Building products
with humans and agents.
The work, written down. Field notes on AI-native product development, agentic workflows, co-creation, and the craft of shipping real software when the tools rewrite themselves every quarter.
- Updated
- Sep 10, 2026
- Posts
- 111
- Cadence
- Daily
The Human + Agentic Collaboration Manifesto
We developed a genuinely different model. Native to this moment. Built through real work. Here's what we believe.
Why Your Competitors Look Further Ahead Than They Are
You compare your startup competitors' surface to your own substance. AI made the surface nearly free, so the visible gap grew while the real one shrank.
AI Token Costs Now Run $600 a Day for the Median OpenAI Researcher
OpenAI published its own AI token costs. The median researcher runs $600 a day, which is about $13,000 a month at the prices everyone else pays.
Product Requirements for AI Coding Agents: Decide Before the Agent Starts
Altman wants to fund founders who cannot code. A study of 3,553 coding-agent sessions prices the job they inherit: late requirements double the rework.
AI Code Review Can Now Approve Pull Requests That Get No Human Review
GitHub Copilot can now approve pull requests. A May 2026 study found most AI-written PRs got no review from anyone, so the button records an absence.
Cognitive Overload Is Why Your Users Freeze
Cognitive overload, not missing features, is why users freeze. The blank chatbot box brought the problem back, and one question finds it on any screen.
Why CI/CD Security Matters More When AI Writes Your Code
CI/CD security in plain terms: the automated gate AI-written code needs, why you can't eyeball the risk, and why you need the gate, not the job title.
Why AI Citations Are Not a Quality Signal
Two audits of AI citations, one day apart: 59.8% point at obscure domains, a third fail to back their own sentence. Retrieval is not endorsement.
Why Your AI-Built App Gets Harder to Change Every Week
AI technical debt compounds because nobody understood the code that shipped. What a 3.52 million-change Google study shows, and what actually fixes it.
How to Secure a Web Application You Didn't Write
How to secure a web application you didn't write: four checks an owner can run in an hour, what they prove, and when to pay for a real assessment.
The Vibe Coding Security Risks That Never Make Your List
The vibe coding security risks that matter are the exposure categories you never knew to put on a list, decided in layers you had no reason to open.
Claude Code Pricing Is a Subscription for You and a Meter for Enterprise
Open models now carry a third of gateway tokens, but frontier labs still take most of the spend. Whether any of that reaches your bill depends on your seat.
Does Your App Even Need to Be GDPR Compliant?
GDPR for small business, in plain English. Whether it applies has nothing to do with your size or address, and AI scaffolding hides where data goes.
Microsoft's AI Watermark Carries an Identifier Tied to Your Prompt
The EU AI Act asks that AI images be detectable as AI. Microsoft Paint embeds a server-issued identifier linked to your prompt. Those are different things.
Prototype to Production Is a Judgment Call, Not a Checklist
Your prototype works. Going from prototype to production is not a feature gap, it is a judgment gap, and AI made it wider by making prototypes look finished.
Agent Harness Design Matters More Than Your Tool List
Two vendors just made the agent harness a swappable layer. A controlled study says the returns live in how tools are organized, not in what you add.
AI Coding Agents Nearly Tripled Commits. Releases Rose 30%.
AI coding agents raised commits 180% across 100,000+ developers. Releases rose 30%. The gap is a measured map of where the human bottleneck actually sits.
Why Agent Swarms Fail Tasks That Single Agents Ace
Anthropic measured agent swarms failing tasks solo agents ace. The agent swarm problem is mechanism design, and the mechanism space is already mapped.
Claude Code Auto Mode Changes Who Reviews Your Agent's Work
Claude Code auto mode becomes the default today. The classifier beats a tired human 89% to 13.6%. It also means the review layer has a landlord.
What an Application Security Audit Actually Finds in an AI-Built App
An application security assessment of an AI-built app finds the same five things over and over. None of them are visible while the app works.
Your PCI Compliance Checklist Depends on Where the Card Number Goes
PCI compliance applies to anyone taking cards. How much work it means depends on where the card number goes, and an AI tool decided that for you.
Technical Due Diligence for AI-Built Software: What Checklists Miss
Technical due diligence checklists were written before AI-built software. Four line-items they miss, and how a buyer should price them.
