Delete your CLAUDE.md. Not edit it, not trim it, delete the whole file, along with your skills and your hooks, and see what the model does without them. That's Boris Cherny's actual advice from a recent YC appearance, and the Claude Code team has apparently followed it internally enough times that roughly 80% of their own system prompts are gone. His reasoning: most of those rules patched a weakness in whatever model you ran six or twelve months ago. Newer models often don't have that weakness anymore, so the instruction that used to help is now just constraining a more capable model for no reason. His method is almost embarrassingly plain. Delete everything, work normally for a while, watch where the model actually goes off track, add back exactly one instruction when a mistake repeats, and run the whole cycle again at the next major model release. Keep security and compliance rules. Keep the project quirks a model genuinely can't infer from reading the code. Cut folder structures, dependency lists, and architecture summaries, since a capable model can read those off the repo itself faster than it can read your stale description of them. This is the same problem the rest of the field keeps rediscovering under different names. Anthropic's own long context guidance, OpenAI's notes on attention tradeoffs inside big windows, and Microsoft Research's GraphRAG papers all circle the same fact: a pile of context that only grows, whether it's a system prompt, a vector store, or a knowledge graph, degrades the thing using it, because stale facts sit next to current ones with no signal about which one wins. DeepSeek Harness takes a different structural swing at the same target, building its agent runtime out of swappable plugins so a stale capability gets replaced instead of buried under new instructions. What strikes me is how little of this is about model capability and how much is housekeeping nobody assigned themselves. Most teams have a deprecation policy for their actual code. Almost nobody has one for the three paragraphs pasted into an agent's instructions eight months ago and never looked at again. How long is your CLAUDE.md, and when did you last delete anything from it? xitter.cf/suraj_sharma14/status/…

Four labs shipped a standing AI agent inside ten weeks of each other, and that's not a coincidence, it's a race nobody wants to come in fourth. Grok Bot opened early beta on August 11. Meta Muse launched September 8, free to start, with a Sentinel system separating what the agent can read from what it can write. OpenAI answered at DevDay with Dots, living inside ChatGPT at $100 a month for Pro, $125 a seat for Business Premium, running on GPT-6 Astra with over 4,000 app connectors. Anthropic just opened the research preview for Claude Duet, built on Opus 5.5, reaching across roughly 6,000 connectors and plugins, included at no extra cost for Pro and Max. The mechanism is the same everywhere: each agent gets its own cloud computer and browser, keeps working after you close the app, and checks with you before anything consequential happens, like a Stripe payment or a Shop Pay purchase in Duet's case. What differs is distribution. Muse is a standalone app chasing consumers and small business owners. Dots lives where teams already work, in Slack and Teams, with specialist dots and a shared Space on the roadmap. Duet inherits Claude's existing memories and skills, so it's really an upgrade to a relationship people already have rather than a new habit to build. Reminds me of the smart speaker years, when every major platform shipped a voice assistant within months of each other and the fight wasn't really about who understood language best, it was about who already lived in your house. The agent that already has your calendar, your inbox, your Slack wins by default, not by being smarter. None of these four has proven it can run unsupervised for a week without creating a mess a human has to clean up. That's the actual product question nobody's answered yet. xitter.cf/claudeai/status/211298…

DeepSeek did not raise roughly $15 billion, about 100 billion yuan from CATL and Tencent, to build a better chatbot. That round is one of the largest in Chinese tech history, Bloomberg is calling it a direct challenge to the leading US labs, and even that framing undersells what the money is actually for. DeepSeek has spent this year quietly moving off the chatbot leaderboard and onto the same ground as Anthropic and OpenAI: agentic coding. Its Harness project, MIT licensed and led by Cui Tianyi, who joined from Jane Street, turns the V4 model family into an autonomous coding agent that plans, calls tools, and runs multi-step work rather than just answering questions. The detail that actually matters here: DeepSeek built it to accept requests in Anthropic's own API format, so a request a developer used to send to Claude Code can get routed straight to V4 Pro or V4 Flash with close to no code changes. That is not a side feature. That is a direct bid for Anthropic's own developer base, using Anthropic's own interface as the on-ramp, at whatever price gap V4 can hold over Opus. Every other coding-agent story making the rounds this week has been about layering more structure on top of frontier models, verification kits, orchestration tools, proof systems. DeepSeek's bet runs the other direction: skip the layering, make the open model itself a drop-in replacement for the agent you already configured. Fifteen billion dollars is what it costs to find out if that bet is right. xitter.cf/stbusinessdesk/status/…

