Author @OReillyMedia "Scaling AI Adoption in Eng" Founder @Gatherdev the CTO community for CTOs who don’t have time for community. Host CTO summit @Kubecon_

New York, NY
Joined March 2007
For anyone who missed it on @hackernews Dijkstra reminds us prompt engineers that those who do not learn from history are bound to repeat it - on the foolishness of natural language programming cs.utexas.edu/~EWD/transcrip…
1
2
157
I'm all down for one shotting when it works, but there is a real place for rigorously describing requirements and/or verifications. These days you can start semi structured, but eventually I think you iterate into a structured set of DSLs for the important verifiable constraints
1
32
NO question - almost all of the value from AI comes when you rebuild your SDLC. Heck - chatted with a very large comnpany last year that reduced cycle time by 60% smply by getting agents to capture rigorous requirements from the business team upfront and not stop until they were sufficiently complete. Saved all of the "hold the line while we book a call with an SVP to understand what they meant by 'customer'" stuff. It's not just about generating code faster
1
2
208
Amazing night last night at DirectorPlus in NYC - thanks so much to the speakers, sponsors and participants - I'll tag andf thank everyone on LinkedIn, but a great night discussing agentic engineering and security. luma.com/2026-10-director-pl…
79
Welcome to a taste of what a random Wednesday is going to look like every week in 2027 Time to look at AppSec and cycle time to patch again. As long as you can go from CVE in inbox to tested patch in prod in under 10 minutes any time of the day or night, you're probably fine...
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
124
Looking forward to giving this a go - thanks @mikehostetler
Wait, you cut lines of code by 20% and doubled the features? Yup, that's Jido V3 Previews begin this week
1
218
My theory? The Roadster by @elonmusk is an homage to @jack and the twitter of old . . . Twitter: "you can post anything - as long as it's only 140 characters" Roadster "you can fly anywhere - as long as it's under 300 yards" :)
Turns out the future does have flying cars
186
My favorite line? "run it, don't read it". We all know that traditional code review is dying and as agentic quality improves, we're never going to catch the error in PR 200 after 199 great ones. We need ALL the verifications, but I do believe @AntithesisHQ is one of the really interesting players in this space. I have build so many tools for pipelines, intermediate artifacts, adversarial reviews and deterministic verifications, but realistically I'm not gonna vibe code the solution to verification in my spare time. Eventually we're all going to be using tools like this - there's no other way to 10x delivered value.
What if saying `claude build me a cloud platform make no mistakes` actually worked??? With the newest Antithesis release we have closed the loop and enabled agents to ship reliable systems: antithesis.com/blog/2026/tim…
1
5
360
x - a mechanism for converting (thoughtful) snark into dollars via followers -> social proof -> raise -> acquihire
157
As someone who organized conferences for a decade I see this all the time. You have to get out of the building and learn from (and teach) others. If you can talk, talk. If you can write, write. If you can code, OSS some code. Find your path, contribute, find community. Your job effectiveness and your career will transform.
Just thinking back how, in the late 2010s I was pulled aside by my skip level, who told me I was doing too many talks at conferences (representing the company - I did ~4 in a year) and he strongly suggests I cut back on it. And reflecting how today, most companies would WANT this I struggled to understand the reasoning at first, but turns out that more senior folks complained to this person how I probably wasn't doing my work (which I was) and the skip level just did not want conflict
12
615
Oh, in addition to the article - check out the home page that @felixrieseberg created at felixrieseberg.com/ His home website is the best short movie I've watched in a while. Bravo Felix!
Hi, I'm Felix. I'm an eng lead working on Claude. I love watching people take flight and do things they never thought possible. We often describe that as "being more ambitious" when using AI, which is tricky advice to follow. I wrote a tutorial: felixrieseberg.com/how-to-be…
242
I love this. For [people] feel free to substitute [organizations]. I spoke with a CTO this summer - 1000 engineers - he said "we're playing with AI but I have enough people to run all the experiments our data will support". When I mentioned that to @fnthawar he said "maybe they should be more ambitious". Here is to the people - and the organizations - who are being more ambitious. It's hard. You'll lean in too far and then not far enough. You'll trust too much, then too little. Everything the experts tell you will break eventually (ask me about md files or generic memory/dreaming systems not backed by graphs with rigorous ontologies). But one day you're talking with @GeoffreyHuntley or @_lopopolo and can actually be a part of the conversation. Its an amazing time to be an AI engineer...
Hi, I'm Felix. I'm an eng lead working on Claude. I love watching people take flight and do things they never thought possible. We often describe that as "being more ambitious" when using AI, which is tricky advice to follow. I wrote a tutorial: felixrieseberg.com/how-to-be…
2
152
Been there - worst was during the "we're gonna take fable away from max plans" days. I'd wake up at night to make sure my long running jobs were still running. No easy answers. But automate all the things and move from ad-hoc spervisor patterns to deterministic flows. Drive most of your work autonomously, sweat the deterministic verifications and then set a soft WIP limit of 3-5 agents running subagents interactively so you don't go mad. Focus on finishing not starting, use other peoples software even thought you could build it. Compose your tools (durable execution doesn't need to be vibe slopped - temporal, restate, conductor - lots of usable implementations). Have really good ux, project intake, approval and management flows. And touch grass once in a while. You don't win by burning ALL the tokens.
