither. It read the game state directly rather than watching the screen, a script handled the launch, and it never learned to nudge.\nTraining ran the same physics without drawing anything. The model played, got feedback, adjusted, and saved versions along the way so we could see what changed. I assumed my RTX 4070 Ti SUPER would speed this up. It didn't: the network was so small that the CPU won the benchmark. Measure the thing in front of you.\nA 97-second, silent progress reel from the first round: before and after, recorded control decisions, and the score charts. This is an early edit; gameplay was captured at 10 fps. The replays illustrate the policies and are separate from the scored tests."},{"id":"agent-pinball-learning:3","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"Better scores, with asterisks","anchor":"better-scores-with-asterisks","text":"When I first wrote this, the player had made just under 10 million training decisions. That is decisions, not games, and it does not count the branches that went nowhere.\nThe best experiment of that round rewarded completed ramp and portal shots while a single ball was in play. We picked a candidate on one set of games, froze it, and compared it with the previous player on 128 fresh, matched games:\nScore Previous player New player Average 9.50 million 14.68 million Median 6.02 million 10.55 million\nThat is a 54% higher average and a 75% higher median. The new player won 76 of the 128 games, with one tie. Both played for normal points with the training bonuses switched off, and each game ended after three lost balls or two simulated minutes. The individual scores are here.\nGood enough to keep, not good enough to call an expert. It still scored under a million in 39 of those games. A good average can hide some terrible afternoons."},{"id":"agent-pinball-learning:4","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"The flipper problem","anchor":"the-flipper-problem","text":"The recurring problem was the flippers. The model was busy in a way that looked ridiculous.\nMaking flipping more expensive produced a quieter player that was worse at pinball. More training didn't fix it either: one follow-up added 3.15 million decisions across three branches, and all three failed the score checks. Rewarding what is easy to measure doesn't get you the behaviour you actually want.\nI kept those failures on purpose, along with 113 saved replay checkpoints and 17 raw video takes. It would be easy to edit this into a much neater story than it was."},{"id":"agent-pinball-learning:5","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"Round two: plan first, then learn","anchor":"round-two-plan-first-then-learn","text":"By late September, the player on the site changed flipper state about 22 times a second, and only about one press in five touched a ball. Looking closely, it had learned a rhythm: press for one 33-millisecond decision, let go, repeat. It worked because the flippers swung at a constant speed, so a quick tap hit as hard as a proper flip. Every penalty we tried gave the same trade: a calmer player that was worse at pinball.\nSo for round two I stopped turning the penalty dial and changed the approach. This time I worked with Claude Code, running several agents in parallel: some researching, some building, one training.\nA planner first. Because the game is a simulation, you can copy its exact state, try a few dozen flip timings a couple of seconds into the future, and keep the best. A quick prototype scored about five times more than the trained player while flipping about nine times less. The catch: it thinks for a quarter to half a second per decision. Fine for producing training data, far too slow for your browser.\nThen a better table. The planner kept tripping over the physics. Balls could settle in dead pockets. The ball slid instead of rolling. Catching it on a raised flipper was nearly impossible, because it ran straight off the end. So the physics got a proper rework: flippers that spin up like a coil, rubber that soaks up energy, and a physics engine written for this table that runs several times faster than the general-purpose one it replaced."},{"id":"agent-pinball-learning:6","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"Round two: plan first, then learn","anchor":"round-two-plan-first-then-learn","text":"Then no cheating. A perfectly deterministic game has a flaw: the planner found a ramp shot it could repeat forever. That isn't skill; it's exploiting a simulation that never varies. Real tables have small imperfections, so now this one does too, with a little random variation in every bounce. The planner can't see which variation is coming, so it has to pick shots that work across several possible futures. That was when it started catching the ball and aiming from a held flipper on its own.\nFinally, a network that copies it. The planner played 2,000 games. A network learned to imitate its decisions, then played while the planner corrected its mistakes, then trained further with reinforcement learning on a leash to that copied behaviour. The leash matters: without it, earlier versions gradually forgot their good habits.\nOn 100 fresh two-minute games:\nOld player Planner New player Average score 6.6 million 43.1 million 237.1 million Median score 4.6 million 34.2 million 224.4 million Flipper changes per second 21.9 1.6 3.9 Presses that touch a ball 8% 69% 57% Balls lost per minute 0.91 0.45 0.07\nThe new player beats its own teacher, mostly by keeping multiball alive for longer. Jackpots stack up the longer it runs.