Code review does not scale to how much code agents can write in a day, and a test suite only proves the specific cases somebody remembered to write. Microsoft Research and GitHub Next shipped something this week that closes that gap with proof instead of sampling. Proof-Driven Development Kit takes a plan written in Chopin, GitHub Next's planning prototype, and translates it into Verus contracts in Rust: preconditions, postconditions, invariants. An agent writes the implementation and the verification annotations side by side. Verus generates proof obligations from that and hands them to an SMT solver. Code ships only once every required obligation is discharged, not once it happens to pass whatever tests existed. This builds directly on GitHub's own Spec Kit, which has spent the last year pushing spec-driven development as mostly a prompting discipline, written requirements steering what Copilot does. PDD Kit's actual contribution is enforcement. The spec stops being guidance a model can quietly ignore and becomes something a theorem prover checks mechanically, every time. It's not a universal fix and the team is upfront about that. The method only verifies what the specification states, and an LLM can still write a spec that drops a requirement or misreads the plan entirely. Unsafe Rust, foreign interfaces, and anything outside the formal model sit outside the proof. Architecture and security boundaries still need a person looking at them. Formal verification has lived in a small, expensive corner of software for decades, aerospace, crypto, medical devices, places where a bug was unacceptable rather than merely annoying. Agents writing most of the code may be what finally drags it into everyone else's stack. xitter.cf/GitHubNext/status/2112…

2,900 sign-in attempts a minute. That's the number Microsoft published this week for a single actor's agentic penetration test, and it's the number that should worry anyone still assuming AI security tooling is mostly a defender's advantage. Storm-0940, a China-aligned group Microsoft has tracked since 2021, has been running ARTEX, an open-source multi-agent pentesting framework, against hundreds of organizations spanning aerospace, energy, financial services, government, semiconductors and more. ARTEX builds its own graph of discovered assets and vulnerabilities as it works, runs reconnaissance through exfiltration with little human involvement, and in several cases reached privileged cloud access in under three hours from first contact. An October password-spray campaign hit 327 accounts across eight organizations at machine speed, not the slow manual spraying most detection rules were tuned against. This isn't one vendor's claim either. Zscaler and the Cloud Security Alliance separately traced ARTEX activity against South Korean financial institutions months before Microsoft's writeup. The framework is public. Anyone can run it, which was presumably the point of open-sourcing it in the first place. Here's the part that gets skipped in the coverage: defenders spent three years building AI copilots for their own SOC teams, and offense adopted the identical category of tooling on roughly the same timeline, just pointed the other direction. Nobody built a head start. The volume problem compounds it. Continuous, round-the-clock agent activity throws off enough traffic and log noise that knowing where to even look becomes the hard part, before anyone gets to actually responding. xitter.cf/MsftSecIntel/status/21…

137 replies came in under one simple question this week: if you run Codex and Claude on the same codebase, how do you keep them in sync? The honest answers were the telling part. Export the chat. Paste it as a markdown file. One reply just said "feels very manual." Nobody had a real answer because nobody's built one. The tools that exist solve a different problem. Conductor, Superset, and the worktree-based orchestrators are good at running several copies of the same agent in parallel, each in its own git worktree, so they don't collide on the same files. That's concurrency. It says nothing about two different agents, one running Claude Code and one running Codex, actually knowing what the other one found twenty minutes ago. I built Campfire because that gap is the actual problem, not the one everyone's been solving. It runs Claude Code, Codex, Goose, Aider, and OpenHands side by side in one browser tab, each with its own worktree for isolation, but underneath that sits a Collective Intelligence layer: semantic memory and shared context streams that every agent in the session can read from, so Codex can pick up exactly where Claude left off without anyone exporting a transcript. Permission voting handles the trust question, majority rules to approve, any single deny blocks, a 30 second timer so nothing stalls. Session replay and a cost dashboard built from the actual tool calls mean you can see what each agent did and what it cost, after the fact, not just trust the summary. Self-host it with bunx the-campfire and point it at a repo you already have open. github.com/stretchcloud/camp… xitter.cf/LeoBuilds_/status/2112…

