Sean Chou retweeted
30 mistakes I see enterprises make with AI transformation:
1. Buying AI licences and calling it a strategy. Decide which problems you want to solve, how people will use the tools and what improvement you expect to see. Access alone doesn’t answer those questions.
2. Expecting every employee to become an AI engineer. People need different levels of training and responsibility. Helping someone use AI in their work doesn’t automatically prepare them to build and maintain a system for others.
3. Asking AI for answers before agreeing on what a good answer looks like. Start with real examples and clear criteria. Keep verified corrections as test cases, and rerun those tests when you change the system.
4. Blaming the model before checking the whole setup. A failure can come from the model, instructions, missing information, tools or the surrounding software. Investigate where it went wrong before deciding what to replace.
5. Automating a process nobody can explain from start to finish. We spoke to a team whose work moved between calls, emails, spreadsheets and shared folders. Understanding how the work actually got done was a substantial job in itself.
6. Giving an agent more access than its job requires. Limit what it can read and change, and require approval for consequential actions. Enforce those permissions in the software. An instruction telling the agent to be careful is not an access control.
7. Making data protection depend on someone remembering to delete a name. Use appropriate access controls and automated checks to limit sensitive information before it reaches the model. Removing names alone won’t address every way confidential information can be exposed.
8. Letting an agent spend money without a limit. We still meet teams with no budget cap. Set spending limits, request limits and stopping conditions, then decide what the system should do when it reaches them.
9. Counting AI usage as proof of business progress. Token consumption can help you understand adoption and cost. It doesn’t tell you whether useful work got finished. Measure results, quality and the time spent reviewing or fixing the output.
10. Letting company data end up in accounts nobody has checked. Know which services employees use, what happens to the information they enter and which settings and agreements apply. Make the approved way of working clear.
11. Choosing a model without considering what switching would involve. Understand which parts of your system depend on that provider. A different model may need different instructions and fresh testing, even when the technical connection is easy to change.
12. Paying for discovery without agreeing on what it must deliver. We heard about an engagement where the estimate kept growing, then the consultant left for another commitment. Set clear deliverables and a point at which you decide whether to proceed.
13. Committing to a plan with no way to act on what you learn. A long project isn’t automatically a mistake. The problem is having no checkpoints where real results can change the priorities or the proposed solution.
14. Launching an agent nobody is responsible for. Assign responsibility for its operation, monitoring, updates and eventual retirement. The people responsible need the authority and resources to do those jobs.
15. Buying a custom system without a plan for when the supplier leaves. Agree on documentation, access, support and handover while the relationship is working. Know who could maintain it if that relationship ended.
16. Waiting for users to tell you something has broken. You should have telemetry installed so you don't find a problem weeks later than you should have.
17. Making an agent read everything to find one thing. Give it tools that search, filter and return relevant information. Large responses full of unrelated data consume context and make the task harder to handle reliably.
18. Letting the people who built it be the only people who test it. Involve the people who do the job and understand the business. They can help identify answers that look reasonable but would cause problems in practice.
19. Testing only the situations where everything goes smoothly. Include exceptions, ambiguous requests and cases where the system should stop or ask for help. Confusing five cases with five individual items is exactly the sort of mistake your tests should catch.
20. Keeping essential knowledge in the heads of people who might leave. One company was trying to capture how experienced colleagues made decisions before they retired. Record their reasoning and examples while they can still explain and check them.
21. Assuming every AI project must wait for the ERP migration. Some read-only work may be possible against existing data. Check freshness, permissions and the work needed to adapt it later. A replica can help, but it may lag behind the live system.
22. Assuming one company’s AI success will transfer to the whole portfolio. Use that success as a starting point. Each company still needs to check whether the approach fits its work, data and business needs.
23. Expecting AI to understand terms your own departments use differently. Explain business terms, calculations and database fields. If several measures could reasonably mean “sales,” specify which one applies to the question.
24. Producing code faster than anyone can review it. Research describes how faster generation can increase the burden on reviewers. We spoke to a team where changes were piling up because every one still needed manual acceptance testing.
25. Hiring an AI engineer and assuming the rest will sort itself out. That person still needs a clear problem, access to useful data, suitable infrastructure and colleagues who understand the work. Hiring doesn’t remove those responsibilities from the business.
26. Expecting people to forget the last failed pilot. Earlier disappointments can make people less willing to trust another system. Find out what went wrong and show what has changed before asking them to invest their time again.
27. Calling a project “90% done” before testing the difficult workflows. We’ve seen projects move quickly, then spend weeks on a couple of remaining workflows. Check what is still unproven before using the feature count to estimate the work left.
28. Expecting an agent to follow rules it cannot access. Pricing exceptions, product substitutions and informal agreements may live in someone’s spreadsheet. Make the relevant rules available, keep them current and test whether the system applies them correctly.
29. Feeding AI conflicting numbers without explaining the differences. Systems may use different definitions, update schedules or reporting periods. Establish which source and definition apply to each question before expecting a dependable answer.
30. Assuming a data feed contains the whole picture. Check which customers it covers, which fields are missing and how far back it goes. Make those limitations visible so users know what the answer is based on.
What else?