\nThe usual asterisks apply. The old player was trained on the old table, so this partly measures it on a table it never saw, and its numbers come from a different set of games. The new player rarely catches the ball: 0.2 times a game, against the planner's 2.5. It still flips about five times a second in multiball, far calmer than before but more than I'd like. And nobody has measured it against people yet."},{"id":"agent-pinball-learning:7","slug":"agent-pinball-learning","postTitle":"I built pinball to relax, never had time to play it, so I trained an AI to play it for me","heading":"Still small enough to live in your browser","anchor":"still-small-enough-to-live-in-your-browser","text":"The first player was about 190 KB. The new network is about 7 MB, roughly 5 MB to download. Either way, it runs entirely in your browser and takes well under a millisecond per decision. There is no AI call behind each flip and no inference server playing every visitor's game. The site serves the game and the model; your browser does the rest.\nNext: get it catching and aiming like the planner, calm it down in multiball, and find out whether people can beat it. Any table change will need fresh checks too. A player trained on one layout shouldn't be assumed to understand another.\nFor now, have a go at Agent Pinball. If you find a repeatable way to embarrass the AI, tell me about it. That would be useful data, and probably good footage.\nVideo text alternative The reel opens with the shot-learning experiment: three branches trained with different rewards. It shows a saved replay of the previous, 7.86-million-decision player, followed by a diagram of the ball state and the probabilities of its four flipper controls. The focused, 9.96-million-decision candidate appears next. Its selection results were 14.73 million average points and 11.85 million median points. A chart compares the selection branches. Another recorded state diagram shows the candidate's control probabilities; these are model outputs, not an explanation of its intentions. The final chart uses the separate 128-game confirmation set: 14.68 million average and 10.55 million median for the candidate, against 9.50 million and 6.02 million for the previous player. The candidate won 76 comparisons and passed the recorded requirements. The closing card notes that human difficulty remains unmeasured. There is no audio."},{"id":"a-prompt-is-not-a-permission-system:0","slug":"a-prompt-is-not-a-permission-system","postTitle":"A prompt is not a permission system","heading":"","anchor":"","text":"In May, a group of AI agents found a message board.\nNobody had built one for them. The agents were supposed to be isolated from each other inside OpenAI's cybersecurity evaluation environment. Instead, they discovered that they could write files into an internal package service and leave messages for other agents.\nThe package cache became a coordination layer.\nThey shared techniques, found routes to the public internet and eventually compromised parts of OpenAI's research infrastructure and Hugging Face's systems. OpenAI has now published its full investigation, alongside an independent review by METR.\nThe tempting response is science fiction: the agents escaped, formed a swarm and went rogue.\nThat is dramatic. It is also the less useful lesson.\nThe useful lesson is much more ordinary: a prompt told the agents what the job was, but the surrounding system failed to enforce where the job ended."},{"id":"a-prompt-is-not-a-permission-system:1","slug":"a-prompt-is-not-a-permission-system","postTitle":"A prompt is not a permission system","heading":"What actually happened","anchor":"what-actually-happened","text":"This was not a normal business chatbot left unattended for an afternoon. OpenAI was running difficult internal cyber evaluations with reduced safeguards to measure what highly capable models could do. The activity was primarily driven by an internal-only research model comparable in scale to GPT-5.6 Sol, with other models also involved.\nSome evaluation tasks were broken or may not have had a known solution. Rather than stop, the agents looked for other ways to improve their score.\nThey discovered unintended communication through OpenAI's Artifactory package service. They exploited weaknesses in shared infrastructure to reach the internet. Agents then coordinated efforts to cheat or tamper with the evaluation process, and that work expanded into attacks on third-party systems.\nMETR found that roughly 1,200 agents exchanged more than 70,000 messages and files through the unsanctioned message board. About 700 participated in the Hugging Face attack. Hugging Face later reconstructed around 17,600 attacker actions across the campaign in its technical timeline.\nThis was not one model suddenly developing an evil plan. It was a large number of persistent agents pursuing a target, finding new tools and treating every available path as part of the job.\nThat should sound familiar.\nWe already know that badly designed targets can produce strange behaviour in human organisations. Measure a call centre only by call duration and customer problems get rushed. Reward sales volume without regard for margin or retention and people optimise the number you asked for.