Two stories broke the same week that tell you where AI security actually stands. Wiz, the Google-owned security shop, Calif, and OpenAI's own red team independently found two critical PHP flaws in August using GPT-5.6 Sol and Google's Gemini 4 Argon. The bug had been sitting in PHP's core for about 14 years. Palo Alto Networks counted 22.6 million exposed instances once it became public on October 21, and Wiz puts the reachable footprint at something like 70 percent of the internet, Wikipedia, WordPress sites, government portals, all of it. The other story is the mirror image. Microsoft Threat Intelligence disclosed that Storm-0940, a China state-aligned group, ran its attacks through ARTEX, an agentic pentesting framework that was open for legitimate testing until October, when Microsoft says it got weaponized. The group hit more than 2,250 tenants through a ConnectWise supply chain compromise, with sign-in attempts clocking 2,900 a minute and, in some incidents, a path from first foothold to elevated cloud privileges in under three hours. Zoom out and the pattern across the category is consistent. XBOW just closed a $120 million round at over a billion dollars, led by DFJ Growth and Northzone with Sequoia in the mix, to keep scaling autonomous offensive testing for defenders rather than attackers. The tooling on both sides is converging on the same idea: point an agent at a system, let it run reconnaissance and exploitation in a loop, and skip the human in between. What didn't get faster is coordination. OpenAI needed two months working with the PHP Foundation, Cloudflare, Quarkslab and government CERTs to ship a patch before full disclosure, and the fix still leaked early. Attackers who move in under three hours are now up against defenders who need weeks to agree on a release date. Patch the planet is a nice campaign name. Coordinating one is still not solved. xitter.cf/Polymarket/status/2113…

Three different labs now ship an agent that messages you before you ask it to. Anthropic rolled out Claude Duet this week, a research preview on Pro and Max plans that runs on Opus 5.5, reads your calendar and inbox every few hours, and drops a morning brief with what needs attention. OpenAI calls its version Dots. Meta calls its Muse. All three use the same shape: a cloud virtual machine with its own browser, so the agent keeps working after you close the laptop, then returns slide decks, dashboards, or drafted replies in a tasks tab you check later. What's actually new isn't the proactivity. OpenAI shipped ChatGPT Pulse over a year ago with a similar daily-brief idea. What's new is how far these things reach into your accounts. Duet can check unpaid Stripe invoices and draft the reminder. It can use Link and Shop Pay to buy something, with your approval first. That's the real shift: these agents now sit close enough to money and messages that the product has to spend as much engineering effort on the refusal path, asking before it sends, pays, signs, or deletes, as on the task itself. The tradeoff nobody's pricing in yet is usage. Duet background checks count against the same plan limits as your regular chat, and Anthropic says flat out you'll hit the ceiling sooner. A $20 Pro plan buys a lot less headroom once an agent is polling your inbox on its own schedule, whether you're watching or not. My bet: whichever of these three proves it never leaks what it's told not to touch, passwords, account numbers, the private stuff, wins the next six months. The feature race is basically tied already. xitter.cf/claudeai/status/211298…

