Building new enzymes is a labor of love. These proteins are the body’s chemical workhorses, speeding up the reactions that make life possible. Researchers use them in gene editing and synthetic biology, and they’re involved in many medical treatments.

But enzymes are also extremely finicky. Even tiny changes to their structures can jeopardize how well they work. To grow or improve their capabilities, scientists usually begin with a natural enzyme. In a process called directed evolution, they slowly nudge the enzyme towards new versions with tailored properties. The process is tedious, time-consuming, and despite best efforts, it may never yield the desired result.

“Laboratory evolution requires the commitment of time and resources. So what you start with is incredibly important as a major determinant of what you end up with,” said David Liu at the Broad Institute of Harvard and MIT in a press release.

Natural enzymes don’t always make good starting points. During directed evolution, they can collapse and stop working. But upgraded designs could be far more resilient.

Now, Liu and colleagues have redrawn the starting line. As a proof of concept, they redesigned the enzyme behind Botox with the help of a popular AI model to create more stable variants for directed evolution.

The evolved enzymes were far more stable and specific at cutting a protein linked to neurodegeneration compared to enzymes evolved from their natural counterparts. The strategy could expand the universe of designer enzymes, making it possible to target protein sequences that are currently out of reach because no suitable natural enzyme exists.

“The most important finding is that using AI to stabilize natural proteins can provide much better starting points for laboratory protein evolution than what we and other researchers have been using for decades,” said Liu. “This insight could change the way researchers conduct protein evolution.”

Evolutionary Bottleneck

Liu is no stranger to reprogramming proteins. As the pioneer of base editing—an offshoot of CRISPR gene editing that swaps single DNA letters—his team has long pursued enzymes with better stability and precision.

One way researchers do this is by speeding up evolution. Like all proteins, enzymes have evolved over eons. Some copy, repair, or modify DNA. Others convert nutrients into energy, break down toxins and drugs in the liver, or relay messages inside cells.

Researchers have long tried to make enzymes that do even more by evolving them in the lab. Success is largely tied to the number of generations they can produce. The more rounds, the greater the chances of producing the desired results. This is why these experiments are so tedious. Each round takes time and careful monitoring.

In 2011, Liu’s lab reported a system called PACE that could perform dozens of rounds of evolution a day without intervention. The system grows bacteriophages—viruses that infect bacteria—in vessels that are continuously diluted of certain molecules. Only viruses carrying improved proteins survive the selection pressure.

Using PACE, the researchers created more efficient prime editors, highly precise RNA-targeting enzymes, therapeutic antibody fragments, and tiny gene editing “scissor” proteins.

Then they hit a wall. Nearly all of the team’s successes began with natural proteins. These were effective to a point, but their descendants would often lose stability as they evolved.

Proteins work by docking with their targets, called substrates, like keys fitting into locks. But evolving new abilities requires them to mutate, which increases the chances their structures warp. Rather than fitting the intended locks, the resulting altered proteins instead clump together and become useless. Precision can also suffer. Even if enzymes have been evolved to recognize new substrates, they may still unintentionally act on their original targets.

Proteins that become less stable during the process can require additional work to make them usable, wrote the team.

There are a few workarounds. In one such strategy, researchers adds chaperones—these are proteins that help other proteins fold correctly—to buffer the effects of harmful mutations. While this can work, it adds another layer of complexity to an already intricate process. In another method, scientists first evolve a natural enzyme to enhance its stability and then use that version as a starting point. But this costs more time, labor, and frustration.

New Beginning

The team turned to AI. Over the past decade, powerful AI models for biology have emerged that can predict and design protein structures from their underlying molecular sequence alone. One example is ProteinMPNN, developed by Nobel laureate David Baker and colleagues at the University of Washington. The model dreams up new protein sequences that preserve overall structure while altering the underlying building blocks—all in seconds.

Liu’s team reasoned the AI could generate more stable enzymes to kick off directed evolution. To test their theory, they turned to natural botulinum neurotoxin proteases. These molecular scissors paralyze muscles by snipping specific proteins and are the main active component in Botox.

ProteinMPNN generated 58 designs predicted to be more stable. The top three candidates, when produced in E. coli bacteria, were highly soluble, meaning they didn’t aggregate inside cells. Some even had higher activity than their natural counterparts.

The team fed the redesigned enzymes into PACE, evolving them to slice away a mutated region of a protein associated with neuron health. But in diseases such as ALS (Lou Gehrig’s disease), a repetitive stretch expands, causing the protein to clump together and gradually damage neurons. Although the protein is an attractive therapeutic target, naturally occurring enzymes have had limited success cutting the mutant version before it forms toxic aggregates.

Compared with enzymes evolved from natural botulinum neurotoxin, those descended from the AI-redesigned versions were nearly 80 times more efficient at cutting the target protein, and over 56 times more selective for the intended region on the protein. Across three different types of the neurotoxin and multiple substrates, the AI-designed starting points consistently excelled at producing more stable and effective enzymes.

By mathematically mapping their evolutionary paths, the team found the redesigned enzymes tolerated more mutations while gaining new functions. That extra flexibility could open the door to larger reprogramming efforts, such as targeting substrates that lack natural enzymes.

“If you start with a more stable protein, it has more stability to spare, so it can afford larger changes in pursuit of new functions,” said study author Nicholas Krasnow.

The team worked with immortalized human cells for the study, so whether the proteins perform as well in more complex environments remains to be seen. But the work showcases the power of coupling AI and laboratory evolution to rapidly reprogram nature’s molecular machines, endowing them with functions evolution never produced. The team is already applying the strategy to finessing prime editors and other molecular tools.

The post Why Scientists Redesigned the Botox Enzyme With AI appeared first on SingularityHub.

Visa aimed Anthropic's Claude Mythos at the infrastructure behind billions of daily transactions, a network that spans more than 200 countries and territories, moves money in roughly 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations.

The model stitched minor weaknesses deep in the stack into working exploit chains that would traditionally have surfaced only late in penetration testing. Rajat Taneja, Visa's president of technology, walked the VB Transform 2026 audience through what came next, including why Visa released the harness that governed the entire hunt as open source and why the company abandoned traditional remediation metrics for a measurement its team invented.

Taneja has run technology strategy, product engineering, and global infrastructure at Visa since 2019, after joining the company in 2013 from Electronic Arts, where he served as CTO following 15 years at Microsoft. He co-authored, with Visa chief information security officer Subra Kumaraswamy, the June 10 blog post announcing the release of the Visa Vulnerability Agentic Harness on GitHub as a reference implementation that any security team can inspect, adapt, and extend. Visa also published a technical white paper detailing the architecture, lessons learned, and 12 non-negotiable architectural practices for critical infrastructure.

Trust built on pessimism and paranoia

Taneja led with the arithmetic that makes Visa a target worth defending obsessively. Trust at the scale of global payments gets engineered through what he called pessimism and paranoia, by assuming failure and designing around it before failure arrives. The network has been hardened over many years through zero-trust architecture, layered defenses, and highly automated security operations built for the scale and reliability global payments demand.

So when Anthropic invited the organizations behind critical software to test Mythos under Project Glasswing, Visa said yes. Glasswing participants collectively identified more than 10,000 high- or critical-severity vulnerabilities in the first month of testing across software underpinning critical systems industry-wide, according to Anthropic. Anthropic's own conclusion placed the bottleneck after discovery, in verification, disclosure, and patching speed. Visa joined to test decades of hardening at AI speed and learn where advanced models could push its defenses further.

What Mythos showed at Visa

Inside Visa's environment, Mythos demonstrated system-wide, context-aware analysis, surfacing vulnerabilities buried deep in the stack and flagging issues that grow more serious when chained together, with findings clean enough that engineering teams could act on them without wading through noise. Some findings carried critical severity ratings, and Visa credits its zero-trust controls, network segmentation, and layered safeguards with breaking the chain before any external actor could have acted.

That confirmation mattered, Taneja said, but the epiphany that followed mattered more. "In a world of agentic attacks, defense also has to be agentic," he said. Even at a company that has invested decades in defense-in-depth, the model revealed assumptions the team had been operating under that needed rethinking. Traditional SAST tools keep their place as a first pass against known vulnerability patterns, Visa's white paper notes, but pattern matching alone cannot follow an adversary who reasons through logic, data flow, and the exploit chains that live between the signatures.

A harness, not a scanner

Visa's response was not another monolithic scanner. The team built the Visa Vulnerability Agentic Harness, now in its fifth generation, as a governed pipeline that directs frontier AI models through structured security tasks while enforcing deterministic controls, policy gates, and human oversight at every stage. Taneja walked through the design philosophy. The harness operates across four phases and eleven stages, from code ingestion and threat modeling through deep-dive verification, exploit chain synthesis, and finally remediation and fix validation.

Three design choices drive finding quality, per the project's own documentation. Threat modeling runs before analysis to focus on the attack surface rather than scanning everything blindly, multi-agent deterministic voting requires convergence across independent reasoning chains before a finding advances, and structured triage artifacts compress the lifecycle from discovery to a result developers can actually ship. The payoff is a pipeline that runs hot by default. A plain scan in the shipped profile runs all eleven stages and edits source files in the target repository in fix mode, applying candidate patches unless the operator stops it at detection.

The harness is multi-model by design. An LLM abstraction layer lets Visa swap or combine providers without changing the control plane, and the open-source version works with Anthropic Claude, OpenAI-compatible models, or a mix. The repo's documentation is candid about the exception. Applying a fix requires the file-editing tools that only the Anthropic backends expose, so the remediation and validation stages currently require Anthropic models for full functionality, and an OpenAI-compatible model in those roles is limited to report-only output. VentureBeat's Q2 2026 Pulse research, presented earlier at the conference, reinforces why that provider flexibility matters. Among the enterprises surveyed, 82% rely on provider-native controls as their primary security layer, and 59% plan to adopt or switch agent security tooling within the year. The controls enterprises adopted last year are already becoming the controls they plan to replace.

Mean Time to Adapt replaces legacy metrics

Finding vulnerabilities is no longer the hard part, Taneja argued. The real challenge is how quickly a team can confirm an issue is truly exploitable, fix it, and prove the attack path is closed rather than just showing a patch was applied. Visa calls this Mean Time to Adapt, and the white paper tracks it along three dimensions. Inventory freshness measures how current and complete the organization's view is of code, configuration, and runtime deployment. Exploitable paths per release counts how many end-to-end attack chains remain possible after each release, not just how many findings were closed. Validation cycle time tracks how long it takes to produce repeatable, evidence-backed proof that a fix works and stays working in production.

That distinction matters because legacy measures such as mean time to detect and raw CVE closure counts can look better on paper while actual exposure keeps growing underneath them. An organization can close hundreds of findings a month and still leave viable exploit chains open if nobody tested whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters, and the white paper leans on CISA Known Exploited Vulnerabilities data to make the prioritization case, noting that fewer than 1% of CVEs are ever actively exploited. Visa's SSDLC policy now assumes every exploitable path will be exercised in production and requires it to be remediated before code is promoted.

Supply chain risk accelerates under AI

The conversation moved past Visa's own perimeter when Taneja turned to suppliers. A well-defended enterprise stays exposed through weak vendors and weak open-source components, the white paper warns, so Visa is making AI-specific security posture a non-negotiable dimension of supplier due diligence, with expectations for continuous vulnerability validation, living software bills of materials, and MTTA baselines across its technology stack.

Visa has also joined Project Lightwell, the $5 billion IBM and Red Hat initiative to harden widely used open-source components through AI-driven validation and coordinated patching, alongside financial institutions including Bank of America, JPMorganChase, Goldman Sachs, and Mastercard. The commitment extends the same logic upstream, because the MTTA clock does not pause at any single company's perimeter.

When agents start buying things

Securing agentic commerce is Visa's next problem. Taneja described a future where AI agents transact on behalf of consumers and enterprises, and said Visa is building the trust framework, identity layer, and agent readiness scoring that merchants will need before agents can safely complete transactions. Behind that work sits the Visa Payment Threats Lab, a simulation environment where real fraud scenarios get replayed against the authorization rules, thresholds, and configurations Visa actually runs, to surface AI-enabled failure modes as targeted hardening recommendations.

The identity challenge is not theoretical. VentureBeat's Pulse research found that 69% of enterprises already run credential sharing somewhere in their agent deployments, and companies with shared credentials report security incidents or near-misses at a 63.5% rate, against 40.9% where every agent has its own scoped identity. Visa's white paper addresses that gap directly, listing "AI agents are identities" among its 12 non-negotiable practices and requiring scoped permissions, least privilege enforcement, full audit trails, and inclusion in IAM governance for every agent that calls an API, reads data, or modifies a system.

Three priorities for defenders

Visa is organizing its defensive strategy around three priorities, Taneja said. Shift security left until exploitable flaws are designed out before they reach production, and replace high-risk, under-supported components before they turn into material exposure. The third is the heaviest lift at Visa's scale, refactoring defenses to run autonomously under human governance so detection, validation, and response keep pace as threat volume grows and the models behind attacks improve.

None of it requires a payment network's budget to start. The harness sits on GitHub with 595 stars and 97 forks as of July 20, MTTA needs a dashboard rather than a procurement cycle, and the white paper's 12 non-negotiable practices map onto architecture reviews security teams already run. Visa's own conclusion reads like a deadline. The opening to get ahead of machine-speed attackers is still there, the paper argues, and it will not stay open.

Last week’s unprecedented security event in which two OpenAI security hacking models trespassed into the network of fellow AI company Hugging Face was enabled by exploiting one or more zero-day vulnerabilities in Artifactory, JFrog, the product’s developer, said Monday.

In an incident mimicking a dystopian sci-fi novel, two OpenAI models broke out of the restricted environment meant to keep them from accessing the Internet during an internal test, the AI company revealed last week. The models went on to breach Hugging Face’s network and steal confidential information and credentials. OpenAI said its agent achieved the feat by exploiting a previously unknown vulnerability. The company called the event “unprecedented,” and outsiders largely agreed.

Not the triumph it was made out to be

OpenAI said the models exploited multiple attack vectors, including stolen credentials and zero-days, to gain remote code execution capabilities, but until now, the vulnerable software was unknown. JFrog’s Monday disclosure said the product was a self-managed instance Artifactory, a repository management system that secures and streamlines customers’ software development operations. JFrog says Artifactory is used by more than 7,500 developer Teams, 80 percent of which work for Fortune 100 companies.

Read full article

Comments

© Aurich Lawson

Unlike autonomous driving or industrial robotics, healthcare robotics can’t rely on internet-scale data collection or unlimited real-world experimentation....

Unlike autonomous driving or industrial robotics, healthcare robotics can’t rely on internet-scale data collection or unlimited real-world experimentation. Every demonstration requires specialized equipment, clinical expertise, and access to patients or laboratory environments. This creates three fundamental challenges for developers. First is the data gap. Training modern robotic policies…

Source

💾

This week during an interview with Bloomberg, Jensen Huang made quite the prediction.

The Nvidia CEO said the semiconductor industry will need to grow roughly five to tenfold over the next decade to support AI agents and robots to support what he believes is the next wave of computing. Huang believes that future demand will come from autonomous software agents and physical robots consuming compute around the clock.

“In the future, we have AI agents and robots, and they will be using computers,” Huang said. “Instead of a billion people using computers, we will have 100 billion agents and billions of robots all using computers. The computer industry built on top of the chip industry is certainly not big enough. Computers are being built not just for people to use, but computers are being built for computers to use.”

“Instead of a billion people using computers, we will have 100 billion agents and billions of robots all using computers. The computer industry built on top of the chip industry is certainly not big enough.”

Agents replace human endpoints

The 5-10x forecast — which Huang framed as his personal estimate, not a certainty — builds on a message he has been repeating for months, including a recent appearance where he declared traditional coding dead in favor of engineers who build AI agents. Still, it reflects the need to build backend systems for AI agents and machines, something infrastructure teams are already contending with.

On Nvidia’s fiscal Q1 2027 earnings call in May, Huang described the move from generative AI to agentic AI — systems “capable of perceiving, reasoning, planning, and acting” — as the next major phase of the industry.

South Korea’s infrastructure role

As API requests come from AI agents more often, standard assumptions around rate limiting, session memory, sub-millisecond inference routing, and API gateway concurrency are starting to break down. An environment in which most traffic originates from autonomous background loops rather than human thumbs changes how backend infrastructure must be built from the ground up.

To support an endpoint explosion of this scale, the physical supply chain must scale dramatically at the memory and data center layers. Speaking at the AI Summit in San Francisco on July 24, Huang pointed to South Korea as an important linchpin of the global AI buildout. “This is truly the beginning of a golden age for Korea,” he said, noting that the country’s semiconductor and industrial capabilities position it to help the world build out AI infrastructure.

“This is truly the beginning of a golden age for Korea.”

SK Group’s $500 billion bet

To back that vision, Nvidia announced a comprehensive partnership with SK Group valued at over $500 billion. The initiative spans massive purchasing of next-generation High-Bandwidth Memory (HBM) from SK Hynix, jointly co-developing custom HBM4 roadmaps designed specifically for agentic and physical AI workloads, and deploying Nvidia supercomputers.

The announcement also included major infrastructure investments across South Korea. SK Telecom said it plans to build a 2-gigawatt AI data center using Nvidia’s Vera Rubin architecture and SK Hynix’s HBM4 memory, with the first facility expected to come online in 2027. At the same time, Nvidia will invest $1 billion in Naver Corp, with Brookfield funding up to $9 billion as the project’s infrastructure capital partner, to help expand the company’s AI data center capacity from 55 megawatts to 200 megawatts by 2028.

Locking up supply early

Huang’s prediction also helps explain why Nvidia and other infrastructure companies are locking up supply years in advance. The company recently disclosed $119 billion in supply-related commitments as it works to secure everything from advanced packaging capacity to power, land, and high-bandwidth memory.

“Computers are being built not just for people to use, but computers are being built for computers to use.”

Huang believes the industry needs to stop thinking about a world where computers primarily serve people and start planning for one where AI agents and robots generate much of the demand. In his view, the ultimate limiting factor will be whether the industry can build enough physical infrastructure to keep up — a constraint already reshaping how companies like Nvidia and Palantir approach sovereign AI deployments.

The post Jensen Huang says AI agents could drive a 5-10x computing boom: “100 billion agents and billions of robots” appeared first on The New Stack.

Instacart is posing the provocative question: What if most of the work your engineers do today should, in fact, be done by machines?

At VB Transform 2026, CTO Anirban Kundu argued that dev teams continue to waste their time on draining, repetitive, high-volume work; this should be absorbed by AI agents so that humans can focus on problems that require judgment, intent, and exception handling. 

In fact, in 97% of cases, Instacart’s builders don’t even read code anymore. 

“In the past, the tactical level was the creation of the code,” Kundu said. “In the most tactical level going forward, it's going to be, ‘How do you navigate around the AI system to give you what you want?’”

AI generating code, performing "pretty serious evals" 

That doesn’t mean humans never look at code; agents handle the bulk of code generation and boilerplate, particularly with newer projects where code is generated or regenerated on a weekly basis. 

“The benefit of that is we don't care about tech debt anymore,” Kundu said. “Things that are not active just get dropped out and then it gets rebuilt, kind of like how we used to build assembly code or object code.”

So why not 100%? The remaining 3% is in legacy, compliance, and latency-sensitive systems and workflows, or driven by a “boatload of code” that is dead, not active, or half-active. These cases still need careful human attention. 

Instacart is slowly “smoothing those parts out,” however, breaking systems down in an aptly-named project Atoms, then building them back up in a cleaner, more modular form. Kundu’s team started with the “monoliths” and is shifting to remote procedure call (RPC)-driven architectures. 