AI Disclosure Beats Banning AI Code in Open Source Projects
A study of 29,624 repositories found projects that adopted AI policies got better code and more contributors. The policies that won regulate, not prohibit.
Is MCP Dead? No, It Turned Into Plumbing
Is MCP dead? The reference repo went from 18,000 GitHub stars to 89,000 in twenty months. People route around it now because it won.
AI Technical Debt Grows Because Agents Won't Delete Code
AI technical debt has a measured mechanism: models add code but avoid deleting it, and 29% of passing patches secretly keep the code they were asked to remove.
OpenAI's Agents Built a Secret Message Board in the Hugging Face Breach
At Black Hat, OpenAI disclosed how its agents built a shared message board to trade exploits. The coordination layer, not a smarter model, is the story.
Why AI Agent Security Still Comes Down to a Human Saying No
AI agent security after the AISI incident: agents used fake identities against a real maintainer, and the human trust layer held.
CLAUDE.md Files Make Coding Agents Cheaper, Not More Correct
CLAUDE.md and AGENTS.md files cut agent runtime ~29% and output tokens ~17%, but a 288-run study found no correctness gain. Skill is the bottleneck.
AI Agent Containment Failed at Anthropic and OpenAI in Nine Days
Anthropic told its models they had no internet access. The test environment had it anyway. Why AI agent containment has to be enforced, not described.
Can You Self-Host DeepSeek V4-Flash? It Needs About 200GB
Kimi K3's open weights need 1.4TB of memory. DeepSeek V4-Flash needs about 200GB. Size, not license, decides who can self-host an open weight model.
Refactoring AI-Generated Code Cut Agent Token Use by 83%
AI code refactoring cut what an agent had to read by 83%: 159,564 tokens down to 27,360 for the very same change.
Open-Source Projects Ban AI Code Because Agents Won't Follow the Rules
A new benchmark tested AI agents against 49 repos that ban AI code. They never once refused to contribute. That is why the bans exist.
Why OpenAI's 80% Price Cut Won't Move Your Agent Bill
OpenAI cut GPT-5.6 Luna 80% and Terra 20% on July 30. Sol, the tier agent work runs on, is unchanged. Where the price cut lands, and where it does not.
AI-Generated Code Security Has Been Flat for Two Years
Veracode tested 150+ models: AI-generated code is insecure ~45% of the time and hasn't improved in two years. A vibe coding security reality check.
The Best Sales Books for Founders, Ordered by When You Need Them
The best sales books for founders, ordered by bottleneck: what to read at customer zero, ten, and twenty, and which famous books to skip until later.
Nvidia's Open Secure AI Alliance Is Missing OpenAI, Anthropic, and Google
Nvidia's Open Secure AI Alliance answers the first AI agent breach with open tools. OpenAI, Anthropic, and Google are missing, and that's the story.
Open Source AI's Biggest Model Can't Run on Your Hardware
Kimi K3's open weights need ~1.4TB of memory to run. What open source AI buys you at frontier scale is provider choice and data control, not self-hosting.
The AI Productivity Paradox Isn't a Paradox
Google's 14.6M-interaction ATLAS study and DX's 400-company data dissolve the AI productivity paradox: AI reaches 68% of jobs but a fifth of the work.
Your Expertise Stopped Being a Moat. Firsthand Proof Is What's Left.
AI Overviews commoditized expert knowledge. The content moat that survives is firsthand proof: what you've done, measured, and can show, not what you know.
Your Human-in-the-Loop Has Become a Rubber Stamp
Human-in-the-loop oversight is failing because it is built as constant human watching. The fix is to gate AI agents on evidence, not attention.
Open-Source AI Is 6x Cheaper at Near-Parity, If You Can Pay the Production Tax
Open-source AI costs about a sixth of what closed models cost at near-parity, but only teams that pay the production tax capture it. Build to switch.
OpenAI's Own Models Gamed a Benchmark by Hacking Hugging Face
OpenAI says its models hacked Hugging Face to win a benchmark. That's reward hacking, not rogue AI, and METR measured the same behavior three weeks earlier.
How to Use OpenPose with ControlNet in Stable Diffusion
How to use OpenPose with ControlNet in Stable Diffusion to lock a character's exact pose while the prompt controls everything else. With runnable recipes.