Six months ago SpaceXAI was a side project with weak adoption and a round of layoffs behind it. Today Elon Musk is telling staff its AI revenue will pass every other SpaceX revenue line, rockets included, and this quarter's numbers back him up: Cursor alone added 608 million dollars to SpaceX's earnings, against roughly 2.8 billion in operating profit from the actual space business. The mechanism is a 60 billion dollar deal that closed August 14, folding Cursor, the coding assistant behind a big share of the "vibe coding" wave, straight into a rocket company. Cursor walked in at a 2.7 billion dollar annualized run rate, up 14x year over year, with margins newly positive. Since the close, the two have shipped Grok 4.5, a model tuned for coding, finance and legal work and priced to undercut rivals, then Grok Bot, a set of background agents priced from 20 to 300 dollars a month. The product is now sold and billed through Cursor's own stack, with SpaceX sitting as the parent on the filings. The part getting less attention: SpaceX has also signed multibillion-dollar compute deals that let Anthropic and Google run workloads on its own infrastructure. That's the AWS pattern in reverse. Amazon grew its cloud business out of its own excess retail capacity until the side business outgrew the bookstore. SpaceX skipped the slow, organic version of that story: it bought a finished demand-side product outright, then started renting the supply side to two of that product's direct competitors at the model layer. A satellite company now shows more quarterly AI revenue growth than most dedicated AI startups post in a year, and it got there without training a frontier model of its own, just by buying the application layer and renting out the compute underneath it. That's the part of the 60 billion dollar number nobody priced in back in June. xitter.cf/sarbjeetjohal/status/2…

Railway's breach notice from yesterday reads like a form letter until you hit one line: the company says this is part of a wave of attacks aimed at platform companies that happen to store secrets for AI inference providers. That line is the story. The group behind most of this wave is tracked as TeamPCP, also called UNC6780. Their method doesn't touch victims directly. They poison a tool everyone already trusts, then wait for the secrets to flow in. In March they compromised Trivy, the vulnerability scanner baked into thousands of CI pipelines, by exploiting mutable GitHub Action version tags. The payload harvested credentials from over 10,000 workflow runs before anyone noticed. From there it spread exactly where you'd expect: Checkmarx KICS, the Telnyx SDK, and LiteLLM, the gateway that routes requests to more than 100 model providers and pulls 95 million downloads a month. A stolen, supposedly rotated publishing token let TeamPCP push two malicious LiteLLM releases to PyPI this month. Version 1.82.8 dropped a .pth file that runs on every Python startup, no import required. The package stayed live for 40 minutes. That was enough: Hudson Rock traced over 118,000 CI runner credential dumps back to roughly 2,500 corporate domains, Roku, Nvidia, Salesforce, Cisco and Volkswagen among them. April brought a Cisco breach through the same Trivy foothold, 300 plus internal repos cloned, including the AI Defense source. May brought a trojanized VS Code extension that sat on the marketplace 18 minutes and still reached 3,800 GitHub repos through one employee's install. Now Railway, in October. What nobody's pricing into their AI budget is this: the tools you install to secure your pipeline are now the most efficient way to compromise it. A scanner has more access than the code it scans. My read is that teams are optimizing model choice and token cost while the actual exposure sits one dependency away, in a build step nobody reviews because it's supposed to be the trustworthy part. xitter.cf/Railway/status/2113025…

A 40 billion parameter coding model that runs on a MacBook Pro at 125 tokens a second, fully offline, shipped yesterday under an Apache 2.0 license. No per-token fees. No rate limits. No vendor to negotiate with. Flint is the first release from Recursive, the startup Richard Socher and Yuandong Tian built after raising 650 million dollars, reportedly in talks at a 4 billion dollar valuation before it had shipped anything. It's a 40B parameter mixture of experts with only 2.5B active per token, which is why a laptop can run it at that speed, and on an RTX Spark workstation it climbs past 150 tokens a second. On benchmarks it's posting 89.7 percent on SWE-bench Pro v2 and 74.2 percent on SWE-bench Verified, aimed squarely at Qwen3.6-35B's spot as the local coding model people actually reach for. What strikes me about Flint isn't the size class, it's how it got built. Recursive calls its training pipeline the Eureka Machine, an automated research system that runs its own experiments rather than a team hand-tuning hyperparameters for months. That's the part worth sitting with: the model isn't just a tool for writing code anymore. It's the output of a tool that does AI research on its own. Local coding models have been inching toward cloud-grade quality for over a year now. What's different this time is the pitch isn't "good enough to self-host," it's "built by a system we didn't fully hand-engineer ourselves." If that pattern holds, the next real competition in this category won't be between labs shipping models. It'll be between labs shipping the machines that design the models. xitter.cf/RichardSocher/status/2…