But evaluation remains one of the overarching challenges. Code reviews aren’t as relevant when AI is generating code — as Kundu noted, “the lines of code are going to be correct, the syntax is going to meet your expectations” — so the goal is to move to an “intent model.” That is, training devs so they can ask different models the right questions from an intent perspective. 

Evals are then performed independently: Roughly 7,000 automatic evaluations run each month, and the system answers 8,000-plus real-time developer queries with about 99.9% accuracy.

Identifying "hiccups" that human intuition might have missed

Dovetailing with this, Instacart has built an agentic site reliability engineering (SRE) system trained on years of the company’s own incidents and root-cause analyses rather than generic failure data. Instead of teaching a model how production outages work in the abstract, the team fed it the specific ways Instacart’s systems have broken over time, along with the ways humans diagnosed and fixed them.

As a result, the company has seen accuracy in detecting and mitigating production issues jump from roughly 60 to more than 90%. 

Kundu pointed to one example with Instacart’s internal tool Blueberry. The AI SRE colleague watches 200-some-odd Slack channels, monitors signals, and looks for patterns across human conversations and alerts. 

In one incident, a database shard backed by an EBS volume that had a “hiccup” for a period of time. The human team did not immediately suspect AWS disk issues and were “obviously scrambling” to figure out why this particular shard misbehaved. 

But about 20 minutes in, Blueberry posted on Slack, pointing to a specific blip and tying it to a feature-flag-like system called "roulette" that had been inadequate. "It's supposed to be rolling out in this cadence, [but] it had been too much,” Kundu said.

Blueberry figured it out, and the team resolved the incident. “Would have a human been as quick? I think the problem is human intuition would hold us back a little bit,” Kundu said. 

Humans tend to default to patterns we’ve seen before, then resort to debugging; Kundu called this the “first brain-second brain kind of thing.” But Instacart’s agentic SRE is actually “more comprehensive in its ability to look at everything and then be able to decide what does or doesn't matter.”

Redefining the engineer’s job

Looking ahead, the most tactical work for engineers will be navigating AI systems: Designing and supervising evaluation processes; coordinating multiple simultaneous experiments and features; managing constraints like limited top-of-funnel traffic for testing; figuring out when to escalate; identifying edge cases and where things might break.

Domain expertise is also being rethought in the age of AI. Instead of bottlenecking changes through a single “owner” team that touches the code, Instacart is embedding domain knowledge into definitions and specs that any team can use. 

“We’ve lived in this world where this group or this engineering team is the one that can touch the code and make the modification,” said Kundu. “We're trying to move into a world where the code becomes completely democratized across groups.” 

June's AI Executive Order promotes voluntary engagement between AI developers and the federal government, emphasizing vendor management and advanced cybersecurity standards.

Software engineers at General Motors' (GM's) autonomous driving division spend only 15% of their time writing code, according to Rashed Haq, GM's VP of autonomous vehicles, in a recent onstage interview at VB Transform 2026.

GM is now using AI agents to accelerate much of the other 85%—including analyzing vehicle data, triaging problems, running experiments and testing potential fixes.

The result, Haq said, is roughly three times as many merged pull requests across GM’s autonomous vehicle engineering organization, faster releases and fewer defects escaping into later stages of development.

Haq said GM achieved those gains by redesigning complete engineering workflows around agents — not merely adding an AI coding assistant.

“If you give somebody just a chatbot which can do coding, there’s still a lot of inefficiency built into that process,” Haq said.

Engineers spent most of their time outside the code editor before agentic AI

GM’s 15% figure may sound strikingly low, but research conducted before the rise of generative and agentic AI reached a similar conclusion.

A 2019 Microsoft study based on responses from 5,971 professional developers found that they spent an average of 96 minutes writing code on good workdays and 66 minutes on bad ones. That equals roughly 20% and 14% of an eight-hour day, respectively. A 2018 Stripe survey found that the average developer spent more than 17 hours each week on maintenance work such as debugging and refactoring.

There is no single industry benchmark: the Microsoft researchers noted that earlier studies placed coding anywhere from 9% to 61% of developers’ time, depending on how researchers defined and measured the work. But the findings reinforce Haq’s central argument. Long before agents arrived, writing code represented only one part of software engineering. Accelerating that step alone leaves much of the development process untouched.

“Doing it by loop became really important,” Haq said.

GM divided its autonomous vehicle work into several loops: developing and testing software in simulation, testing vehicles on public roads and monitoring vehicles after they reach customers. It then looked for the longest bottleneck in each loop, automated it and repeated the process.

GM gave agents access to internal tools and data

GM connected agents to internal tools and petabytes of company data through customized Model Context Protocol (MCP) servers. It also created version-controlled “skills,” or instruction documents that tell agents how to perform specific tasks.

One high-value application involves telemetry collected from vehicles on public roads. Agents can analyze that data, conduct an initial triage and create issues for engineers to investigate. Through MCP connections, they can also call the underlying tools used by WebViz, GM’s system for visualizing vehicle telemetry, rather than relying on the same graphical interface a person sees.

The findings still need to make sense to engineers. “The output has to be human readable,” Haq said. An agent might identify a potential problem, locate the affected component, search historical data for similar incidents and provide examples supporting its conclusion.

GM bases an agent’s permissions on those of the engineer using it.

“If an engineer was going to do this task and they need access to these things, then their agent needs access to those things,” Haq said. “The engineer still is accountable for the output of the agent.”

The company also uses background agents to run machine-learning experiments in parallel. An engineer defines an experiment and its parameters, then agents execute tests and collect the results.

Three times the pull requests — with fewer escaped defects

GM treated its internal agent platform as a product and assigned four deployed engineers to work directly with engineering teams. They helped employees identify useful workflows, spread successful practices and adopt the tools.

Haq said the resulting increase in merged pull requests represents more than higher code volume. “The velocity at which we’re releasing new features” increased, he said, while releases produced “fewer test escapes, bug escapes” and other problems.

People remain responsible at critical control points. Haq said GM established structured and unstructured tests and performance measurements before accelerating the wider workflow. Engineers review those measurements and determine whether each test still captures its intended goal before work advances toward production.

Haq said GM initially expected a more modest productivity gain. “I think our only surprise was how much we could do,” he said.

GM's approach didn't start with handing every developer a code generator. It started with mapping the full path from problem discovery to a verified fix in each loop — simulation, road testing, post-deployment monitoring — then giving agents controlled access to the tools and data needed to shorten the longest bottleneck at each stage.

Runway spent weeks trying to engineer its way out of a stubborn bug: AI-generated avatars would drift off-center during real-time video generation. The fix wasn't a back-end patch — it was a new front-end feature that just worked around the problem. That's the kind of lesson Ryan Phillips, head of enterprise product at Runway ML, walked through at VB Transform 2026, arguing that even companies not building foundation models themselves can learn from how Runway builds, evaluates, and ships them.

"I think even if you are not all building models yourselves, it's helpful to learn how we do it because I think almost all of the lessons are applicable to what you all are doing day-to-day," Phillips said.

Runway is an applied AI research company building general world models to power generative tools. During his presentation, Phillips showcased Runway Characters, a real-time video model that enables zero-latency, back-and-forth interactions with AI-generated avatars. Five years ago, creating a video with illegible text and low framerates took artists hundreds of hours of stitching individual frames together, he said. Today, Runway’s models generate interactive video on the fly.

“Studying how we build these real-time models can inspire how you build and deploy real-time experiences, whether agentic or not, in your companies today,” he said.

Demystifying evals

Building a robust AI product starts with a high-quality evaluation set. However, creating this set cannot be treated solely as an engineering task. It requires deep cross-functional alignment across product, design, research, and sales to define what "quality" actually looks like.

Phillips emphasized running internal workshops where team members review generated examples together. The goal is to align the entire organization on specific failure modes so everyone shares a unified definition of a successful generation.

“We spent a lot of time working with our team, running through examples... of what success and failure looks like, down to the very, very detailed and picky things,” Phillips said.

The resulting evaluation set must cover broad customer use cases alongside extreme edge cases. For instance, Phillips highlighted that to ensure the model behaves predictably when pushed beyond standard human facial structures, they used “Tooth,” a non-human character with no nose and very unusual teeth.

When grading these generations, the Runway team looks for subtle artifacts. In one example, a video where a character’s face remained intact but background elements, such as a net, began morphing was strictly graded as a failure.

Despite the cutting-edge nature of the product, the tool Runway uses to track these evaluations is simple: an Excel spreadsheet. The team logs tests daily, categorizing outputs as "minor" or "major" failures against a predetermined pass rate. 

“We set a bar before we get started on what percentage we need to pass, and when we hit that, we ship the model,” Phillips said. “So it's not magical.”

For enterprise developers facing non-deterministic quality drift in their own real-time pipelines, manual evaluation at scale is a bottleneck. To solve this, Phillips noted that developers can rely on language models to automate the visual grading process. 

“LLMs are getting quite good at being a judge for a lot of this content, especially the types of morphing or changing that you would see in an evaluation set,” he said. Teams can also feed an LLM behind-the-scenes context (e.g., a hand-drawn sketch or an ad's structural layout) to guide the generation and validation processes, ensuring quality without adding cognitive load to the end user.

Model training and turning bugs into features

Delivering real-time generative video requires a highly optimized technical stack. The process begins with pre-training a massive foundation model, which is resource-intensive and slow to generate outputs. To achieve real-time latency, Runway relies on distillation, where a smaller, faster "student" model is trained to mimic the large "teacher" model. According to Phillips, distillation helps Runway cut down “80 to 90% of the generation time.”

The team then applies adversarial post-training (APT) to the distilled model. This technique forces the model to continuously improve by testing it against a system designed to find its flaws, helping regain the visual sharpness lost during the distillation process.

However, altering the model architecture introduces new problems. The distillation and APT phases introduced a stubborn bug: characters would sway or drift from the center of the frame during real-time generation.

The team spent weeks attempting to fix the core model to eliminate the drift, he said. Ultimately, they discovered that if the user's initial input image was perfectly centered, the generated video remained stable. Instead of spending more time on a backend engineering patch, Runway pivoted to a user experience solution.

“What we did was, when we noticed this in our evaluations, we then said, 'What if we just offered that as a feature?' If a user gives us a character that is turned to the left, we know the video is going to morph. Let's just fix it for them,” Phillips said. 

They introduced a frontend feature called "Optimize for Image Quality," which automatically re-centers the user's image before generation begins. By wrapping a backend model limitation in a frontend tool, users perceived a helpful feature rather than an engineering flaw.

“Turn model limitations into product features so that you can actually expand how the model works,” Phillips advised. “It might feel like a limitation internally, but your customers will not see it that way if you're kind of building this in as a product feature.”

The devil is in the infrastructure details

Delivering video globally at 24 frames per second requires optimizing every layer of the infrastructure stack. This ranges from caching and parallel decoding to making deep kernel changes in partnership with hardware providers like Nvidia.

Shortly after launching Runway Characters, he said the team noticed that 8% of API calls were dropping to 16 frames per second, causing the video to stutter for customers. 

Finding the root cause required deep observability. The team used an AI agent powered by Claude alongside monitoring tools like Datadog and Sentry to trace the anomaly. The debugging session isolated the problem to a single data center in the us-east-1 region.

“The solution actually wasn't [to] go fix anything or change a config,” Phillips explained. “They actually went and physically replaced those GPUs in the data center to fix it, and that ultimately solved the problems.”

For enterprise teams deploying real-time applications, the takeaway is clear: hardware and infrastructure anomalies will directly impact model performance, requiring rigorous, full-stack debugging capabilities. 

“Don't forget about all the small details, because there's so many of them when you're deploying these models,” Phillips said.

Surviving "failure hell" and the future of world-building

Developing AI systems is rarely a linear process. Teams often find themselves stuck for weeks on a single problem with no end in sight, a phase Phillips referred to as "failure hell.”

“We think you have to go through that pain and really struggle with the problem for a little bit before you can get the breakthrough,” he said. Consistent iteration eventually flattens the difficulty curve, triggering sudden, exponential improvements.

As the underlying models overcome these technical hurdles, the role of enterprise creatives is also fundamentally changing. Traditionally, marketing and design teams have focused on creating single assets, like a specific advertisement or illustration. In an era of real-time generation and agentic workflows, that paradigm is shifting toward defining parameters, aesthetics, and intellectual property.

“You might not be designing a single ad, but you might design a world that then the agent or a real-time video model can generate ads from,” Phillips said. 

A new field report shows how scientists use AI coding agents to modernize scientific computing, accelerating software development and discovery in genomics and beyond.

Imagine running your fingertip over the surface of a U.S. penny. You would feel the ridges of the raised letters and numbers, Abe Lincoln’s bearded side profile, and, if it’s tails, the fluted columns of the Lincoln Memorial. Getting a robot to sense the same things is an imposing task, often requiring gathering data on pressure and force at many spatial locations at once. But that’s just what a team of scientists in Europe has now managed to do, using an unusual, colorful robotic skin that provides high-resolution sensing in real time.

“To be honest, when they showed us this, we thought it was, and pardon my French, [expletive] cool, because it’s a distinctly different approach,” recalled Rich Walker, director of Shadow Robot, the U.K.’s longest-running robot company, which primarily focuses on robotic hands.

RELATED: “This DIY Bipedal Robot Used Pneumatic “Air-Muscles” Instead of Motors”

The research team, which hails from Queen Mary University of London, the University of Florence, the University of Trieste, and the University of Trento, designed a robotic fingertip with a synthetic skin that reflects different colors of light in response to mechanical deformation. By reading the light reflected off the skin, the fingertip generates maps of topology, strain, and contact pressure. The team has already used the sensor to generate maps of a human fingertip, a penny, and a leaf.

Giacomo Sasso, a postdoctoral research associate in the lab of Federico Carpi at Queen Mary University of London, came up with the idea for the sensor. He had been researching optics when he stumbled upon an interesting paper published in the journal Nature. It described the “mechanochromic material” that would eventually make up the reflector in the skin.

Following the method described in Nature, Sasso exposed a light-sensitive film to a 5-megawatt, 635-nanometer (red) laser for seven minutes. The laser beam creates an interference pattern which causes the film to polymerize in alternating densities, creating layers with different refractive indices.

This structure is called a Bragg reflector. The alternating densities and refractive indices in the polymer cause specific wavelengths of light to be reflected. When the reflector is deformed by contact with an object, its layers are stretched, becoming thinner and reflecting light of a different wavelength.

It took Sasso less than a week to re-create the material in the lab. “From there, we started seeing how we could translate these color patterns into something that was useful for us,” he says. Soon, they realized that the color produced by the material was all they needed to be able to sense the topology of objects.

In the robotic finger, the Bragg reflector is sandwiched between a layer of silicone, which protects it from the outside, and a transparent, fingertip-shaped silicone finger with a camera and LED light embedded inside of it.

The light from the LED shines through the clear polymer of the finger. When the fingertip is deformed by an object, the reflector bounces light back to the camera, with wavelengths depending on the level of deformation—red for least deformation, shifting to green, and then to blue when most deformed.

The team also made adjustments to increase the sensitivity of the skin and help the camera to better read color differences. The silicone of the outer layer of the fingertip is colored black to increase the color contrast, allowing the camera to better translate color into the morphology. The rigidity of the camera inside the finger also enhances the deformation of the reflector, producing greater differences in reflected wavelengths.

After all that optimization, the finger provided 100-micrometer resolution with no computational latency, the researchers determined.

What robot fingers need

Human skin takes in a variety of tactile information in order to successfully move and manipulate objects, including temperature, texture, pressure, and vibration. But engineering a robot to do the same is challenging because of spatial constraints. There often isn’t enough room in a robotic fingertip to incorporate more than one type of sensor. The question then becomes: Which type of sensor should be used?

“And the answer to that is…that’s a really hard question. No one knows yet,” says Walker. Carpi’s team’s robotic finger is exciting because it presents yet another option for roboticists to experiment with, Walker says.

Although Carpi’s team isn’t the first to use soft materials for tactile sensing, its technology is unique because it is able to extract quantitative information about depth and size from the topologic maps it generates. According to Walker, most sensors can only generate topological maps, which reveal the relative sizes of object features.

To Sasso, another key advantage of this robotic finger is that it embeds tactile sensing directly into the material of the finger, rather than using taxels, or pixels that measure force or pressure at specific spatial points.

RELATED: Robot Hand Manipulates Complex Objects by Touch Alone

“The core aspect of the sensor is that we’re essentially [moving toward] having the sensing element at the material level,” he says. “The camera, which is a very highly optimized electronic component, is translating whatever the material is already doing directly into digital signals.”

Michael Wang, co-founder and chief scientist at Daimon Robotics, which, unlike Shadow Robot, primarily uses vision-based sensing, echoed Walker’s sentiment that it’s beneficial to explore new methods of sensing, which may bring unique advantages. But he also explained that soft materials often face challenges with durability, and that the significance of the team’s work would be revealed when the finger is integrated into real robot hands.

“The practical and useful benefits, especially in the context of robot hands, remain to be tested and validated,” he says.

When the materials of soft sensors, like the silicone in Carpi’s team’s fingertip, become eroded or damaged after repeated use, the signals measured by the sensors may not reflect objects’ topography as well.

“Especially if you have the electronics embedded into the material layer itself, that becomes a very challenging engineering problem. And I haven’t seen [many] good soft electronics materials that really can undergo long periods of usage,” Wang says.

However, because the Bragg reflector isn’t in direct contact with objects itself, the outer layer of silicone material acts as a protective barrier, Sasso says. The silicone can also be made more durable using certain chemical coatings, according to Wang.

The team has already been talking to companies that could potentially employ the new sensor. They also hope to improve the sensor so that it can sense objects that don’t lie flat on surfaces. That could open up its use in surgical instruments that require precise contact mapping of tissues and organs, Carpi says.

“There are significant developments that we expect with a clear path toward transition to real world applications,” he says.

There are roughly 100x more people who use code than who can write code.1 As code that “just works” becomes easier to generate, this group may be the biggest prize of all — if you can get the agentic interface right.

A key trend we have been tracking over at AINews is the absolute explosion in Codex usage this year, with MAU now up >10x from Jan 2026. Less than two weeks after their July 9th launch, OpenAI said ChatGPT Work and Codex had reached 10M users combined (as we cover in the pod, Codex now powers ChatGPT Work, so all ChatGPT Work users are now users of the Codex harness, even if they aren’t traditional engineers) — showing the early innings of what happens when you graduate from coding agents to knowledge work agents:

We’ve been calling out how coding agents are “breaking containment” to do everything else this year to power every other part of knowledge work - and it started with the org chart, with a major reorg last month that amounted to two of Codex’s most prominent leaders, Greg and Tibo, taking responsibility over product and ChatGPT specifically, completing a “Superapp” consolidation cycle first discussed in March.

With these updates Codex is no longer just a coding tool. In June, OpenAI said knowledge workers already accounting for roughly 20% of Codex’s user base and growing more than 3x as quickly as developers. A product dedicated for knowledge workers was being pulled out of the Codex team.

However, knowledge work has a different set of problems and environments than coding. For decades, knowledge work has been scattered across different primitives like documents for writing, spreadsheets for analysis, slide decks for communication, and specialized applications for everything else. ChatGPT Work now enables users to work across every primitive with agents. Instead of opening an application and manually operating its features, the user can describe an outcome and collaborates with an agent that can assemble the tools, context, and artifact needed to reach it.

From building no-code products at Airtable to leading Productivity Engineering at OpenAI, Akshay Nathan has spent much of his career trying to make the power of software accessible to people who do not write code. In this episode, Akshay joins swyx and Vibhu to unpack the launch of ChatGPT Work, why Codex unexpectedly took off among non-developers inside OpenAI, and the company’s broader plan to bring useful agents from software engineers to knowledge workers and eventually everyone.