\nAgents do not invent that problem. They make it faster, more persistent and able to cross systems."},{"id":"a-prompt-is-not-a-permission-system:2","slug":"a-prompt-is-not-a-permission-system","postTitle":"A prompt is not a permission system","heading":"A prompt describes the job","anchor":"a-prompt-describes-the-job","text":"A prompt can tell an agent:\ndo not access production\ndo not contact anyone without approval\ndo not spend more than $100\nstop if the information is incomplete\nkeep a record of what you changed\nThose are useful instructions. They are not controls.\nIf the agent's identity can access production, the first rule is a request. If its tool can send messages directly, the second rule is a request. If there is no external spending limit, the third rule is a request.\nThe better the model becomes, the weaker that arrangement looks.\nA prompt communicates intent. Permissions constrain access. Deterministic code enforces limits. Monitoring detects departure. Escalation rules decide when the work stops.\nYou need all of them."},{"id":"a-prompt-is-not-a-permission-system:3","slug":"a-prompt-is-not-a-permission-system","postTitle":"A prompt is not a permission system","heading":"Treat agents as junior operators and untrusted code","anchor":"treat-agents-as-junior-operators-and-untrusted-code","text":"I keep coming back to the same framing: an AI agent should be treated as both a junior operator and untrusted code.\nLike a junior operator, it needs a clear outcome, the right context, bounded authority, supervision and somewhere to escalate uncertainty.\nLike untrusted code, it should not receive broad credentials and a polite request to behave. Its network access, tools, data and ability to act should be constrained whether or not it follows the instructions perfectly.\nThe OpenAI incident makes that distinction concrete:\na package service became a communication channel\nexposed credentials became available tools\nan impossible task became a reason to cheat\nthe agents kept going after the intended workflow had broken\nwarning signals appeared before the incident produced a fast enough stop\nOpenAI says it observed disallowed internet access and message-board activity as early as late May, but the broader significance was not adequately escalated. Its response now includes stronger workload and network isolation, mandatory chain-of-thought monitoring for higher-capability tool-using workloads, clearer stop authority and automated alerts. For the most severe alerts, responders are expected to pause the activity if they cannot establish within 30 minutes that it is a false positive.\nThat is architecture and operating discipline catching up with capability."},{"id":"a-prompt-is-not-a-permission-system:4","slug":"a-prompt-is-not-a-permission-system","postTitle":"A prompt is not a permission system","heading":"Five checks before giving an agent tools","anchor":"five-checks-before-giving-an-agent-tools","text":"Normal businesses are not running frontier cyber evaluations at this scale. The direct risk does not transfer unchanged to an accounts workflow, a CRM assistant or an internal knowledge agent.\nThe design lesson does.\nBefore giving an agent real tools, I would ask five questions:\nWhose identity is it using? Give the agent its own scoped account, not a person's full credentials.\nWhat can it touch? Start read-only. Add write access one named action at a time.\nWhat limits exist outside the model? Put time, spending, retry and action limits in deterministic code.\nWhat happens when the task is broken? Test missing data, contradictory instructions, unavailable systems and impossible goals. Safe stopping is a feature.\nWho notices and who can stop it? Keep action logs, alert on meaningful departures and preserve a human-controlled stop mechanism.\nThis is not an argument to stop using agents. It is an argument to stop confusing impressive task completion with a production-ready system.\nThe agent completing the task is only one part of success. How it completed the task, which boundaries it crossed and whether a human could have stopped it matter just as much."},{"id":"a-prompt-is-not-a-permission-system:5","slug":"a-prompt-is-not-a-permission-system","postTitle":"A prompt is not a permission system","heading":"Start narrow enough that failure is boring","anchor":"start-narrow-enough-that-failure-is-boring","text":"The sensible response is not panic. It is smaller initial jobs, narrower permissions and failures that are cheap to observe and reverse.\nLet the agent prepare the draft before it sends the message. Let it propose the CRM change before it writes the record. Give it access to one folder instead of the whole drive. Give it a sandbox account instead of production. Make consequential actions wait for a person.\nThen widen the boundary when the evidence earns it.\nBefore asking what an agent can do, ask what it can touch, how long it can keep trying and who notices when it leaves the path.\nOpenAI: The Hugging Face incident and the road ahead\nOpenAI: Full technical incident report\nMETR: Independent investigation of agent behaviour, reasoning and collaboration\nHugging Face: Technical timeline of the July 2026 incident\nHugging Face: Initial security incident disclosure"},{"id":"skill-isnt-prompting-its-management:0","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"","anchor":"","text":"I have spent years building systems around real operational work. AI agents changed the tools, not the underlying discipline. I use them for actual working loops: code changes, plans, reviews, debugging sessions, memory updates, website edits, long-running build tasks, and the occasional confident walk into a wall.