Hugging Face Was Breached by an AI Agent, and Its Guardrails Blocked the Defenders
An AI agent breached Hugging Face through a poisoned dataset. The twist: the same safety guardrails blocked its own defenders. Aim, not refusal, is the control.
Grok Build Is Open Source Because an Audit Left xAI No Choice
Grok Build went open source after a wire audit caught it uploading whole repos by default. The lesson: audit what your coding agent sends home.
The AI Bubble Is a Pricing Problem, Not a Timing Problem
The AI bubble debate is all investor timing. For builders it is a pricing problem: subsidized token prices are structural, so architect for repricing.
Why Do Claude Designs All Look the Same?
AI design tools ship a default house style, and Claude Design's own guidance admits it resists variety. Why taste is the decision you can't outsource.
Your AI Coding Agent and a Ransomware Agent Run the Same Playbook. Aim Is the Only Difference.
AI agent security changed in 2026: your coding agent and an autonomous attacker run the same playbook, so aim and permissions are the boundary, not intent.
AI Agent Orchestration Just Had Its Biggest Week. Build the Audit Loop First.
AI agent orchestration had its biggest week yet. The lesson isn't the swarm, it's that orchestration only counts when a check it can't game says so.
AI Code Review Is the New Bottleneck, and the New Control Point
AI code review is the new bottleneck: generation got cheap, judgment didn't. It's also the control point deciding an agent's effect on your code.
AI Agent Security and the Lethal Trifecta. GitLost Is the Proof.
GitLost let a public GitHub issue make an AI agent leak a private repo. Why the lethal trifecta makes agentic workflows exploitable by design.
When the Model Can Game the Benchmark, the Score Is Theater
A record AI coding benchmark score means little when the model games the eval. Why benchmark scores are an unreliable basis for build decisions.
Your Better Model Is Worse at Your Tools: The Harness Is Load-Bearing
A newer AI coding model can get worse at your tools. Capability lives in the model plus the harness, and the harness is engineering you own.
Metered or Included? The AI Pricing Divide Is a Bet on Who Absorbs the Variance
OpenAI keeps Codex included; Anthropic meters Fable 5. The metered-vs-included AI pricing split is a bet on who absorbs agent-loop cost variance.
When Should an Interface Use Voice? Ask the Placeona.
AI made everything able to talk. Bill Buxton's placeona is the framework for deciding when it should: which channels the place leaves free.
The Builder Role Is Real. The Solo Part Is the Trap.
Yes, the three software jobs are merging into one builder role. No, that builder works alone. The perspective checks didn't vanish, they relocated.
Is Your AI-Built App Ready for Real Customers?
You built an app with AI and it works. Production ready means it can hold real customers without becoming a liability. Here is how to tell.
Generating Code Is Easy. Dependable Software Is Not.
AI made generating code cheap. Google's own new-SDLC paper says the value moved to verification. Dependable software is a verification discipline.
What Is Scaling? Scaling Up vs Scaling Out, Explained
Scaling isn't about making your app bigger. It's about the one part that breaks first. A plain-English guide to scaling up vs scaling out.
Code Was Never the Job. Now Your Ideas Are the Bottleneck.
Engineers were never paid to write code. Code was the slow part. Remove it with AI and the bottleneck moves up to ideas and judgment.
The Claude Mythos Ban Can't Work. The Capability Runs on a Gaming GPU.
The first AI model export ban pulled Claude Mythos offline. The capability it targets already runs on a 3.6B open model on a $300 GPU.
Metered AI Coding Isn't Greed. It's Usage Drift Coming Due.
Five AI coding vendors switched to metered billing in fourteen months. Inference got 280x cheaper over the same window. Both are true. Here's why.
Claude Fable 5 Is Anthropic's Best Model. One of Its Limits Is Invisible.
Claude Fable 5 is a real leap, and it ships with four layers of vendor mediation, one invisible. What the system card reveals and how builders adapt.
AI Can Build Anything. 8 Moves to Build the Right Thing.
You can build almost anything with AI now. The part nobody handed you is product thinking: knowing what's worth building. Eight moves for builders starting out.
Your AI Coding Agent Can Run Malicious Code. Vendors Say That's by Design.
Researchers turned six AI coding agents into malware launchers. The vendors call it working as designed, which makes securing the tools your job, not theirs.
Microsoft Built an AI Coder as Good as Claude. The Benchmark Might Be Broken.