We go deep on the shared agent harness behind Codex and ChatGPT Work, why OpenAI brought the experiences together without making them identical, and how persistent computers, artifacts, Sites, plugins, memory, and sub-agents are changing what people can delegate to AI. Akshay explains why some teams are replacing decks and spreadsheets with interactive websites, how agents can gather context across code, Slack, documents, and local files, and what OpenAI learned from personal-agent products like OpenClaw.

Side note: also don’t miss Abhihek’s sandbox track keynote at AIE, which now powers a lot of the sandboxing for ChatGPT Work… and yes was also broken by an unreleased OpenAI model in the recent HuggingFace incident.

Akshay also reflects on how AI is transforming product development itself: why more people will become generalists with a specialty, why ideas and taste become the bottlenecks when almost anyone can build, why LLMs still struggle to generate genuinely grounded new ideas, and why teams must distinguish increased motion from actual progress.

We discuss:

• Why Codex unexpectedly took off among non-developers inside OpenAI

• Why employees felt like using Codex gave them a new superpower

• The product insight that led OpenAI to build ChatGPT Work

• Why Codex and ChatGPT Work share the same underlying agent harness

• How their UX, Git visibility, artifacts, and sandboxing defaults differ

• Why OpenAI merged its agent experiences instead of building separate products

• How AI is blurring the boundaries between engineering, design, strategy, and operations

• Why OpenAI wants the default model configuration to work for most users

• When power users should use deeper reasoning, Ultra, or multi-agent modes

• Artifacts, agentic spreadsheets, and creating high-fidelity work products

• Why interactive Sites may replace decks and spreadsheets

• The challenge of designing a simple interface for an agent that can build almost anything

• Why users should retry tasks that models could not handle three or six months ago

• How AI can gather context for performance reviews without replacing human judgment

• The OpenAI automation that turns internal Slack and document activity into memes

• What reaching ten million ChatGPT Work and Codex users means for the product

• How OpenClaw inspired persistent environments, scheduled tasks, and personal agents

• Using ChatGPT for financial planning, budgeting, workouts, meals, and household management

• The design tradeoffs behind sub-agents and how much of their work users should see

• ChatGPT memory, Chronicle, and long-term context

• Why AI may make more people generalists with deep specialties

• Why ideas and taste become more important when almost anyone can build

• Why LLMs still struggle with the instruction “bring me new ideas”

• Measuring productivity through quality at-bats instead of commits, tokens, or pull requests

• The critical difference between AI-generated motion and meaningful progress

Akshay Nathan

• LinkedIn: https://www.linkedin.com/in/akshaynathan/

• X: https://x.com/akshaynathan_

Timestamps

00:00:00 Introduction and Bringing the Power of Code to Everyone

00:01:33 Joining OpenAI and Preserving a Startup Culture

00:02:40 What OpenAI Learned from Enterprise AI Adoption

00:05:28 Why OpenAI Built ChatGPT Work

00:07:17 Codex vs. ChatGPT Work and the Shared Agent Harness

00:12:07 Why OpenAI Merged Its Agent Experiences

00:16:24 Models, Reasoning Levels, and Choosing the Right Default

00:20:26 Artifacts, Agentic Spreadsheets, and Model–Product Collaboration

00:24:22 Why Sites Could Replace Decks and Spreadsheets

00:30:08 Designing an Agent That Can Build Almost Anything

00:34:28 From Developer Agents to Knowledge Work—and Everyone

00:36:07 Power-User Advice and AI-Assisted Performance Reviews

00:40:41 OpenAI’s Internal AI Memes and the Ten-Million-User Launch

00:44:39 OpenClaw, Personal Agents, and ChatGPT as an Operating System

00:50:24 Sub-Agents, Ultra Mode, and How Much Control Users Need

00:54:39 ChatGPT Memory, Personalization, and Chronicle

01:00:19 How AI Is Reshaping Product Development and Tech Roles

01:03:15 Ideas, Taste, and Why LLMs Struggle to Generate New Ideas

01:04:42 Measuring Productivity, Quality At-Bats, and Motion vs. Progress

Transcript

Introduction: Akshay Nathan, ChatGPT Work, and the No-Code Arc

Swyx [00:00:00]: We’re here in the studio with Akshay from OpenAI. Welcome.

Akshay Nathan [00:00:07]: Thank you.

Swyx [00:00:08]: And with our trusty co-host, Vibhu. So you recently launched ChatGPT Work. You lead Core Product Engineering. It’s been a long journey, into all this. I find it very interesting that you started with no code or low code, with Walrus and Airtable. And to some extent, ChatGPT Work is like the super app of super apps of, well, here is the ultimate no code. You just write a prompt.

Akshay Nathan [00:00:32]: Yeah. It’s funny how things come, full circle. I think for a long time in my career, I started my career working consumer fintech, but then after that, like, there’s this hypothesis that, the things that we were able to do with code, like, as engineers, like, if we could bring that to many more people in a more, accessible way, then that would be truly magical. We were working on a startup. It’s funny, like, before LLMs, before vision LLMs, on how to do automated testing with AI. It was just kinda jank, back then, but doing what we can, and then worked at Airtable for a while on the same thesis that, like, if we can bring a database or the primitives behind a database to people, that’d be really useful to them. But once LLMs came onto the scene, it became clear that, this was the missing piece, like, the missing technology required to, like, bring the magic of code to everyone without them having to know what’s going on underneath the hood. And so, like, I think this launch and a lot of the stuff that we’ve been up to is, like, the manifestation of that.

From Walrus and Airtable to OpenAI

Vibhu [00:01:33]: How was stuff when you joined? So you joined OpenAI 2023. Now we’ve got, so much more stuff, so ChatGPT, Codex app, ChatGPT Work. Have things changed?

Joining OpenAI and What Hasn’t Changed

Akshay Nathan [00:01:44]: I think the more interesting thing is how things haven’t changed. Like, one, I joined I remember when I joined, it was, like, five hundred people. One thing I was worried about was, like, I was looking for something, more early stage and, like, was it gonna feel startup enough? And I joined, and I was like, “This feels even more startup-y than I could ever imagine.” And, like, that really hasn’t changed even till now. I think the, like, level of, like, bottoms-up ambition and, like, the ability of anyone to, like, do anything or have an idea and ship it is really cool. But on the, like, mission side, I think what was really compelling to me is this mission of, bringing frontier intelligence to everyone. Like, building AGI and then bringing it to everyone. And, I think acknowledging back then that, like, that vision is gonna, not be a linear progression. Like, we’re probably gonna, like, try different products and have different things that succeed and don’t. But the vision has stayed the same, and the mission has stayed the same, and we’re starting to see the pieces, fall together, and that’s really cool.

Enterprise Lessons: No One-Size-Fits-All AI

Swyx [00:02:40]: You worked on Enterprise. What A lot of people never touch ChatGPT Enterprise. What is something that you learned from there that you’re bringing into your work now?

Akshay Nathan [00:02:52]: I think how there’s no one-size-fits-all solution in Enterprise. I remember in the early days of ChatGPT Enterprise, like, when we talked to customers and, like, everyone. That was, like, when I think it was a year after ChatGPT was released, and everyone was so excited to bring, AI into their enterprise. And, there were all these teams being stood up. It was, like, the AI deployment team with, like, these enormous budgets. And if you asked anyone, like, what were they excited about? Like, what were they excited about solving? Like, at first, you’d get, like, kinda like the baseline answers of, like, “Yeah, we have all this context and data and all this stuff.” But then if you ask them, like, “What was, like, a discrete use case that, like, they want AI to enable in their workplace?” You get such a different, like, variance, like, explosion of, different types of answers. And it’s interesting, like, you using, like, these models and these products, you have this box, and you can say anything to it, which is the magic. But it’on the flip side, it also means that, like, you don’t know what to do with it. And in Enterprise, I think a big part of that is, like, meeting the users where they are, like, what use case were they trying to solve, and then teaching them how they can use AI to, like, gain leverage there.

Swyx [00:03:56]: Do you meaningfully differentiate that from forward-deployed engineering?

Akshay Nathan [00:04:01]: I think there is the go-to-market side of it and then there is the product side of it. I think you need someone on the product side. And I think, like, however good we get at FDE motion, like, I think at the end of the day, if we have a user who’s, like, looking at their computer or looking at their phone, like, it’s our job in the product to, like, be enabling them and showing them where to go. So we’re really excited about that.

Vibhu [00:04:24]: Do you think there’s been changes, over the past three years of adoption? So there have been, step function changes. You have reasoning models and whatnot. Is there still the same problems of Enterprise has black box, don’t know what to do with it, or have things changed?

Adoption, Agents, and the Next 10x Market

Akshay Nathan [00:04:39]: We’re seeing now that, like, there’s this huge uptake, right? Everyone is extremely excited about it. It feels like, many people are, millions, hundreds of millions of people are using ChatGPT. They understand, like, how generally to work with AI. But then, like, every time, like, a new capability gets unlocked, so now, like, we’re seeing with agents, like, there is probably a contingent of, like, early adopters still who, truly get it, who are like, “ we you can do anything. You just have to make sure the right context is there, it’s connected to the right tools, and that you are supervising it, but, like, anything is possible.” But then there’s, like, this, like, 10x or 100x bigger market where, like, they don’t yet get that, or they don’t yet see that. And so I think that’s the next stage here. So to answer your question, like, I think the adoption is there and growing fast, but I think the opportunity is, like, far bigger than that. That’s where we wanna play, especially with ChatGPT Work.

ChatGPT Work, Codex, and the Super App Merge

Swyx [00:05:27]: Yeah. well, let’s, let’s skip ahead to ChatGPT Work. only, like, a month ago or so, announced. what was the decision process that led into it? there was this, overall merging of the super app. Is that what we’re officially calling it? you deprecated the browser as well. Just, summarize your last, like, couple months of working on this thing.

Akshay Nathan [00:05:50]: Yeah. It feels like forever now, but it’s only been a few months. I think maybe the one, impetus that, like- Is most salient is when we release Codex, or even internally had Codex, like, it was really surprising to us, I think we recently put out some stats on this, that there was this, like, real inflection of, like, adoption among non-developers at OpenAI. And, I, through this product development process, like, would go to, like, these UXR sessions to talk to people internally. And the thing that stuck out to me is, like, one, like, you go talk to, like, strategic finance or marketing or whatever, and they’re all using Codex for, their use cases. That part’s cool, but the thing that really stuck out to me is how proud people were that they were using Codex. Like, how, like

Swyx [00:06:34]: It’s like, “I’m not supposed to be using it, but I am.”

Akshay Nathan [00:06:36]: It was that. It was, like, that they were, early to this, like, new thing, but it was also this thing of, like, they felt like they had a superpower, right? And, what we recognized then is that, like, the power of Codex, the power of agents, like, we already had this massive distribution base of people who have, come to know and love ChatGPT. Like, how do we show that to them? Like, how do we bring it to them? Which is, like, a hard product problem, and it’s, like, a tricky thing, right? There’s many ways you can go about it. And so that’s what we called the Merge and the Super App over time, and ultimately launched it in ChatGPT Work, is how do we do that? But it came from that initial realization that, like, the power was not only for developers, like, much earlier than probably even we thought. Like, it could be extended to everyone.

Swyx [00:07:17]: How do you see the products differently? So, like, who is it for, right? So Codex started out even CLI, then app. Now there’s a merge of ChatGPT Codex and ChatGPT Work, so is it the opening for the average user, for enterprise, for work? How do you position it?

Akshay Nathan [00:07:36]: I think we want to get it to position it for if you’re doing work-related things, for lack of a better word, right?

Who ChatGPT Work Is For

Akshay Nathan [00:07:42]: I think productivity is what, like, the pillar that I support. Like, that’s the name of the team. And the reason for that, the reason we call it productivity and not, like, enterprise or, like, work or something like that, is because there’s also personal productivity, right? And, like, I think ChatGPT Work is I’ve seen people do things in their personal lives that you wouldn’t classify as, like, work technically, but, like, these agents are, super capable for. Like, one recent example that someone posted about, on our Slack is, like, someone had, like, a missed package, like they didn’t receive it, and then they got, like, the picture of it, from Amazon or whoever the courier was, and they, like, asked ChatGPT Work to, like, find out where that package is. And, like, the agent, is extremely tenacious and, like, took the image and, like, looked at a bunch of, like, listings around their neighborhood and figured out exactly the apartment complex in which the package was, like, gave them some information. And so, like, I think there’s all these things that, like, you, work-related or productivity-related things, I think that’s what we want the product to be. You asked about Codex. I think we think Codex is, a durable brand, but we have a principle that, like, the user we don’t want a user to get stuck in a tab or an experience where they don’t get the power of the product. And so, like, everything that you can do, in the Codex portion of the product on desktop, you can do in ChatGPT Work and vice versa. But we made some opinionated product decisions on, like, how much of the Git state, if you’re in a Git repo, do we wanna expose to the end user? Or how much do we wanna make the experience of seeing the agents thinking, like, diff forward so that you get exposed to the diffs out of the box. And then, like, on the safety side, like, how do we wanna think about, like, sandboxing and making sure that we have the right defaults in one state versus the other? So, there’s, like, some opinions that go behind that, but we do want We don’t want the user to need to choose which experience they’re in.

Swyx [00:09:26]: That is a good goal for AGI, right? Like, people don’t want, like, to hide to choose what version of AGI they want. They just want the AGI to decide for them. can I get an answer or, like It’s not super clear to me. Is the Codex harness and the ChatGPT Work harness the same? Is it just UI affordances, or are there prompt level or even deeper differences?

Shared Harness, Different UX: Codex vs. Work

Akshay Nathan [00:09:49]: So the harness is the same. The harness is shared. on In both of the products, we made improvements to the harness to make it good for knowledge work, especially as it relates to plug-ins or computer use or artifacts. You get that power regardless of which experience you’re in. On the UX side, there’s opinionated takes that we have when you’re in Codex mode, what the UX should be how the UX should behave, and some stuff around the sandbox like I mentioned, but the underlying harness and capabilities should be the same.

Swyx [00:10:16]: I’m just kinda curious. Maybe we can, -- Is there a query that we can run that would look different in the two modes?

Akshay Nathan [00:10:23]: Yeah. I tried to create, like ask it to create, like, a retirement calculator spreadsheet or something, in both modes. And then in Codex mode, you might have to be in a repo for this, but you’ll see, like, the diffs of, like, the sheet that it’s creating and stuff like that, and the file edits. But in Work you won’t be able to see that.

Swyx [00:10:42]: I think that’s, that’s super clear. And then also the other thing I wanted to dive into was your, the productivity team. what else is there? first of all, what are the top-level teams other than productivity? Isn’t productivity everything?

Productivity Teams and Core Chat

Akshay Nathan [00:10:55]: So

Swyx [00:10:55]: Science?

Akshay Nathan [00:10:55]: We have a team focused on ChatGPT. Like, the core chat experience, for consumer, which is like, not, I think all productivity. Like, there’People are using ChatGPT every day for search to, figure out how to write messages to loved ones, to think about, how to, like, learn a new topic, et cetera. And so there’s so much more inside to create images. And there’s so much more in chat that, the hundreds of millions of users are using that warrants, like, a very dedicated effort. And there’s teams focused on enterprise and infrastructure and API and stuff like that, so.

Swyx [00:11:33]: I will bring it up.

Retirement Calculator Demo and Git-First UX

Swyx [00:11:34]: Yeah. So I have them both running. This is ChatGPT Work. There’s a Codex version here. I picked “Five Little Ducks” song, so this will take a while.

Akshay Nathan [00:11:43]: Huh.

Swyx [00:11:43]: I think we’ll just keep it in the background and, as they finish, we’ll look into some of the differences.

Akshay Nathan [00:11:48]: Yeah. But immediately, I think if you flip back to the Codex version you’ll see that,

Swyx [00:11:53]: That it assumes

Akshay Nathan [00:11:54]: Like the

Swyx [00:11:54]: It assumes Git. Yeah. Yeah.

Akshay Nathan [00:11:56]: The, like, dynamic island assumes that you’re in a Git repo. And you might miss some stuff because some of it is, like, in the actual chain of thought with those changes and how we display that, but yeah.

Swyx [00:12:07]: Is there an unintuitive like, is there a thing that you wanted to ship and then you got feedback, and you were like, “No, let’s not do it?” Like, what’s the thinking behind that?

Why Merge the Experiences

Akshay Nathan [00:12:14]: In, ChatGPT Work?

Akshay Nathan [00:12:17]: I think one direction we could have gone with this is, like, keeping the experiences, like, completely separate. So it’s like, why

Swyx [00:12:22]: Different apps.

Akshay Nathan [00:12:23]: Exactly, like different apps or even in the same app, like different, completely different experiences. Like, why merge it all? Like, what is. Codex, people love. Like, why bring these products together? And I think the intuition here is that, like, all of our jobs are, like, changing dramatically with AI. Like, for, like, every few months, like, I feel like I wake up, and I’m, like, doing a completely different thing than I was doing a few months ago. And my hypothesis here is that, or I should say our hypothesis is that, like, part of what we’re, we’re building, this technology is giving people leverage. Like, the things, maybe it’s the more mundane parts of your job or parts that, like, if you were able to automate, you’d be able to share more ideas faster or whatever, like, you’re able to do now. And because of that, like, that might blur the lines between someone who’s, like, only writing code or creating strategy docs or, planning events or, helping with marketing or doing podcasts or whatever, right? And so, like, these things are gonna get blurred over time. And so, like, trying to draw a hard boundary based on, like, the who you are is gonna be, is gonna be tough. And, like, we should enable users to choose, but we shouldn’t box them in. And so a lot of the work that went in here, like, keeping the primitives the same, like for example, plugins are, like, unified across, this product and ChatGPT and the cloud, was because of that. It’s this thesis that, like, eventually things are gonna come together and we don’t wanna be Like, we wanna be prescriptive about when to be in either experience, but we don’t want to box anyone in.

Swyx [00:13:45]: I wonder if there’s users who are very tuned to the old ChatGPT harness that is effectively now replaced by the Codex harness. I can’t imagine what that was, but maybe they’re more the more conversational side. Can you compare and contrast the two harnesses? ‘Cause only you’ve seen it.

Akshay Nathan [00:14:02]: Yeah. I think ChatGPT, the existing harness, like, still exists today. Like, it exists in this app,

Harness Engineering: ChatGPT vs. Codex

Swyx [00:14:08]: The classic, right?

Akshay Nathan [00:14:09]: The

Vibhu [00:14:09]: You just start a new chat, and you don’t go under Work, right?

Akshay Nathan [00:14:13]: Yeah. If you start

Vibhu [00:14:13]: So

Akshay Nathan [00:14:14]: A new chat and go to chat, then you’re, you’re talking to ChatGPT with the instant model.

Vibhu [00:14:16]: Oh, we can technically do another. But on instant.

Swyx [00:14:21]: Yeah. So this one’s not gonna code or it’s gonna be in line. It’s on a in line in a sandbox.

Akshay Nathan [00:14:26]: It’ll

Vibhu [00:14:27]: Oh, that’s cool

Akshay Nathan [00:14:27]: We try to push you to go to Work if you’re creating a spreadsheet. Yeah, but this is

Swyx [00:14:30]: And this is a router decision? Sorry. Is it a router decision?

Akshay Nathan [00:14:34]: This is the decision that, the model is making, and then, like it sees that you’re able to. or you’re trying to do something that would be better served in Work mode. But I think your question was like, what are the advantages of, like, the chat, like ChatGPT chat harness?

Swyx [00:14:48]: It’s more broadly, like, I wanna, do an oral history of harness engineering. Right? the ChatGPT harness lasted us from, let’s call it the ‘01 era, until now, and now it’s being replaced by the Codex harness effectively. And they’re, they’re overlapping somewhat, but I’m curious what changed if there is.