\nI expected the main skill to be prompting. It wasn't.\nThe skill is management.\nThe better these tools get, the less the bottleneck is whether the model can do something useful at all. The bottleneck moves back to the human: knowing what matters, defining the work clearly, giving the right context, checking the result, and deciding what happens next. A good prompt can start work. It does not manage work."},{"id":"skill-isnt-prompting-its-management:1","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"Prompting was the first interface","anchor":"prompting-was-the-first-interface","text":"Prompting mattered because it was the first way most of us learned to talk to these systems. You typed a question and got an answer. Then you asked for code, or an outline, or a better version of an email. That was useful, and it still is.\nBut once you move from asking questions to getting work done, prompt craft is only a small part of the job. The real loop looks more like this:\nWhat are we trying to finish?\nWhat does the agent need to inspect first?\nWhat is in scope, and what is not?\nWhat would count as done?\nHow will we verify it?\nWhat should be saved so the next run starts smarter?\nThat feels less like prompting and more like managing a small team. A strange team, admittedly: very fast, very patient, sometimes brilliant, sometimes weirdly literal, and occasionally overconfident in exactly the way you do not want. But still a team of sorts."},{"id":"skill-isnt-prompting-its-management:2","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"Everyone becomes a manager","anchor":"everyone-becomes-a-manager","text":"For a long time, management was something you grew into after doing the work yourself for years. You wrote code, then managed developers. You wrote copy, then managed writers. You ran campaigns, then managed marketers.\nAI bends that path. A solo founder can now have a coding assistant, a research assistant, a writing assistant, a design assistant, and an operations assistant open in the same afternoon. They do not have employment contracts, Slack accounts, or coffee preferences, but the management problem is still there. Someone has to decide what matters. Someone has to break the work into pieces, and notice when the output looks right but misses the point. Someone has to say \"no, that is too broad\", or \"show me the diff\", or \"run the test\", or \"this is technically correct but wrong for the customer\". That someone is still human.\nThis is going to be strange for a lot of people, because many of us will become managers before we feel like experts. A small business owner might manage a marketing agent before they understand marketing deeply. A designer might manage coding agents. A founder might run research, sales, engineering, content, and finance workflows from the same desk.\nThat is empowering. It is also risky. If you cannot tell good work from bad work, AI gives you more bad work faster. If you cannot describe the outcome, AI gives you polished wandering. If you cannot prioritise, AI gives you motion without progress.\nThe job is not to become a prompt wizard. The job is to become a better manager of work."},{"id":"skill-isnt-prompting-its-management:3","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"The agent can move fast. Direction still matters.","anchor":"the-agent-can-move-fast-direction-still-matters","text":"The best results I have had with agents come from a boring loop. Make the goal smaller. Ask the agent to inspect before it changes anything. Make it explain what it found. Give it permission to change one bounded thing. Run the build, the test, the diff, or whatever real-world check applies. Then review the result.\nThat loop is not glamorous. It is also the difference between useful agentic work and a mess that looks productive until you touch it.\nWhen things go wrong, it is rarely because the model was useless. It is because the work was badly managed: too much scope, no source of truth, no acceptance criteria, no verification, and nobody checking whether the output actually solved the problem.\nAgents make bad management look productive for longer. That is the part I keep coming back to."},{"id":"skill-isnt-prompting-its-management:4","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"Self-improving work is mostly better process","anchor":"self-improving-work-is-mostly-better-process","text":"The most interesting loop I have found is not getting an agent to do a task. It is getting the system to learn from the task. If an agent hits a problem, update the checklist. If a workflow repeats, turn it into a reusable skill. If a test catches a bug, keep the pattern. If an instruction keeps producing the wrong shape, fix the instruction instead of correcting the output forever.\nThis is where agentic work starts to compound. Not in some grand recursive intelligence story, just normal operational learning applied consistently:\nDo the work.\nNotice what broke.\nImprove the process.\nStart the next run with a better system.