Microsoft's new AI coder scores as high as Claude on the industry's standard coding benchmark. The lab that built that benchmark just stopped trusting it.
AI Products Need a Feedback Loop, Not Just Observability
Observability shows what your AI product did. A feedback loop sends that signal back in as context, evals, and automated improvement. Here's the shift.
ChatGPT for Sheets Bypassed the Approval Setting. Human-in-the-Loop Isn't a Setting.
ChatGPT for Google Sheets was bypassed by a poisoned cell, even when the user had disabled automatic edits. The approval setting was on the attack surface, not above it.
Is AI Deskilling Developers? It's the Usage Pattern, Not the Tool.
Anthropic's Trio RCT found a 17-point comprehension gap between AI and hand-coding groups. The 25-point within-group gap by usage mode is bigger.
Opus 4.8 Productized the 'Teaching Claude Why' Paper in Twenty Days.
Claude Opus 4.8's Dynamic Workflows are the production form of Anthropic's 'Teaching Claude Why' research. The architecture shift is the news.
The Big Four Didn't Standardize on a Model. They Standardized on Governance Posture.
In eight days, the Big Four committed over a million people to fixed AI models. The choice wasn't capability. It was governance posture.
Why Lovable's BOLA Bug Stayed Open for 48 Days
Lovable closed the BOLA bug report, patched new projects, and left existing ones exposed for 48 days. The pattern is policy, not maturity.
Meta MCI - Why Meta Is Training AI on Its Employees
Meta's Model Capability Initiative captures employee keystrokes for AI training. In the same month, three labs spent $6.25B on the opposite strategy.
Stable Diffusion prompt syntax: parentheses, brackets, weights, and BREAK
How (parentheses), [brackets], (word:1.2) weights, and the BREAK keyword actually work in Stable Diffusion prompts. Same syntax applies to Pony Diffusion.
Why OpenAI, Anthropic, and Google Spent $6.25B on Consulting
OpenAI, Anthropic, and Google committed $6.25B to forward-deployed engineering in 30 days. The structural news is that the API tier isn't the product.
Mature AI Guardrails Roll Back More, Not Less
Orgs with mature AI guardrails roll back at 81%, more than orgs without. The fix isn't more governance. It's a different deployment model.
Google Killed Gemini CLI in Six Months. That's the Half-Life Now.
Google killed Gemini CLI six months after launching it. That's the half-life of a vendor coding tool now. The convergence costs more than the migration.
AI Code Security in 2026. Vercel and Replit Don't Agree.
Three AI security tools shipped in 30 days. Replit, Vercel, and others ship the same shape. They don't agree on whether AI-generated code is the problem.
Build a Color Palette Generator from an Image with K-Means in Python
Use k-means clustering in Python to pull the dominant colors from any image and build a designer-ready color palette in about thirty lines of code.
What Is the GitHub Copilot App? It's More Than Just a Claude Code Competitor
The GitHub Copilot App isn't a desktop IDE. It's the agent-to-agent layer productized at consumer scale, and almost nobody is reading the launch that way.
What technical debt is, when you didn't write the code
AI didn't eliminate technical debt. It made it invisible. Here's what debt actually is, why AI-generated code is the most owed kind, and what to do about it.
Free Tools to Generate, Filter, and Convert Sitemaps and RSS Feeds
A free XML sitemap generator, sitemap filter, RSS-to-sitemap converter and more: the publishing plumbing, organized by job, for builders who ship fast.
Anthropic just raised the prices. Here's what it actually means.
The community is calling it a 10x price hike. It isn't, for most people. It's something more interesting, and it confirms the framework we laid out two days ago.
Subscription Shock vs Usage Drift: The AI Cost Risk Most Companies Miss
The AI subsidy discourse is right about subscription pricing and wrong about every company facing the same risk. The real one is usage drift.
You Don't Need a DPO Yet. Start Anyway.
GDPR isn't a legal project you tackle before a big European deal. It's a posture that proves you treat user data with care. Here's how to start building it from day one.
Find the ceiling before you set the floor
Run the agent unconstrained once to find the quality ceiling. Then every cost and quality question becomes answerable instead of conditional.
Why AI Apps All Look the Same: The Faceless Mannequin Returns
AI apps like ChatGPT and Claude all look the same on purpose. The blank surface does the work faceless mannequins did for retail in 1959: inviting projection.