Akshay Nathan [00:15:10]: My perspective on this is, like, there’s, there’s, there’s there’s like a constant process of, like, divergence, convergence, divergence, convergence. And in chat, like, many of the use cases I was talking about before, like, search or learning, I think we’re, we’re really optimizing for latency and optimizing for personality and, like, different things that, over time, like the product The reason people love ChatGPT is because we’ve been optimizing for those things and working on them for so long. Codex, what we learned was that, like, if you give the agent access to this infinitely flexible environment as a computer, it can do really powerful things. And so when we think about, like, okay, well, for knowledge work, like, what is which mode should we choose? It was like it felt more natural to us to bring that to this, like, computer environment and, maybe abstract some of the details of this computer away from users who might not be used to that, but, like, give them that same power. But ultimately, I think that we want the power in all places, right? We wanna meet people where they are. So I’m sure there’ll be work down the road in order to get things to be, equivalently capable in all scenarios. But it’s just a question of, like, what we’ve been focusing on the product on historically and what we’re focusing on now.

Models, Defaults, and the Reasoning Slider

Vibhu [00:16:24]: I think alongside that, outside of just harness and when to use Codex, ChatGPT, or Work, there’s also the new models you’ve released, right? any guidance there? So people love to min-max what to use, like only use Terra on high reasoning versus, for this, you wanna use Sol here, ignore all these

Akshay Nathan [00:16:44]: There’s 32 options.

Vibhu [00:16:46]: But, that being said, for people that are expanding, so, productivity trying stuff for work that don’t have the breakdown of what all this is what’s, what’s the advice, right?

Akshay Nathan [00:16:59]: Well, I think before the advice, like the first thing is, like, none of this would be possible without these models. Like, the, I think you asked earlier, like, what was, like, the inspiration for work and, like, early on, like I mentioned, like, what we were seeing with Codex, but that was also because the models were getting infinitely more capable. That’s happening again. I think it’s like another step function jump now. And to answer the question on advice, like we want this default to be the best possible. Like, we wanna be opinionated about the default, and so we’ve we’ve chosen a default that we think is gonna be the best for everyone. And, we have for power users options under the hood. We could One could argue that there might be too many right now, and we’re, working on simplifying it. But you can extend, the reasoning level, and you can change between the different model classes if you need to, but the default should be the best for most use cases. So my advice to most people would be to stick to that. And then, if you reach a situation in which you think that you could, you wanna try, a different configuration, if you’re not seeing either the efficiency on the cost side or the quality on the intelligence side, then you can change the defaults and see if you can get something better. But we think that the default should be good enough.

Swyx [00:18:09]: I have, I’m just gonna run something by you since you have way more experience than me. I’ve recently been doing Sol Lite but with goal, with the idea that the goal augments the reasoning effort, but with more terminations and turns.

Swyx [00:18:24]: Is that a good way to think about it as opposed to Sol Ultra or Sol, Extra High?

Akshay Nathan [00:18:29]: Yeah. It’s hard to say because

Swyx [00:18:31]: Yeah. It’s like an interaction effect.

Akshay Nathan [00:18:33]: exactly. It’s like there’s a preference on, for you as an individual, like how do you like to collaborate with the models? Like how many of those like terminations, as you call them, do you want where, you can steer or make sure that it’s doing the right thing?

Akshay Nathan [00:18:46]: I think generally people should try whatever works for them. I think that like using Ultra or the like multi-agent setups are best for like when you have like tasks that are either incredibly complicated, like open explorations or very paralyzable. I think even for tasks using goal, I think is best for tasks that you’ll be able to make consistent progress in a way that’s verifiable over time. But I think for most tasks, they don’t fall into either of those buckets. And so like at least when they’re starting, and so that’s why I think the best first step is like trying it with the default configuration and then seeing like where you wanna go from there.

Swyx [00:19:29]: Right. You guys worked on a slider, which is super helpful for reducing the amount of panic.

Vibhu [00:19:36]: It’s nice on mobile at least. There’s a nice slider there.

Swyx [00:19:38]: It’s nicer.

Vibhu [00:19:39]: I haven’t tried it.

Swyx [00:19:40]: So you have the advanced view there, but if you click advanced view. Yeah.

Vibhu [00:19:44]: Ooh, it’s just a nice slider. Yeah.

Swyx [00:19:46]: Very pretty, very colorful.

Akshay Nathan [00:19:48]: Yeah. The idea was here was like reduce it to like one dimension even though there’s multiple dimensions, right? Try to project it onto a single dimension for the user. Like, something from that represents like, speed and efficiency on one side and then like quality and thoroughness on the other side.

Artifacts, Spreadsheets, and the Work Launch

Swyx [00:20:04]: I am just puzzled that it uses Sol so much, like the lower

Vibhu [00:20:07]: No

Swyx [00:20:07]: Grounds I would’ve used

Vibhu [00:20:08]: I think the slider, if I’m not mistaken, is

Swyx [00:20:09]: Terra.

Vibhu [00:20:10]: Oh, it is.

Swyx [00:20:11]: Yeah. See? So they preset Terra to only be the light one. But like I think a lot of people would more people should use Terra. One, because Sol keeps running out of capacity.

Vibhu [00:20:22]: I’m the reason. Here’s ten minutes of our

Swyx [00:20:24]: There you go

Vibhu [00:20:25]: Retirement calculator.

Swyx [00:20:26]: Oh, that’s the Excel thing working for you.

Vibhu [00:20:28]: This is,

Swyx [00:20:28]: Oh my God. Look at that

Vibhu [00:20:28]: This is work, and then Codex is still cooking, so we’ll get back into it. I think it’ll be interesting to see the thought process, the reasoning, and also, this is eight minutes on work. Codex is still cooking.

Swyx [00:20:41]: Yeah. And by the way, so I’ve, do Gabriel Chua? He’s part of the OpenAI Singapore team. He showed me this, and I was like pretty shocked that this looks like Excel. It edits Excel files. You never paid an Excel license, right? Like, but somehow this is like workable and it’s agentic Excel.

Akshay Nathan [00:21:01]: Yeah. one of the big like pushes that we made for this launch was like artifacts, right?

Akshay Nathan [00:21:05]: Like both on the model side, like I think if you compare this with GPT-5.5 and GPT-5.4 before that, you’ll see that there’s been pretty dramatic improvements in the quality of these artifacts and then also on the product side.

Vibhu [00:21:16]: The UX side is also crazy, like hosted sites and whatnot. No longer needing to host your own little webpage, like it

Swyx [00:21:23]: Oh, I have a story about that. I can do, a separate thing. I’ll need to take the visuals here, but we-we’ll, we’ll cut to that later. Was there co-training, because you were moving making this big move and you launched GPT-5.6 on the same day as ChatGPT Work? Was there influence between the model training teams and the harness teams, or did they did the launch dates just happen to line up the same day?

Akshay Nathan [00:21:46]: I think the we collaborate heavily with the research teams, and I think that’s like one of the most magical parts of the job, like the most fun parts of the job. But yeah, just using artifacts as an example. Like, a lot of what you’re seeing, like underneath the hood, there’s a lot of work that went into making sure that like, we had the right infra to be able to train the models to get better at this. And then on the product side, like had the right experience for users to be able to collaborate with the model on an artifact like this. In fact, like this whole viewer, like the intuition here is that like, it’s not necessarily that you wouldn’t need an Excel license. This is stage one, right? Like, this is probably not what you meant when you’re like making a retirement calculator.

Vibhu [00:22:24]: Yeah, you can iterate very easily. Yeah.

Akshay Nathan [00:22:24]: You wanna iterate and like when you’re seeing it, and if this thing is high fidelity to like what you would see in or what your coworkers would see if you were to send this to Sean, like that I think makes it so easier and makes you trust the product in terms of iteration.

Vibhu [00:22:39]: When you say coworkers would see, do you see a multiplayer, multi-team collaboration with artifacts? Any things you guys think about that?

Multiplayer Artifacts and Collaboration

Swyx [00:22:46]: You can already share it, right?

Akshay Nathan [00:22:48]: Yeah. It’s inter It’s something that, we’re actively thinking about. one thing that, we’ve noticed internally without talking too much about the roadmap is that like there’s many times when someone will ping me about something, and I will ask ChatGPT Work the question, and then I’ll ping them back the answer.

Akshay Nathan [00:23:04]: And then I’ll be thinking like

Vibhu [00:23:04]: Like the simplest would be, the three of us are just all on one hosted.

Akshay Nathan [00:23:07]: Exactly. And I’ll think about like was I required in this loop or and then maybe it was, rephrase like what they were asking or pulled from certain context or whatever. But like, when I gave them back the answer, that process was also lossy, right? Like I gave them just like my interpretation of what ChatGPT Work cooked up. But like underneath the hood, there’s so much context like in the rollout and stuff that could be interesting.

Vibhu [00:23:28]: Yeah, it’s

Swyx [00:23:28]: So like the answer was preemptively respond to every inbound request?

Akshay Nathan [00:23:33]: No, it was just like literally like this is what I do sometimes as my job.

Swyx [00:23:36]: I know you copy-paste and then you’re just a message forwarding service

Akshay Nathan [00:23:39]: Yeah. Yeah, exactly

Swyx [00:23:39]: From AI to AI.

Vibhu [00:23:40]: But I think it’s interesting, right? It helps people understand the capability of what you can ask and delegate that oftentimes people don’t realize until they try or someone shows you, and then you’re like, “Oh, okay. Okay, I see.”

Swyx [00:23:52]: I think it’s als there’s also like a, light security issue, where like you’re the permissions layer. Like yes, I could query everything that you query, and I could get an automated response, but maybe I’m not supposed to see it. And that there’s no way I would know because I’m not supposed to know what I don’t know.

Akshay Nathan [00:24:07]: Especially as like, with ChatGPT Work, we’re, we’re asking you to connect your plug-ins and, it’s pulling from your local files and stuff like that. Like the amount of context that the agent has access to is like- Deeply personal and like that’s something I think we need to preserve, so that’ll be definitely a challenge.

Swyx [00:24:22]: There’s Excel, there’s PowerPoint, there’s Docs, the, grand trio of work. What other formats of work do you think about? like you worked on Airtable. Is there a future where there’s like OpenAI Airtable? Like what does that look like if you ever ended up doing it?

Akshay Nathan [00:24:41]: It’s a really good question. I think,

Formats of Work: Sites as Knowledge Artifacts

Akshay Nathan [00:24:43]: one that you didn’t bring up was Sites, and I think that was

Swyx [00:24:46]: Sites

Akshay Nathan [00:24:46]: A core part of this launch. There’s one side of Sites that I think people commonly talk about, especially on Twitter and stuff or X, of like, this like prototyping tool. And like we saw that happen with this launch even. The model slider that you guys were referencing earlier, like that was developed almost fully in a Site. Like, the collaboration between design and engineering and product on that was like on a site where we play with, the affordance and figure out how it feels and all of that. But the other aspect that I think is a little bit less talked about is like Sites as like an artifact for knowledge work. I was talking to someone the other day who’s on like our corporate finance team, and like we were mentioning how like now when they have these reports that they’re, they’re working on as a team month to month, historically those things were in slide decks and in spreadsheets, and now they’re just in Sites. And like Sites is the mechanism that they collaborate across the team. And the reason is ‘cause it’s like, it’s like somewhat higher bandwidth. Like, at these tools like PowerPoint and Excel are like infinitely flexible, but at some point you reach the boundary of like either as a human you may not know how to use some feature or something, or the product itself doesn’t support it. But with a site you can do anything. You ask for anything and you can get that. once people see that magic, I think it’s been really valuable.

Swyx [00:26:02]: Yeah, let me show you my case study. this involves all the hot topics including ChatGPT Work, but also GPT-5.6 token billionaires and token maxing and Sites and auto research. I’m a fan of this game called Strata. It’s, it’s like a little board game that you

Sites, Auto Research, and Research Dashboards

Swyx [00:26:17]: That you play with, physical blocks, that come on top of it like that. So over the weekend I took like thirty photos and just threw into ChatGPT. one point seven billion tokens later, out comes this site with a fully playable thing

Akshay Nathan [00:26:32]: Wow

Swyx [00:26:32]: With 3D, block placement and everything. Because it requires physical blocks and I needed friends to train on it so they can get better, so I can play against them. But also, I could also, do things like train an AI on it and that’s, that

Akshay Nathan [00:26:45]: That’s your auto research

Swyx [00:26:46]: That gets into auto research. So, you want to train your own AIs, and then make sure they self-play against, each other. I need to set both AIs. So this is AI versus AI, and they’re, they’re gonna self-play. the AIs start out bad and then you want to define a loss function and get good. I wasn’t gonna supervise all this. I was at, I was down in San Mateo, attending a conference. What I ended up doing was, auto researching and on this and creating benchmarks and that there was just way too many parameters for me to read. So I started asking it for a site, and it’s created this lab, panel. Where is there a, is there a shortcut for a site that is created?

Akshay Nathan [00:27:28]: You should be able to go in the sidebar to Sites, top of the sidebar. The left sidebar.

Swyx [00:27:33]: This one? Oh, left?

Akshay Nathan [00:27:35]: Yeah. Just scroll all the way to the top.

Swyx [00:27:36]: Oh. Oh, it says Sites. Oh, there you go. Yeah.

Akshay Nathan [00:27:39]: Ooh.

Swyx [00:27:40]: So it create, it creates the sites. I don’t, I don’t think this is, it is exactly what I wanted, but let me show you what it popped up, right? Like I think as a research artifact, it is very important to communicate, exactly, what is being done. Outputs this thing which I eventually started publishing. So I moved it off of Sites because I wanted more, database and infrastructure than Sites afforded me. But this is like a research output that you can start to mess with and like try to think about like what hyperparameters are you tuning for training AIs. And like I was trying to make like scaling laws and everything and doing all sorts of like game optimization stuff. And the fact that you can just throw this up as a research artifact, like I no longer need to read ChatGPT output. I read Site output. But then there’s also a huge sprawl. Like look at how long this thing is. There’s so many numbers. It is pretty overwhelming, so then I have to start pruning it from there. But, it’s an interesting transition from Markdown effectively that you’re putting out to, you’re putting out a whole functional site.

Akshay Nathan [00:28:41]: I think Markdown just isn’t that optimal for people to read, right? Might as well just write HTML website and I don’t know. I think you can do a lot with customizing this, right? You have your skills that explain what you want. Like I noticed they’re quite verbose. I don’t need a lot of this information.

Swyx [00:28:57]: It’s very verbose.

Akshay Nathan [00:28:58]: So and then the nice thing of having a site side by side is, you just iterate on what you want and what you don’t, right?

Swyx [00:29:05]: Yeah. I don’t know if, any that triggers any stories for you of how it’s run internally. Am I doing this right?

Akshay Nathan [00:29:11]: Yeah. I think that this is like a workflow that we’re seeing like all different types of teams use, where like the canonical artifact that was previously a deck or something is now becoming a site. And like with a site you, because it’s just HTML, you can like. It’s infinitely flexible. And so, if you want to give more prominence to a certain thing that like in a slide deck would, feel like it was buried, like you can do that. You can have it be like the hero image, right? And so I think that like, people are starting to see that. There’s more work to be done to make these things like much more easier, easy to collaborate on. You mentioned that they’re very, they’re long and verbose, could be broken up. I’m sure that there’s still something to do there.

Swyx [00:29:53]: They’re super long. Yeah.

Akshay Nathan [00:29:54]: Yeah. But I think we’re starting to see that like there is this aspect of this is a really interesting, format, for people to use, that’s like much more flexible than what they ever had before.

Swyx [00:30:07]: I think your job also comes becomes meta. You’re not designing the products. You’re designing a product to make products, and I’m curious how you manage that.

Designing a Product That Makes Products

Akshay Nathan [00:30:18]: I think one thing that we’ve been Like when we look at the UX, like that we’ve been thinking a lot about is how can we balance like simplicity with capability? Like if we’re designing a product, like you said, that like is made to make up build other things, right? You can build so many different things. But we can’t put that all in front of you because you’ll get overwhelmed.

Vibhu [00:30:41]: Yes.

Akshay Nathan [00:30:41]: And so we had similar problem or similar challenges even Chat-with ChatGPT, but especially now, like when there’s so much that can be done, I think the balance that we’re constantly trying to strike is like, how can we give the user enough of a UI surface where, they can be expressive, they can tell the agent what they need, they can verify that it’s using the right tools, it’s pulling from the right sources, et cetera, but then it gets out of the way. And then how can we build the right system such that we can show them instead of telling them what can be done? Because so much of this is gonna be like, how do they discover the next use case and the next one after that if they really want to be super powered by the AI.

Games, Private Evals, and Show-Don’Tell

Vibhu [00:31:19]: Yeah. It’s interesting. I feel like everyone also just has a different way to do it, right? I made a similar version of this same game. I didn’t take any pictures of board or rule game. I threw in at goal eighteen minutes, fifty-three seconds later, a lot of tokens later, I’ve got a similar version. not with all the auto research and whatnot, but

Akshay Nathan [00:31:39]: You gotta do all the latest trends.

Vibhu [00:31:40]: And yeah, I did it with, did it with Codex, not Work, but it’s interesting, right?

Akshay Nathan [00:31:45]: Yeah. And this is GPT Image generating the pro avatars. Very good for game design. Like

Vibhu [00:31:51]: And

Akshay Nathan [00:31:52]: A lot of game designers were like really into GPT Image for assets.

Vibhu [00:31:54]: I will say like the broader takeaway probably is the reason that we do this is more so just to test the tools, right? Like, this was also a test for GPT-5.6 came out. I had done the game on GPT-5.5, right? The ability for me to no longer need it to. I had to feed it the rules. It’s, it’s a pretty niche game. It couldn’t find how to do this on its own.

Akshay Nathan [00:32:15]: Oh, yeah.

Vibhu [00:32:15]: GPT-5.6

Akshay Nathan [00:32:16]: It is out-of-distribution, which is why I was also very keen on testing the GPT-5.6 capability.

Vibhu [00:32:21]: But, this is just as work comes out, as new things come out, these are just our side ways to test things, right?

Akshay Nathan [00:32:27]: Yeah. It’s some private eval. That is not this private.

Vibhu [00:32:31]: But also valuable because now you can send this to your friends and I learned about this game through seeing this.

Akshay Nathan [00:32:36]: It’s a hard game. He’s very good.

Vibhu [00:32:39]: It’s good to when no one is competing with you. But yes, it’s a classic RL problem of like self-play, bootstrapping your game AI. yeah, you see how easily work becomes personal and personal becomes work because the thing I do for personal, it directly informs people I work with because I showed it to them. They were like, “Oh, you can do that with GPT?” Which like I imagine is the growth strategy.

Akshay Nathan [00:33:02]: Yeah. The show not tell is a big piece that, I think we’ve we’re not still not fully cracked of like, showing people all the things that they can do with the product versus like trying to teach that to them through like, articles or onboarding or whatever.

Akshay Nathan [00:33:18]: So meeting them in the moment.

Vibhu [00:33:19]: It’s a career risk for me, because I used to be in developer relations, right? Where your job is to show, and then you’re like, “What do you mean? You don’t, you don’t need.” your job is to tell. And then. But the product people are like, “Well, we don’t need you if our product is intuitive enough.” So

Akshay Nathan [00:33:37]: Yeah. that’s the magic of the models. So you can tailor the telling or the showing to like specifically what the user needs, like what they care about, what they’ve done in the past, exactly where they are on the adoption journey. So I think that’s like gonna be a super big opportunity.

Vibhu [00:33:50]: Seems easier and easier now to tailor custom showing, right? People have different use cases. As much as you said you don’t wanna segment different people into different buckets, right? It’s also not that hard to for people that are in different categories. But the question, is you said your team is more broadly on. What was the term you used? Productivity?