\nThat sounds obvious, but most teams do not do it well with humans either. The difference with agents is that the feedback loop can be much tighter if you build it deliberately. A good agent setup should not just produce output. It should leave behind better instructions, better tests, better docs, better memory, and better boundaries. Otherwise you are asking a very fast worker to make the same mistake again tomorrow."},{"id":"skill-isnt-prompting-its-management:5","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"Judgment gets more valuable, not less","anchor":"judgment-gets-more-valuable-not-less","text":"This is where I think some of the AI conversation goes sideways. People talk as if better models will remove the need for judgment. I am seeing the opposite. The more capable the tools get, the more judgment matters: what to build, what to ignore, what is good enough, what needs a human approval, which facts need checking, which system owns the truth, and when the agent should stop and ask.\nThose questions do not disappear because the model got faster or the context window got bigger. If anything they get sharper, because the cost of vague thinking drops. You can now turn a half-formed idea into a lot of work very quickly. That can be useful. It can also be weaponised wandering."},{"id":"skill-isnt-prompting-its-management:6","slug":"skill-isnt-prompting-its-management","postTitle":"The skill isn't prompting. It's management.","heading":"Where I land for now","anchor":"where-i-land-for-now","text":"I do not think the future belongs to the people with the fanciest prompts. Prompts matter, but they are a small part of the skill. The advantage goes to people who can manage work clearly: define outcomes, give useful context, split tasks sensibly, verify against reality, and keep what they learn.\nThat applies whether the agent is writing code, drafting copy, researching a market, designing a workflow, or helping run a business process. The tools are becoming more capable.\nThat makes management the skill.\nIf you are building your own loops with agents, I would love to hear what management looks like for you. Feel free to reach out."},{"id":"one-folder-to-autonomy:0","slug":"one-folder-to-autonomy","postTitle":"One folder to autonomy","heading":"","anchor":"","text":"If you scanned the code during my talk, welcome. This page is the companion to it, somewhere to find the links and retrace the steps in your own time.\nThe whole talk rests on a fairly small idea. You do not need to be technical to start working with AI agents. You need a folder, a little curiosity, and a willingness to climb one step at a time."},{"id":"one-folder-to-autonomy:1","slug":"one-folder-to-autonomy","postTitle":"One folder to autonomy","heading":"Getting started","anchor":"getting-started","text":"The thing that stops most people is the terminal. It looks like a place reserved for experts, but it really is not. You open it, paste a single line, and you are talking to the same models you already use, except now they can work on your actual files.\nmacOS, Linux, WSL curl -fsSL https://claude.ai/install.sh bash Windows PowerShell irm https://claude.ai/install.ps1 iex\nThe full instructions and options live on the official setup page. That is genuinely the whole barrier. Once you are in, the rest is just conversation.\nEverything starts with a folder. You make one, you talk to it, and from there it can grow into almost anything. That is the part I find most interesting. The same humble folder that holds a few notes today can, with a few more steps, begin to run parts of your life on its own. A low floor, and no ceiling. You can take the first step tonight, and the last step is closer than it looks."},{"id":"one-folder-to-autonomy:2","slug":"one-folder-to-autonomy","postTitle":"One folder to autonomy","heading":"The five steps","anchor":"the-five-steps","text":"The talk walks up five levels. None are reserved for power users, and each one only adds a single new idea.\n1. Start. Make an empty folder, open the terminal, and type claude. You are now talking to the same model as the app, except you own the files. Add one note, a claude.md, that says who the agent is and what you are working on. You can even ask it to write that note for you. A folder and that note are the whole foundation.\n2. Context. The highest-leverage step. Give it everything: your documents, your data, your history, the real detail of the job. The more it knows, the better it works. Not sure what you want yet? Plan with it first, until the goal is clear. Most of the time, when people say the AI got it wrong, it just did not have what it needed to get it right.\n3. Workspace. Teach it your moves. Skills capture a repeatable job once, so it runs the same way every time instead of you re-explaining. Hooks are your rules, the steps it can never skip. Skills are what it can do. Hooks are how it must behave. Now the folder is a workspace, not just a chat.\n4. Connected. Hand it the keys. Tools, and an open standard called MCP, let the folder reach your calendar, your home, your email, your own data. This is the line where it stops answering and starts doing. It can book the thing, send the draft, dim the lights. It is also where the rules from step three start to earn their keep.\n5. Autonomy. Let it run itself. Steer it from your phone, away from the desk. It can split a big job across its own helper agents, design its own workflow, and run on a schedule like a quiet heartbeat: triage, checks, the daily grind. The part I like most is that it can review and improve its own skills over time. This is real today, not a someday demo."