Sean Chou retweeted
As engineering, product, design, DS, etc. melt into a new kind of role, I was reflecting on what roles might look like in the future. For example, when I look at the Claude Code team I see what I think is five archetypes:
1. Prototyper: comes up with brand new ideas; churns out many ideas, most of which don't ship
2. Builder: quickly turns a prototype/idea into production-grade product/infra
3. Sweeper: cleans up the UI, simplifies the code and system, unships, optimizes performance
4. Grower: takes a product that has been built and iterates on it to improve Product-Market Fit
5. Maintainer: owns a mature system to make it secure, reliable, fast, and efficient as it scales
Many people span across 2 roles, and sometimes 3 roles. I also notice that these roles are not really tied to job function -- eg. across Anthropic, some designers match category 1, some 2, some 3; same for engineers, PM, DS.
A healthy team needs a mix of these, depending on the product:
- A product that is new and pre-PMF needs people that are strong at 1+2+3
- A product that is growing and has found PMF needs 2+3+4 and some 5
- A product that has strong PMF needs 3+4+5 and some 2
Maybe product roles of the future will look more like this, and less like the domain-specific roles of today?
Sean Chou retweeted
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/router/i…
Credit to the security researcher for responsible disclosure.
Sean Chou retweeted
A parasite that has been eating people for 3,500 years is about to be wiped off the planet. It infected 3.5 million people in 1986. Last year, it infected 10. And I have not seen it make a single front page.
It is called Guinea worm. You drink contaminated water from a pond in a poor village. A year later, a worm up to three feet long starts coming out of your leg through a burning blister. There is no pill that stops it and no surgery that works. You wrap the worm around a stick and pull it out slowly, over days or weeks, inch by inch. If you rush, the worm breaks inside you and causes a fresh infection.
Guinea worm is ancient. Preserved worms have been pulled out of Egyptian mummies from around 1000 BCE. The Ebers Papyrus, an Egyptian medical scroll from 1550 BCE, describes pulling the worm out with a stick. For three and a half thousand years, that was the best humans could do.
Then in 1986, public health workers decided to kill the parasite off. They had no vaccine and no drug. What they had was cheap cloth water filters and a small army of volunteers willing to walk from village to village for decades.
The plan was simple. Give everyone who drinks from a pond a cloth filter to strain out the tiny water fleas that spread the parasite. Then send volunteers walking house to house, year after year, teaching people how to use the filters and keeping anyone with an emerging worm out of the water.
It worked. From 3.5 million cases a year to 10. Four were in Chad, four in Ethiopia, two in South Sudan. The other four countries where the worm used to be common, Angola, Cameroon, the Central African Republic, and Mali, had zero human cases for the second year in a row. The World Health Organization has already certified 200 countries as Guinea worm free. Six are left.
The last hurdle is dogs. Cameroon had 445 infected animals last year and Chad had 147, so a lot of the remaining work is on animals, not humans. Strays get leashed, and crews treat ponds to kill any remaining worms. The campaign keeps watching until the number hits zero.
When Guinea worm hits zero, it becomes the second human disease ever erased from the planet. The first was smallpox. It will also be the first parasite humans have ever wiped out, and the first disease ever ended without a single dose of medicine. Volunteers walked village to village with cloth filters for 40 years. Now a plague from the age of the pharaohs is about to be gone.
Sean Chou retweeted
If you are a software engineer "experiencing some degree of mental health crisis", now hear this, because I've been coding for 50 years since the days of punched cards and I have a salutary kick in your ass to deliver.
Get over yourself. Every previous "programming is obsolete" panic has been a bust, and this one's going to be too.
The fundamental problem of mismatch between the intentions in human minds and the specifications that a computer can interpret hasn't gone away just because now you can do a lot of your programming in natural language to an LLM.
Systems are still complicated. This shit is still difficult. The need for people who specialize in bridging that gap isn't going to go away.
As usual, the answer is: upskill yourself and adapt. If a crusty old fart like me can do it, you can too.
Sean Chou retweeted
Just cancelled cursor, end of an era.
kind of crazy because I would have paid like $2000/mo for it only a year ago
Sean Chou retweeted
JUST IN: Ethereum Foundation announces intent to sell 10,000 $ETH worth $43 million.
Sean Chou retweeted
The current enterprise data war - with Salesforce shutting down access to Slack and Snowflake avoiding building an MCP server for exfil is going to get unreal the second half of this year.
They’re all holding on to prevent disintermediation- ultimately- they will lose because their customer and ISV ecosystems will force them to walk all of this backwards.
Your data, is your data - and as hard as they try (and they will try hard) to prevent you from using it - the power of the models and the upcoming consolidation that will come as a result is a crushing wave no vendor will be able to stop.
You either embrace and figure out where you fit in the new world or you will be made obsolete over time. You can only hold people hostage to their data for so long before the pressure to cave gets too great.
Sean Chou retweeted
This is the moment that the entire crypto industry must come together to update all of our frontends and price BTC in Sats and ETH in Wei so that newcomers to crypto don’t have undue unit bias
Sean Chou retweeted
Every year, I share this video of French caretakers who take sand from Omaha Beach in Normandy, and scrub them into the letters to give them the gold coloring.
They do this for all 9,386 US soldiers who died.
France also gave us this land as American soil. #MemorialDayWeekend