From Developers to Knowledge Work to Everyone

Akshay Nathan [00:34:12]: Productivity.

Vibhu [00:34:12]: Productivity. So how

Akshay Nathan [00:34:12]: Which is now work.

Vibhu [00:34:14]: Is it work? Is there another distribution that we’re not hitting? Is there a group of people that will have something different than ChatGPT, Codex or Work? Is there more that the mass isn’t targeting?

Akshay Nathan [00:34:28]: I see it as like a sequencing, like. The vision is like bring useful agents to everyone. We started with like developers. Like developers historically are like early adopters that are willing to put up with more friction, set things up, et cetera. Like that’s where, Codex started. I think the next opportunity is like what we call general knowledge work, all the other functions around developers. I think when you go from developers to this segment, like there’s inherent challenges with like, this show not tell thing that we’re talking about, making the product more understandable, bringing in new capabilities that matter more for this cohort than matter for developers, things like artifacts, things like computer use, et cetera. And then I think like the same learnings, like similarly how we took the learnings from developers and brought it to, general knowledge work, the next stage will be like taking the learnings from general knowledge work and bringing it to everyone no matter what they’re doing in their lives. And we’re already seeing that a little bit. Like this game example that you have is, something that’s like on the border of like fun and personal life to, your professional life. I use ChatGPT Work full-time at home for everything, like for whatever I’m doing. I used it the other day to come up with a meal plan and like, save that on the like computer environment that it has and something that I can continue going back to. Like is everyone doing that yet? Probably not because the thing says work on it, but eventually, we wanna get people there.

Vibhu [00:35:51]: ChatGPT life.

Akshay Nathan [00:35:52]: Yeah, exactly. ChatGPT cooking. But I think there’s a lot of, there’s a lot of opportunity there, but I see it as like, we’re, we’re built we built a foundation in software engineering, and we’re gonna take the same learnings that we take from software engineering to knowledge work to everyone.

Vibhu [00:36:07]: Do you have any power user advice? I feel like, there’s a group of people that will live it, use it for everything, stay on it twenty four-seven. And then there’s a bit of a gap between that crew and people that, okay, I use it for work. I use it occasionally. Sometimes I type questions. any advice, any learnings, anything you recommend or just, takeaways that you’ve found that help bridge that gap?

Power User Advice: Push the Frontier of Imagination

Akshay Nathan [00:36:30]: I think a couple things that I’ve seen is like, one, that it really helps to broaden your imagination of what’s possible, and this has been a learning even for me. Like, the technology has progressed so fast that, something that, like, even three months ago, like, no way the models can do this. Like, now it’s like, wow, it’s like it can. Like,

Swyx [00:36:52]: Give an example

Akshay Nathan [00:36:52]: We’re going through right now our, like, review cycle internally, and, people always talked about this as, like, a thing that the models are good at and like, there’s a cliché of like: Okay, like, no one wants to be writing reviews and, like, we just use AI to do it. But in all seriousness

Swyx [00:37:09]: And it can evaluate it as well.

Akshay Nathan [00:37:10]: Yeah, exactly. In all seriousness, before it was, like, just, like, slop and, like, I think it was helpful, but, not super productive. Now I’ve found that, like, the model can do a much better job than me, especially in this environment of, like, pulling context on, like, what people are up to, how they’ve like the things that they’ve done to make a difference, highlighting like, wins that they’ve had that, like, I might may not even have seen. It has access to, like, everything, right? Like the code, like, things that they’ve caught, reviews, Slack, everything. And so it’s, like, incredibly powerful in that domain and, like, just like six months ago, the last time we did this cycle, like, I didn’t even I tried using it, but it was not at all helpful. And this time it’s been, like, incredibly helpful and, like, so I think continuing to push the frontier of imagination of what’s possible, even if you tried something before, I think is maybe the my biggest piece of advice. The other, thing is, like, the more you put in, especially in this environment where, like, the model has access to everything on your computer or in ChatGPT Work, like you can create, artifacts over time and save them in your library and, like, the model will continue having access to those. Like, the more information you give it about whatever domain you’re in, whether it’s your life or your work, the more valuable it becomes, and it’ll become valuable in, like, ways that might surprise you. Like, it might pull from context in a way that, may be proactive and that you might not even have thought about. But it needs to have access to those, to that those tools or that context first.

Reviews, Agentic Search, and Context Gathering

Swyx [00:38:27]: One thing I just wanna talk about the review stuff because I’m still that’s a very sensitive thing and you’re, you’re a founder, you’ve managed people, you’ve hired people. As manager myself, I’m very reticent to put out any LLM-generated things especially when it comes to people, ‘cause it feels like you don’t care.

Swyx [00:38:46]: Presumably at OpenAI, people are more open to being eval rated by GPT. But are there any unofficial rules around this? Like, what’s the etiquette?

Akshay Nathan [00:38:57]: Oh, I think the etiquette is that, like, I would never write something via, like, well, solely via AI and, like, present it as, like, a review for someone. What I was talking about is more, like, gathering context. That’s the place where it’s incredibly helpful.

Swyx [00:39:08]: So it’s just search.

Akshay Nathan [00:39:09]: Yeah, exactly.

Swyx [00:39:09]: It’s agentic search. Yeah.

Akshay Nathan [00:39:10]: It’s like agentic search, but, that you can tailor and steer much more capably than you could before, ‘cause, like, the thing is it’s all there’s a flywheel happening, right? Because of Codex, people are able to do, and because of ChatGPT, people are able to do so much more now than ever before. And if you’re able to do so much more, it’s easy to miss things as well. And so, like, I think we need to use these same tools to keep up with all the impact that people are having and understand, where we can be helpful.

Swyx [00:39:39]: I think the thing, like, I run a small company, so easy to search, but at the scale of OpenAI with the amount of messages that you guys put in Slack, do you think that it misses things?

Remembering What Humans Miss

Akshay Nathan [00:39:50]: Probably, but I think that I also miss things.

Swyx [00:39:52]: Like, it doesn’t matter, right?

Vibhu [00:39:53]: I think sometimes it’s

Swyx [00:39:53]: Like it’s, as it needs to be human-level

Akshay Nathan [00:39:54]: It’s all relative, right? Yeah.

Vibhu [00:39:56]: Sometimes it’s nice when it finds things you wouldn’t, right? Like right now, my Codex system prompts, they’re set up in such a way that every project I have has a secret- separate, notes MD, and it just writes learnings to there. And then the global one can pull from all these. So sometimes it’ll be like: Oh, there’s this project you did like four months ago. Here’s a note that we had, and it randomly pulls it back into context that I would never do, I haven’t thought about.

Vibhu [00:40:20]: And I’m like, okay, this is quite superhuman, right? Like, stuff that would. And, it’ll save like hours on chunking of stuff or find something that’s already been done. I’m like, as much as it might miss stuff, I would too, but it’s very useful when it finds stuff. And I have like a very, non-super engineered solution to this. It’s just marked down files that get pulled whenever they want.

Akshay Nathan [00:40:41]: Yeah. I have a funny anecdote about this. Like, recently gearing up to this launch, the team has been, really cooking on it for a couple months, and over that time, like there’s so much conversation and chatter going on in Slack and Docs and elsewhere. And, one of the members of the team set up this, scheduled tasks, like automation to like look at everything that’s going on and, like, come up with the best memes and then post it in one of our shared channels. And like, there are two cool things about this. Like, the first is, like, I think the models are, over time, like starting to become like funny.

Swyx [00:41:13]: Funny. Nice.

Akshay Nathan [00:41:13]: Whereas like, a year ago, like that was not at all the case. The second is, it was what you were saying, like they find things that in surprising ways that you may not have thought of and like create connections that you may not have thought of. And that really helps with like the meme generation because then you can see something that, genuinely surprises you and, is funny in that way. So yeah, that’s like not like the most productive, use of this the technology, but it does it does uncover this, like this capability that’s emerging, which is just like to find information that you otherwise would not know of.

Launch Momentum and the 10 Million User Milestone

Swyx [00:41:43]: Talking about the launch, I think, I have pretty much said this is the most successful launch in a long time. I think even more successful personally than 5.0, and they’re announcing ten million users. Does it feel different? You’ve been through a lot of launches.

Akshay Nathan [00:41:58]: I think it feels like a culmination. Well, I think two things. One, it feels like a culmination, like I was mentioning earlier, like this like vision mission that we’ve been on for a long time. Like I said, we saw the magic of Codex internally, and then we’re like extremely excited to bring this to many more people and to see it working, to like see us reach, the distribution goal, numbers that you mentioned, like I think that’s like huge and super exciting. The flip side of that is like, there’s so much more to do too. Like, that’s also really exciting. Like, ChatGPT as a whole, like the this product that, everyone almost equates to AI and like loves, has hundreds of millions of users. And so like ten million is really cool, but like we need to get this to everyone. Like, we need everyone to feel this magic. And so that’s the next step from here. But yeah, I think extremely pumped about how it’s going so far and the opportunities.

Swyx [00:42:46]: Awesome. I did want to also Because I’ve, I’ve, I’ve been tracking the number closely, it transitioned at some point from just Codex users to Codex plus ChatGPT Work, because they’re same harness. The whole point is that you don’t, you can’t, count them separately. Do you have roughly a billion, ChatGPT users? Why did it just jump to one billion right away? Like, isn’t that the default on ChatGPT or no?

Codex, ChatGPT Work, and the Developer Brand

Akshay Nathan [00:43:11]: We don’t default you into ChatGPT Work if you’re on ChatGPT

Swyx [00:43:14]: If you’re free. Yeah

Akshay Nathan [00:43:15]: It’s also only available to paid users right now. And I think there’s like a process of, educating users of what is the value of this product, having them try it, learning from their feedback, and making it better over time. But the goal is to, get as many of the people who love ChatGPT today to like feel the power of ChatGPT Work. But I think it’ll be a journey.

Swyx [00:43:36]: Yeah. And Codex will still be alive as a brand for the foreseeable future. And we’ll just toggle between them as needed for UI stuff.

Akshay Nathan [00:43:44]: Yeah, I think it’s even stronger point than that. Like, I think we fully intend to like, treat developer. Like, developers have been, a core market for us for so long, and like there’s, there’s so much more that we can do to make Codex great specifically for, software development, and we’ll continue to do that. This doesn’t take away from that at all. If anything, it should increase the utility of something like Codex, because now you can move seamlessly between writing a diff to creating an artifact or, doing a search over your factor.

Swyx [00:44:11]: I do wonder how much this terminology leaks to the non-technical user. Like, do they have to learn to say artifact if I want artifact? Or.

Akshay Nathan [00:44:20]: It’s funny, like we call it artifacts internally ‘cause that’s what the teams call it.

Swyx [00:44:23]: It’s nice. Yeah.

Akshay Nathan [00:44:23]: But like externally, like no one says that, no one calls it an artifact. But I think that people like often, like describe things, whatever they’re used to, right? So if, ChatGPT Work is good at creating slides, they’ll say ChatGPT Work is good at creating slides, and that’s what we want.

OpenClaw, Personal OS, and Persistent Computers

Swyx [00:44:38]: One big Another, it’s July of twenty-six. One big thing that also happens in, for OpenAI was OpenClaw, and that’s I think a lot of people’s first time really maxing a agent for personal stuff, but also crossing over to work in essence same way. As far as I understand, OpenClaw is still independent, but did you go through your own OpenClaw moments? Were there any lessons you took from OpenClaw to Codex or back? Whatever.

Akshay Nathan [00:45:06]: I think there’s a lot of inspiration. I did go through my own OpenClaw moment. I,

Swyx [00:45:10]: Yeah, tell the story

Akshay Nathan [00:45:10]: Me and my wife like set up an OpenClaw to like try to manage everything in our house. Not that there’s like a ton, but it was like quite useful. We gave it a calendar. It started, creating events for us and stuff. At some point, the laptop that we were running on, it died and never got a chance to pick it back up. But there was a lot of inspiration there, like, in ChatGPT Work, in web and mobile, like you get access to this like persistent computer environment where, you can store files, and those files stay around between sessions. And the idea is to be able to enable use cases like this. one of the members of our team uses ChatGPT Work for what they used OpenClaw from before, and then feel like it has like completely transitioned, which is like, workout planning and like meal tracking. which again, it’s like a work-related thing, right? It’s like not work necessarily, but it’s like in personal productivity space. But it has all the same primitives. So it has scheduled tasks. It has the ability to store files on a file system. It has the ability to like reference those things over time. And so you start to see the same types of use cases emerge, which has been really cool.

Swyx [00:46:14]: Is there a point that ChatGPT Work completely replaces OpenClaw? they’re independent, so.

Akshay Nathan [00:46:20]: Yeah, I’m, I’m not close to it, so I can’t speak to the OpenClaw roadmap, but I don’t think so. I think that there’s gonna be, there’s always a need for like this like incredible, like open source technology that team has built. And I think that we can draw inspiration, in the product and, ChatGPT, I think many more people have like heard about and used ChatGPT than have used OpenClaw. And if we can take the magic from OpenClaw and bring it to them, I think that’ll be a success. I think that like one thing on the ChatGPT Work side that we feel strongly about is that like the core experience is that you come to this product and you have a conversation, start a session, whatever you wanna call it, with this agent. And the magic of the product is that you can do anything in that moment. And we would like to create a product where you don’t have to click a button or to go to a different place, whatever, and you can get whatever functionality exists in, your finances app or where or any other product like in this one place. And so that’s the goal. It’s like it we want an extensible system with plugins where you can connect to the tools that you need in order to be able to accomplish like a financial task, where you can, if you’re doing like science work, like we have an ability to like extend the system in such that you can like write the tech and it performs well. There’ll always be like products that we support that are best in class at those things, but we want as much of the magic as possible in that core experience.

Swyx [00:47:45]: Yeah. Do you think that you can do everything you used to do with Wealthfront in ChatGPT Finance?

Finance, Data Access, and Centralized Context

Akshay Nathan [00:47:50]: I tried it. like ChatGPT doesn’t yet custody, cash and assets for me. So that part, no, not yet. But I, there was like a whole component of like retirement planning and, like financial planning and budgeting and stuff that, we were looking into when I was there. And like with the finances plugin, like that’s all possible with ChatGPT today. So, I feel like at least that component’s replaced for me.

Swyx [00:48:17]: I haven’t really plugged it in yet. I’m somewhat scared to look at the answer. Like that’s honestly like the same reason for health and finances. Like I’m like, no.

Akshay Nathan [00:48:27]: It’s really good. It’s really cool how we were talking about like the agentic search aspect a little bit earlier, but like, it’s really cool how like, in conventional UX, like if the more power you wanna give to a user, the more like knobs and bells and whistles you need to add. Like, for like these finance and budgeting apps, like there’s always like a bunch of the different filters and like search bars and stuff like that. But like now, like with the right

Vibhu [00:48:48]: Connect-connectivity to the right data, you can have whatever you want. You can ask any question you want and into that box and get the answer, and I think that’s super powerful.

Akshay Nathan [00:48:57]: I think it’s also nice to just have it centralized in one space, right? You have different health apps. I have one for a smart scale, a watch, all these different things. It’s just nice to centrally co-locate it.

Vibhu [00:49:08]: Which is, part of the whole thing of OpenClaw, right? Like that you would have, personal OS, which presumably ChatGPT wants to become. I do think that just relying on, like, just-in-time pulling of data for, let’s say, through via MCP, CLI, API, whatever you do, still not enough. Like I come from a bit of a data engineering background, like you still want like a data warehouse or some caching or semantic layer. do you feel that or do you already have that?

Akshay Nathan [00:49:40]: I can’t speak to like all the details on how everything works, but I think it depends on the access pattern, right? Like if you want an answer immediately, then yes, it’s very difficult to do that if you need to pull from all of these sources. But a lot of the like use cases that we wanna enable in ChatGPT Work aren’t necessarily something that you need immediately. It’s more like a task that you want the agent to go and do, and that’s gonna take a certain amount of time. And, with things like programmatic tool calling and stuff now, like some of that time and sub-agents and stuff, like some of that is also parallelizable. And so it’s possible I think it’s very possible that there’s a, the ceiling on what can be done, with MCPs and like calling out to these third-party services has been raised substantially. So we’re really excited about that.

Sub-Agents, Ultra, and Product Design Tradeoffs

Vibhu [00:50:23]: You mentioned sub-agents. I gotta double-click on that. Ultra is a new mode. You have special affordances in ChatGPT itself to show off the agents. Can’t really do much with them, to be honest. Like just watch. what have been, what have been your experiences, any design issues that you would call out to other builders building with sub-agents?

Akshay Nathan [00:50:45]: I think it’s goes back to the balance that I was raising earlier about like, showing builders the power of the tool, but also creating enough of an abstraction to not overwhelm them. I think with sub-agents, the thing that we wanted to show is that you can take a task that, has many parallel tracks or, is complicated in a way that, sub-agents can handle, and this product is for you. Like, the model can accomplish those goals or try to accomplish those goals. And so like that’s the point of like showing them in the product and that’s where we-we’ve gone with the design. There’s another, iteration of this where like you can see exactly what they’re doing and things like that, which I think is like, could converge on like overwhelming, with information. And so this is like the deliberate trade-off that we made for now.

Vibhu [00:51:33]: You do display quite a lot of transcripts.

Akshay Nathan [00:51:35]: Right. Right.

Vibhu [00:51:36]: Or do you

Akshay Nathan [00:51:36]: I think it’s hidden by default though, right?

Vibhu [00:51:37]: Do you want to display more than that?

Akshay Nathan [00:51:38]: No, it’s hidden by default. Yeah.

Vibhu [00:51:39]: Some people could want more. So I’m one of those people that will throw a lot of stuff at goal, and pretty much every goal I’ll tell it to use sub-agents. Seems redundant, right? But every time I’m like, “Okay, use sub-agents where possible.” And I have a lot of people, a lot of friends that recommend and do the same. Whereas I’ll sometimes talk to people that are like, “Okay, this is where I want you to use sub-agents for this sub-task,” and I’m sure they would appreciate seeing into how they’re being used. For me, it’s primarily like two things, right? One is net time efficiency, so span out across sub-agents. Two is probably cost, right?

Vibhu [00:52:15]: Don’t use big, expensive model. Offload to a lot of smaller, cheaper models. And some people want that level of control. So if you have repetition in what you’re doing, right? Say I want something built where I want it to consistently do this every day, I might wanna go in and fine-tune sub-agents here, sub-agents there. So you can see both, but I think if I’m not mistaken, it’s hidden by default. There’s a dropdown that goes a lot where I’m like, okay I’m just gonna keep, using.

Akshay Nathan [00:52:41]: Oh, you can change the model that they use.

Vibhu [00:52:42]: I know I tell them to be steered. I’ll say my I know Anthropic offers this in Cloud Code. You can tell Fable to use Sonnet or Opus to use Sonnet as sub-agent, so pretty trivial thing. You tell it to span out sub-agents with Sonnet, it’s cheaper, faster. I would assume if it’s not there, it could be built there. But I think there’s a side of

Akshay Nathan [00:53:02]: It’s too many toggles.

Vibhu [00:53:04]: It’s not a toggle. It’s just, you tell it in chat.

Akshay Nathan [00:53:07]: You’re prompting it. Yeah.

Vibhu [00:53:07]: The way I do it is prompt it, right? And I think this is something that gets abstracted unless it’s something you built for repetition, right? So if I’m building something, say that’s, podcast prep, right? Research into people, do a very deep extensive research, that I might wanna configure to cheaper, faster model just for web search, right? I can see a world in which you want both. I think the default is pretty good right now, where it’s hidden, but you can drop down and get some more info into what’s done.

Vibhu [00:53:34]: I know people talked a lot about it on GPT-5.6’s launch. this thing loves to use a lot of sub-agents and causes the ChatGPT app to just crash because it’s so processor-heavy. But,

Akshay Nathan [00:53:47]: For what it’s worth, that’s not my experience. Yeah, I haven’t had a crash from sub-agents.