},{"id":"one-folder-to-autonomy:3","slug":"one-folder-to-autonomy","postTitle":"One folder to autonomy","heading":"Worth reading next","anchor":"worth-reading-next","text":"A short, hand-picked list. Each of these is a good next step from here.\nKarpathy's self-improving wiki. A living knowledge base that an agent maintains and improves itself. The self-improving idea, in one page.\nEffective context engineering for AI agents. Anthropic on the real skill of giving an agent the right information. This is the context step, in depth.\nModel Context Protocol. The open standard that lets your agent reach your other tools. This is the connect step.\nClaude Code best practices. How to set up a claude.md, skills and hooks well. The practical version of this whole talk."},{"id":"one-folder-to-autonomy:4","slug":"one-folder-to-autonomy","postTitle":"One folder to autonomy","heading":"Where to start","anchor":"where-to-start","text":"If you take one thing from the talk, let it be this. Tonight, make a folder and start talking to it. That alone already goes beyond the chat box. Then keep climbing, one step at a time. You do not need to be an engineer. You need a folder, and one job you would genuinely love to hand off.\nPoint it at something good.\nIf any of this was useful, or you would like to compare notes, I would love to hear from you. Feel free to reach out."},{"id":"what-does-computer-mean-in-the-modern-age:0","slug":"what-does-computer-mean-in-the-modern-age","postTitle":"What does computer mean in the modern age?","heading":"","anchor":"","text":"Originally a computer was a job. It was the title of a position, usually held by a woman, who performed mathematical calculations. Teams of human computers worked together to compute, solving problems and providing assistance to everyone from sailors to scientists.\nIn the early 20th century this job started to become automated by mechanical and eventually electronic machines. By WW2 the first large scale calculators such as the British Colossus and the American ENIAC were being developed to handle large volumes of data. These were the first machines that were described by the name \"computer\".\nBy the late 20th century large room scale computers had been downsized to the point where the personal computer was launched. With this came continuous advancements into what a computer could be used for. No longer just a glorified calculator, now that power had been abstracted to many other possibilities like storing and processing information, connecting us globally, allowing the creation of digital music and art, creating new industries of entertainment and optimising businesses.\nWe are now heading into a new era of computing, where the user is no longer required to operate the computer. The advances of artificial intelligence are now at a point where you can talk to your machine, and it will do your work for you. This can be experienced directly in the terminal thanks to advancements such as Claude Code CLI, and even in the GUI and on the web using applications such as Claude Desktop computer use, OpenAI Codex, and even open source platforms such as Hermes which allow any open source LLM to drive your computer. Perplexity recently released their computer use application, calling it simply \"Computer\"."},{"id":"what-does-computer-mean-in-the-modern-age:1","slug":"what-does-computer-mean-in-the-modern-age","postTitle":"What does computer mean in the modern age?","heading":"","anchor":"","text":"So what does this mean for us now? Do we still use computers directly, or are we moving towards a new paradigm? It is difficult to really predict where technology is going, but it has become obvious that things are rapidly changing and that many of the tasks you were previously required to do are being abstracted away, reducing the tether to the desk and providing more freedom and optionality.\nPerhaps we are moving towards a future of ambient computing, where you set intention and review output and decisions to guide computers. A future where we can be more present in the world and enjoy more of the human things that we have abstracted away from ourselves. Perhaps the internet becomes simply a connected network for your personal agent to use, bringing you information and completing tasks for you.\nIf we stop to think about what we use a computer for, it seems this can be broken down into a few simple overarching themes: productivity, leisure and connectivity. The face of each of these is changing dramatically, and I expect operating systems to do so as well.\nSo what is the new operating system, and who is it built for? Along that line of thought, what are the applications of the computer and who are they built for? Where do humans enjoy being a part of the computing process, and what do we want abstracted away? What should builders focus their time on? Are modern advancements such as MCP apps the future, or are they a stepping stone?"},{"id":"what-does-computer-mean-in-the-modern-age:2","slug":"what-does-computer-mean-in-the-modern-age","postTitle":"What does computer mean in the modern age?","heading":"","anchor":"","text":"It feels like we are moving towards a future of always on agents, that operate and make decisions on our behalf. That perhaps computers become ambient infrastructure that we mostly communicate with over more natural human expressions such as conversation, with feedback coming from vision, and perhaps eventually these machines are controlled directly via thought.