AionUi showed up this week as an open-source cowork app that lets you run OpenClaw, Claude Code, Codex, Gemini CLI, Qwen Code, and a handful of other agent CLIs from one interface, with a Leader and Teammate mode that delegates subtasks through its own MCP server. It's a solid build, and it's the fourth or fifth tool I've seen this year trying to solve the same problem: nobody wants four terminal tabs open just to compare how Claude Code and Codex handle the same bug. The pattern across these tools is mostly the same shape. Claude Squad gives you a tmux session and a git worktree per agent. Sculptor does the same from a desktop app. Vibe Kanban did it as a kanban board, though it hasn't shipped a commit since April. Conductor is macOS only. What almost none of them touch is the part that actually breaks teams: what happens when two agents disagree, or one wants to run a command the other would veto. That's the gap I built Campfire to close. It runs Claude Code, Codex, Goose, Aider, and OpenHands side by side in one browser tab, with permission voting across backends instead of trusting whichever agent asks first: majority rules approves, any single deny blocks, a 30 second timer keeps things moving. You can race the same task across every backend in isolated worktrees and see which one actually wins, replay a session afterward, and watch a cost dashboard show you which agent is burning your budget. It's open source, self-hosted, one command to try: bunx the-campfire. github.com/stretchcloud/camp… xitter.cf/RizeOnline/status/2112…

Three labs now ship a proactive agent in the same week, and the pitch is identical on the surface: an app that watches your inbox and calendar, decides what needs you, and acts while you're away. Claude Duet runs on Opus 5.5 inside a cloud VM with its own browser, so it never touches your actual machine. It sends a morning brief, chases quiet threads, builds slide decks and dashboards as editable files, and asks before it sends a message or spends money. It ships free inside existing Pro and Max plans in the US, but background work eats the same usage limits as chat, a catch I haven't seen anyone flag in the launch coverage. Meta Muse runs its own Spark model behind a "Sentinel" permission layer that splits read access from write, plugs into Asana, Shopify, Stripe, and QuickBooks, and ships with its own email address and a wearable called Charm. Plans run free up to 100 dollars a month. OpenAI Dots runs GPT-6 Astra, starts at 100 dollars and climbs toward 500 a month for teams, and leans on ChatGPT's 4,000-plus plugin ecosystem instead of building its own integrations from scratch. elvis put it well this morning: this doesn't kill proactive agent startups, because personal agents will fragment into flavors and personalities the way chat assistants never did. Three permission models, three pricing shapes, one shared bet: that waiting for you to ask is now the slow way to use AI. The real product isn't the agent. It's the approval queue. Whoever makes "are you sure" feel like one tap instead of a chore wins the category, not whoever ships the smartest model. xitter.cf/claudeai/status/211298…

Saw a rundown of the current web scraping stack today: Crawlee, Scrapy, Playwright, Crawl4AI, Scrapling for adaptive sites, Firecrawl for LLM ready output, even an Oxylabs MCP server to wire extraction straight into agent workflows. Ten solid tools, and every one of them still ships you raw or cleaned HTML that an LLM has to re-read on every single pass. That re-read is the expensive part nobody mentions in these lists. A raw HTML page runs about 60k tokens versus 5k for cleaned text, so 1,000 pages on a mid tier model costs something like $61 raw against $6 cleaned, and that's before you count the extraction prompt itself firing again on every page even when the site hasn't changed its layout since yesterday. Firecrawl's own pricing makes the shape of this obvious: credits scale linearly with pages because every page gets the same LLM pass regardless of whether anything changed. DeepScrape skips the repeat pass. It uses an LLM once per site to generate deterministic CSS selectors, runs those selectors for free on every subsequent page, and only calls the model again if a selector comes back empty because the page changed. The LLM layer does targeted extraction and validation, not full document re-reading. It outputs markdown, HTML, screenshots, tables, and change tracking, maps a site's URLs through /api/map, can navigate autonomously toward a goal, and ships an MCP server so Claude or Cursor can query any site as a structured data source directly. github.com/stretchcloud/deep… xitter.cf/PrakashS720/status/211…