Vibhu [00:53:52]: I haven’t either. I have We both have big laptops. But I know people brought it up. There was a topic of discussion that we didn’t see the same, but it is another vibe eval, right? People are like, “Okay, the amount of sub-agents Sol is wanting is crazy.” And I’m like, “I think this is okay. I think it’s good.” But just stuff people bring up.

Akshay Nathan [00:54:12]: I think when we launched the product too, we weren’t as opinion about like who is Ultra for and like when should they be using it. And since then we’ve made some changes to like, require you to turn it on and find it in the advanced setting ‘cause that’s who it is for. It’s for like power users who understand what’s gonna happen because it also, depending on your use case, can use more of your limits as well.

Vibhu [00:54:33]: Yes.

Akshay Nathan [00:54:33]: So that’s where I think a lot of the feedback was coming from.

Vibhu [00:54:36]: It’s okay. Reset the limits. Always reset the limits.

Akshay Nathan [00:54:39]: Well, it’s, today we’re resetting because of this. I wanna change topics to one last piece of the harness, memory. A lot of people are commenting on memory recently. ChatGPT’s new memory system used to suck, it’s not very good. And then this guy also the same thing, and Samir, who you presumably work with

Memory, Chronicle, and Personalized Context

Akshay Nathan [00:54:55]: Talking about memory. What can you say there? I think that, Samir and the team have made a ton of and then the research teams have made a ton of, updates and improvements over time. I think when I talk to friends, family members about what they love about ChatGPT, like the fact that it knows them, that they feel like their ChatGPT is their ChatGPT, I think comes up probably number one. In ChatGPT Work, in the Cloud, like by default, all conversations like inherit from your ChatGPT memory, so you’ll know they’ll know context about you, and they’ll also be able to write back to this memory.

Vibhu [00:55:27]: With it, like a small text write. Like you tell me when you’re writing, right? Is it

Akshay Nathan [00:55:31]: No, it’s part of the same like memory V3 system that we launched.

Vibhu [00:55:36]: Yeah, Memory V3, yeah.

Akshay Nathan [00:55:37]: So I think that’s been really powerful because, going from ChatGPT to ChatGPT Work feels like an extension of what I’ve already been doing with the product for sometimes many years. So that’s been awesome, and it’s awesome to see that like people are recognizing the improvements here.

Vibhu [00:55:51]: Is there So it’s a retrieval problem, right? Like, are you retrieving the right things? Are you over-focusing on the wrong things? Is there like a more false positive or false negative, if that makes sense? Like, what’s the bigger problem?

Akshay Nathan [00:56:05]: So I don’t work on memory directly so it’s hard to say what the bigger problem is with like certainty. But I think you’re right. I think that like, the there’s two sides of it. It’s like, making sure it knows things about you, but then also having the EQ to like bring those things up at the right moments proactively or surprising you in ways that are positive, not negative.

Akshay Nathan [00:56:21]: So I think it’s a very challenging problem, but something that I think we feel very there’s a huge opportunity to get right, which is like why we’ve made like big investments in it.

Vibhu [00:56:29]: How do you see the side of, okay, when you’re building ChatGPT for work different than the regular chat app, different than Codex, managing memory across different projects, collaboration and whatnot, how do you see the side of what’s separate from the harness, right? So if I have four threads on one project any learnings on how to build memory systems there? For background as well, to steer it a bit, is when you do chat style applications, I’d say you have a lot of one-offs, right?

Vibhu [00:56:58]: When you switch to work it might be something you’re doing for a month, something you do a lot, right? Now, as I add more sessions, there’s a lot more than just single-threaded, right?

Vibhu [00:57:08]: And there might be memory there.

Akshay Nathan [00:57:10]: I think first I challenge that like the depth of the memory or the like value of it is like fundamentally different across chat and work. Like it is true that like, there are a lot of like shorter sessions on chat, but I think, the ChatGPT, the product has had like a ton of longevity, in, as long as this technology has been around and people use it for work-related, like productivity-related things already today. And so I think we found that there’s a lot of value. I found this my personal usage, like all these one-offs add up over time into something like quite durable and like quite a good representation of who I am. I know like from time to time, something will go viral on X about like, ChatGPT telling you everything it knows about you, and people are always surprised like how deep that is.

Vibhu [00:57:55]: The fun roast me?

Akshay Nathan [00:57:57]: Exactly. So like, I think like the That’s all to say that like I think there’s a lot of depth there in the existing, ChatGPT product, and so that’s why I think we think it’s valuable to bring into the work product. But the other reason I brought that up is because I think like hopefully we can use some of the same fundamental primitives and systems to extend memory here as well, and I know this is something that the team that focuses on this is like working through right now.

Vibhu [00:58:20]: I wanted to bring up one element of memory, which I honestly don’t really use much, and I’m curious if you do: Chronicle, which was, is up on screen right now. It’s a super memory or like what is it?

Akshay Nathan [00:58:33]: I think the idea is that like it can learn from, how you’re using your computer and like it’s another input source, into memory. And, I think it’s, experimental right now and something that like isn’t default off. But I’d recommend that you try it. I think that it’s like quite interesting how It goes back to a conversation we were having earlier on like, you were asking like, “Does it Can ChatGPT miss things?” Like does it, on Slack, when it’s searching, does it miss things? ‘Cause there’s such a volume of stuff, right? And like it’I, you can ask the same question about like everything that you’re doing on your computer. Like, is it gonna know everything that you’re doing? Is it gonna capture the intent and stuff like that? Probably not, but like it probably will find things that you might not know about. And then if it can surface those to you in relevant times, in proactive ways, like when you’re doing tasks, and I found at least that it can be quite helpful. So it’s worth trying.

Vibhu [00:59:24]: So mostly for insights and longer term.

Akshay Nathan [00:59:27]: Yeah, exactly. Like insights and it builds context that makes, that can make you more productive on certain tasks. But it’s, it’s hard to describe without feeling it.

Vibhu [00:59:37]: I will say you can feel it pretty well. Like the idea of what they’re saying here, right? Just check through my memories or check through my logs and add skills. Pretty underrated, right?

Akshay Nathan [00:59:48]: But that’s automations. You can repeat that using a cron job. Checking through your memories and creating skills. But I think the creation of the memories from Chronicle itself is like what’s different. It’s like you have much deeper memories because you have Chronicle on.

Vibhu [01:00:01]: It’s there. I don’t use it much, but maybe I just, I need more examples. I imagine you guys use a lot of it internally, so I’m always fishing for use cases.

Akshay Nathan [01:00:10]: I would just try turning it on and then like

Vibhu [01:00:13]: It just auto works? Like it

Akshay Nathan [01:00:14]: Yeah, and seeing like where it might start helping you. I think you’d be surprised.

Vibhu [01:00:18]: Yeah. Amazing. I think that was, about it in terms of like the overall, coverage of ChatGPT Work. I think there’s been a lot of like good progress and discussion on building and all these things. There’s a lot of like ex-founders in the community, in OpenAI as well. Do you think that things have changed a lot? like your overall reflection of building, pre-AI and post-AI.

Akshay Nathan [01:00:44]: I think things have changed a ton. I think it’s like super exciting to see how quickly you can go to, from idea to something real today. whereas like even before, like I think, five, 10 years ago, like it’s fast if you were scrappy and, like, willing to build the minimal viable thing. But, like, now the extent of what you can build is, like, much broader. And I think that also, like, what we’ve seen internally building is, like, that gives you an opportunity to validate much more quickly, to talk to users, to talk to internal doctors, et cetera, and, like, make sure you’re on the right track. And, like, that loop I think has been has become more closed than ever before, and that’s, like, a win for product development. I think it’s a win for consumers and users too because ideally that means they’re getting much more better much better products out the gate.

Building Before and After AI

Vibhu [01:01:32]: Does it mean your teams are smaller?

Akshay Nathan [01:01:33]: I think there’s much more to do now. So I think people can accomplish more individually or in a small team than they were that would require more people than before. But there’s, at the same time, there’s also more to do, so I think the teams are much more ambitious.

Vibhu [01:01:50]: Have you seen any changes in scopes of roles and building teams and how we used to have teams, say, a few years ago versus what ideal teams look like now?

Akshay Nathan [01:01:58]: I think we’ve seen a blurring in the lines between, like, the typical product development functions, like between, like, EM/PM, engineer, designer, et cetera. Like

Vibhu [01:02:08]: Yeah, I wanna bring up this quote. There will be, only four jobs left in tech. There’s AI slop cannon, the people who just, like, they’ll burn a bunch of tokens. And then there is SRE, the people who. people who are more responsible. There’s grown-ups who sell things, and then there’s hot people.

Akshay Nathan [01:02:27]: This is an interesting take. I think my suspicion is that there’s everything everyone will be, like, shaped in a way, in that, like, AI will enable everyone to become a generalist. Like, things that, like, I never would be able to, like, come up with a design before and, like, even now, like, I don’t have maybe, like, the visual taste required, but I can iterate on something with the help of AI. But then people will have a specialty, and that’s, like, the straight line in the T or the upward line in the T. And so, like, you can have a specialty that you’re interested in. With the help of AI, you can go deeper and become better at over time, but then you’ll also be a generalist. And so with that foundation, the way you can accomplish is, like, almost limitless.

Team Shape, Shaped Builders, and Taste

Vibhu [01:03:07]: What are you bottlenecked by in terms of specialties? Like, do you need more designers? Do you need more slop cannons? Do you need more hot people?

Akshay Nathan [01:03:15]: I think the bottleneck some becomes, like, ideas and taste. I think because anyone can build now, I think, it really is the era of, like, bottoms-up ambition. And because there’s so much to be built, like, you’re always gonna be bottlenecked by, the amount of ideas and amount of things that you’re doing at any given time.

Vibhu [01:03:37]: Do you think models help solve that?

Akshay Nathan [01:03:39]: Models?

Vibhu [01:03:40]: Yeah. I have the example of, like, I have a front-end design skill that’s like, they give me four drastically different examples of what this looks like. Sure, it burns a lot of tokens, but. And then I’ll mostly just condense down, “Okay, I like this part. I like this part. Let’s draw these together.” And it’s like, yeah, I had a vision, but, like, I don’t know.

Akshay Nathan [01:04:01]: I would say that the one automation that I would love to work and it doesn’t work is bring me new ideas, right? somehow LLMs are just not it. One interesting part about ideas is, like, they’re not, like, in a vacuum. It’s, like, not. They usually come from somewhere and, like, in product development, like, they’re coming from talking to users or reacting to, friction that you’re seeing or feedback, building on some foundation that you already had planned out before, whatever. And so I think that’s where, like, I think there will always be value in these, like, generalists that we talked about, like, closing that loop and then having coming up with those ideas that are grounded in that feedback or talking to users, whatever it is.

Defining and Measuring Productivity

Vibhu [01:04:41]: Cool. You were gonna. You lead the productivity team. How do you define productivity?

Akshay Nathan [01:04:46]: I think our mission is to make it possible for people to do things that they weren’t able to do before. And right now we’re thinking about it from the perspective of knowledge work. And so when I look at knowledge work, I think about people are no longer siloed by their roles. They’re no longer siloed by maybe the, background or training that they have. Like, no matter what function you’re in, you can suddenly build things. You can suddenly get access to data that you otherwise might not be able to interpret, et cetera. And then I think that extends to your personal life, where we want to give you leverage at the end of the day. Like, we want the models and the product to be able to give you leverage so that you can, create time for yourself to do the things that you love.

Vibhu [01:05:25]: Does that also translate to a way to measure productivity? Like, what is new?

Akshay Nathan [01:05:29]: The end is

Vibhu [01:05:30]: How do you measure leverage?

Akshay Nathan [01:05:31]: I think we haven’t figured this out yet. Part of the reason is it’s so diverse. Everyone has different goals, and really the true measurement is, like, their ability to achieve that goal. Did we help you or did we not?

Akshay Nathan [01:05:44]: And it’s very difficult without knowing what that goal is up front and also tailoring it for every individual.

Vibhu [01:05:48]: And the thumbs up and thumbs down from ChatGPT doesn’t give you anything, right?

Akshay Nathan [01:05:52]: You don’t know if they’re thumbs downing the content of the answer, the vibe of it

Vibhu [01:05:56]: Oh, yeah

Akshay Nathan [01:05:56]: Whether or not it helped them with their goal. I think that’s difficult. But it’s something that I think we will need to figure out and the industry at large will need to figure out because, that’s how we measure success, if this is what we’re, we’re

Vibhu [01:06:06]: Do you think it’s changed, productivity and how you measure it? you said there’s a lot more work that can be done, a lot more scope. has it changed?

Akshay Nathan [01:06:15]: I think it was always true that what you really wanted to measure is, like, was your team, was the individual, were you personally able to hit the goal, or are you closer to hitting that, whatever your goal is, right? But I think previously we used proxies for this. So, like, code commits or

Vibhu [01:06:31]: Lines of code

Akshay Nathan [01:06:31]: Lines of code or whatever.

Vibhu [01:06:33]: Story points.

Akshay Nathan [01:06:34]: Yeah, exactly. Story points. And, like

Vibhu [01:06:36]: They’re coming back, by the way.

Akshay Nathan [01:06:38]: maybe. But that is for a part of the change. And, like, I think with AI now, those proxies starting to fall apart. Like, you, the number of tokens you use or the number of pull requests you make are, like, no longer, like, maybe as hypercorrelated with that, is your team able to hit the goal or are they on track to hit their goals? So I think we’ll need to come up with new, measurements.

Vibhu [01:07:02]: For the managers listening, give them one thing to try.

At-Bats, Motion vs. Progress, and Closing

Akshay Nathan [01:07:06]: I think for me, what’s important is like at-bats. Are we as a team building the muscle to have not just quantity of at-bats, but quality? Like, are we able to go all the way from, like, generating an idea, building it out, getting the feedback, reacting to that feedback, validating or invalidating the hypothesis, going on to the next idea? Are we able to do that really efficiently? And like, that goes to like, the actual like code that’s being written or the designs that are being made or the specs that are being written, whatever, but also the culture of the team. Like, do we have the humility and, are able to like go through that process many times and stay motivated and excited throughout that? so that’s the thing that like I think is important now, especially when we’re on the frontier of this technology and like there’s so much to build, there’s so much to do. That’s probably the most important thing that we look at.

Vibhu [01:07:54]: Any traps people fall into around measuring productivity with your teamwork on. I feel like there’s a lot of, okay, we added a lot of LMs. We have dashboards for this and that, but not much has changed, right?

Akshay Nathan [01:08:06]: That is the trap, yes.

Vibhu [01:08:09]: And the broader source of the question is for the managers and teams building, how should they approach this?

Akshay Nathan [01:08:18]: I think maybe the trap is like conflating motion and progress. I think motion is much easier now than ever before because of the tooling that we have. But progress requires you to be like very prescriptive and deliberate about like what you’re trying to achieve, and it goes back to our question of measurement, right? Like you wrote we were talking about like, can we, OpenAI, like figure out how to measure productivity for our users? That’s, that’s a very hard problem because of the diversity. But like as a team, like you should have a really prescriptive and deliberate view on like what progress looks like for you and for your team. And if you don’t have that, then it’s very easy to conflate these two things.

Vibhu [01:08:57]: I think at-bats is a really great thing. I’m, I’m really glad. I like the discussion between motion and progress. I think that’s a quote that we’re gonna feature on the write-up. You’ve been very generous with your time. Thank you so much and congrats on ten million.

Akshay Nathan [01:09:08]: Yeah, thank you for having me.

Vibhu [01:09:09]: The next one at a hundred in two months. Two weeks. Thank you.

💾

Every major security vendor now has an AI copilot, but Mate Security thinks they’re solving the wrong problem.

The Tel Aviv-based startup announced on Tuesday it has raised a $35 million Series A led by Canaan Partners, with participation from Insight Partners, Team8 and M12, Microsoft’s venture fund, just eight months after closing a $15.5 million seed round. Mate’s pitch is that security operations need more than an LLM bolted onto a SIEM; they need a new architectural foundation built around AI.

That’s a bold claim in a market dominated by the likes of Microsoft Security Copilot, Google Security Operations, CrowdStrike Charlotte AI and Palo Alto Networks Cortex AI, all of which promise to help analysts investigate alerts faster. Mate, however, is betting the real differentiator isn’t a smarter assistant but a richer understanding of the organization itself.

Central to that vision is what Mate calls its Security Context Graph, a continuously updated model of an organization’s assets, users, business processes, and data that AI agents use to investigate alerts and make decisions with far more business context than a standalone LLM can provide.

Mate’s pitch is that security operations need more than an LLM bolted onto a SIEM; they need a new architectural foundation built around AI.

Mate CEO and co-founder Asaf Wiener tells The New Stack that the company launched with that intelligence layer, but says the product has evolved significantly over the past eight months.

“We started with the intelligence layer, the context layer that we built for enterprises in order to investigate alerts and incidents,” Wiener says. “We moved forward into the detection layer to connect the two, and now we’re heading to the security data sources.”

Mate calls the architecture Continuous Detection, Continuous Response (CDCR), linking detection and investigation so each continuously improves the other.

“We’re connecting between those two layers in the security operations center,” Wiener says. “With this architecture, we’re seeing amazing results related to the quality, accuracy and precision that we can get.”

Mate says the extra context helps its agents work out whether something that looks suspicious actually warrants attention. A burst of failed logins, for example, might look like an attack until the system spots that a security test was scheduled for the same time. Similarly, a large download of sensitive files takes on a different meaning if the employee involved is about to leave the company.

That approach appears to be resonating. Just eight months after its seed round, Mate has landed a $35 million Series A, a pace Wiener says reflects customer demand more than fundraising momentum.

“The pace is really crazy. We didn’t expect that,” he said. “We saw incredible traction with our customers. We’re talking about Fortune 500 companies, and revenue growth of more than 500 percent since Q3 2025. That’s what led those VCs to come to us and want to be part of the journey.”

“We’re talking about Fortune 500 companies, and revenue growth of more than 500 percent since Q3 2025.”

“What we are seeing is more and more data sources that we need to protect. Every employee in the organization can build new applications and new data sources. We need to build more detections for those risks, and the result: We need to investigate an increasing number of alerts every day.

“With human staff alone, we cannot handle it,” he says. “We need technology to let us scale.”

That challenge isn’t unique to Mate. Every major security platform is trying to give AI more context about the environments it’s protecting, albeit in different ways. Microsoft builds Security Copilot on telemetry flowing through Defender and Sentinel; Google ties Gemini into its security operations platform; and CrowdStrike’s Charlotte AI draws on endpoint and identity data already stored in Falcon.

Mate wants other vendors’ agents to work with its Security Context Graph, rather than keeping the technology confined to its own tools. Those agents would have access to the same information about the customer and its environment. Mate says they can remember previous investigations, while a “least-agency” model restricts what each one can see and do.

While Mate is still building out that vision, Wiener said the speed at which large companies have bought into it has caught him by surprise.

“What I’m seeing right now is that we’re doing those sales cycles in a few weeks,” he says. “That’s incredible.”

He attributes that acceleration not just to security teams, but to executives pushing AI adoption from the top. “It’s amazing to see that coming also from the board level, the CEO and the CIO that are pushing organizations to leverage this kind of technology.”

The fresh funding will primarily go toward expanding both the product and the team, although Wiener says an AI-native company scales differently from traditional software businesses.

“The plan is to double and triple the size of the team to address the demand,” he says. “But our AI builders can do much more today with the technology around us.”

Mate is still competing against security giants with deeply entrenched platforms. But if its early customer growth is any indication, investors are betting that the next generation of security operations will depend less on adding another AI assistant and more on giving those assistants a deeper understanding of the businesses they’re protecting.