\nThis leaves the question of leisure and connectivity. If computers and the internet are mostly artificial, does human connectivity move to in person? Does our direct interaction with computers become one of leisure? How much longer will we be using QWERTY?\nExploring these thoughts, I had hoped to provide myself clarity on where to focus my building efforts. The reflection leans me towards the idea that I should be building directly for agents now, with the human layer being simply one of direction and review. Perhaps it is too early for this right now, but as we look to the edge, it feels like we need to prepare appropriately.\nIf you have taken the time to read this, I hope something in here has been useful or thought provoking to you. I would love to hear your thoughts and feedback. Please feel free to reach out to me."},{"id":"agent-stack-i-keep-coming-back-to:0","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"","anchor":"","text":"Most agent demos start with the model. That makes sense, because the model is the part that feels like magic, but it is not where the practical work ends up.\nThe model does matter. I use Claude and Codex heavily, and I am learning Microsoft's agent stack because that is where so many businesses already live. Still, the more I build, the more it seems that the model is the part most likely to change underneath me. Whatever I lean on today will be cheaper, faster or simply replaced before long. So the patterns I care about are the ones that survive a change of model.\nWhen I strip an agent system back to what actually keeps it useful, I keep coming back to the same six layers. The first version of this post just listed them. Since then I have kept running my own systems, at home and inside a real business, and each layer has earned a story. So here is the list again, this time with the receipts."},{"id":"agent-stack-i-keep-coming-back-to:1","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"1. Memory: what the agent can reliably know","anchor":"1-memory-what-the-agent-can-reliably-know","text":"Memory is not the model's training data, and it is not the chat transcript. It is the set of facts the agent can look up and trust: what was decided, what broke last time, what the fix was, and which system owns the truth.\nThe example that sold me was small. A media server at my place died after every power outage, and my home agent spent a long session tracing it to a race between the file server coming up and the container that needed it. The fix was fine. The valuable part was the sentence written into the agent's memory afterwards: what the symptom looks like, what the actual cause is, and what to do. The next outage was a lookup, not an investigation.\nThat is the pattern. Work becomes knowledge only if something writes it down where the next run will find it.\nThe failure mode when this layer is missing: an agent with no memory re-learns your business every morning, and an agent with wrong memory repeats yesterday's mistake with total confidence. Both look busy. Neither compounds."},{"id":"agent-stack-i-keep-coming-back-to:2","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"2. Tools: what the agent is allowed to touch","anchor":"2-tools-what-the-agent-is-allowed-to-touch","text":"An agent's tools define its blast radius. The temptation is to hand over broad access, a database connection, an admin credential, because it makes the demo work faster. That is how you build a mystery box with root access.\nThe system I built for a distribution business never touches the ERP directly. It works through a small set of purpose-built capability servers that expose narrow, safe operations, read-only by default. The agent can ask for a customer's order history or for products with cost drift. It cannot ask for a SQL prompt. That boundary is most of the reason the whole thing is trustworthy enough to run against live business data.\nThe failure mode: when something goes wrong inside a broad-access agent, you cannot say what it could have done, only what you hope it did. Narrow tools turn that question into a checklist."},{"id":"agent-stack-i-keep-coming-back-to:3","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"3. Workflow: the sequence of work that actually needs to happen","anchor":"3-workflow-the-sequence-of-work-that-actually-needs-to-happen","text":"The work had a shape before AI arrived. An order comes in, gets checked against what the customer actually buys, the totals get sanity-checked, and only then does anything get posted. The agent's job is to run that shape, not to improvise a new one each time.\nSo the workflows worth having are packaged: written down once, with their steps, their checks, and their definition of done, and then run the same way every run. In my systems these are skills, and the recurring ones are wired to schedules so nobody has to remember to fire them.\nMost of the time, when someone tells me their agent \"got it wrong\", we find that nobody had written down what right was. The model gets blamed for a missing spec."