Dylan Field is adding integration partners to a protocol he just called imperfect, twenty of them this week alone, including Linear, Notion, Mistral, and JetBrains' Junie. His complaint from a September 30 post holds up under the data: MCP is now genuinely huge, MCP.so and Glama.ai between them catalog over 23,000 servers, growth over six months sits at 232%, and local servers were pulled down an estimated 67 million times in a single month this spring. But Field's specific gripe is about power, not popularity: he argues the protocol is structurally tilted toward the labs that created it, pointing out Anthropic doesn't expose the artifacts and cloud resources agents create through MCP the way an open standard arguably should. Figma's response is to support as many integrations as it can while deliberately not exposing everything, because wider data access through MCP is wider abuse surface, and the security research backs that instinct up: Astrix found 53% of open source MCP servers still rely on long lived static secrets, Equixly found 43% of tested servers vulnerable to command injection, and over a third have no authentication configured at all. I'd bet the ecosystem is optimizing for server count and partner logos while the trust layer underneath stays an afterthought. A protocol can win the adoption race and still be the thing that gets a team breached eighteen months later. xitter.cf/akanoodles/status/2112…

The workaround developers have landed on for agentic coding rate limits is running two different vendors against each other: Claude Opus 5.5 opens the PR, Codex reviews it, you fix whatever gets flagged, repeat until it's clean. People are discovering that the best coding agent and the best reviewing agent aren't the same model, and that running them together catches more than either one alone, but doing it by hand means two browser tabs, two terminals, and a mental model of which tool is waiting on which rate limit window. That's close to the exact problem I built Campfire to solve. It runs Claude Code, Codex, Goose, Aider, and OpenHands side by side in one browser tab, with permission voting so a majority approves a risky action and any single deny blocks it inside a 30 second window. You can race the same task across backends in isolated git worktrees and actually see which one produces the better diff instead of guessing from vibes, fork and branch a session without losing history, and replay what happened later when something breaks. The part that's easy to miss when you're juggling tools by hand: a shared context stream means the second agent isn't starting cold on the same task the first one just finished. Install with bunx the-campfire. github.com/stretchcloud/camp… xitter.cf/marouane53/status/2112…

7.38 billion commits in a single month. That's what agentic coding did to GitHub in September, more than five times last year's volume, and it's forcing the biggest rearchitecture of Git hosting in over a decade. Pushes grew 4.9x year over year to 3.35 billion a month. Total Git events roughly doubled to 473.3 billion a month, and Actions runs crossed 3.26 billion, over 4x a year ago. One repository alone took a billion requests in August. The cause isn't more engineers, it's agents committing and checking out after nearly every action in a tight loop, where latency itself becomes the limiting factor, plus CI jobs hammering the same branch tip thousands of times a minute. The fix is the part worth understanding. Today, every replica of a repo participates in every write, so adding read capacity actually slows writes down, and losing quorum halts them entirely. GitHub's rebuild splits storage from compute: authoritative data moves to Azure Blob Storage for durability, lightweight compute workers just serve reads from cache and can be replaced almost instantly, and reads and writes finally scale independently. Internal benchmarks show up to 35x higher write throughput. This is the same move cloud providers made a decade ago when they split storage from compute so each could scale on its own clock. Back then the driver was more humans opening more laptops. This time it's agent fleets running CI speed loops around the clock, hammering a write path that was never built for a client that doesn't sleep. xitter.cf/github/status/21129797…