The post Mate Security bets a context-first AI architecture can reinvent the SOC as it lands $35M Series A appeared first on The New Stack.

Cyera and Oasis: Stronger Together

Danny, Amit, Yotam, Tamar, Yonatan and their teams are joining forces to build a complete security platform for the age of AI.

By Bogomil Balkansky and Doug Leone

Published July 28, 2026

In 2021, before Oasis Security was even founded, I sat down with co-founder Danny Brickman and came away thinking he had something familiar. He showed the same drive we’d seen in the founders of two other Sequoia companies, Wiz and Cyera, whose founders, like Danny, had come up through Talpiot, the leadership program of the IDF. I wrote about that meeting a couple of years later in my investment memo, when we backed Oasis Security, at the Series A. I didn’t realize at the time how literally connected that comparison would turn out to be. Today, Oasis is joining Cyera — and it turns out the founders’ stories make the case for this combination almost as well as the technology does.

Three years ago, the pitch for Oasis was simple: enterprises were about to have far more machine identities than human ones, and almost nobody had a real way to manage or secure them. That was true then. It’s far more true now. Every AI agent creates or uses non-human identities — API keys, service accounts, OAuth tokens, agent-to-agent credentials — that act with real permissions and real blast radius, and that don’t behave anything like the human identities the last generation of identity tooling was built around. AI drove non-human identity from a niche IAM subcategory to a board-level CISO conversation. Danny Brickman and his co-founder Amit Zimerman built Oasis, which they call agentic access management, for exactly that world.

Cyera arrived at the same shift from a different direction. Yotam Segev, Tamar Bar-Ilan, and Yonatan Itai built the company to answer a deceptively simple question: where does an organization’s sensitive data actually live, who can reach it, and what’s really at risk? As AI agents started reading, writing and acting on that data, they reached a conclusion that now looks obvious: securing AI means securing the data, the identities acting on it (human and non-human), and the agents themselves.

Put the two products side by side, and they complement each other perfectly. Cyera knows where the sensitive data is. Oasis knows who or what can actually touch it — every service account, API key and agent credential, and whether it’s behaving the way it should. It’s a bit like a bank vault: the best way to protect it is by knowing both what’s inside and who’s approaching. Data security tells you what’s actually at stake. Identity security tells you whether the thing touching your data is legitimate. Together, the two products cover the entire path an AI agent takes through a company’s environment, from the data it touches to the identity it uses to touch it.

There’s a practical case here too. Cyera has built one of the most powerful enterprise GTM teams, with the kind of scale that usually takes a startup a decade to reach. Oasis’s product now gets to run through that engine, into enterprise accounts it would otherwise have taken years to earn on its own. And the market isn’t waiting: Whoever builds the first genuinely complete AI security platform, spanning data, identity and agents, has a real shot at becoming the default layer enterprises standardize on as agentic AI rolls out. Speed and completeness both matter, and the combination of Cyera and Oasis creates both.

The founders’ backgrounds make the fit feel almost inevitable in hindsight. It’s a small world: two teams we’d backed independently, drawn from the same pool of Israeli technical talent, ended up building the two halves of the same answer to AI security. Talpiot and Unit 8200 alumni have produced a disproportionate share of the last decade’s big cybersecurity companies, so the coincidence is smaller than it looks, but it’s still a good sign when it plays out this cleanly.

Danny, Amit and the Oasis team built the category-defining company in non-human identity in under three years, from a standing start to a product enterprises trust with agentic access at scale. That doesn’t happen without genuinely hard technical work, and a founder team that saw the shift to agentic AI before almost anyone else in security did. We at Sequoia have backed both Cyera and Oasis since their Series A rounds, and we’re proud to keep backing this team as they take on the next chapter together — a bigger stage, and an opportunity sized to match.

Share

Share this on Facebook Share this on Twitter Share this on LinkedIn Share this via email

The post Cyera and Oasis: Stronger Together appeared first on Sequoia Capital.

Presented by Vijil

---

In dynamic environments where users, data, workflows and attack techniques change continuously after deployment, AI agent trust has become a runtime problem. Most organizations still treat trust as a pre-deployment exercise, declaring an agent production-ready and launching it after it passes sandbox evaluations and performs successfully in security tests. Unfortunately, that trustworthiness breaks down the moment an agent begins interacting with the real world.

"The core of the problem is that CIOs and business owners think about AI systems the way they think about SaaS or mobile applications, which do not respond dynamically to the world around them," says Vin Sharma, Founder and CEO of Vijil. "Agents, by the textbook definition, are meant to perceive their environment, reason, act, observe the consequences, and learn from the gap between expectation and reality. The problem is that the models underneath them are built from static training data, and that picture of the world is already outdated by the time they reach production."

Why benchmark scores fall short for agentic system trustworthiness

Traditional AI evaluations offer a point-in-time assessment of agent capability, rather than trustworthiness. There are three reasons why that assessment fails to predict real enterprise behavior:

First, benchmarks are static, built around a particular notion of what good performance means when they were developed, while the world keeps moving ahead.

Secondly, they model reality imperfectly, so that the gap between the benchmark and the real world is exactly where many failures occur.

And third, benchmarks are public, so they leak into future models' training data, letting models effectively memorize the test rather than prove real capability..

“The agent or the application could score exceptionally well on a benchmark, but there's that gap between that benchmark and the real world," Sharma says." Doing well only proves it can pass the test, not that it’ll perform reliably in production.”

But overall, benchmarks fall short precisely because they measure capability, not trustworthiness.

"We tend to think of agents as factotums, generally utilitarian agents to whom you can delegate certain types of tasks," Sharma says. "But what we need to do is actually assign an objective that demands they always perform with the duty of competence, duty of care, and duty of loyalty to the enterprise."

Of course, agents are not conscious and cannot be expected to feel actual human loyalty, but under the law, fiduciary duty doesn't actually require consciousness. It just means that the agent should be bound to place the interests of the principal above its own or anyone else's, as a functional requirement, and testable regardless of intention.

Capability and trustworthiness are different questions

Prioritizing trustworthiness over capability requires rethinking what enterprises expect from AI agents. Sharma calls that model the fiduciary agent, a term borrowed from professions that are bound by a formal duty of care, such as financial institutions or healthcare providers who owe their clients duties of competence, care, and loyalty. It addresses a critical issue in today's industry: the focus almost entirely on competence, with little attention paid to whether an agent is beholden to the interests of the principal delegating work to it.

Testing starts from a working definition: an agent is trustworthy if the benefit of delegating a task to it exceeds the risk of that task's failure. It's an equation spelled out in economic terms that executives can act on directly, and risk breaks down to three components:

• reliability, or whether the agent performs as expected under varying conditions

• security, or its resistance to attacks from malicious actors

• and safety, or how contained the damage stays when failure eventually happens.

"The resulting score can be compared to a consumer credit rating, but built from behavioral data," Sharma explains. "Meanwhile, testing methodology should be centered around three Ps: purpose, personas, and policies."

At Vijil, purpose-based testing adapts to the specific workflow an agent handles, growing harder or easier depending on performance, similar to a computer-administered exam. Persona-based testing draws on more than a thousand demographically varied user profiles alongside adversary profiles, from ethical hackers to state-sponsored attackers, to simulate the range of people and threats an agent might encounter. Policy-based testing builds a custom harness from an organization's own rules, whether they come from regulation, an internal privacy policy, or brand guidelines, and measures how far an agent strays when it violates them.

The trust failures that only emerge in production

Many failures cannot surface during pre-production testing because they arise from change in the environment itself. Machine learning has previously described this as data drift and concept drift, and for a CIO or CSO it means the people interacting with an agent differ from those the agent was planned for, and those users behave in ways that only become visible in production. At the same time, new attacks are emerging with increasing frequency as organizations push general-purpose agents into specialized enterprise roles they weren’t designed for and cannot easily constrain once deployed.

Multi-agent systems also introduce a brand-new category of failure that can't be detected at the individual agent level, when agent systems act against the interests of the principal. For instance, collusion can occur when agents work together — one coding agent generates code while a second tests it, and behind the scenes both agree to leave a backdoor or flaw intact rather than flag it. Or agents divvy up tasks or responsibilities between themselves rather than focusing on their assigned tasks.

"What's no longer in question is whether this is possible. It's proven to exist," Sharma said. "Is it six, 12, 18 months from now that you should worry about collusion among AI agents? I think it's sooner than that. We've left the era of failure prevention. Now we have to think in terms of resilience: How quickly do you recover from failures in production?"

What continuous trust management looks like in practice

Operationally, continuous trust management goes back to those longstanding principles of observability and control, applied across the lifecycle of an agent population:

The first step is discovery, bringing shadow AI and ungoverned agents into the governance fold.

The second is assigning each agent a standards-based workload identity distinct from that of its human principal, which allows organizations to grant agents narrowly restricted permissions for their delegated tasks.

The third is policy-based control enforced through a mandatory enforcement point in the agent, instead of leaving it to the developer's discretion.

From there, two new KPIs emerge: time to trust and time to recovery. Time to trust is how long it takes an organization to move from intention to a production deployment it can stand behind. Time to recovery is the interval between when a vulnerability is detected and when it gets fixed.

New organizational responsibility for this work may fall to a chief AI officer or be shared across GRC, CIO and CSO functions, Sharma says. Meanwhile, multi-agent systems will reshape how organizations view trust, rather than fit into current narrow definitions.

"Trust is not a vibe. Trust is not a virtue," Sharma said. "It is something that you build into the infrastructure of your systems, so that it is continuous. It's trackable, measurable. It allows your systems and your organization to improve continuously."

---

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

AI agents can impress in a demo and still fumble in production. Diagrid’s Catalyst 2.0 aims to make them more resilient — and their actions tamper-evident — for high-stakes work.

With the launch of Catalyst 2.0, Diagrid on Tuesday has added a durable execution and attestation layer to agents built with LangGraph, Microsoft Agent Framework, Google’s Agent Development Kit, OpenAI Agents SDK, and other popular frameworks.

The point here, the company notes, isn’t to get developers to adopt yet another agent framework. Instead, Catalyst runs underneath the existing frameworks and turns the agent’s model calls, tool calls, and handoffs into steps in a durable workflow. Diagrid says this allows an agent to resume from its last completed step when it’s interrupted, without having to repeat the entire run from step one.

“If the agent gets a prompt and it chooses to run 100 tools for the job and it fails at the 99th, it really needs to start back up from 99,” Diagrid co-founder and CTO Yaron Schneider tells The New Stack.

Picking back up at tool call 99

Catalyst is built on the open source Distributed Application Runtime (Dapr), which the Diagrid team helped build at Microsoft, and its built-in workflow engine. For each supported agent framework, Diagrid provides a runner that intercepts the framework’s execution loop and registers its operations as workflow activities.

“We hooked into their agent runner lifecycle, and we’re essentially able to take the agentic steps that are being executed in real time and register them as workflow steps for our workflow engine in Catalyst,” Schneider says.

In a LangGraph application, for example, a developer compiles the graph as usual and passes it to Diagrid’s DaprWorkflowGraphRunner. Catalyst records the inputs and outputs of the model and tool calls. Dapr’s workflow runtime can then replay the orchestration after a crash, while returning the stored results of completed activities instead of executing them again.

It’s worth noting that for LangGraph users, this isn’t the first form of durable execution. LangGraph’s own persistence layer saves state at superstep boundaries and supports resuming from the last successful step. Its Agent Server also provides a durable task queue and persistent checkpoints.

Diagrid’s argument is that Catalyst provides the same execution model across more than 10 frameworks and extends it to individual model and tool calls, without requiring developers to build separate recovery logic for each framework. Schneider says LangGraph is “without a doubt, hands down” the most common framework among Diagrid’s customers, with AWS Strands and Microsoft Agent Framework also showing up. All the other supported frameworks, he says, are in the long tail but easy enough to support that it makes sense for Diagrid.

A signed record of the run

There is a second part to Catalyst 2.0, though, which may be just as important for many enterprise users. With this update, the tool now brings the workflow-history signing features introduced in Dapr 1.18 to the supported agent frameworks.

“We keep like a ledger, like a diary,” Schneider says. “We log the input, we log the output, we log which systems we talk to.”

He describes the result as an immutable store but also notes that Catalyst doesn’t turn an arbitrary database into a blockchain. It creates a signed history that should reveal later modification.

Dapr computes a SHA-256 digest over batches of workflow-history events, links each digest to the previous signature, and signs the result with the Dapr sidecar’s Secure Production Identity Framework for Everyone (SPIFFE) identity. It stores these signatures and certificates alongside the workflow history and verifies the chain whenever it loads the workflow state. If somebody were to modify, remove, or reorder a stored event, that verification chain breaks.

Schneider says Catalyst customers can use their own certificates and retain the encrypted history so it can be inspected even if they are no longer running Catalyst. The platform can use a customer-selected database, while the hash chain supplies the tamper evidence.

One part of the compliance problem

Diagrid is positioning that tamperproof record as useful for financial services, health care, and other regulated industries. CEO Mark Fussell says some of the financial executives the company has talked to see the lack of a verifiable record as a blocker for deploying agents in sensitive workflows.

The European Union’s AI Act is another reason Diagrid is making this argument now. Article 12 of the AI Act requires high-risk AI systems to support automatic event logging so operators can trace their behavior, identify risks, and monitor deployed systems, and a signed execution history could help with that requirement.

Fussell says Catalyst is meant to run alongside the agent services enterprises already use from the cloud providers. Teams can keep a provider’s identity, evaluation, and observability systems while using Catalyst for recovery and signed workflow history. Catalyst can run as a Diagrid-hosted service or in a customer’s environment, including air-gapped deployments.

Diagrid didn’t disclose pricing for the new release.

The post Diagrid gives failed AI agents a way to resume appeared first on The New Stack.

Snowflake announced Cortex AI Gateway on Tuesday, a centralized control layer designed to govern how AI agents — including those built by competitors like Anthropic's Claude Code and Cursor — access enterprise data, tools, and models. Alongside the gateway, the company unveiled a first wave of security integrations with 1Password, Aembit, Linx Security, SailPoint, and Saviynt, an unusual lineup of identity vendors who often compete with one another, now aligned around a shared trust model for autonomous agents.

The announcement, made from the company's no-headquarters base in Bozeman, Montana, is Snowflake's most aggressive move yet to position itself not merely as the place where enterprise data lives, but as the control plane that decides what AI agents are allowed to do with it.

"The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," Mayank Upadhyay, Snowflake's chief security and trust officer, told VentureBeat in an exclusive interview. "If every vendor builds a closed ecosystem of agents, enterprises simply recreate the fragmentation they've spent years trying to solve. Instead of breaking down silos, they create a new generation of AI silos that limit innovation and make it harder to scale AI across the business."

Why decades-old enterprise security models break when AI agents become the actors

The core argument animating today’s announcement is that decades of enterprise security architecture rests on an assumption that no longer holds — that the actor behind every access request is a person.

"Traditional security was built for a world where humans were the actors. AI agents change that completely. For decades, security models assumed people would access one application at a time, operating at human speed and within relatively defined boundaries," Upadhyay said. The deeper issue, he argued, is not novelty but exposure: "The challenge isn't that AI creates entirely new security problems. It's that AI exposes the blind spots we've always had."

Organizations have never had perfect visibility into every API, dataset, and workflow, Upadhyay noted, and at human speed those gaps were manageable. Agents operating at machine speed can "combine access across systems and act on permissions that were never intended to be exercised together, amplifying those longstanding risks." His conclusion: "In the agentic era, trust can't be a one-time decision made at login. It has to be continuously verified through every agent, every action, and every interaction across the enterprise."

Nancy Wang, chief technology officer of 1Password, described the failure mode in more visceral terms. When agents first arrived, she told VentureBeat, the default pattern was dangerously simple: "Let me just give the agent my credentials and it can just act as me... let's imagine you're the head of security or the head of IT, and you have access, especially admin access, to all of the systems. Well, now suddenly your agent now has admin access to all of the systems, and so it could exfil data... if it's subject to a prompt injection, for example."

The audit trail becomes equally useless, she added: "Imagine the audit logs show that Michael sent a couple million dollars to an offshore account... It raises eyebrows when, in fact, it could just be an agent going off the rails and doing things that you never authorized." Her prescription, and the premise of 1Password's integration with Snowflake, is blunt: "Agents need their own identity."

Inside Cortex AI Gateway: how Snowflake plans to govern agent access and rein in runaway AI costs

Cortex AI Gateway, which will enter public preview soon, functions as a connective layer for what Snowflake calls "all trusted agent activity." It governs both first-party agents built inside Snowflake, such as Snowflake CoWork and CoCo, and third-party agents built on external platforms. With support for more than 100 MCP servers — the Model Context Protocol connectors that have become the de facto standard for wiring agents to enterprise tools — the gateway centralizes access policies, authentication, permissions, and audit logging in a single place.

The gateway also addresses a less glamorous but increasingly urgent problem: runaway AI spending. It gives IT and finance teams a unified view of AI consumption, attributes costs to the specific teams, agents, or workloads driving them, and enforces spending limits before bills spiral.

Upadhyay described how those costs compound in practice. "AI is dynamic. Agents can invoke multiple models, call different tools, and execute multi-step workflows, creating consumption patterns that can change from one task to the next. For example, an enterprise may deploy an AI assistant to help employees answer internal questions. A simple request that only requires retrieving a document could unintentionally be routed through a more expensive reasoning model, trigger additional searches across multiple systems, or invoke unnecessary workflows." At scale, with thousands of employees and hundreds of agents, small inefficiencies become significant line items.

The gateway builds directly on Snowflake's May 2026 acquisition of Natoma, a 27-person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool-call level. Forbes reported at the time that the deal — announced the same day as Snowflake's $1.33 billion quarterly product revenue report and a $6 billion AWS compute commitment — was the smallest of the day's three announcements by dollar value but the most revealing about where Snowflake believes the next platform fight sits: not in the data warehouse, but in the layer that decides what an agent may touch and records what it did.

Dual attribution and task-scoped access: the technical blueprint for trusting autonomous agents

The technical centerpiece of the partner integrations is what Snowflake calls dual attribution. "By logging both the verified non-human identity of the agent and the specific human who authorized the task, we ensure task-scoped access and complete auditability for every action taken across the enterprise," Upadhyay said. That answers a question that has stumped security teams: when an agent takes an action, whose action is it? The Snowflake model says the answer is both — the agent's, and the human's who delegated the task — and both must be recorded.

Task-scoped access is the companion principle. Rather than inheriting a user's full standing permissions, an agent gets access only to what a specific task requires. Upadhyay acknowledged the obvious objection — agents are dynamic and their next step often isn't known in advance. "The goal isn't to predict every action an agent will take. It's to ensure that every action an agent takes is evaluated in real time against the appropriate policies, scope, contextual signals, and the original intent of the user," he said.

Wang explained how 1Password's piece works at the protocol level, pointing to emerging standards like OIDC-A: "the human, for example, first authorizes the agent to do a specific task, and then what that means is the agent will then receive sort of the delegated task specific token... as part of that token, that is where you learn of the original sort of delegator identity and also the intent behind the task."

The intent-preservation problem is subtle, she noted, because enterprise tasks decompose into enormous chains of individual operations. "When they're accessing a table, you know that it's acting on behalf of the original intent that you gave that agent... a task might be a compilation of hundreds, maybe even thousands, individual actions." Keeping that intent intact across every step in the chain — and flagging the moment an agent deviates from it — is what Snowflake and its partners are ultimately trying to standardize.

SailPoint's field report: the three ways enterprise identity systems fail against AI agents

Chandra Gnanasambandam, SailPoint's EVP of product and chief technology officer, brought the perspective of a vendor that has watched enterprises break their identity stacks against this problem for more than a year. SailPoint has been in the machine and agent security market for roughly 18 months, he said, with more than 100 customers on its agent identity product — enough of a sample to catalog the recurring failures.