AI was supposed to make us work less I've never been this tired in my life most days I have up to 10 agents running at the same time. one fixing a bug, one writing pages, one refactoring something I already forgot I asked for, 3 other I have no idea what they are doing but i suppose i ask it? and I jump from conversation to conversation all day compared to 5 years ago, I probably context switch 100x more by the end of the day my brain is fried. completely toasted. nothing left, not even for the people I love I call it the fried brain effect thought it was just me but almost every founder I talk to lately says the exact same thing we got superpowers, and somehow the pressure only went up. if you can ship 10x more, you feel like you have to ship 10x more. every single day I don't have a solution honestly I have no idea where this goes from here anyone else feeling this?
1
2
213
In AI adoption, alignment is more important than maximalism...
4
2
1
5
1,089
Peter Bell retweeted
Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel. - Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all. - Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract. - Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code. - And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while. The funnel is driven by a combination of factors: 1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel. 2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel. 3. Access. Free-tier, paid-tier, internal. So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.
Judging by my tl there is a growing gap in understanding of AI capability. The first issue I think is around recency and tier of use. I think a lot of people tried the free tier of ChatGPT somewhere last year and allowed it to inform their views on AI a little too much. This is a group of reactions laughing at various quirks of the models, hallucinations, etc. Yes I also saw the viral videos of OpenAI's Advanced Voice mode fumbling simple queries like "should I drive or walk to the carwash". The thing is that these free and old/deprecated models don't reflect the capability in the latest round of state of the art agentic models of this year, especially OpenAI Codex and Claude Code. But that brings me to the second issue. Even if people paid $200/month to use the state of the art models, a lot of the capabilities are relatively "peaky" in highly technical areas. Typical queries around search, writing, advice, etc. are *not* the domain that has made the most noticeable and dramatic strides in capability. Partly, this is due to the technical details of reinforcement learning and its use of verifiable rewards. But partly, it's also because these use cases are not sufficiently prioritized by the companies in their hillclimbing because they don't lead to as much $$$ value. The goldmines are elsewhere, and the focus comes along. So that brings me to the second group of people, who *both* 1) pay for and use the state of the art frontier agentic models (OpenAI Codex / Claude Code) and 2) do so professionally in technical domains like programming, math and research. This group of people is subject to the highest amount of "AI Psychosis" because the recent improvements in these domains as of this year have been nothing short of staggering. When you hand a computer terminal to one of these models, you can now watch them melt programming problems that you'd normally expect to take days/weeks of work. It's this second group of people that assigns a much greater gravity to the capabilities, their slope, and various cyber-related repercussions. TLDR the people in these two groups are speaking past each other. It really is simultaneously the case that OpenAI's free and I think slightly orphaned (?) "Advanced Voice Mode" will fumble the dumbest questions in your Instagram's reels and *at the same time*, OpenAI's highest-tier and paid Codex model will go off for 1 hour to coherently restructure an entire code base, or find and exploit vulnerabilities in computer systems. This part really works and has made dramatic strides because 2 properties: 1) these domains offer explicit reward functions that are verifiable meaning they are easily amenable to reinforcement learning training (e.g. unit tests passed yes or no, in contrast to writing, which is much harder to explicitly judge), but also 2) they are a lot more valuable in b2b settings, meaning that the biggest fraction of the team is focused on improving them. So here we are.
2,152
5,843
2,243
43,654
6,721,492
Developers who implement blocking modals on gas pumps, which require you to say no to the random promotions before you can pump gas - can we send them to the same purgatory for startups that require you to speak to a human to cancel your account
1
1
3
345
Peter Bell retweeted
Your chance to own a piece of computing history. onlineonly.christies.com/s/f…
5
8
1
72
7,859
So I've been digging into this more and more. I think in the new post-mythos threat environment it REALLY makes sense to become fanatical about the surface area for attacks against your apps and this seems one of the very plausible approaches to reducing the number of potential attack vectors. We have to do things that used to be hard if we want to harden things we used to believe were secure...
🗞️ unikernels were hard. key word: were. ghuntley.com/unikernels Justin Cormack, who worked on MirageOS back in the day, called me at the pub to talk about why unikernels are coming back. The friction that made them hard is gone; the operating system is design debt, and if you care about security, you should seriously consider them.
3
178
Awesome - always wanted a starbucks bot that would both capture my order and do my python homework :)
Starbucks is exploring a potential $41 billion takeover of Chipotle, according to Financial Times. The deal would become the largest restaurant acquisition in history. (ft.com/content/79cef26a-e5e9…)
1
173