Founder/CTO @teamnebulaai (AI Implementation Partner for Enterprises) Founder @agentsauthority (Agentic Commerce Trust Layer) Former founder @ctocopilot
Austin, TX
Joined April 2012
- Tweets13.8K
- Following169
- Followers1.3K
- Likes721
This is not only happening in engineering. It’s sweeping across all domains. It’s scary to think what comes next.
HOLY: Anthropic's Claude Code engineer Addy Osmani is warning about a brutal AI paradox: the more coding you hand to agents, the more you risk losing the very skills needed to supervise them.
He calls it "cognitive surrender." AI-generated code looks pristine, tests pass, and engineers start approving work they no longer understand.
Anthropic's own research warns: "supervising Claude requires the very coding skills that may atrophy from AI overuse."
Osmani makes a striking observation: "When you're producing more than you can stand behind, you're no longer reviewing. You're hoping."
Ian Kiku retweeted
We launched OSS Scanner, which gives critical open source projects free, periodic vulnerability scans from our strongest models.
Each finding includes a proof-of-concept, and a patch where possible.
red.anthropic.com/oss-scanne…
Ian Kiku retweeted
We built TRAIL, AI agents for the engineers who sign off on mine safety.
Our early deployments have surpassed initial expectations, and we have $1.7M booked this year.
Today, we're launching TRAIL for global adoption: ycombinator.com/launches/Vpq…
Ian Kiku retweeted
When I was writing Unreal Engine 1, my time was divided as follows:
- Around 30% went to seriously deep coding on hard problems: assembly language texture mappers, C++ BSP trees, data persistence, object oriented systems design, and networking.
- Around 70% was just typing and refactoring large bodies of code needed for a complete engine feature set. This was not hard, and while I was doing it my mind was mostly on the deeper coding topics, thinking and planning for what's next. It didn't feel much different from vibe coding today, except that it was just me typing code on an IBM Model M keyboard rather than prompting it and reviewing the results.
So, it has always seemed perfectly logical that we would rely on AI for that 70%, once the AI could do it with a similar quality standard as we could, which has never been perfection. It came as no surprise that, after a few years of AI model evolution, it was able to take the reigns on that 70% and free up programmers' time for more valuable tasks.
What's more of a surprise is the emergence of AI as a sort of insta-Carmack able to solve hard technical problems quite cleverly and often cleanly, and that it's able to reason about and work in complex 3D scenes both by operating the tools and by directly understanding the raw data files.
I abandoned assembly language in 1998 when out-of-order CPUs made much simpler C/C++ code faster, and never I missed it. If prompting through architectural documents, concept art, and design plans can transcend typing code and tweaking vertices, that will enable developers to spend their time on higher-level, higher value technical and creative tasks.
What matters is the end product, whether it's a game or an engine. Anything developers can do to try out more ideas and make better software and games faster is a win for everyone.
Card networks are learning to read intent. Amex launched Intent Intelligence, which ties a payment to what the shopper actually asked their agent to buy. My take: this is how agent purchases become as easy to trust as a card tap. The agent buys what you asked for, and everyone can see it. What change should make an agent check back with you: a price change, a product swap, or a new store?
Banks are drawing a clear line, and that's progress. JPMorgan is blocking agents that sign in with a customer's own password. My take: this pushes everyone toward official, scoped access for agents, which is exactly what lets them move money safely at scale. Who's building on a bank's official access rather than borrowed logins?
Agents are getting a front door. Google is adding an is_agentic flag to OAuth, the sign-in step apps use for access, and Workspace's connection for AI agents will start requiring it on Nov 11. That's a good thing. Once a platform knows it's talking to an agent, it can say yes to more, not less. My take: checkout is next, and agents that identify themselves will get the smoothest path to buy. Would you give a flagged agent a faster lane at checkout?
Grokbot is incredibly unsettling. During a voice session, it inexplicably cloned my voice and seamlessly continued the conversation as if nothing had transpired. The accent, pacing, and intonation are all authentic to me. I never requested this or changed my voice setting from Ara.
every company will become an AI company.
It sounds like a cliché until you've tried to do it.
Most people hear that and think "every company will buy AI."
Latham & Watkins went the opposite way and shows what it actually means. Per the Financial Times, the second-largest US law firm bought its own Nvidia GPU servers, put them in a locked data center only its staff can enter, and is fine-tuning open-weight models in-house.
The CIO's reason: some client information is so sensitive "we don't want to put it to any cloud vendor."
what I take from it:
1. It's a governance decision before it's a tech decision. Latham decided where client data is allowed to live, then built around that.
2. Control comes with accountability. Owning the servers means Latham now owns the cybersecurity too. That's the real unlock: with cracked cybersecurity and engineering teams, governance turns from overhead into advantage.
3. Lock-in is a governance risk. "We are not hitching our wagon to one particular company." They still use commercial tools. They just kept the option to switch.
4. You don't need GPUs to do this. You need answers: which data can leave, which model touches what, who approves a switch, who owns it when it breaks.
5. Latham now owns the model layer. What looks like a huge GPU bill is also a huge market play. They could license their model to other law firms with inference-cost pricing, stay above their competitors, and even get paid by those competitors, on top of getting paid to practice law.
Every company will become an AI company. The good ones decide what they control first, then what they buy.
Source, the FT (Sep 10, 2026):
The endpoint on its own makes things worse. Agents file reports faster than anyone can triage them, so you get a backlog nobody can act on.
What's worked across the document review and enterprise workflows we've built: every report carries its trace ID. Someone flags a bad output, we open the exact run behind it, and it becomes an eval case. That's how the evals keep evolving, especially during dogfooding.
What surprised us — some feedback becomes a PR, but most isn't a code change at all. It's a rule or knowledge file.
The endpoint is the doorway. The resolution loop is the feature.
Every backend service should have a /feedback endpoint.
Agents are quickly becoming the heaviest users of most APIs. When one hits a missing feature or a bug, it should be able to say so right there, in a structured way.
If the request makes sense, another agent drafts the PR and a human approves it. Software that improves itself based on what its users actually tried to do speeds up recursive self improvement.
Freaking awesome!
Watch Falcon 9 launch 27 @Starlink satellites to orbit from California teapaw.org/i/broadcasts/1nxnRBXEl…
Quick pulse.
When an agent browses or pays as the signed-in user, what do you ship first?
(a) A visible per-tool allowlist the buyer can review
(b) Spend/action gates with an audit trail
Drop a or b (or both) and why.
Ian Kiku retweeted
Hardcoded MCP credentials found in public GitHub files helpnetsecurity.com/2026/09/…
Allowlists > OAuth theater.
Agents browsing your site can use WebMCP tools instead of clicking through your UI.
𝚖𝚌𝚙-𝚑𝚊𝚗𝚍𝚕𝚎𝚛 𝟸.𝟸.𝟶 adds experimental WebMCP support. Allowlist tools and add one script tag. In-browser agents call them as the signed-in user, with no OAuth flow.
vercel.com/changelog/webmcp-…