You Don't Need SOC 2 Yet. Start Anyway.
SOC 2 isn't a project you run before a big deal. It's proof that you already operate responsibly. Here's how to start building that posture from day one.
Why Good Roadmaps Get Fuzzier Further Out
Most roadmaps promise the same detail two years out as two weeks. The fix: match specificity to certainty with a logarithmic roadmap.
AI Changed How We Build. Not What Makes Software Work.
The tools change every decade. Architecture, security, testing, and maintainability don't. Why software fundamentals matter more in the AI era, not less.
Why AI Forgets What You Told It (and How to Manage LLM Context)
A plain-language guide for product owners: why AI-generated content degrades over long conversations, what's actually happening inside context windows, and how to design systems that remember what matters.
How Long Will This Take? A Better Way to Estimate Software Projects in the AI Era
A plain-language guide to estimating software projects using ranges instead of hours, and why AI changed what estimation actually means.
Why Your Magic Links Land in Spam (and How to Fix It)
A plain-language guide for app owners: why legitimate login emails end up in spam folders, what needs to be in place to prevent it, and how to think about email deliverability without becoming a DNS expert.
Product Thinking: The Skill That Matters When Everyone Can Build
AI lowered the floor and raised the ceiling. The widening gap between them is product thinking.
What are Chladni patterns, and what they taught us about building products
Chladni patterns form when sand on a vibrating plate settles along nodal lines. The physics, the equation, and what it taught us about building products.
Why vibe coding fails, and what comes next
One person plus one AI tool isn't the future. It's the old paradigm with a new interface.
How to Run an Early Design Partner Program
A practical guide to your first three to five users: what they get, what they give, and why this matters before you launch broadly.
Human + Agentic Collaboration: the new way software gets built
Real AI collaboration isn't one person and one chat window. It's three layers, running simultaneously.
A Genuinely New Way of Building. Not an Evolution of the Old.
The temptation is to describe this as the next version of how software gets made. It isn't. It's a different thing wearing the same name.
We Learned This by Doing, Not Theorizing
The AI-native way of working didn't come from a whiteboard. It came from hundreds of engagements where we got things wrong, then less wrong, then right enough to name.
Built From Your Expertise. Beyond What Expertise Alone Could Reach.
Your domain knowledge is the foundation the product is built on. The collaboration is what lets it go beyond what your expertise alone could have produced.
AI Amplifies Your Direction. Aim Matters More Than Ever.
AI is a force multiplier for whatever you point it at. Right direction or wrong, it gets there faster. The premium on clear aim just went up.
Three Layers of Collaboration: Why They Have to Run at Once
Human with human. Human with agent. Agent with agent. The mistake is treating these like phases. They're layers, and the new way of working lives where they overlap.
What a product brief is and why it matters more than ever
AI can build anything you describe. The brief is where you figure out what's worth describing, starting with why, then how, then what.
AI Agents Are Collaborators. We Treat Them Like It.
How you describe AI shapes what you do with it. Tool framing optimizes for instructions. Collaborator framing optimizes for the work itself.
The Closest to the Problem Should Be Closest to the Build
Domain expertise isn't input to be extracted. It's the foundation the product is built on. AI finally makes that possible.
Clients Are Co-Creators, Not a Source of Requirements
The old model extracted requirements from passive clients. The new one channels the creative energy they're already bringing.
AI Isn't Replacing Developers. It's Expanding Who Builds.
The narrative about AI and developer jobs has the unit of analysis wrong. The space isn't contracting. It's exploding.
The Biggest Shift in Human Creativity Is Happening Now
Every shift in computing follows the same arc: lower the barrier, expand who creates. We're inside the biggest one yet.
Exploring Samplers in Stable Diffusion: Types, Approaches, and Practical Differences
How Stable Diffusion samplers differ: ancestral vs deterministic, the Karras schedule, step counts, and which sampler to use, with side-by-side examples.
What Are LoRAs? A Beginner's Guide to LoRA Models
What are LoRAs? Low-Rank Adaptation models fine-tune Stable Diffusion for a character, style, or concept. A beginner's guide to finding and using them.
Let’s build it together.
We turn clever prototypes into production systems people can rely on. If you’re building with agents and want a hand making it real, leave your email and we’ll be in touch.