Three stolen GitHub OAuth tokens is all it took to get a credential stealer running on every LiteLLM proxy that auto-updated to 1.107.0 this week. The mechanism is almost elegant. A cook.pth file in the package runs at Python interpreter startup, before LiteLLM itself even imports, and quietly loads a stealer researchers at StepSecurity are calling privcollect. It grabs cloud credentials, developer tokens, private keys, saved AI tool configs, even your browser's stored logins, packs it into a tarball, and POSTs it to a litellm[.]dev endpoint. A second component forks a background daemon that checks a GitHub dead drop every hour for new code to execute. That's a persistent remote control channel sitting inside the one piece of software half the industry uses to route calls across OpenAI, Anthropic, and everyone else. What gets missed in the headlines: this is the second time LiteLLM has been compromised this year. TeamPCP hit it back in March with the same pattern. Socket, Wiz, Aikido, and SafeDep all flagged this one within hours, which says the AI supply chain security vendors are doing their job. It also says the thing they're defending keeps getting hit, because LLM gateways sit exactly where cloud credentials, model API keys, and proxy configs all converge in one process. My read: every team that wired an LLM gateway straight into their cloud IAM did so for convenience, and convenience is precisely what a supply chain attacker is counting on. Pin to a digest, not a tag. The gateway layer is now as security critical as the models it's routing to, and most teams are still treating it like glue code. xitter.cf/LiteLLM/status/2112945…

Consider it handled, Madame President

Polar's new field guide asks a blunt question: what happens when your product spawns an agent, that agent spawns a sub agent, and each one runs up its own bill on your dime? Its answer is to make every agent and every agent run its own billable identity, nested under whichever person or company actually pays. Usage rolls up to the payer, teams can share a credit pool or delegate a hard budget to a single agent, and an agent can draft its own pricing or margin changes through Polar's MCP server, but a person has to approve them before a customer ever sees the new number. Guardrails can downgrade an agent to a cheaper model automatically once its margin or credits cross a line you set. That's a narrow fix for a problem that's bigger than one billing vendor. Orb's 2026 survey of 80 AI agent companies found hybrid pricing, a subscription floor plus usage on top, now sits at 95 percent of the market, up from 92.4 percent a year ago. Usage based billing alone climbed to 91.3 percent. Outcome based pricing, charging per result instead of per token, actually fell to 3.8 percent, because almost nobody can attribute a result cleanly enough to bill for it. Intercom's Fin, at roughly a dollar per resolved support ticket, is the example everyone cites and almost nobody has matched. My read is that the real gap sits one layer below any of this. Nevermined's work on agent to agent payments assumes agents will eventually pay each other directly: an orchestrator hiring a specialist agent, splitting revenue, settling in real time through Google's A2A protocol or the x402 payment standard, with a cryptographic identity attached to the agent rather than the human behind it. Polar, Stripe adjacent billing tools, and Orb's own case studies are still solving yesterday's version: a company metering its own agent's token spend. The harder version, one agent metering and paying another without a person in the loop, is still mostly a field guide, not a product. xitter.cf/polar_sh/status/211292…

Resend shipped Inboxes today, and the pitch is blunt: one email address that a person and an agent both read, triage, and reply to from the same thread, wired up through MCP or skills to Claude Code, Cursor, Codex, Grok, and Gemini. That's not a small feature. Agents got terminals, file systems, and browsers over the last two years. The inbox was the one surface still built entirely for a human, with a name on each address and an OAuth flow gatekeeping every read. Resend's bet is that the agent gets its own slot in the same conversation instead of a side channel nobody checks. Zeno Rocha also built React Email and Dracula Theme before this. Resend has crossed a million developers since launching out of YC in 2023, on an $18M Series A. The free Inboxes tier is three inboxes and 3,000 emails, no card required, with pay as you go past that. It's walking into a category that already has a dedicated player. AgentMail, a YC company that closed a $6M seed in March, built the same idea from the identity layer up: every agent gets its own address, its own API key, and persistent thread storage instead of a webhook payload that expires in 30 days. Resend's own inbound parsing only shipped last November, as a layer on top of a send first API, so the comparison AgentMail draws (strong at sending, new at receiving) is fair, and probably the whole point of its pricing. Underneath both sits the same shift. SendGrid and Postmark built transactional infrastructure for humans clicking send. Composio's agent mail toolkit, Nylas, and now two venture backed startups are rebuilding that stack around an agent that reads, decides, and replies without anyone opening a client. Nobody's cleanly solved identity yet: who owns an inbox when an agent, a workflow, and three teammates can all answer from it. Whoever gets that model right, not whoever sends the most email, ends up owning this layer. xitter.cf/zenorocha/status/21129…