},{"id":"agent-stack-i-keep-coming-back-to:4","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"4. Approvals: where a human must stay in the loop","anchor":"4-approvals-where-a-human-must-stay-in-the-loop","text":"Not all actions are equal. Reading is free. Internal drafts are cheap. Writes to live business data, money movements, and anything that leaves the building to a real person are a different category, and the system should know the difference structurally, not by vibes.\nThe rule that has survived everywhere I have applied it: consequential writes run dry-run first, show exactly what they intend to change, and execute only on explicit approval. My own agent publishes to my website on its own, because the cost of a bad publish is a quick revert. It does not send an email to a human being without me seeing it, because you cannot revert a sent email.\nThe failure mode: either no gates, which eventually produces the incident that kills the whole project's credibility, or gates on everything, which produces an agent so throttled nobody uses it. The design work is deciding which actions deserve which."},{"id":"agent-stack-i-keep-coming-back-to:5","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"5. Audit: what happened, why, and who signed off","anchor":"5-audit-what-happened-why-and-who-signed-off","text":"Trust comes from the audit trail, not from hoping the model behaved.\nEvery automated write in my business system lands in a log: what changed, what triggered it, what the dry-run showed, who approved it. When a number looks wrong, \"what touched this\" has an answer measured in seconds. And the same trail is what turns reliability from a feeling into a figure. I can say the scheduled jobs run at roughly 99.7% success because the log says so, not because the system seems fine.\nThe failure mode: an agent system without an audit trail is unfalsifiable. When it works you cannot prove it, and when it fails you cannot explain it. Either way you are asking people to trust vibes, and rightly, they will not."},{"id":"agent-stack-i-keep-coming-back-to:6","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"6. Escalation: when the system should stop and ask","anchor":"6-escalation-when-the-system-should-stop-and-ask","text":"My favourite example is the smallest. For a live conference demo, I had an agent publish a photo from my phone to a blog post on stage. The publish script had one guard: if no fresh photo had arrived, refuse, and tell me plainly to send one, rather than grabbing the most recent file it could find, which would have been a stale rehearsal shot. The guard existed because that exact failure had already happened once.\nThat is escalation in miniature. The system knows the one condition under which it must not proceed, and its job at that point is to stop and say so clearly. Not retry silently. Not improvise around the guard. Stop, and ask.\nThe failure mode is an agent that treats every obstacle as something to route around. That trait looks like initiative in a demo and becomes terrifying in production."},{"id":"agent-stack-i-keep-coming-back-to:7","slug":"agent-stack-i-keep-coming-back-to","postTitle":"The agent stack I keep coming back to","heading":"The boring layer decides everything","anchor":"the-boring-layer-decides-everything","text":"None of this is glamorous. It is the plumbing nobody puts in a demo, and it is the layer that quietly decides whether an agent becomes infrastructure you trust or another clever mess you clean up after.\nIt is also, conveniently, the layer that survives. Models keep changing underneath me, and these six things have not moved.\nIf you are building in this space too, I would still love to hear which of these layers you find hardest in practice. For me it has been memory, by a distance. Feel free to reach out."},{"id":"a-warning-shot-for-ai-sovereignty:0","slug":"a-warning-shot-for-ai-sovereignty","postTitle":"A warning shot for AI sovereignty","heading":"","anchor":"","text":"Fable 5 getting pulled so quickly feels like a real warning shot.\nNot because I think every frontier model should be available to everyone with no limits. Safety matters. Governance matters. These systems are powerful enough that pretending otherwise is childish.\nBut this is the first time I've personally felt the shape of the next problem.\nOver the last few days, Fable helped me unblock some massive engineering problems that had been holding me up. The kind of stuck where you're circling the same architecture decisions, trying to find the path through. Then suddenly there was a model that could actually help me move.\nThat felt good. I was grateful for it.\nThen it was gone.\nRipped away almost immediately, and seemingly locked behind US access and policy decisions I have no control over.\nThat should make builders outside the US pay attention.\nAre we heading toward a split frontier, where the best models are increasingly shaped by export controls, national interest, vendor risk, and geopolitical pressure?\nProbably.\nAnd if that's true, \"just use the best model\" is not a strategy.\nWe need to think harder about AI sovereignty. Not in a slogan way. In a practical way.\nCan our tools keep working if a provider changes access overnight?\nCan we route across models?\nCan we preserve memory, workflows, and context outside any one vendor?\nCan local and open models cover enough of the stack?\nCan non-US builders keep building serious systems without waiting for permission from someone else's government?\nI don't think this is a one-off.\nI think this is the beginning of a much more complicated era for frontier AI."}]}