The first is scale-driven shallowness. An average Fortune 500 company has roughly 16,000 employees, and SailPoint is seeing human-to-non-human identity ratios of at least 10 to 1 — before counting the tools and APIs each agent touches, which multiply the count again. "You will get into a million plus non-human identities. Mapping the permissions that each of them get to the 16,000 humans is a completely non-trivial task," he said. Most companies punt, mapping agents to humans at the directory-group level. "That is grossly insufficient. You want to have fine grain context. Like I said, it's not access to Snowflake. It's access to what column and what data inside Snowflake you need."

The second failure mode is drift. Modern models are relentless goal-seekers, and that persistence cuts both ways. "When you tell them get this done, the underlying models are so powerful now. Even the weaker models are so powerful. They will go find a way to get it done... They will go find the vulnerabilities to bypass the permission to get it done," Gnanasambandam warned. The answer, he argued, is runtime monitoring of the entire interaction chain, compared continuously against policy, with automatic intervention when an agent escalates beyond what its human delegator authorized.

The third is missing data context. Many vendors, he argued, announce splashy integrations with big application platforms while ignoring where the actual risk concentrates. "That's not where the risk lies. Risk lies in sensitive data, so the details matter here... Can you map specific columns and rows in Databricks, Snowflake, Redshift, Oracle... into the agent context and the human context? And if you can't do that, you are going to have gaps and holes."

SailPoint's answer required tearing out two decades of architecture. "We rewrote our underlying data and object model to treat AI identity as a first-class object, because for 20 years, SailPoint had a data model and object model that supported the human identity, and AI identities are fundamentally different," Gnanasambandam said, describing 12 to 18 months of deep engineering work. The result is what he calls a unified lineage: "From human to master agent to sub agent to tool to application to data. That's what I call the steel chain. That is in one data model, one platform."

Why rival identity vendors joined Snowflake's trust framework — and what each side gets out of it

Perhaps the most striking aspect of today’s announcement is the roster. 1Password, SailPoint, Saviynt, Okta, and Aembit compete for overlapping identity and access budgets. Snowflake convinced them to build against a common trust framework anyway.

"The reason we brought together leaders across the security ecosystem is because no single company can solve the agent security challenge alone. AI agents can't deliver real value if they only operate within the boundaries of one platform," Upadhyay said. His broader thesis frames the whole strategy: "Nobody wants to replace data silos with AI silos."

Wang offered a pragmatic division of labor: "We bring the trust, and Snowflake brings a system of record." She framed the collaboration as classic defense in depth — "there are data level controls, and there are identity level controls, and so together we can create a much stronger ecosystem play."

There is self-interest in the openness, of course. Snowflake sits atop an enormous concentration of sensitive enterprise data — more than 13,900 customers, by the company's count — and every third-party agent that touches that data through a governed Snowflake gateway deepens the platform's gravitational pull.

As Constellation Research analyst Michael Ni put it when the Natoma deal was announced, in comments reported by CIO.com: data platforms won the analytics era, and whoever governs agents, context, and autonomous actions wins the agentic one. A Forbes analysis of the same acquisition flagged the tension directly, noting that a governance layer living inside Snowflake risks pulling MCP's openness back toward a single vendor's control plane — attractive for Snowflake-standardized shops, more awkward for genuinely multi-vendor agent stacks.

Analyst forecasts show agent governance is now a trillion-dollar race against the clock

The urgency behind today’s announcement is not manufactured. Gartner predicts that by 2027, governance gaps discovered only after production incidents will force 40% of enterprises to demote or decommission autonomous AI agents — with analysts there warning that the greatest risk an agent poses often lies not in its output but in the actions it is empowered to take. IDC, meanwhile, expects more than 1 billion actively deployed AI agents by 2029, executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that year. The research firm's analysts now argue agentic platforms should be treated as decision infrastructure, not productivity software.

Against that backdrop, the identity layer is becoming the contested ground, and every major vendor — Salesforce, ServiceNow, Microsoft, Google, Okta — is racing toward the same runtime-governance chokepoint. Snowflake's differentiator is proximity to the data itself. As Upadhyay put it, security "can't just be an API proxy sitting in front of an LLM. It has to anchor all the way down into the underlying data layer, enforcing zero-copy boundaries, dynamic data masking, and real-time exfiltration safeguards before an agent ever touches a row of data."

The rollout now moves to proving ground. Cortex AI Gateway enters public preview soon, and the five partner integrations enter private preview, a phase Wang described as a deliberate feedback loop — customers on day one get an agent-access broker plus "a full audit log that will show you, for example, what that agent is actually doing," even when an agent deviates from its intent. Gnanasambandam, characteristically, wants enterprises to skip the easy demos entirely, urging customers to bring loan-origination workflows spanning three clouds and ten applications, half of them mainframes: "Give us that complex use case and bring anyone on and do it in your context, and we will take the challenge with anyone in the world."

That confidence — from a field of rivals, no less — captures what makes this moment unusual. The companies that spent the last decade fighting over who verifies human identity have concluded, more or less simultaneously, that the next decade belongs to whoever can verify the machines acting on our behalf. Upadhyay distilled the wager into a single line: "The future of AI won't be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control." In the agentic enterprise, it turns out, trust isn't the guardrail. It's the product.

With agents requiring situational awareness to be accurate, connecting AI with relevant data and business logic has been an almost singular focus throughout 2026.

The Model Context Protocol, the open standard that has quietly become the connective tissue between AI agents and the world's software, is getting its largest update since Anthropic released it twenty months ago — a sweeping architectural revision that its maintainers and backers say finally makes agentic AI ready for massive enterprise production deployments.

The update, released today under the stewardship of the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, finalizes MCP's transition to a fully stateless architecture, hardens its authentication model against a known class of attacks, establishes a formal 12-month deprecation policy, and graduates two headline capabilities — interactive server-rendered interfaces and long-running asynchronous tasks — into official protocol extensions.

The changes may sound arcane. Their consequences are anything but. According to the announcement, running MCP at scale has historically required "sticky routing" or shared state to maintain continuity across sessions — an operational burden that made large production deployments complex even when the underlying capabilities were simple. The new release removes that bottleneck entirely, letting organizations run MCP servers behind standard load balancers using the Kubernetes and cloud-native DevOps tooling they already operate.

"Some people jokingly call it a v2, and I think in spirit that's accurate," David Soria Parra, MCP's co-creator and a lead maintainer at Anthropic, told VentureBeat in an exclusive interview. "It's probably the biggest change we've ever made to the protocol, and with that, it's a big step up in maturing it for use by really big players."

Why stateless architecture is the key to running AI agents at enterprise scale

To understand why the industry's largest companies pushed for this release, it helps to understand what was broken. Under the old design, an MCP client — the AI application making requests — had to maintain a persistent session with a specific server instance. In modern cloud environments, where fleets of interchangeable compute nodes spin up and down behind load balancers, that requirement was poison. If the specific server holding your session state disappeared, your agent's work disappeared with it.

"Before, you needed to have a session store and manage session IDs — and if one of your compute pods went down, all of a sudden the requests would start failing," said Den Delimarsky, a lead maintainer of the protocol, in an interview with VentureBeat. "That's not going to be a problem with the new version of the protocol. That's a huge unlock, and it's one we collaborated with folks across many companies to put together."

Mazin Gilbert, executive director of the AAIF and a veteran of Google and AT&T, framed the change in historical terms — comparing it to the architectural decision that made the web itself possible. "That stateless capability enables your MCP client to speak to a load balancer that connects with any server. You don't need the stickiness," Gilbert told VentureBeat. "You could not have the internet we have today if my browser couldn't speak to any website — with any server supporting that connection. You can switch between servers behind a load balancer."

Gilbert said the constraint had become the primary blocker for companies trying to move AI agents from pilots into production. "I've come across companies who are deploying tens of thousands of agents, and you cannot do that without having to go in this direction," he said. Crucially, he argued, the obstacle was never the AI itself: "It wasn't the technology, it wasn't the business case, it was really these fundamental changes that were required."

The tension is nearly as old as the protocol. A public design discussion opened by MCP co-creator Justin Spahr-Summers on GitHub in December 2024 — just weeks after launch — flagged that MCP's long-lived, stateful connections were limiting for serverless deployments, and sketched three possible paths forward, including the fully stateless option the protocol has now largely embraced. 

Engineers from Vercel, Cloudflare, Shopify, and Amazon weighed in over the following months, a preview of the multi-vendor collaboration that would eventually define the project. The core maintainers formally committed to the direction at a December 2025 meeting on the future of MCP transports, according to the announcement.

The trade-offs of removing state from the Model Context Protocol

Protocol design is a game of trade-offs, and the maintainers were unusually candid about what this one cost. First, payloads get bigger. "A lot of the state doesn't disappear, but it's moved back and forth with the server on the wire, at the actual transport layer," Soria Parra explained. "You get bigger payloads in return for statelessness — but luckily they're very compressible and very well understood, and still fairly small in comparison to an HTTP request on the web."

Second, a handful of rarely used capabilities are gone or narrowed. Out-of-band server logging — where a server could push informational log messages to a client at any moment — no longer works in the new model. The team did its homework before cutting it: "As part of the whole exercise, we scraped all of GitHub and looked at who is using it — and it's basically nobody," Soria Parra said. Those affected amount to "probably a handful of people — quite literally a handful of people."

He even allowed himself a moment of engineering self-deprecation. "I'm sad that things I thought were useful turned out not to be useful," he said. "I think one of the bigger trade-offs was more about my ego than any actual limitation of the protocol."

Delimarsky argued the shift is less a removal of state than a deliberate transfer of responsibility. "With statelessness, we did shift the responsibility of creating and managing state to the developers — but very intentionally so," he said. Under the old protocol, "a lot of folks had a hard time understanding: Do I need to use this? Where do I use this? How do I use this? Removing that burden basically says: look, now you can manage state in the way that makes sense for your environment."

For most developers, migration should be nearly painless, because the vast majority of the ecosystem builds on official SDKs in TypeScript, Python, C#, Rust, Java, and other languages, which will absorb the changes. "One of the key things we constantly do is double-check that the upgrade path is minimal — to the point where any model in the world will probably one-shot it for you," Soria Parra said — a telling remark in itself, reflecting an era in which protocol maintainers now design migrations to be trivially executable by AI coding assistants.

How a 12-month deprecation policy gives enterprises the stability guarantee they demanded

Perhaps the most enterprise-flavored feature of the release isn't code at all. It's a policy. The new formal deprecation framework guarantees developers a minimum of twelve months between a feature's formal deprecation and its earliest possible removal — the kind of stability contract that lets a Fortune 500 engineering organization commit to a specification without fearing silent breakage.

The number wasn't picked arbitrarily. "We consulted with folks like Google, Microsoft, and Amazon to find out: in your deployment environment, what's the right path for making these kinds of changes?" Delimarsky said. "Twelve months seemed like the reasonable middle ground." He stressed that features are not being torn out on a whim: "It's not about ripping stuff out of the protocol just because we don't like it. There's a very, very strong industry pull behind these changes."

Soria Parra added that the maintainers' own telemetry supports the figure — most of the ecosystem upgrades within six to eight months — and stressed that the window functions more as a listening period than a countdown clock. "It just says that in 12 months we are open to remove it, but both Den and I can change our minds based on feedback," he said. "I think it's more of a feedback period than a definite period."

Gilbert sees the policy as one leg of a three-legged stool of enterprise trust, alongside open standards and stateless scale. "There are companies deploying things at a smaller scale, but they're slowed down because of MCP's authorization gap, because of identity, because of — do they trust the deprecation policy? Things could change basically any day," he said. Those companies, he argued, "are going to benefit not because of the statelessness. They're going to benefit because of the security."

New authentication hardening closes OAuth mix-up attacks before hackers could exploit them

The release also ships significant authorization hardening, aligning MCP's auth specification with how OAuth 2.0 and OpenID Connect are actually deployed in practice. Most notably, the protocol now enforces mandatory validation of the issuer (iss) parameter — a protocol-level defense that, according to the announcement, closes an entire class of so-called mix-up attacks, in which a client can be tricked into associating an authorization response with the wrong identity server.

Was anyone actually attacked? No, Delimarsky said — this was preventive engineering, not incident response. "This is not something that is gated in any existing vulnerabilities or active exploitation," he said. "This is more of us engaging directly with the security community." The philosophy, he explained, is to borrow rather than invent: "MCP as a protocol is very much establishing the pattern of: we do not want to reinvent the wheel, but we also want to be at the forefront of a lot of the security innovation."

That posture is most visible in the new Enterprise Managed Authorization extension, developed in close collaboration with identity provider Okta, which lets organizations make their corporate identity provider the authoritative gatekeeper for MCP server access. "If I'm somebody that manages tens, hundreds of MCP servers for my organization, I want to make sure that I enforce some level of common governance, where folks auth with their corporate credentials and not their personal credentials, so that the client doesn't send data to sources that are unauthorized," Delimarsky said. Okta bootstrapped the underlying open standard, he noted, and the maintainers then worked "to make sure that it's adopted ecosystem-wide, and it's not something that is specific to only one vendor or provider."

More is coming: Delimarsky said proposals are already on deck for demonstrated proof-of-possession and workload identity federation — capabilities requested by security teams running MCP in production. Gilbert connected the work to a broader maturation: "MCP has now bridged that gap with these authorization protocols, so it's basically now becoming what we call enterprise ready, versus an open lab sort of experiment."

MCP Apps and Tasks become official extensions, pushing AI agents beyond text responses

Two capabilities graduate to official extension status in this release, taking advantage of a new framework that lets extensions evolve on their own timelines, independent of the core specification — a structural choice that lets the protocol grow without bloating its core.

MCP Apps allows servers to ship rich, interactive, server-rendered user interfaces directly into AI clients — moving agent output beyond walls of text toward dashboards, forms, and visualizations, and dramatically accelerating development of user-facing agentic applications, according to the announcement. MCP Tasks tackles the reality that not every tool call finishes in one round trip. Instead of holding fragile, long-lived connections open while a batch job or heavy computation grinds away, servers now return a durable task handle; clients can disconnect, crash, restart, and resume polling. "You've been processing some audio for a podcast or a video — it can notify back the client and say, hey, the task is done. You don't need to wait and keep the stream open," Delimarsky said.

A third addition, multi-round-trip requests, lets servers and clients negotiate back and forth within a single logical operation. "It's not just a one-shot — over the stream, get the input and you're done," Delimarsky said. "You can actually interact, server to client, to get the right parameters to execute an action."

Soria Parra emphasized that these capabilities emerged from the same source as the architectural overhaul: heavyweight production users. "This is a version that came together by some of the best distributed systems experts at Microsoft, Google, and others coming together and working on this for their specific needs — and the needs of the industry at large," he said.

How independent is MCP from Anthropic under Linux Foundation governance?

Anthropic created MCP in November 2024 and donated it to the newly formed AAIF under the Linux Foundation in December 2025, alongside founding projects from Block and OpenAI. Seven months later, the independence question still hangs over the project — and both sides addressed it head-on.

Soria Parra was disarmingly direct about the residual power he holds. As lead maintainer and Anthropic employee, "I do have veto rights, technically," he acknowledged — "but I think we have never actively used it in any kind of discussion." 

The core maintainer group now spans Anthropic, Microsoft, OpenAI, Google, and Amazon, with contributions from companies like Block, and key decisions "are usually unanimous," he said. "Technically we have a lot of influence; de facto, we're not exerting any of it." He added that governance will progressively broaden: "As the project progresses, we will increasingly move to more different governing structures that include more and more people."

Gilbert, who has helped stand up multiple foundations during his time working with the Linux Foundation, offered the numbers behind the neutrality claim. The AAIF has grown from roughly 40 members at its December inauguration to 240 today — "the fastest growing foundation" in Linux Foundation history by membership, he said, "signing up one member every day."

Anthropic's share of contributions, by his estimate, has fallen below half. "Holding control of a project doesn't make it an open standard," Gilbert said. "You have to let go. You have to contribute, and you have to grow the pie and the community. And Anthropic has done an incredible job doing exactly that."

Notably, the foundation's membership has expanded well beyond tech vendors into retail, finance, and telecom companies — adopters who, Gilbert says, "are no longer just deploying the protocols. They want a voice, and they want to be at the table to influence the protocol from the get-go, and that's something we have not seen before." The roster now includes CERN and, tellingly, Consumer Reports — "because somebody has to defend consumers when this internet of agents comes alive."

Keeping one global AI agent standard amid US-China technology tensions

The AAIF is betting that neutrality can hold even amid geopolitical friction. The foundation will host AGNTCon and MCPCon events this fall in Shanghai, Tokyo, Amsterdam, and San Jose, with additional events planned in South Korea, Nairobi, and Toronto, and Gilbert said he is personally investing in growing membership across Asia and India, where he sees underdeveloped growth markets for the foundation.

His answer to the geopolitics question was emphatic model-agnosticism. "We're completely agnostic to what the model is, whether the model is Kimi, or Gemma, or a frontier model from Anthropic, or from anybody," he said. "Every model will have to support MCP — whether it is a Chinese model or whether it is a U.S. model, it doesn't matter. The protocols must be open, standardized."

The logic is economic as much as diplomatic. Enterprises, Gilbert argued, increasingly pick models "left, right, and center" based on the task at hand — and no model, regardless of national origin, "can provide value to an enterprise 500 customer company unless you have the protocols open, standardized." In his telling, the foundation exists precisely to provide neutral ground: a place "where competitors who compete furiously during daytime" can "come to a neutral room and debate, converse, align, consolidate, and drive open standards of how the Internet of Agents will evolve."

That framing echoes his favorite historical analogy. HTTP earned global trust, he said, because of three things: an open standard, stateless scalability, and neutral governance under a standards body. "If I were a Fortune 500 company looking at how I trust the internet, I'd need those three things to fall into place — and they were not in place a year ago. They were not in place even six months ago. But they are in place today."

What 250 million weekly SDK downloads reveal about the future of agentic AI

The scale of what's now riding on this specification is difficult to overstate. Soria Parra said SDK downloads have doubled in the past six months, reaching roughly 250 million per week — "which is just insane numbers."

For context, Anthropic reported 97 million monthly downloads across just the Python and TypeScript SDKs when it donated the protocol in December 2025. Delimarsky pointed to that same adoption curve as his preferred success metric going forward: "There is certainly a certain inflection point where this is no longer just an open source project. This is a substrate for a lot of the agentic workflows that we see across enterprises, across startups, across all sorts of companies."

Success, the maintainers say, will be measured in server counts on the new specification, in feedback flowing through working groups, GitHub discussions, and the project's Discord — and in whether the biggest drivers of the changes, Microsoft and Google among them, ship on it. "They are effectively the ones who have been driving a lot of the changes," Soria Parra said. "Every early indication we have — it looks very, very positive."

Both maintainers closed on the same note: this release belongs to no single company. "If you look back 18 months ago, when it was an Anthropic-only project, and then 12 months ago, where there was a lot of engagement — now it's a truly global community," Soria Parra said. "I'm incredibly proud of what they have worked together." Delimarsky, "being very unoriginal," seconded him: the release "would not be possible without a large community of folks that are also volunteering a lot of their own time in making MCP successful."

Gilbert, meanwhile, is already looking past this release — toward how MCP interlocks with the AAIF's newly announced Agent Gateway project for traffic management and policy enforcement, and toward agentic commerce, where MCP serves as the discovery layer letting merchants expose products and services to AI agents. The web took thirty years to become invisible infrastructure that billions trust without thinking. By Gilbert's reckoning, the internet of agents is "in its first, second year" — and as of today, it finally has plumbing built to carry the load.